Upload File

chapter 3 – program security section 3.1 secure programs section 3.2 nonmalicious program errors...

  • Home
  • Documents
  • Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code
22
Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Upload: dwight-glenn

Post on 17-Dec-2015

224 views

Category:

Documents


4 download

Report

Tags:

TRANSCRIPT

Page 1: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Chapter 3 – Program SecuritySection 3.1 Secure Programs

Section 3.2 Nonmalicious Program ErrorsSection 3.3 Viruses and Other Malicious Code

Page 2: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

In this SectionProgramming errors with security

implicationsMalicious Code

Program Development and ControlsControls to protect against flaws in execution

Programs (lots of them)have errorsHow do we keep programs from flaws?How do we protect computing resources

against programs that contain flaws?

Page 3: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Secure ProgramsWhat is a secure program?Everyone has there own requirement of

secure.Part of assessing software qualityDoes it meet security requirements in

specification? (is requirements complete?)

In general, we often look at quantity and types of faults for evidence of security (or lack of it). We track these things.

Page 4: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Who’s Fault is it?Finding lots of faults in software early.

NOT GOOD.Early approaches were “Penetrate” and then

“Patch”NOT GOOD.

Repairing with a patch is a narrow focus and not the more important requirements.

Patches can cause other problems.Non obvious side effectsFix one places – fails anotherPerformance or function suffers

Page 5: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Types of FlawsValidation error (incomplete or inconsistent):

permissions checksDomain error: controlled access to dataSerialization and aliasing: program flow

orderInadequate identification and authentication:

basis for authorizationBoundary condition violation: failure on first

or last caseOther exploitable logic errors

Page 6: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Unexpected BehaviorUnexpected behavior is a program security

flaw.Does the program behave as it was designed?Behavior can be:

Vulnerability (class of fault)Flaw (fault or failure)

Flaw (human)InadvertentIntentional

Page 7: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Nonmalicious Program ErrorsBuffer Overflows

Excess information provided – overfilling the bucket

Buffer – space in which data is held (array or string)

char sample[10] or char sample[i]For (i=0; I<=9; i++)

sample[i] = ‘A’;sample[10] = ‘B’;

Page 8: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-1  Places Where a Buffer Can Overflow.

Page 9: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Nonmalicious Program ErrorsIncomplete Mediation

Supplying the wrong type of data being requested.Supplying the wrong length of data being

requested.Problem

System Fails Supply of Bad Data

Must be checked by programmerClient side verses Server Side

Time-of-Check to Time-of-Use ErrorsOld bait-n-switch

Page 10: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses and Other Malicious CodeWhy worry about it?

HarmWhat is it?

Unexpected or undesired effects in program or data caused by an agent intent on damage.

Agent is the writer of the codeMistakes are not malicious (human error)Virus – program that replicates itself to other

programs by altering the program code. Transient virus – runs when host runs Resident virus – resides in memory (active as a stand

alone)

Page 11: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Trojan Horse – in addition to primary effect, has a second, non-obvious malicious effect. Passwords

Logic Bomb – only on a conditionTime bomb – only at certain timeTrapdoor (backdoor) – other means of

privileged access; intentional and non-intentional

Worm – spreads virus via network Rabbit – replicates to exhaust recourses

Viruses can append, surround and integrate

Page 12: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-4  Virus Appended to a Program.

Page 13: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-5  Virus Surrounding a Program.

Page 14: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-6  Virus Integrated into a Program.

Page 15: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-7  Virus Completely Replacing a Program.

Page 16: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Document Virus

Within the format of a documentMacro Virus

Appealing Qualities for Virus WritersHard to detectNot easily destroyedSpreads widelyRe-infects easilyEasy to createMachine and OS independent

Page 17: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Where do they live?

One-Time Execution Virus – come in on EMAIL; these are popular

Boot Sector Virus From the bootsrap (bootup); bootse ctor of the hard

disk

Page 18: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Where do they live?

Memory-Resident Viruses Terminate and Stay Resident (TSR) Infects Windows System Registry to reload

ApplicationsMacrosScriptsLibrariesImagesDocuments

Page 19: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Virus Signatures

Viruses are no completely invisibleThey all leave a signature pattern (DNA)Patterns are found with Virus ScannersVirus patterns

Always at same location Top of file location File size grows Strange code; jump statements Hash or checksum change (later chapters)

Page 20: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Figure 3-9  Recognizable Patterns in Viruses.

Page 21: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Transmission PatternsPolymorphic Virus – every changing virusEncrypting Virus – tries to hide

PreventionCommercial software applicationsTest all softwareOpening attachmentsMake system imagesKeep copies of executable files and data filesVirus Detection Software

Page 22: Chapter 3 – Program Security Section 3.1 Secure Programs Section 3.2 Nonmalicious Program Errors Section 3.3 Viruses and Other Malicious Code

Viruses (Continued)Truths and Misconceptions about Viruses

Viruses infect only Windows (False)Viruses can modify “hidden” or “read-only” files

(True)Files only appear in executable files (False)Viruses spread only on disks or only through EMAIL

(false)Viruses cannot remain in memory when power is off

(True/False)Viruses can not infect hardware. (True/False)Viruses can be malevolent, benign or benevolent

(True)


COMPSCI 111 111G Software - Auckland · 12 “Windows - so intuitive ... • Generic term for malicious software • Usually malicious program is disguised as useful program • Causes

Stefan Schmid - TUM · Adding Malicious Players… • What is the impact of malicious agents in this selfish system? • Let us add b malicious players to the grid! • Every malicious

ASEC REPORT - AhnLab · ASEC REPORT 45 | MALICIOUS CODE TREND 4 Ranking Malicious Code Reports Percentage Ranking ↑↓ Malicious Code Reports Percentage Table 1-2 | Top 20 Malicious

Malicious Code

Experts - Malicious program targets Macs - CNN.com (April 22, 2009)

Malicious Cryptography Exposing Cryptovirology€¦ · Exposing Cryptovirology Adam Young Moti Yung Wiley Publishing, Inc. C1.jpg. Malicious Cryptography. Malicious Cryptography Exposing

Malicious Malware Softwareathena.csus.edu/~cookd/115/notes/CSC 115 - Summer...Malware that Spreads A virus is a malicious program that is able to infect files with copies of itself

Counterintelligence Through Malicious Code Analysis Hack Program 07thesis_murphy

Malicious Cryptography

Malicious Cryptography Techniques for Unreversable ... · Malicious Cryptography Techniques for Unreversable (malicious or not) binaries Eric Filiol [email protected] ESIEA - Laval

Malware is any malicious program or code developed by

€¦ · Internal Malicious Espionage I/T Sabotage Fraud / abuse IP Theft Non-malicious External Malicious Non-malicious CERT Threat Models • An authorized user of a system who

MALICIOUS PROSECUTION AND NEGLIGENT INVESTIGATION: … · MALICIOUS PROSECUTION (i) Brief History of Malicious Prosecution in Canada The tort of malicious prosecution has its genesis

Malicious Software Malicious Software Han Zhang & Ruochen Sun

MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

Malware: Malicious Software€¦ · •Benign example: Easter Eggs in DVDs and software 9/18/2013 Malware 4 . Logic Bombs •A logic bomb is a program that performs a malicious action

Chapter 3 – Program Security Section 3.4 Targeted Malicious Code Section 3.5 Controls Against Program Threats

Malicious Code By Diana Peng. What is Malicious Code? Unanticipated or undesired effects in programs/program parts, caused by an agent with damaging intentions

Defamation and Malicious Publications (Scotland) Bill ... · Defamation and Malicious Publications (Scotland) Bill CONSULTATION DRAFT CONTENTS Section PART 1 DEFAMATION Actionability

Malicious Dersertion

Taxonomy of Malicious Programs Malicious Softwareabc/teaching/bbs677/slides/Malware_4.pdf · Taxonomy of Malicious Programs Needs Host Program Independent Programs Malicious Trapdoors

Defamation and Malicious Publication (Scotland) … and...Defamation and Malicious Publication (Scotland) Bill [AS INTRODUCED] CONTENTS Section P ART 1 D EFAMATION Actionability and

Malicious Software - Sirindhorn International Institute of Technologyict.siit.tu.ac.th/.../CSS322Y10S2L16-Malicious-Software.pdf · 2011-10-07 · CSS322 Malicious Software Malicious

malware: Malicious Code - Uic Computer Sciencesloan/CLASSES/privacy/Malware.pdf · Malicious code: Viruses • Most famous type of malicious code • Malware Program that seeks out

CHAPTER 3 Program Security 1. Objectives 2 Defined the concept of secured program differentiate malicious and non-malicious code identify and describe

Malicious Code as Weapon Malicious Code as Weapon

Malicious software

Phishing and Malicious JavaScript - eecs.csuohio.edueecs.csuohio.edu/~sschung/CIS408/Ch05-malicious-javascript.pdfPhishing and Malicious JavaScript. Outline Phishing and online identity

Instructor Notes · Trojan horse is a piece malicious code embedded in a utility program that a user will run frequently. That is, when a user runs this useful program, the malicious

PERANGKAT LUNAK BERBAHAYA (MALWARE MALICIOUS SOFTWARE) · •One of oldest types of malicious software •Code embedded in legitimate program •Activated when specified conditions

Malicious Software Lesson 16. Malicious Software Trojan Horses A program that appears to do one thing (and may indeed do it) but that hides something

Malicious Proxies

ITMS- 3153 Information Systems Security 1. Malicious Code Malicious code or rogue program is the general name for unanticipated or undesired effects in

Malware: Malicious Software - Brown UniversityLogic Bombs • A logic bomb is a program that performs a malicious action as a result of a certain logic condition. • The classic example

Malicious Falsehood