Sem título

Malware

1. What?

   • software designed to disrupt confidentiality, availability and integrity of a computer system or its assets
   • Fun
   • Corruption/ stealing data
   • remote control of a machine

2. Worms

   • self replicating code which automatically spread without any user intervention
   • Scanning worms
     • installs itself and then scans the network to find other vulnerable hosts
       • then it sends itself
     • Morris worm
       • attempts to connect to TCP port 80 on a randomly chosen host
         • if successful, the attacking host sends a crafted HTTP GET request to the victim
           • attempting to exploit a buffer overflow
           • worm 'bug': all copies of the worm use the same random generator to scan new hosts
             • Then performed a Denial of Service attack on those hosts
       • remote shell execution. dictionary attempts on weak passwords
       • remote buffer overflow explot
   • exploit multiple vulnerabilities
   • Needs to scan, spread and remain undetected
   • MS blaster worm
     • exploit a buffer overflow vulnerability of the RPC (remote procedure call) service
     • scan a random IP range to look for vulnerable systems on TCP port 135
       • open TCP port 4444, which could allow an attacker to execute commands on the system
         • DNS on versions of windows
   • email worms
     • exploit errors in SMTP
     • infects host and gains email client through password cracking
     • causes hostto send out emails, often containing link to the worm
     • mass mailing worms generate a high proportion of the world's spam email

3. Viruses

   • A virus is a piece of self replicating code which is designed to disrupt the normal functioning of a computer system
   • attaches itself to an executable file to spread itself
     • social engineering - email
   • Install without users knowledge
   • scipt files for system admin
   • documents that contain macros - word -excel databases
   • infection mechanism and payload
     • payload
       • an exploit - a way to capitalise on a bug/ error in system or its security to change the function of the system
       • installation of back door software
       • causes a system to crash by modifying operating system
       • annoying for user
       • causes unauthorised sending of emails/spam
       • writes into memory on computer

4. Types of virus

   • classic infect and copy itself / spread to other machines
   • Adware
     • to place adverts on system
     • redirect search requests
   • Spyware
     • collects info usage and sends it to a malicious third party
     • install illegitimate access points- backdoors
       • keyloggers for passwords and data like account numbers
   • Riskware
     • malicious use of admin tools to subvert or destroy a system
   • Trojan Horses
     • malicious program pretending to be a legitimate application
     • from websites/ email
     • do not replicate themselves, rely on user thinking it is a legitimate program
     • pretends to be application to clean hardware
       • Instead it infects the host with adware/ spyware
   • Rootkit
     • activated before a system boots
     • hide malware from detection of standard countermeasures

5. DNS

   • disrupting availability of devices
   • exploiting features of network protocols
   • smurf attack
   • Distributed DNS attacks
     • many machines are attacking machnes
       • using botnets - can be millions of machines
     • multiple simultaneous requests to a resource making it crash

6. Botnets

   • • machine becomes compromised through spyware infection
   • machine becomes a 'zombie machine' controlled by a master - 'botherd'
   • botherd sends instructions for each machine in botnet to send packets to some machine
   • In 2007 - 80* of machines infected with some form of botnet

7. Cross Site Scripting Attacks

   • application layer attack used to exploit vulnerabilities in the way in which websites are coded
     • application layer is an abstraction layer that specifes the shared protocols and interface methods used by hosts in a communications network
   • can embed JS, flash or html code into the client/ server communication in web
   • Using a comments box to add a script which then subverts the webpage
   • create spoofed webpages to collect user data