Upload File

introducing malware script detector

23
Introducing The Malware Script Detector (MSD) By d0ubl3_h3lix http ://yehg.net Tue Feb 19 2008

Upload: guest31a5be

Post on 25-May-2015

2.785 views

Category:

Technology


4 download

Report

Tags:

DESCRIPTION

The version 2 is similar to XSS warning addon. Look for URL string for XSS payloads. Detect and stop XSS attacks from evil bad guys to you in addition to detection of Malicious JavaScript embedded in malicious sites. This script has been tested for false positives thoroughly. False positives may occur at those sites which use crypto strings like order.php?token={a:xC2;id:ac3f52233;[]} and Squirrel mail sites which use URL strings like compose.php?to=John. We can\'t fix it for the sake of security. If you know this one, you can feel assured this is safe to accept and go on.

TRANSCRIPT

Page 1: Introducing Malware Script Detector

Introducing The Malware Script Detector

(MSD)By

d0ubl3_h3lixhttp://yehg.net

Tue Feb 19 2008

http://yehg.co.nr/
http://yehg.co.nr/
Page 2: Introducing Malware Script Detector

Agenda• Counter Strategy

• Overview

• XSS Coverage

• Versioning Info

• Standalone MSD

• Detection Screenshots

• Why MSD?

• Weaknesses

Page 3: Introducing Malware Script Detector

Counter Strategy

• Using the Power of JavaScript,

Malware Script Detector detects JavaScript Malwares which use the Power of JavaScript

Page 4: Introducing Malware Script Detector

Overview

• Run on Gecko browsers (Firefox, Flock, Netscape, …etc)

• GreaseMonkey addon needed

• Acted as Browser IDS

• Intended for Web Client Security

• Recommended for every web surfer

• Please don’t underestimate MSD by looking its simplest source code

Page 5: Introducing Malware Script Detector

Overview (Cont.)

• Coded mainly to detect today’s popular powerfully malicious JavaScript attack frameworks: XSS-Proxy, XSS-Shell, AttackAPI, BeEF

• Version 2 was enhanced to prevent most XSS threats and includes XSS Attack Blacklists based on Firefox XSS-Warning addon

Page 6: Introducing Malware Script Detector

XSS Coverage

MSD was coded to detect the following XSS exploitation areas:

• data: protocol exploitation like - data:image/gif - data:text/javascript - data:text/html

• jar: protocol exploitation

• file: protocol exploitation by locally saved malicious web pages

Page 7: Introducing Malware Script Detector

XSS Coverage

• Other protocol exploitation such as vbscript:, livescript:, mocha:, ftp:, mocha:, telnet:, ftp:, res:, x-gadget(MS-Vista), call (VOIP), aim: …etc

• unicode injection• utf-7,null-byte (\00), black slash injection

(u\r\l), comments star slash injection (/* */),injection like \u00, \x00....etc

Page 8: Introducing Malware Script Detector

XSS Coverage

• MSD was thoroughly tested with:

- RSnake’s XSS CheatSheet - XSS-ME Addon Attack List

- Dabbledb.com’s Xssdb list - CAL9000 XSS List

Page 9: Introducing Malware Script Detector

Versioning Info

GreaseMonkey Version

• Main Objective: Alert XSS Attacks to users• Must be Installed by users• Requires Gecko Browser + GreaseMonkey

Addon• Version 1 – Detect Malware Scripts• Version 2 – Detect Malware Scripts +• Prevailing XSS

Page 10: Introducing Malware Script Detector

Versioning Info

Standalone Version

• Main Objective: Alert XSS Attacks to users & webmaster

• Must be Deployed by web developers• Browser-Independent• No Checking if users have GreaseMonkey

version• Version 1 – Detect Malware Scripts +

Prevailing XSS

Page 11: Introducing Malware Script Detector

Standalone MSD

• Standalone version was created as single .js file for web developers

• To embed in their footer files • To notify both visitors and webmasters

of XSS injection attempts & attacks• Browser-independent unlike

GreaseMonkey Script version• Intended for web application security as

a portable lightweight solution

Page 12: Introducing Malware Script Detector
Page 13: Introducing Malware Script Detector

Detection Screenshots

Page 14: Introducing Malware Script Detector

Why MSD?

• XSS Payloads like

• http://victim/?q=“><script>eval(location.hash.substr(1))</script>#xxxxxxxxxxxxxxxxxxxxxxMaliciousxxxxxPayloadsxxxxxxxxxxxxxxxxxxxxMaliciousxxxxxPayloadsxxxxxxxMaliciousxxxxxPayloadsxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx…..etc

Page 15: Introducing Malware Script Detector

Why MSD? (Cont.)

• Never get DETECTED by

Web Server-level Firewall/IDS/IPS

• Because the code is Totally Executed at Client’s Browser

Page 16: Introducing Malware Script Detector

Why MSD? (Cont.)

• Malicious sites intentionally embed malicious JavaScript attack frameworks

• Bad guys 0wn web server boxes, and secretly install those attack frameworks as web backdoors or trojans to abuse users

Page 17: Introducing Malware Script Detector

Why MSD? (Cont.)

• No ways to detect such Malware scripts unless we check HTML source codes

• Disabling JavaScript, Using NoScript/VMware, Always Checking source codes are not effective solutions for most cases

• According to above scenarios,MSD becomes a nice solution for us

Page 18: Introducing Malware Script Detector

Oh, But …

Page 19: Introducing Malware Script Detector

Weaknesses

• Doesn’t check POSTS/COOKIES variables

• No guarantee for full protection of XSS

• Many ways to bypass MSD

• XSS Filtering needs to be updated regularly where extensive filtering may cause false alerts and much annoyance to users

Page 20: Introducing Malware Script Detector

Where Can I get it ?

Check Under Tools Sectionhttp://yehg.net/lab/#tools.greasemonkey

If you wish to contribute, there is a smoketest page.

Insert your own XSS payload to defeat MSD.

Notify me of whenever new Attack frameworks are created

http://yehg.net/lab/#tools.greasemonkey
Page 21: Introducing Malware Script Detector

Special Thanks

Goes to

Mario, http://php-ids.org

Secgeek, http://www.secgeeks.com

Andres Riancho, http://w3af.sf.net

For encouragements and suggestions

Page 22: Introducing Malware Script Detector

Reference

• XSS Attacks & Defenses by PDP, RSnake, Jeremiah, Aton Rager, Seth FogieSyngress PublishingISBN-13:987-1-59749-154-9

Page 23: Introducing Malware Script Detector

Thank you!


An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Practical Malware Analysis: Ch 11: Malware Behavior

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

A Review Paper on Effective Behavioral Based Malware ... › irph › ijert_spl17 › ijertv10n1spl_169.pdf · ICC Detector trained model for malware detection Author Proposed [4]

1 EnsembleHMD: Accurate Hardware Malware Detectors with ... › ~kkhas001 › pubs › tdsc18.pdf · malware detector. The online detection problem uses a time-series window based

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

FILELESS MALWARE DETECTION · Fileless malware is a malicious script that gets loaded into a system’s memory (RAM) by a legitimate application resident on the end-user’s system

Metamorphic Malware 1 Metamorphic Malware Research

Android Malware Exposed-Evolution of Android Malware

Document Part No.: SLEM28556/181213...Lockdown, Script Lockdown, Integrity Monitoring, USB Malware Protection, Storage Device Blocking, and Predefined Trusted Updater. • Windows

Annotated Control Flow Graph for Metamorphic Malware Detection › b156 › 64267e99d5a... · detector to detect metamorphic malware. In [13], the authors use an intermediate language

Blocking internet threats: the avast! script enginedownload307.avast.com/files/marketing/materials/whitepaper_script... · script-based malware. Consequently, all modern antivirus

Malware & Anti-Malware

ANDROID UNTRUSTED DETECTION WITH ERMISSION BASED …aircconline.com/ijitcs/V8N4/8418ijitcs01.pdf · android malware security are the Absence of efficient Malware detector in Android

Back to the Future: Malware Detection with Temporally ...mct/pubs/tr16.pdf · include a scalable malware detector integrating manual review with machine learning and the examination

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

A framework for detection of malicious software in …openaccess.uoc.edu/webapps/o2/bitstream/10609/40884/6/...(Machine Learning–based Detector for Android malware), a framework

The Vulnerability Market - FIRST · The Vulnerability Market. ... • Widespread access to drag and drop tools for malware and exploits • No more script kiddies ... – An economy

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Script-based malware detection in Online Banking · PDF file · 2015-06-08Script-based malware detection in online banking – security overview ... Script-based malware detection

Windows Malware Firewall: Remove Windows Malware Firewall

Real-Time Detection of Malware Downloads via Large-Scale … · 2018-02-09 · Malware Download Detector (MDD) • Global situation awareness • Build/update annotated graphs •

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Lightweight Behavioral Malware Detection for Windows Platformsspiros/papers/malcon2017a.pdf · Our malware detector uses a simple randomization fea-ture selection technique to increase

On the Detection of Malware on Virtual Assistants Based on ... › ~spiros › papers › MALWARE19.pdf · a behavioral-based malware detector and compare the effectiveness of different

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

RSA DISCOVERS MASSIVE BOLETO FRAUD RING IN BRAZIL · 2018. 3. 20. · MALWARE INSTALLATION The malware relies on UPX to pack a compiled AutoIt script. The AutoIt script task is to

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Exploring Adversarial Examples in Malware Detection › TC › SPW2019 › DLS › doc › 02-Suciu.pdf · MalConv: Malware Detector based on Raw Bytes §2MB input padding, CNN 128

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

MADAM: A Multi Level Anomaly Detector for Android Malware€¦ · Android Security State of the Art •Producer Side: –Native Security Mechanisms: •App Isolation •Permission