CheckPoint: Anatomy of an evolving bot

Anatomy of an Evolving
Bot and How to Protect
Your Network Against it

[Protected] For public distribution

©2013 Check Point Software Technologies Ltd.

Antivirus 20th+ Anniversary



2



3

The Halting Problem
 The Halting Problem



4

The Malware Problem



5

Pre-Infection


6

The Constraints

TIME

SPACE

Cannot analyze program forever
• Slow down loops
• Sleep
• Time-consuming operations (Encryption/Packing)

Cannot maintain unlimited states
• “Run out the clock”
OpenProcess  VirtualAllocEx 
WriteProcessMemory  LOOP  .. 
CreateRemoteThread



7

Exploiting the Constraints

Thwart static analysis --> SPACE

Advanced malware exploits these constraints
Thwart dynamic analysis --> TIME + SPACE



8

More Depressing News
 Elevation of privilege to kernel mode
– Bypassing security products

 Stolen certificate authorities
– Breaking the trust

 Automatic static analysis is hard!
– Packing / obfuscation /
encryption

 Manual static analysis
– Unpacking / time consuming /
not scalable

 Dynamic analysis
– The malware problem!


9

Relax



10

Current Detection Methods (Partial)

Pattern Based
•
•
•
•
•
•

MD5 / SHA1 / SHA256
Fuzzy hashing
Pattern-based
PCRE / Regex
Proprietary language
Malware classifiers (J48, J48 Graft,
PART)

Static Analysis
•
•
•
•
•

Anti-VM
Anti-debugging
Anti-disassembly
Obfuscation
Reverse engineering
**Rodrigo Rubira Branco BH12

Dynamic Analysis Hybrid Approach
• API call trace analysis
• Network activities
• Registry modifications
• Process creation/injections
• File activities
What you see is what you get!

•

•


Semantic-aware detectors
• Extract dynamic trace
• Transform into IR
• Compare to pre-defined templates
Memory dump analysis (packers)


11

The Sample Lifecycle

Sample Arrives

Unknown

Static
Analysis

# Flags
< Threshold

Dynamic
Analysis

Classification

# Flags
< Threshold

Classified

Benign

Family
Threat

Not Classified

Manual
Analysis

Interesting

Generic
Threat


Malicious


12

Bypassing Detection Methods

Pattern Based
•
•
•
•

Build variants (e.g. Zeus)
Append garbage
Encoding
“Stay compliant”

Static Analysis
•
•
•
•

Packing
Obfuscation
Encryption
Anti-reversing techniques

Dynamic Analysis Hybrid Approach
•
•
•
•
•

Detect analysis*
Detect emulation*
Detect security product*
Beat the clock (AV sandbox)
“Split the maliciousness”

•
•

*Could be detected during static analysis

Avoid using the same executable
template
Metasploit AV-evasion
• Reuse “trusted templates”
• PowerShell
• In-memory exploits


13

MYTH #1
Malware executes immediately



14



15

MYTH #2
Malware is usually small



16



17

Malware Detection Based on File Size

Ref: http://www.fortiguard.com/sites/default/files/DetectingMalwareThreats.pdf



18

Malware Bypassing Detections
Static Analysis
4 x Zero-Days
2 x Stolen Certificates
(Break the trust)

Multiple Files (lesser

Execution depends on host

Static Analysis

Dynamic Analysis

20 MB of Code!

Flame

Obfuscated Entry Point
(Needs a special Loader)

Unknown DLL loading
technique

Stuxnet

Dynamic Analysis

Does not execute
immediately

Breakthrough in
cryptography (Break the
trust)

Multiple Files (lesser

Legitimate Libraries (LUA)

Obfuscated Entry Point
(Needs a special Loader)

maliciousness
entropy)

maliciousness
entropy)



19

Malware Thwarting Analysis
Mac OSX

C&C
Exploit Java Vulnerability
UUID

Send Hardware UUID (Unique)

Infected
with
FlashFake

Encryption
Key
Encrypt
Malware and
Obfuscate

Encrypted Malware

Executable will only run
on the original host



20

PROBLEM
Detection is good but not great



21

Process Enumeration
Problem:
Malware checks for the
existence of a security
product process

Solution:
Process enumeration using
weight based mechanism:
taint analysis



22

Detecting

“Weird” Process Enumerations

 Monitor EPROCESS structure access
 Track process name usage (taint analysis)
 Score the process based on “weird” usage
– HASH
– Encryption
– Encoding
– Etc.



23

Obfuscation!
Problem:
Malware uses obfuscation to
hide malicious code during
Drive-by-download attacks

Solution:
Hook the browser at
strategic places and inspect
the de-obfuscated buffers



24

Tapping The Browser
 Obfuscation is a problem!
– Network devices are blind

 Possible solution on the network side
– Analyze data entropy to detect possible obfuscation
– Google uses obfuscation -> massive FP

 Better solution on the end point
– Hook the browsers (IE/Chrome/Firefox) at strategic places
– Eval, Document.write, innerhtml, etc’

– Let the browser do the “heavy lifting”
– Communicate the information back to the network devices


25

Demo



26

Anti-VM OUT, Anti-Analysis IN
Problem:
Malware drop anti-VM
technique and focus on
anti-analysis techniques

Solution:
Subvert the analysis machine
with a Rootkit before
executing the malware



27

Subvert the Analysis Machine
 Malware usually cannot detect Rootkit!
 Install a rootkit on the analysis machine
– Hide files/processes/drivers
– Hide open ports
– Hide registry values

 Malware is not aware that it is being subverted
 Results in higher detection rate of advanced malware


28

DEMO: Tool-B-Gone
 Easy-to-use rootkit generator
 Choose the process/files/ports/registry values you
wish to hide

 Generates a customize rootkit
 Install rootkit
 Benefit!



29

Post-Infection


30

The Biggest DDoS Attack: CyberBunker

CyberBunker vs. Spamhaus vs. CloudFlare vs. The Internet

350Gb/s of DNS Traffic (DNS Amplification Attack)
Botnet of 30,000+ open DNS resolvers


31

Carna Botnet

Scanning the Internet for open devices
with open passwords
Devices were used to form a botnet

Bots were commanded to perform
Internet port scanning

420,000+ Botnet


32

Monkey See, Monkey Do, Monkey Sell
Black Hole Exploit Kit



33

Polymorphism is Striking Back
 Signatures are the #1 most popular detection method
 Attackers evade signature based detection by obfuscating
the attacks and creating attack variants
– It isn’t something the average script kiddie can do, but you also
don’t need Anonymous for that either

 So how tough is it?
– Zeus and SpyEye “builders”, generating Zeus or Spyeye
variants in a click, are sold at $1–10K
– www.styx-crypt.com will obfuscate HTML, Javascript,
Executable files, PDF & Flash files at $5–25 per file, quantity
discounts apply



34

Botnet Operation: The Infection
C&C Server

Download Egg
 Small payload
 Contains initial

Infection

activation sequence
 Egg downloaded
directly from infection
source or source,
such as Command &
Control server

 Social engineering
 Exploiting vulnerability
 Drive-by downloads



36

Botnet Operation: Self -Defense
Command
& Control
Server
Self Defense

 Stop Anti-Virus
service
 Change “hosts” file
 Disable Windows
Automatic Updates
 Reset system
restore points



37

Botnet Operation: The Damages
Command
& Control
Server
Payload Pull







Spam
Denial of Service
Identity Theft
Propagation
Click fraud



38

Anti-Bot Software Blade

DISCOVER and STOP Bot Attacks
Discover
Bot infections

Prevent
Bot damage

Investigate
Bot infections

Multi-tier
discovery

Stop traffic to
remote operators

Extensive
forensics tools


39

ThreatSpect™ Engine
ThreatSpect™ Engine

Reputation

Network
Signatures
Suspicious
Email
Activity

Maximum security with
multi-gig performance

 Detect Command & Control sites and drop zones
 Over 250 millions addresses in ThreatCloud™
 Real time updates
 Over 2000 bots’ family unique communication
patterns
 Dozen of behavioral patterns

 Over 2 million outbreaks



40

Anatomy of Discovering a Bot
(ThreatSpect™ Engine)
ThreatCloud™

Reputation
Engine
in the cloud

Resource

 Using smart caching
to minimize number
of queries to the
cloud

C&C

(IP/URL/DNS)

Command &
Control


41

ThreatCloud™

Check for
Signatures
in the gateway
 Multi-connection
communication
patterns (unique per
botnet family)
 Bot behavioral
patterns

Command &
Control


42

ThreatCloud™

Check
suspicious
Email activity

Mail params

Bot-based spam

(obfuscated)

 Outbound mail
analysis to identify
Spam sent from the
organization
 Mails normalized,
parameters
extracted
 All customer data is
obfuscated



43

Future Directions

Detecting Bots and Internal Threats Using ML
 Most network behavior analysis tools fail to deliver
– Bad feature sets that results in massive FP

 Feature set focus on user behavioral profile and
not malware
– Data entropy / working hours / keyboard typing speed

 Based on the Protoleak project (RSA 12’)
– Profile-based decision tree per node

 Focus on data exfiltration and behavior deviations



44

Summary

Force malware mistakes, don’t wait for them to strike
Raise attackers’ cost by innovating mitigations
Detect data exfiltration using Anti-Bot and ThreatCloud

Behavior, machine learning and intelligence is the key



45

Questions?



46

Thank You



CheckPoint: Anatomy of an evolving bot

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie CheckPoint: Anatomy of an evolving bot

Ähnlich wie CheckPoint: Anatomy of an evolving bot (20)

Mehr von Group of company MUK

Mehr von Group of company MUK (19)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

CheckPoint: Anatomy of an evolving bot

Hinweis der Redaktion