Digital Immunity -The Myths and Reality

Digital Immunity The Myths and Reality Cornell University 27 June 2002 Christine M. Orshesky, CISSP, CQA

Topics for Discussion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What is Malware? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Virus – Defined ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Virus Infection Process Ensures virus executes before original executable Pre-pend Append PE Infector Overwrite

Types of Viruses ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Virus - Example ,[object Object],[object Object],[object Object],[object Object]

Worm - Defined ,[object Object],[object Object],[object Object],[object Object],[object Object]

Worm - Example ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Trojan horse – Defined ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Trojan horse - Examples ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Joke Program – Defined ,[object Object],[object Object],[object Object]

Joke Program – Example ,[object Object],[object Object],[object Object],[object Object]

Hoax – Defined ,[object Object],[object Object],[object Object],[object Object]

Hoax - Example ,[object Object],[object Object],[object Object]

Logic Bomb – Defined ,[object Object],[object Object],[object Object]

Logic Bomb – Example ,[object Object],[object Object]

Internet Threats ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Exposures ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Propagation Requirements ,[object Object],- Fred Cohen Short Course on Computer Viruses, 2 nd Edition

Propagation Requirements ,[object Object],[object Object],[object Object],[object Object]

Propagation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

How Fast Do They Spread? Source: ICSA/TruSecure 22 minutes 2001 E-mail enabled script NIMDA 5 hours 2000 E-mail enabled script LoveLetter 4 days 1999 E-mail enabled word macro Melissa 4 months 1995 Word Macro Concept 3 years 1990 Boot Sector Form Time to #1 Year Type Malware

Concealment Techniques ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Impact and Effects ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Impact and Effects (concluded) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Incident Management Model ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Response Team Members ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Incident Management Model (continued) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Tools ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Techniques ,[object Object],[object Object],[object Object]

Sample Message Header From: stranger <stranger@yahoo.com> To: bluminx @hotmail.com Subject: Worm Klez.E immunity Date: Thu, 13 Jun 2002 09:39:56 -0400 MIME-Version: 1.0 Received: from [63.117.44.150] by hotmail.com (3.2) with ESMTP id MHotMailBED1EBAB002B400431923F752C9606970; Thu, 13 Jun 2002 06:39:59 -0700 Received: from Zkprhj [216.54.110.216] by mail.atel.net (SMTPD32-6.06) id A08E53F007E; Thu, 13 Jun 2002 09:39:26 -0400 From [email_address] Thu, 13 Jun 2002 06:41:03 -0700 Message-Id: <200206130939556.SM02700@Zkprhj>

Incident Management Model (continued) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Incident Management Model (concluded) ,[object Object],[object Object],[object Object],[object Object],[object Object]

Demonstration ,[object Object],[object Object],[object Object]

Summary ,[object Object],[object Object],[object Object],[object Object]

Some Information Resources ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Additional Resources ,[object Object],[object Object],[object Object],[object Object],[object Object]

End of Presentation ,[object Object]

Digital Immunity -The Myths and Reality

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Digital Immunity -The Myths and Reality

Ähnlich wie Digital Immunity -The Myths and Reality (20)

Mehr von amiable_indian

Mehr von amiable_indian (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Digital Immunity -The Myths and Reality