SlideShare ist ein Scribd-Unternehmen logo

Identifying and Removing Malwares

•
•
n|u - The Open Security Community
n|u - The Open Security Community

null Dharmashala Chapter - July 2014 Meet

Bildung
1 von 44
Downloaden Sie, um offline zu lesen
Identifying and Removing Malwares FOR BEGINNERS n|uNullMeetDharamsala 1 July2014
Agenda  @me  Light  Operating System  User Mode  Kernel Mode  Camera  Malware  History  Types  Properties  &Action  Take n|u Null Meet Dharamsala 2 July 2014
@me  Malware Analyst  Can protect my Web Applications.  Know of: C, C++, Java, Ruby, Python  I “google” a lot.  badboy16a@gmail.com  @_badbot  *PC Gamer* n|u Null Meet Dharamsala 3 July 2014
Light, Camera, Action  Light  Relevant Information about OS  Some historical information  Camera  Statistics  Predictions  Action  Finding and acting on clues  Take  Recommendations July 2014n|u Null Meet Dharamsala 4
“Ware” n|u Null Meet Dharamsala 5 July 2014
Malware A software that performs unintended actions without user consent. n|u Null Meet Dharamsala 6 July 2014
Operating System n|u Null Meet Dharamsala 7 July 2014
Operating System Hardware Operating System Application User Command n|u Null Meet Dharamsala 8 July 2014
Operating System Hardware Device Driver Kernel Programs n|u Null Meet Dharamsala 9 July 2014
Memory Model Real Memory  Exact amount of installed H/W RAM.  Fixed size.  Shared among everything running in system.  Backed by H/W  Protected by OS Virtual Memory  Amount of RAM perceived by every process.  Variable size.  Owned exclusively.  Backed by OS Memory Management.  Mixed Protection. July 2014n|u Null Meet Dharamsala 10
Memory Model User Mode  Unprotected  Program code/data  Un-privileged  Exclusive for process  Swappable  Libraries(.dll, .so, …) Kernel Mode  Protected  Kernel code/data  Privileged  Shared in real space  Mostly not-swappable  Drivers(.drv, .sys, .ko,…) July 2014n|u Null Meet Dharamsala 11 0x00000000-0x7FFFFFFF 0X80000000 – 0xFFFFFFFF
Windows Access Levels July 2014n|u Null Meet Dharamsala 12 •Own Processes •Other User’s Processes User •User Access •Other User’s Processes •Unrestricted Access Administrator •Administrative Access. •Unrestricted Access to Local System. NT_AUTHORITY SYSTEM
Windows Registry  Configuration Database.  Key  [Key] Value[or Default] = [Data]  Permanent and Transient Keys  Derived Keys  Root Keys:  CLASSES_ROOT  LOCAL_MACHINE  USERS  CURRENT_USER  CURRENT_CONFIG July 2014n|u Null Meet Dharamsala 13
Windows Executables  PE (based on COFF) file format.  File starts with “MZ”  Entry point defined in header.  Typically used extensions  EXE: Normal Executable  DLL: Dynamic link library  LIB: Static Library  SYS: Driver  OCX: ActiveX Controls (special purpose DLL) July 2014n|u Null Meet Dharamsala 14
Malware  Software programs designed to damage or do unwanted actions on a computer system. In Spanish, "mal" is a prefix that means "bad," making the term "badware“. July 2014n|u Null Meet Dharamsala 15 Malware Malicious Software
Malware Evolution 1948 Self- Reproducing Automata -John Von Neumann 1970Creeper -PDP-10 -Bob Thomas -Reaper 1975 The Shockwave Rider -Xerox - John Shock & John Hepps July 2014n|u Null Meet Dharamsala 16
Malware Evolution 1981 Elk- Cloner •Apple DOS 3.3 • 15 year old 1986 Brain •PC-DOS • Alvi Brothers 1988 Morris • UNIX Finger service • Robert Morris 1995 Concept • MS Word • Macro Virus July 2014n|u Null Meet Dharamsala 17
Malware Evolution 2000 I LOVE YOU •VBScript • Reomel Lamores 2004 Cabir •Symbian OS 2007-2008 Zeus Conficker 2010 Stuxnet • SCADA Systems July 2014n|u Null Meet Dharamsala 18
Malware Evolution 2011 Duqu, Anti Spyware 2011 2012 Flame 2013 Cyptolocker BlackPOS Dexter vSkimmer 2014 Dragonfly July 2014n|u Null Meet Dharamsala 19
Malware Statistics  Categories that Delivered Malicious Code, 2013 : Symantec July 2014n|u Null Meet Dharamsala 20
Malware Statistics July 2014n|u Null Meet Dharamsala 21
Malware Statistics July 2014n|u Null Meet Dharamsala 22
Malware Predictions  More attack binaries will use stolen or valid code signature.  Browser vulnerabilities may be more common.  Cybercrime gets personal.  More targeted attacks.  More stealthier techniques for C&C.  Expect more malicious code in BIOS and firmware updates.  64bit Malwares.  Malware Diversifies and Specializes.  Sandbox Evasion. July 2014n|u Null Meet Dharamsala 23
Malware Classification  Worm  Propagates by itself on different machine.  Virus  Attaches itself to targets. Infects other systems when target moves.  Trojan  Masquerades itself as legitimate/useful software.  Spyware  Spies on your data and send it to controller.  Adware  Displays unwanted/unsolicited advertisements. July 2014n|u Null Meet Dharamsala 24
Malware Classification  Ransomware  Locks access to your systems or files and demands ransom for further access.  Backdoor(Remote Administration Toolkit):  Allows unauthorized remote user connect to and control your system.  Downloader  Primary payload for exploits. Download/Installs other malwares.  Rootkit  Interferes with kernel to hide itself from user and security tools. July 2014n|u Null Meet Dharamsala 25
Malware Lifecycle  Infection  It has to infect the target. First run.  Persistence  It has to persist. Cannot be downloaded every time.  Run  It has to run. Preferably without user action e.g. Boot, Timed…  Hide  Hide itself from naked eye. July 2014n|u Null Meet Dharamsala 26
&Action  Almost at every stage malwares leave clues.  Identify Clues.  Identify Malware.  Remove Malware. July 2014n|u Null Meet Dharamsala 27
Infection  Exploitation:  Using vulnerabilities to achieve code execution.  Vulnerable program crashes/restarts most of the time.  External Media  Carried to the target system using external media e.g. USB Stick.  Un-mounting the media usually fails.  E-mail Attachments  Sent via email attachment.  Grammatical/Spelling mistakes. Duplicate e-mail. Attachments with double extension, wrong extension. July 2014n|u Null Meet Dharamsala 28
Persistence  Files  Stored as files.  Cryptic file names.  Known file names in unexpected locations.  Misspelled file name.  Streams  Data is stored as NTFS alternate stream.  Pathname containing ‘:’ character. July 2014n|u Null Meet Dharamsala 29
Run & Hide  Hiding in plain sight.  An entry in process list.  Unknown process name.  Unexpected Process.  Process binary at unusual location.  Process with unexpected user account/privilege.  Hiding deep inside  No entry in process list.  Unexpected library.  Unusual usage of system resources.  Re-appearance of some files after deletion. July 2014n|u Null Meet Dharamsala 30
Detection Difficulty Hardware Kernel Device Driver User Programs July 2014n|u Null Meet Dharamsala 31
Sysinternal Tools  Sysinternal Suite  Autoruns  ListDll  Handle  Process Explorer  Process Monitor  RootkitRevealer  Strings July 2014n|u Null Meet Dharamsala 32
Autoruns July 2014n|u Null Meet Dharamsala 33
ListDLLs July 2014n|u Null Meet Dharamsala 34
Handle July 2014n|u Null Meet Dharamsala 35
Process Explorer July 2014n|u Null Meet Dharamsala 36
Process Monitor July 2014n|u Null Meet Dharamsala 37
Rootkit Revealer July 2014n|u Null Meet Dharamsala 38
Strings July 2014n|u Null Meet Dharamsala 39
Other Tools  GMER  Redline  Kaspersky Virus Fighting Utilities  TDSS Killer  McAfee Stinger  Sophos Anti-Rootkit  Norton Power Eraser  Trend Micro House Call July 2014n|u Null Meet Dharamsala 40
GMER  By default downloads with random file name.  Similar to Rootkit Revealer  More signature and parameters to look into. July 2014n|u Null Meet Dharamsala 41
Redline  Separate data collection and analysis system.  Collector can run from removable media.  Verifies against hashes of known good modules.  Reporting July 2014n|u Null Meet Dharamsala 42
Take  Antivirus Not Enough  Understand  Be Updated  Be Paranoid  Don’t Trust  Protect  Backup July 2014n|u Null Meet Dharamsala 43
The END  All the images, statistics, data belong to their respective owners (including me). July 2014n|u Null Meet Dharamsala 44

Empfohlen

Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Is there anybody out there?
Is there anybody out there?Is there anybody out there?
Is there anybody out there?Manuel Bernhardt
 
Cyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesCyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesSandeep Kumar Seeram
 
Security News Bytes - null Dharmashala
Security News Bytes - null DharmashalaSecurity News Bytes - null Dharmashala
Security News Bytes - null Dharmashalan|u - The Open Security Community
 
Fun & profit with bug bounties
Fun & profit with bug bountiesFun & profit with bug bounties
Fun & profit with bug bountiesn|u - The Open Security Community
 
Practical Incident Response - Work Guide
Practical Incident Response - Work GuidePractical Incident Response - Work Guide
Practical Incident Response - Work GuideEduardo Chavarro
 
Introduction to Malwares
Introduction to MalwaresIntroduction to Malwares
Introduction to MalwaresAbdelhamid Limami
 
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Cyphort
 

Empfohlen

Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Is there anybody out there?
Is there anybody out there?Is there anybody out there?
Is there anybody out there?Manuel Bernhardt
 
Cyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesCyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesSandeep Kumar Seeram
 
Security News Bytes - null Dharmashala
Security News Bytes - null DharmashalaSecurity News Bytes - null Dharmashala
Security News Bytes - null Dharmashalan|u - The Open Security Community
 
Fun & profit with bug bounties
Fun & profit with bug bountiesFun & profit with bug bounties
Fun & profit with bug bountiesn|u - The Open Security Community
 
Practical Incident Response - Work Guide
Practical Incident Response - Work GuidePractical Incident Response - Work Guide
Practical Incident Response - Work GuideEduardo Chavarro
 
Introduction to Malwares
Introduction to MalwaresIntroduction to Malwares
Introduction to MalwaresAbdelhamid Limami
 
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.
Sony Attack by Destover Malware. Part of Cyphort Malware Most Wanted Series.Cyphort
 
Identifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareIdentifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareTeodoro Cipresso
 
Security Handbook
Security Handbook Security Handbook
Security HandbookAnthony Hasse
 
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROIDMACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROIDIRJET Journal
 
Chapter 1 malware analysis primer
Chapter 1 malware analysis primerChapter 1 malware analysis primer
Chapter 1 malware analysis primerManjuA8
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.pptCHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.pptManjuAppukuttan2
 
Malware
MalwareMalware
Malwarejosefrozhi12
 
Anton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsAsep Sopyan
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxtarkovtarkovski
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdfCHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdfManjuAppukuttan2
 
An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition Fraunhofer AISEC
 
Lecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptxLecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptxSiddiquiSid1
 
Top 10 Latest Viruses
Top 10 Latest VirusesTop 10 Latest Viruses
Top 10 Latest VirusesLouise Balicat
 
Virus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptxVirus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptxsachingwalani24
 
WEBQUEST ALSOANKA
WEBQUEST ALSOANKAWEBQUEST ALSOANKA
WEBQUEST ALSOANKAALSOANKA
 
Web quest ALSOANKA GROUP
Web quest ALSOANKA GROUPWeb quest ALSOANKA GROUP
Web quest ALSOANKA GROUPALSOANKA
 
DEFINING A SPYWARE
DEFINING A SPYWAREDEFINING A SPYWARE
DEFINING A SPYWAREunnecessary34
 
Spyware
SpywareSpyware
Spywaresubharock
 
powe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hackingpowe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hackingdhruvpawar010
 
Cybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdfCybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdfHaris Chughtai
 
Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)n|u - The Open Security Community
 
Osint primer
Osint primerOsint primer
Osint primern|u - The Open Security Community
 

Weitere ähnliche Inhalte

Ähnlich wie Identifying and Removing Malwares

Identifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareIdentifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareTeodoro Cipresso
 
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROIDMACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROIDIRJET Journal
 
Chapter 1 malware analysis primer
Chapter 1 malware analysis primerChapter 1 malware analysis primer
Chapter 1 malware analysis primerManjuA8
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.pptCHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.pptManjuAppukuttan2
 
Anton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsAsep Sopyan
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxtarkovtarkovski
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdfCHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdfManjuAppukuttan2
 
An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition Fraunhofer AISEC
 
Lecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptxLecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptxSiddiquiSid1
 
Virus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptxVirus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptxsachingwalani24
 
WEBQUEST ALSOANKA
WEBQUEST ALSOANKAWEBQUEST ALSOANKA
WEBQUEST ALSOANKAALSOANKA
 
Web quest ALSOANKA GROUP
Web quest ALSOANKA GROUPWeb quest ALSOANKA GROUP
Web quest ALSOANKA GROUPALSOANKA
 
powe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hackingpowe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hackingdhruvpawar010
 
Cybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdfCybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdfHaris Chughtai
 

Ähnlich wie Identifying and Removing Malwares (20)

Identifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareIdentifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting Malware
 
Security Handbook
Security Handbook Security Handbook
Security Handbook
 
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROIDMACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
MACHINE LEARNING APPROACH TO LEARN AND DETECT MALWARE IN ANDROID
 
Chapter 1 malware analysis primer
Chapter 1 malware analysis primerChapter 1 malware analysis primer
Chapter 1 malware analysis primer
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.pptCHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
CHAPTER 1 MALWARE ANALYSIS PRIMER.ppt
 
Malware
MalwareMalware
Malware
 
Anton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is HackedAnton Chuvakin on Discovering That Your Linux Box is Hacked
Anton Chuvakin on Discovering That Your Linux Box is Hacked
 
Ceh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and wormsCeh v8 labs module 07 viruses and worms
Ceh v8 labs module 07 viruses and worms
 
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptxFunctional and Behavioral Analysis of Different Type of Ransomware.pptx
Functional and Behavioral Analysis of Different Type of Ransomware.pptx
 
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdfCHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
CHAPTER 1 MALWARE ANALYSIS PRIMER.pdf
 
An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition An Antivirus API for Android Malware Recognition
An Antivirus API for Android Malware Recognition
 
Lecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptxLecture-4 FIT Introduction To Software (1).pptx
Lecture-4 FIT Introduction To Software (1).pptx
 
Top 10 Latest Viruses
Top 10 Latest VirusesTop 10 Latest Viruses
Top 10 Latest Viruses
 
Virus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptxVirus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptx
 
WEBQUEST ALSOANKA
WEBQUEST ALSOANKAWEBQUEST ALSOANKA
WEBQUEST ALSOANKA
 
Web quest ALSOANKA GROUP
Web quest ALSOANKA GROUPWeb quest ALSOANKA GROUP
Web quest ALSOANKA GROUP
 
DEFINING A SPYWARE
DEFINING A SPYWAREDEFINING A SPYWARE
DEFINING A SPYWARE
 
Spyware
SpywareSpyware
Spyware
 
powe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hackingpowe point presentation on kali linux and ethical hacking
powe point presentation on kali linux and ethical hacking
 
Cybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdfCybersecurity Free Tools for Practice Project.pdf
Cybersecurity Free Tools for Practice Project.pdf
 

Mehr von n|u - The Open Security Community

Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...n|u - The Open Security Community
 

Mehr von n|u - The Open Security Community (20)

Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)Hardware security testing 101 (Null - Delhi Chapter)
Hardware security testing 101 (Null - Delhi Chapter)
 
Osint primer
Osint primerOsint primer
Osint primer
 
SSRF exploit the trust relationship
SSRF exploit the trust relationshipSSRF exploit the trust relationship
SSRF exploit the trust relationship
 
Nmap basics
Nmap basicsNmap basics
Nmap basics
 
Metasploit primary
Metasploit primaryMetasploit primary
Metasploit primary
 
Api security-testing
Api security-testingApi security-testing
Api security-testing
 
Introduction to TLS 1.3
Introduction to TLS 1.3Introduction to TLS 1.3
Introduction to TLS 1.3
 
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
Gibson 101 -quick_introduction_to_hacking_mainframes_in_2020_null_infosec_gir...
 
Talking About SSRF,CRLF
Talking About SSRF,CRLFTalking About SSRF,CRLF
Talking About SSRF,CRLF
 
Building active directory lab for red teaming
Building active directory lab for red teamingBuilding active directory lab for red teaming
Building active directory lab for red teaming
 
Owning a company through their logs
Owning a company through their logsOwning a company through their logs
Owning a company through their logs
 
Introduction to shodan
Introduction to shodanIntroduction to shodan
Introduction to shodan
 
Cloud security
Cloud security Cloud security
Cloud security
 
Detecting persistence in windows
Detecting persistence in windowsDetecting persistence in windows
Detecting persistence in windows
 
Frida - Objection Tool Usage
Frida - Objection Tool UsageFrida - Objection Tool Usage
Frida - Objection Tool Usage
 
OSQuery - Monitoring System Process
OSQuery - Monitoring System ProcessOSQuery - Monitoring System Process
OSQuery - Monitoring System Process
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
 
Extensible markup language attacks
Extensible markup language attacksExtensible markup language attacks
Extensible markup language attacks
 
Linux for hackers
Linux for hackersLinux for hackers
Linux for hackers
 
Android Pentesting
Android PentestingAndroid Pentesting
Android Pentesting
 

Kürzlich hochgeladen

Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfVirtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfErwinPantujan2
 
The Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsThe Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsRommel Regala
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfPatidar M
 
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTS
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTSGRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTS
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTSJoshuaGantuangco2
 
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...Postal Advocate Inc.
 
Textual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSTextual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSMae Pangan
 
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)lakshayb543
 
How to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPHow to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPCeline George
 
Presentation Activity 2. Unit 3 transv.pptx
Presentation Activity 2. Unit 3 transv.pptxPresentation Activity 2. Unit 3 transv.pptx
Presentation Activity 2. Unit 3 transv.pptxRosabel UA
 
How to Add Barcode on PDF Report in Odoo 17
How to Add Barcode on PDF Report in Odoo 17How to Add Barcode on PDF Report in Odoo 17
How to Add Barcode on PDF Report in Odoo 17Celine George
 
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxMULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxAnupkumar Sharma
 
ROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxVanesaIglesias10
 
TEACHER REFLECTION FORM (NEW SET........).docx
TEACHER REFLECTION FORM (NEW SET........).docxTEACHER REFLECTION FORM (NEW SET........).docx
TEACHER REFLECTION FORM (NEW SET........).docxruthvilladarez
 
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfInclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfTechSoup
 
Integumentary System SMP B. Pharm Sem I.ppt
Integumentary System SMP B. Pharm Sem I.pptIntegumentary System SMP B. Pharm Sem I.ppt
Integumentary System SMP B. Pharm Sem I.pptshraddhaparab530
 
ClimART Action | eTwinning Project
ClimART Action | eTwinning ProjectClimART Action | eTwinning Project
ClimART Action | eTwinning Projectjordimapav
 
ANG SEKTOR NG agrikultura.pptx QUARTER 4
ANG SEKTOR NG agrikultura.pptx QUARTER 4ANG SEKTOR NG agrikultura.pptx QUARTER 4
ANG SEKTOR NG agrikultura.pptx QUARTER 4MiaBumagat1
 
4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptxmary850239
 

Kürzlich hochgeladen (20)

Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdfVirtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
Virtual-Orientation-on-the-Administration-of-NATG12-NATG6-and-ELLNA.pdf
 
The Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World PoliticsThe Contemporary World: The Globalization of World Politics
The Contemporary World: The Globalization of World Politics
 
Active Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdfActive Learning Strategies (in short ALS).pdf
Active Learning Strategies (in short ALS).pdf
 
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTS
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTSGRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTS
GRADE 4 - SUMMATIVE TEST QUARTER 4 ALL SUBJECTS
 
YOUVE GOT EMAIL_FINALS_EL_DORADO_2024.pptx
YOUVE GOT EMAIL_FINALS_EL_DORADO_2024.pptxYOUVE GOT EMAIL_FINALS_EL_DORADO_2024.pptx
YOUVE GOT EMAIL_FINALS_EL_DORADO_2024.pptx
 
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
USPS® Forced Meter Migration - How to Know if Your Postage Meter Will Soon be...
 
Textual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHSTextual Evidence in Reading and Writing of SHS
Textual Evidence in Reading and Writing of SHS
 
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
Visit to a blind student's school🧑‍🦯🧑‍🦯(community medicine)
 
Paradigm shift in nursing research by RS MEHTA
Paradigm shift in nursing research by RS MEHTAParadigm shift in nursing research by RS MEHTA
Paradigm shift in nursing research by RS MEHTA
 
How to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERPHow to do quick user assign in kanban in Odoo 17 ERP
How to do quick user assign in kanban in Odoo 17 ERP
 
Presentation Activity 2. Unit 3 transv.pptx
Presentation Activity 2. Unit 3 transv.pptxPresentation Activity 2. Unit 3 transv.pptx
Presentation Activity 2. Unit 3 transv.pptx
 
How to Add Barcode on PDF Report in Odoo 17
How to Add Barcode on PDF Report in Odoo 17How to Add Barcode on PDF Report in Odoo 17
How to Add Barcode on PDF Report in Odoo 17
 
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptxMULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
MULTIDISCIPLINRY NATURE OF THE ENVIRONMENTAL STUDIES.pptx
 
ROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptxROLES IN A STAGE PRODUCTION in arts.pptx
ROLES IN A STAGE PRODUCTION in arts.pptx
 
TEACHER REFLECTION FORM (NEW SET........).docx
TEACHER REFLECTION FORM (NEW SET........).docxTEACHER REFLECTION FORM (NEW SET........).docx
TEACHER REFLECTION FORM (NEW SET........).docx
 
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdfInclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
Inclusivity Essentials_ Creating Accessible Websites for Nonprofits .pdf
 
Integumentary System SMP B. Pharm Sem I.ppt
Integumentary System SMP B. Pharm Sem I.pptIntegumentary System SMP B. Pharm Sem I.ppt
Integumentary System SMP B. Pharm Sem I.ppt
 
ClimART Action | eTwinning Project
ClimART Action | eTwinning ProjectClimART Action | eTwinning Project
ClimART Action | eTwinning Project
 
ANG SEKTOR NG agrikultura.pptx QUARTER 4
ANG SEKTOR NG agrikultura.pptx QUARTER 4ANG SEKTOR NG agrikultura.pptx QUARTER 4
ANG SEKTOR NG agrikultura.pptx QUARTER 4
 
4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx4.18.24 Movement Legacies, Reflection, and Review.pptx
4.18.24 Movement Legacies, Reflection, and Review.pptx
 

Identifying and Removing Malwares

  • 2. Agenda  @me  Light  Operating System  User Mode  Kernel Mode  Camera  Malware  History  Types  Properties  &Action  Take n|u Null Meet Dharamsala 2 July 2014
  • 3. @me  Malware Analyst  Can protect my Web Applications.  Know of: C, C++, Java, Ruby, Python  I “google” a lot.  badboy16a@gmail.com  @_badbot  *PC Gamer* n|u Null Meet Dharamsala 3 July 2014
  • 4. Light, Camera, Action  Light  Relevant Information about OS  Some historical information  Camera  Statistics  Predictions  Action  Finding and acting on clues  Take  Recommendations July 2014n|u Null Meet Dharamsala 4
  • 5. “Ware” n|u Null Meet Dharamsala 5 July 2014
  • 6. Malware A software that performs unintended actions without user consent. n|u Null Meet Dharamsala 6 July 2014
  • 7. Operating System n|u Null Meet Dharamsala 7 July 2014
  • 10. Memory Model Real Memory  Exact amount of installed H/W RAM.  Fixed size.  Shared among everything running in system.  Backed by H/W  Protected by OS Virtual Memory  Amount of RAM perceived by every process.  Variable size.  Owned exclusively.  Backed by OS Memory Management.  Mixed Protection. July 2014n|u Null Meet Dharamsala 10
  • 11. Memory Model User Mode  Unprotected  Program code/data  Un-privileged  Exclusive for process  Swappable  Libraries(.dll, .so, …) Kernel Mode  Protected  Kernel code/data  Privileged  Shared in real space  Mostly not-swappable  Drivers(.drv, .sys, .ko,…) July 2014n|u Null Meet Dharamsala 11 0x00000000-0x7FFFFFFF 0X80000000 – 0xFFFFFFFF
  • 12. Windows Access Levels July 2014n|u Null Meet Dharamsala 12 •Own Processes •Other User’s Processes User •User Access •Other User’s Processes •Unrestricted Access Administrator •Administrative Access. •Unrestricted Access to Local System. NT_AUTHORITY SYSTEM
  • 13. Windows Registry  Configuration Database.  Key  [Key] Value[or Default] = [Data]  Permanent and Transient Keys  Derived Keys  Root Keys:  CLASSES_ROOT  LOCAL_MACHINE  USERS  CURRENT_USER  CURRENT_CONFIG July 2014n|u Null Meet Dharamsala 13
  • 14. Windows Executables  PE (based on COFF) file format.  File starts with “MZ”  Entry point defined in header.  Typically used extensions  EXE: Normal Executable  DLL: Dynamic link library  LIB: Static Library  SYS: Driver  OCX: ActiveX Controls (special purpose DLL) July 2014n|u Null Meet Dharamsala 14
  • 15. Malware  Software programs designed to damage or do unwanted actions on a computer system. In Spanish, "mal" is a prefix that means "bad," making the term "badware“. July 2014n|u Null Meet Dharamsala 15 Malware Malicious Software
  • 16. Malware Evolution 1948 Self- Reproducing Automata -John Von Neumann 1970Creeper -PDP-10 -Bob Thomas -Reaper 1975 The Shockwave Rider -Xerox - John Shock & John Hepps July 2014n|u Null Meet Dharamsala 16
  • 17. Malware Evolution 1981 Elk- Cloner •Apple DOS 3.3 • 15 year old 1986 Brain •PC-DOS • Alvi Brothers 1988 Morris • UNIX Finger service • Robert Morris 1995 Concept • MS Word • Macro Virus July 2014n|u Null Meet Dharamsala 17
  • 18. Malware Evolution 2000 I LOVE YOU •VBScript • Reomel Lamores 2004 Cabir •Symbian OS 2007-2008 Zeus Conficker 2010 Stuxnet • SCADA Systems July 2014n|u Null Meet Dharamsala 18
  • 20. Malware Statistics  Categories that Delivered Malicious Code, 2013 : Symantec July 2014n|u Null Meet Dharamsala 20
  • 21. Malware Statistics July 2014n|u Null Meet Dharamsala 21
  • 22. Malware Statistics July 2014n|u Null Meet Dharamsala 22
  • 23. Malware Predictions  More attack binaries will use stolen or valid code signature.  Browser vulnerabilities may be more common.  Cybercrime gets personal.  More targeted attacks.  More stealthier techniques for C&C.  Expect more malicious code in BIOS and firmware updates.  64bit Malwares.  Malware Diversifies and Specializes.  Sandbox Evasion. July 2014n|u Null Meet Dharamsala 23
  • 24. Malware Classification  Worm  Propagates by itself on different machine.  Virus  Attaches itself to targets. Infects other systems when target moves.  Trojan  Masquerades itself as legitimate/useful software.  Spyware  Spies on your data and send it to controller.  Adware  Displays unwanted/unsolicited advertisements. July 2014n|u Null Meet Dharamsala 24
  • 25. Malware Classification  Ransomware  Locks access to your systems or files and demands ransom for further access.  Backdoor(Remote Administration Toolkit):  Allows unauthorized remote user connect to and control your system.  Downloader  Primary payload for exploits. Download/Installs other malwares.  Rootkit  Interferes with kernel to hide itself from user and security tools. July 2014n|u Null Meet Dharamsala 25
  • 26. Malware Lifecycle  Infection  It has to infect the target. First run.  Persistence  It has to persist. Cannot be downloaded every time.  Run  It has to run. Preferably without user action e.g. Boot, Timed…  Hide  Hide itself from naked eye. July 2014n|u Null Meet Dharamsala 26
  • 27. &Action  Almost at every stage malwares leave clues.  Identify Clues.  Identify Malware.  Remove Malware. July 2014n|u Null Meet Dharamsala 27
  • 28. Infection  Exploitation:  Using vulnerabilities to achieve code execution.  Vulnerable program crashes/restarts most of the time.  External Media  Carried to the target system using external media e.g. USB Stick.  Un-mounting the media usually fails.  E-mail Attachments  Sent via email attachment.  Grammatical/Spelling mistakes. Duplicate e-mail. Attachments with double extension, wrong extension. July 2014n|u Null Meet Dharamsala 28
  • 29. Persistence  Files  Stored as files.  Cryptic file names.  Known file names in unexpected locations.  Misspelled file name.  Streams  Data is stored as NTFS alternate stream.  Pathname containing ‘:’ character. July 2014n|u Null Meet Dharamsala 29
  • 30. Run & Hide  Hiding in plain sight.  An entry in process list.  Unknown process name.  Unexpected Process.  Process binary at unusual location.  Process with unexpected user account/privilege.  Hiding deep inside  No entry in process list.  Unexpected library.  Unusual usage of system resources.  Re-appearance of some files after deletion. July 2014n|u Null Meet Dharamsala 30
  • 31. Detection Difficulty Hardware Kernel Device Driver User Programs July 2014n|u Null Meet Dharamsala 31
  • 32. Sysinternal Tools  Sysinternal Suite  Autoruns  ListDll  Handle  Process Explorer  Process Monitor  RootkitRevealer  Strings July 2014n|u Null Meet Dharamsala 32
  • 33. Autoruns July 2014n|u Null Meet Dharamsala 33
  • 34. ListDLLs July 2014n|u Null Meet Dharamsala 34
  • 35. Handle July 2014n|u Null Meet Dharamsala 35
  • 36. Process Explorer July 2014n|u Null Meet Dharamsala 36
  • 37. Process Monitor July 2014n|u Null Meet Dharamsala 37
  • 38. Rootkit Revealer July 2014n|u Null Meet Dharamsala 38
  • 39. Strings July 2014n|u Null Meet Dharamsala 39
  • 40. Other Tools  GMER  Redline  Kaspersky Virus Fighting Utilities  TDSS Killer  McAfee Stinger  Sophos Anti-Rootkit  Norton Power Eraser  Trend Micro House Call July 2014n|u Null Meet Dharamsala 40
  • 41. GMER  By default downloads with random file name.  Similar to Rootkit Revealer  More signature and parameters to look into. July 2014n|u Null Meet Dharamsala 41
  • 42. Redline  Separate data collection and analysis system.  Collector can run from removable media.  Verifies against hashes of known good modules.  Reporting July 2014n|u Null Meet Dharamsala 42
  • 43. Take  Antivirus Not Enough  Understand  Be Updated  Be Paranoid  Don’t Trust  Protect  Backup July 2014n|u Null Meet Dharamsala 43
  • 44. The END  All the images, statistics, data belong to their respective owners (including me). July 2014n|u Null Meet Dharamsala 44