Software Vulnerabilities

Page 1

Malware and Exploits

Malware- how it proliferates:

Virus

Worm

Trojan

Exploit

Payloads:

Backdoor

Rootkit

Ramsomware

Logic Bomb

Adware

Spyware

Vectors:

Mechanism through which malware infects a machine

Usually the vector will be a software vulnerability

Or someone clicked yes by mistake

Payloads

Actual malware deposited on the machine

Can range from doing nothing/ minor things like spam to stealing info and system destruction

Viruses

Self replicating code

Attaches to disk/ file/ document which would usually be executable

When file run, virus runs and attempts to proagate

Installs without users knowledge or consent

Attachment mechanisms: historically boot sector, now email attachments, scripts, macros

Worms

Viruses traditionally require human to spread

Worms are self-replicating and stand alone programs- no human intervention

Scanning or email worms

Exploit known software vulnerabilities to spread

MSBlaster worm

Caused buffer overflow in windows Remote Procedure Call (RPC), reboots machine

Performed DDOS on windows update

Spread between machines on an internal network easily

Sasser- Buffer overflow in LSASS, scans IPs and infects via port 445

Exploit lifecycle

Many exploits reverse engineered from patches

Zero day exploits- ones that are previously unknown, no patch, the most dangerous

Stuxnet- American/ Israeli cyber weapon to destroy Iranian nuclear facilities

4 zero day flaws

Seeks out Siemens software to control/ monitor factory equipment

Finds programmble logic controllers and causes them to spin nuclear centrifuges to destruction

Reports back to control software they are fine

Kernel mode rootkit, auto updates itself

Trojans

Malicious program pretending to be a legit app

Often in email attachments or malicious websites

Don't replicate themselves- user error

Randomware- Encrypt/ block access to files/ demand a ransom

Backdoors- Once in, provides easy access to a system. Often work in a client- server architecture. Can do discretely by changing software/ kernel itself

Rootkits

Hide malicious code from OS process table

Often activated before or during a boot

Used to hide other malware from standard countermeasures

Often installs inside kernel itself, or into master boot record

Exploits- how they happen

Programming errors

Unchecked user input

Incorrect assumptions

Weak APIs

Bad protocols

Memory management- C, C++- dangerous- Buffer/ stack/ heap overruns. Type safe languages avoid this

Data execution prevention (NX)

Modern OS's mark stack as non-executable

Prevents "stack smashing"

Can work around with return-to-libc attack

Return-oriented programming- stitching parts of a program together to do what you want

Race-conditions- with concurrent threads/processes, timing can lead to security vulnerabilties