Modern Computer Viruses
Author - Chas Tomlin
- IT Security Specialist in School of Electronics and Computer Science
- Member of Shadowserver
- Maintain a db of currently ~16,000 unique viruses and their associated network traffic.
Aim
- Take a look at current viruses/malware and how they propagate
- See what features modern viruses come with
- See what impact an infected machine might have on your network
- Learn to detect and prevent viruses
Four Installments:
- Infection
- Payload
- Impact
- Response
Focus on Windows viruses
Payloads
- What do modern viruses carry the capability of doing?
- Spreading/Replicating
- Backdoor/Remote control
- Update/Install
- Log remotely/Steal information
- Proxy traffic
Spreading/Replicating
- Spread using one of the methods mentioned in first installment.
- Scanning, remote buffer overflow
- IM spamming
- Copying to network shares
- Infecting files
- Just because a virus spreads by one method, doesn’t mean that’s all it will do!
Backdoor/Remote control
- Most modern malware carries the ability to communicate with a command and control source.
- Most initiate outbound network connections
- Use all sorts of internet protocols, UDP or TCP, IRC, HTTP, FTP, SMTP…..
- In Nov 2006 of 2434 viruses analysed 1047 (43%) exhibited IRC backdoor traffic
Backdoor/Remote control IRC
- What is IRC - Internet Relay Chat ?
- Typical IRC backdoor connection details
- IRC Bot Commands
- IRC DDoS Command
HTTP Backdoor/Remote control
- HTTP can also be used to remote control infected hosts
- Commands stored on a web server, malware polls server periodically to retrieve them.
- Can be encrypted, very hard to identify.
Other Backdoor/Remote control
- Unix rootkit, has a backdoor that is triggered by a certain sequence of network traffic.
Update/Install
- Viruses will carry the ability to update themselves, Why?
- 26% of viruses captured in Nov 2006 were not recognised by anti virus software!
- Virus writers need to stay ahead of the AV companies.
Remote Logging
- Viruses carry the ability to log remotely
- Used for stealing passwords, login details, keystrokes.
- Logging can take place over many different internet protocols, HTTP, FTP, SMTP, IRC….
Remote Logging SMTP
Remote Logging FTP
Remote Logging HTTP
Proxy Traffic
- Viruses carry the ability to allow traffic to be proxied through the infected host.
- Allows the attacker to hide his/her real IP address.
Conclusion
- Spreading/Replicating
- Backdoor/Remote control
- Update/Install
- Log remotely/Steal information
- Proxy traffic
<< | Viruses | >>
