Upload File

introduction

34
Connecting the AV industry Igor Muttik, McAfee Avert Labs™ VB’2009 - Geneva 24 September 2009 biquitous malware and ubiquitous A Igor Muttik – Intel’s McAfee Labs TM CARO’2011 Prague

Upload: biana

Post on 24-Feb-2016

62 views

Category:

Documents


0 download

Report

Tags:

DESCRIPTION

Introduction. Amy. Agenda – follow Amy for a day. Timing and coverage . Amy’s home. Amy’s router. Router-to-router worm (psyb0t, discovered on Netcomm NB5) MIPS CPUs running Linux Had a collection of ~55 shellcode attacks (30 – for LinkSys, 10 – for Netgear, 15 – for other types) - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Introduction

Connecting the AV industryIgor Muttik, McAfee Avert Labs™

VB’2009 - Geneva24 September 2009

Ubiquitous malware and ubiquitous AVIgor Muttik – Intel’s McAfee LabsTM

CARO’2011Prague

Page 2: Introduction

2

Introduction

Amy

Page 3: Introduction

TIMING AND COVERAGE

Agenda – follow Amy for a day

Page 4: Introduction

Amy’s home

Page 5: Introduction

5

Router-to-router worm (psyb0t, discovered on Netcomm NB5)MIPS CPUs running LinuxHad a collection of ~55 shellcode attacks(30 – for LinkSys, 10 – for Netgear, 15 – for other types)It could

Manipulate the DNSBe an invisible MitMRe-flash the router

Invisible for AVWe see only where we look

Amy’s router

Page 6: Introduction

Amy’s car

Page 7: Introduction

7

Amy’s car – bluetooth and MP3 vulnerabilities

Bluetooth vulnerability in mass-production 2009 car (Kohno & Savage)Brakes, door locks and dashboard, remotely read tyre pressure

Page 8: Introduction

8

Amy’s mobile phone

Android marketplace calamity in March 2011 Zeus and SpyEye attacks on dual authentication

Phones usually have 2 CPUs and both can be attacked

Consumerisation of ITIT policies

Sometimes – not a good thing!

Remote lock/wipe/backupWill be misused

Computrace and LoJack on PCs – RPCNET.DLL from Absolute.com

Page 9: Introduction

Guys, these smart devices are everywhere…You do protect me, don’t you?

Page 10: Introduction

TIMING AND COVERAGE

At a bank

Page 11: Introduction

11

Amy’s payment terminals

QIWI Has 100,000 terminals in Russia alonePWS trojan infection (PWS.OSMP)

Windows is in places you would not expectInformation screens in airportsBluescreen on a boat navigation system in Amsterdam during CARO 2008

It is not just Windows and IntelEmbedded LinuxMIPSAndroid

You only seewhere you look!

Page 12: Introduction

TIMING AND COVERAGE

Near a factory

Page 13: Introduction

13

Industrial processes (like 235U enrichment)

http://en.wikipedia.org/wiki/File:Uranium_enrichment_proportions.svg
Page 14: Introduction

TIMING AND COVERAGE

At work

Page 15: Introduction

TIMING AND COVERAGE

Amy’s computer has a bootkit

Page 16: Introduction

16

Pre-OS

MBR and boot-sector virusesW95/CIHBIOS quick-boot vulnerability (Schouwenberg)Bootkits grow

EFI, UEFI and GPT (GUID Partition Table)A standard of pre-OS environment and driversIn the BIOS or in a separate partitionEFI is a platform like an OSA protected place for malware droppers

Getting common - Macs, many laptops and PCs

http://en.wikipedia.org/wiki/File:Uefi_logo.svg
Page 17: Introduction

17

You cannot detect what you cannot see…Do you see this malware?

Page 18: Introduction

18

EFI platform

EFI has scripting (NSH)All open sourceOVMF – virtual machines

NTFS.EFI – NTFS driver

EBC (EFI Byte Code)32-bit interpreted bytecode Cross-platform

Computers can boot into EFI shell

http://en.wikipedia.org/wiki/File:Uefi_logo.svg
Page 19: Introduction

19

Enabling UEFI boot

Page 20: Introduction

20

EFI shell startup video

Youtube link: http://www.youtube.com/watch?v=wrybDw9UL5E

http://www.youtube.com/watch?v=wrybDw9UL5E
http://www.youtube.com/watch?v=wrybDw9UL5E
Page 21: Introduction

21

EFI shell

Page 22: Introduction

22

EFI shell startup video and HEXEDIT.EFI demo

Youtube link: http://www.youtube.com/watch?v=kiRsaaS1mbM

http://www.youtube.com/watch?v=kiRsaaS1mbM
http://www.youtube.com/watch?v=kiRsaaS1mbM
Page 23: Introduction

23

EFI shell commands (1/4)

Page 24: Introduction

24

EFI shell commands (2/4)

Page 25: Introduction

25

EFI shell commands (3/4)

Page 26: Introduction

26

EFI shell commands (4/4)

Page 27: Introduction

27

EFI nightmares

Nightmare scenarios1. EFI boots

Sends HDD image out (or selected files)Continues to boot the OS

2. EFI bootsEFI launches Windows in a virtual machineHas full control after that

3. EFI boots and drops malware into the file system

As powerful as BAT scripting. + Has networking+ Has unrestricted access to local devices

http://en.wikipedia.org/wiki/File:Uefi_logo.svg
http://en.wikipedia.org/wiki/File:Uefi_logo.svg
Page 28: Introduction

Guys, you need a wide and hardened net to catch all these nasties everywhere …

Page 29: Introduction

29

Hardening the net

Protection should be where it is neededOS ?AV (when OS is lacking) ?CPU

TrustIsolationAudit of data-flowEconomics

Security on CPUsOpen for security companiesSeparate “security” core?

Page 30: Introduction

30

What can we trust?Digital signatures – Yes (almost always)SSL certificates – Maybe (mostly yes)

What would be nice to trustOSSoftwareLAN and WAN agents

TPM did not work

Technological Trust

Page 31: Introduction

31

Example: Trust enforced at the CPU level

A software vendorSubmits code to the root authorityPays for a certificateGets a key back which matches the codeThen they can run their “trusted” code

Enforced in CPU, not by the OS!

Rather restrictiveIf applied to all softwarePerhaps OK if applied to “important” software Or certain CPU opcodes which will get special security privileges

“Economics” driving security

Page 32: Introduction

32

Conclusions

• Malware gets into many new places

• We see only where we look and if we have access

• We need a wider, ubiquitous net

• We would benefit from more low-level trust and security

Page 33: Introduction

33

References1. Routers:

http://apcmag.com/Content.aspx?id=3687 http://www.theregister.co.uk/2011/03/10/router_rooting_malware/

2. Cars: http://www.technologyreview.com/computing/35094/?nlid=4233

3. Mobile: http://securityblog.s21sec.com/2010/09/zeus-mitmo-man-in-mobile-i.htmlhttp://www.f-secure.com/weblog/archives/00002135.html

4. Antitheft:http://www.geek.com/articles/news/stolen-pcs-disabled-over-internet-20030528/http://www.intel.com/technology/anti-theft/index.htmhttp://communities.intel.com/docs/DOC-2384http://shop.lenovo.com/ISS_Static/WW/AG/merchandising/US/PDFs/lenovo_anti_theft_protection.pdf

5. Qiwi: www.lenta.ru/news/2011/03/16/qiwi/

6. ATMs: http://www.computerworld.com/s/article/9179796/Update_ATM_hack_gives_cash_on_demand http://www.computerworlduk.com/news/security/16042/more-dodgy-atms-in-las-vegas-found-by-defcon-attendees/

7. Stuxnet:http://en.wikipedia.org/wiki/Stuxnet http://www.f-secure.com/weblog/archives/00002066.html

8. EFI: http://software.intel.com/en-us/articles/efi-shells-and-scripting/ www.tianocore.org http://www.logic.nl/Products/Technology/BIOS-and-EFI.aspx

http://apcmag.com/Content.aspx?id=3687
http://www.theregister.co.uk/2011/03/10/router_rooting_malware/
http://www.technologyreview.com/computing/35094/?nlid=4233
http://securityblog.s21sec.com/2010/09/zeus-mitmo-man-in-mobile-i.html
http://www.f-secure.com/weblog/archives/00002135.html
http://www.geek.com/articles/news/stolen-pcs-disabled-over-internet-20030528/
http://www.intel.com/technology/anti-theft/index.htm
http://communities.intel.com/docs/DOC-2384
http://shop.lenovo.com/ISS_Static/WW/AG/merchandising/US/PDFs/lenovo_anti_theft_protection.pdf
http://www.lenta.ru/news/2011/03/16/qiwi/
http://www.computerworld.com/s/article/9179796/Update_ATM_hack_gives_cash_on_demand
http://www.computerworlduk.com/news/security/16042/more-dodgy-atms-in-las-vegas-found-by-defcon-attendees/
http://en.wikipedia.org/wiki/Stuxnet
http://www.f-secure.com/weblog/archives/00002066.html
http://software.intel.com/en-us/articles/efi-shells-and-scripting/
http://www.tianocore.org/
http://www.logic.nl/Products/Technology/BIOS-and-EFI.aspx
Page 34: Introduction

34

Questions


Introduction to Transducers, Introduction to Transducers ... on... · Introduction to Transducers, Introduction to Transducers, Sensors and ActuatorsSensors and Actuators Introduction

INTRODUCTION SPECIFICATIONS INTRODUCTION

Introduction to introduction to introduction to … Optimization

VisionaryScancombinesarichsetofqualitycontrolandproductivi ... · Introduction Introduction VisionaryScancombinesarichsetofqualitycontrolandproductivityfeatureswithasimpleinterfacedesignedspecificallyforscanningandcodingdepositionexhib-

The Sacrament of Baptism Introduction Video Introduction Video The Sacrament of Baptism Introduction Video Introduction Video

Introduction to Databases: Introduction

Introduction 1. Introduction

Introduction Introduction (ctnd.)

Introduction€¦ · Introduction ThisdocumentprovidesinformationabouttheIOSXEsoftwarereleasefortheCiscoNCS4201andCisco …

INTRODUCTIONS (LEADS) Creative introduction Action introduction Dialogue introduction Personal introduction Question introduction Quotation introduction

Optimisation des Requêtes. Introduction Introduction

R as a Web Service Introduction Introduction Introduction

Industry introduction Industry introduction Company introduction Company introduction Production introduction Display time time content

voip-iptel-introduction-SRK1.ppt voip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-iptel-introduction-SRK1.pptvoip-ip

Introduction Introduction Introduction Introduction

Topics Introduction 1 / 3 Introduction 2 / 3 Introduction 3 / 3

Introduction to Logic Introduction

§1.1.1 INTRODUCTION: 1. INTRODUCTION

1. INTRODUCTION 1.1 Introduction

Introduction and Thesis Introduction - …...1 Introduction and Thesis Introduction: The introduction relates the topic to the main point of the essay. The introduction is composed

Systems Analysis I introduction I introduction. 2Systems Analysis - Introduction Contents Introduction Introduction 3 classic phases 3 classic phases

Introduction & Strategy Module Introduction & Administrative

Introduction to Elasticsearch and Logstash. - KIT · PDF fileOutline 1 Introduction 2 Logstash Introduction 3 Elasticsearch Introduction 4 Conclusions Introduction Logstash ElasticsearchConclusions

Module: Introduction...Module: Introduction Page: Introduction CC0.1 Introduction Please give a general description and introduction to your organization. Providing electrical, hydraulic

INTRODUCTIONS (LEADS) Academic introduction Creative introduction Action introduction Dialogue introduction Overarching societal statements Personal introduction

General introduction 1.1 Introduction

1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN … · 2016-12-16 · 1. INTRODUCTION • INTRODUCTION • EINFÜHRUNG • INLEIDING • INTRODUCCIÓN

Introduction | Introduction | Millennium Serials · 2018. 4. 17. · MARC Display | Print | Introduction | Millennium Serials INTRODUCTION Introduction This tutorial introduces the

An Introduction for An Introduction for Introduction for ......An Introduction for An Introduction for Introduction for TeachersTeachersTeachers . exChange, Blackburn Cathedral’s

1. INTRODUCTION INTRODUCTION - Deusto

Introducción / Introduction / Introduction

URBAN STREAM REHABILITATION. INTRODUCTION, OBJECTIVES & IMPACTS INTRODUCTION, OBJECTIVES & IMPACTS INTRODUCTION, OBJECTIVES & IMPACTS INTRODUCTION, OBJECTIVES

Introduction Section I: Introduction

PRODUCT INTRODUCTION Company Introduction

Introduction Chapitre 1 · Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .