intro

malware

  • ‘‘evil software’’
  • display a funny message
  • send passwords/credit card numbers to criminals
  • take pictures to send to criminals
  • delete data
  • hold data hostage
  • insert/replace ads in webpages
  • …

viruses

  • malware that inserts itself into another program

  • ‘‘infects’’ other programs when run

    • usually modifies executables directly

macro viruses

  • Word, Excel, other office software support macros

    • scripts embedded in Word/Excel/etc. documents

  • viruses written in a scripting language

    • Visual Basic for Applications

  • spread to office documents, not executables

    • easily spread in corporate environments

  • vendor reaction: macros disabled by default now

worms

  • independent program
  • usually ‘‘blends in’’ with system programs
  • copies itself to other machines or USB keys, etc.
  • sometimes configures systems to run it automatically

trojan (horse)s

  • useful-looking program that is malware:

    • ‘cracked’ version of commerical software
    • fake anti-virus software
    • or looks like useful PDF doc
    • …

  • maybe is (or not), but also does something evil

  • common form for targeted attacks

potentially unwanted programs (PUP)

  • most commonly: programs bundled with other programs
  • sometimes disclosed but in (deceptive?) fine print
  • sometimes considered malware, sometimes not

bad behavior by ‘normal’ programs

  • some mostly-legitimate programs also do malware-like things

  • location info collected by cell phone apps?

  • advertisments injected by useful browser extensions?

VDR=portion detected as unwanted; PPI=pay-per-install; MDM=mobile device management

what is malware

  • opinion question:
    if you’re making anti-malware software, what should it do for…?

      1. pre-installed browser extension that displays coupon codes
        but sends domain name of all websites to third-party to do so
      1. remote administration software that shows a subtle icon
        in the corner of the screen when used to monitor the machine

  • A. remove it, no prompting

  • B. prompt to remove it, default to yes

  • C. prompt to remove it, default to no

  • D. don’t flag it

  • E. something else (discuss?)

dual-use, context-sensitivity

  • this class: mostly talking about clearly anti-user software

    • … and how it tries to be covert

  • but there are also problems of dual-use software

    • phone tracking anti-theft software
    • computer remote administration software

  • intentionally ‘evil’ software masquarding as legit

    • remote admin software that’s unusually well hidden…
    • … and marketted on ‘‘how to spy on your \rule{1cm.5pt}’’ blog

  • ideally, prevent ‘‘bad’’ use somehow

    • phone OS should prevent covert tracking?
    • antimalware software should notice such software?
    • …

making money from malware

  • adware — from ad revenue

  • ransomware — ransom user’s files/usability of system

  • steal/resell personal info

    • identity theft
    • account credneitals / cryptocurrency

  • resell computation/network time

    • advertising fraud
    • distributed denial of service
    • cryptocurrency minining

aside on malware statistics

  • most malware statistics come from antivirus companies
  • probably a biased data source

Source: FireEye M-Trends Report 2020

againframe(followTheMoney)

ad injection (1)

  • internet advertising is big business

  • … but you need to pay websites to add ads?

  • how about modifying browser to add/change ads

  • mostly bundled with legitimate software

From Thomas et al, ‘‘Ad Injection at Scale: Assessing Deceptive Advertisement Modifications’’

ad injection (2)

  • 5% of Google-accessing clients (2014)

  • 90% using code from VC-backed firm SuperFish:

  • $19.3 M in investment (CrunchBase)
  • $38M in revenue (Forbes, 2015)
  • defunct after Lenovo root CA incident (2015)
  • … but founders reported started new, similar venture (JustVisual; according to TechCrunch) Adware prevalence: Thomas et al, ‘‘Ad Injection at Scale: Assessing Deceptive Advertisement Modifications’’

againframe(followTheMoney)

cryptolockers

  • encrypt files, hold for ‘‘ransom’’

  • decryption key stored only on attacker-controlled server

  • possibly decrypt files if victim pays

  • many millions in revenues

    • accurate numbers are hard to find

other ransomware

  • we have your private data, pay us or it gets released

individualized stealing/extortion

To Catch a Ratter: Monitoring the Behavior of Amatuer DarkComet RAT Operators in the Wild by Fairnholt et al. Abstract--Remote Access Trojans (RATs) give remote attackers interactive control over a compromised machine. Unlike large-scale malware such as botnets, a RAT is controlled individually by a human operator interacting with the compromised machine. Ther versatility of RATs makes them attractive to actors of all levels of sophistication: they've been used for expionage, information theft, voyeurism and extortion.

to catch ratter results

  • 2016/7 study
  • 61% attempt to access webcam; 26% microphone
    • (both not present in experimenter’s ‘honeypot’)
  • 31% enable keylogger (passwords?)
  • approx. 5% harass legit user
  • approx. 2% try to phish legit user

the underground economy (1)

<A> Sell Cvv US(1$ each), Uk(2$ each)Cvv with SSN & DL(10$ each)and ePassporte Account with 560$ in acc(50$), Hacked Host(7$), Tut Scam CC Full in VP-ASP Shop (10$).shopadmin with 4100 order(200$), Tool Calculate Drive Licsence Number(10$).... I'm sleeping. MSG me and I will reply U as soon as I can!

  • advertisement for stolen credentials on an IRC (Internet Relay Chat) server
    • via Team Cymru, ``The underground Economy: Priceless’’ (2006, Usenix ;login: magazine)
  • CVV = card verification value — verification number on back of credit cards
  • DL = driver’s license?

the underground economy (2)

advertisements for ‘drops’ (bank accounts for money laundering) and for ‘cashiers’ (criminals who will clean out accounts)
via Team Cymru, “The underground Economy: Priceless” (2006, Usenix ;login: magazine)

the underground economy (3)

Taxonomy of underground actors labeled as Figure 2 from a paper. X-axis goes from 'Product' to 'Theft'; Y-axis goes in increasing dependency (going upwards). Items are listed from least to most dependency in four tranches: First, Raw materials (hosting, network, human services); then Traffic acquisition (accounts, SEO, cloaking); Then Malware distribution (Exploit kits; PPI services); Then Specialized paylods (Spambot, Clickbots, Banking trojans).

via Thomas et al, “Framing Dependencies Introduced by Underground Commoditization” (2015)

Measuring Pay-Per-Install: The Commoditization of Malware Distribution by Juan Callebero, Chris Grier, Christian Kreibich, Vern Paxson of IMDEA, UC Berkeley and ICSI

2011, Usenix Security

espionage

  • information gathering
    • SolarWinds (network monitoring software) attack (“supply chain”)
      • suspected nation-state compromise to get data from many organizations
    • exploits via subject-specific links (“here’s an interesting PDF”)
  • sabotage
    • Stuxnet: Iranian enrichment controls

SolarWinds

  • supplier of network-monitoring software

  • … used by many big customers, including US Gov’t

  • attacked by third-party to spy (?) on customers

Stuxnet

  • targeted Iranian nuclear enrichment facilities

  • physically damaged centrifuges

  • designed to spread via USB sticks

  • publicly known 2010, deployed 2009

  • US + Israel gov’t developed

    • according to press reports

why talk about money/other motivations?

  • doesn’t change malware much
  • (also, not a likely topic later in this course)
  • … but …
  • can often attack monetization
  • may be easier than our focus on exploits/code in this course

vulnerabilities

  • for viruses, worms
  • for trojans + PUP that do more than is supposed to do be allowed
    • e.g. getting location information without ‘‘permission’’
  • software vulnerability
  • unintended program behavior that can be used by an adversary

vulnerability example

  • website able to install software without prompting
  • not intended behavior of web browser

software vulnerability classes (1)

  • memory safety bugs
    • problems with pointers
    • big topic in this course
  • “injection” bugs — type confusion
    • commands/SQL within name, label, etc.
  • integer overflow/underflow
  • …

software vulnerability classes (2)

  • not checking inputs/permissions
    • http://webserver.com/../../../../file-I-shouldn’t-get.txt
  • almost any ‘‘undefined behavior’’ in C/C++
  • synchronization bugs: time-to-check to time-of-use
  • … more?

vulnerability versus exploit

  • exploit
    • something that uses a vulnerability to do something
  • proof-of-concept
    • something = demonstration the exploit is there
    • example: open a calculator program

malware spreading with human help

  • installed by other malware
  • installed manually after illegitimate access
  • included in deceptively marketted software
  • added to update to non-malicious software
    • by insider or by external attacker
    • “supply chain attack”

xz-utils backdoor

  • xz-utils: very heavily used open source compression library
    • used by dependency of OpenSSH added by common third-party patch
  • c. 2023: GitHub user jiaT75 becomes xz-utils maintainer
    • after making some normal contributions to it
  • jiaT75 added backdoor
    • code that only runs if program is /usr/bin/sshd
    • malicious code in test data + build system files in xz-utils git

malicious libraries in repositories

malware spreading without human help

  • vulnerable network-accessible services
  • shared files/folders
    • autorun on USB sticks
    • macros in Word/Excel/etc. files
  • email attachments
  • websites + browser vulnerabilities
    • JavaScript interpreter bugs
    • Adobe Flash Player bugs

malware defenses (1)

  • ‘‘antivirus’’ software:
  • Windows Defender
  • avast!
  • Avira
  • AVG
  • McAfee
  • …

malware defenses (2)

  • app stores/etc. filtering (in theory)
    • require developer registration
    • program analysis?
    • blacklisting after the fact?
  • “sandboxing” policies
    • don’t let, e.g., game access your taxes
    • don’t let weather app access your microphone

malware defenses (3)

  • some email spam filters

  • blacklists for web browsers

    • Google Safe Browsing list (Chrome, Firefox)
    • Microsoft SmartScreen (IE, Edge)

malware counter-defenses

  • malware authors tries to make it hard-to-detect

  • obfuscation:

    • make code harder to read
    • make code different each time
    • blend in with normal files/applications/etc.