Presentation Transcript

1. Onion, not parfait:Today's security check-up and malware for the rest of us

   Jared DeMott, lifelong haX0r
2. Qualified for this talk? You decide … rounded out by groups, cons, and talks like this NSA My deep dive into a whole new world - security focused Booz Allen Hamilton Level 3 consultant - Reverse Engineering Applied Security, Inc. GPF sprung to life VDA Labs, LLC Founder - Further opened the eyes of many to the effects of fuzzing Defcon CTF Campion Was part of the l@stplace team during another winning 2007 season HBGary, Inc. All but the kitchen sink guy, started working with Malware Author and Speaker (Black Hat, Defcon, and Toorcon) Ari Takanen, Charlie Miller, and I have a book coming out very soon! Ferris State University Assistant Professor - focus on OS, security, programming, and more Crucial Secuity, Inc Security Researcher
3. Layers of Security Computer Science as a field is growing all the time More and more users each year Security is one such sub-field and it is growing as well High level Policy Technology Users Low Level Policy Low Level Technical Threats
4. High Level Policy Decision making and risk management Should come from above Are CIOs, CSO, etc always qualified for this? For example did anyone follow DailyDave thread on AV being dead, that occurred a while ago? Sandboxing to be discussed later Need formal processes to make good decisions Business continuity Disaster recovery Data security Are Nation-states really our threat? For big business and government contractors … YES! Booz allen spear-fish that went public a bit ago Not so much for small to mids, schools, etc … they worry about keeping their head above water, and hoping the network works.
5. Technology What’s it good for? How has it improved our lives? I’m waiting for my RFID tag and mark of the beast Who knows, but it can transform business Just ask people in health care Technology is exploding in this field and is changing the way people are able to receive care Just ask online sales, which didn’t really exists pre-1990’s Usage We need security to be sure technology is used well, or to perform the Incident Response (IR) when it’s not Yes even though current security solutions aren’t perfect
6. Some current working Attacks 0day to the desktop In 2008, client side bugs are alive and kicking! The old thumb drive outside the bank trick Rootkit Insider payoff Rootkit Stealing and modifying hardware (supply chain) Rootkit Simple .exe in email Run this file for pics of whoever == Rootkit .com was one of the best I’ve ever received
7. Defense Can technology defend against technology? Application filtering firewall with a buffer overflow, what were we thinking there? Same for IDS, AV, Wireshark, etc. Clearly we’ve got to rid ourselves of the buffer overflow to have a real shot at reliable computing We’re finally seeing this begin to happen Modern protections in 64 bit machines are impressive But, weak passwords, sniffing, lost hardware, social engineering, hardware modified in transit Defenders have to think of it all! The attacker need only find one route in
8. Users Average Users Just want to do their job, play games, edit pictures of the grand kids, whatever. Need security training. Power Users Growing. Many users have complex needs and those annoying Vista pop-ups, personal firewalls issues, etc. Just disable all that stuff, right? Need Policies and training. Either way, 0day to the desktop We still can’t trust our software
9. So what’s to be done? Totally depends on the scope of your organization Someone has to sit down and think about these issues, and do the best you can with available money ah… risk management, my favorite oxymoron Also totally depends on the layer at which you work CIO response should differ from software developer or incident responder, or secretary
10. Lets discuss some lower layer examples(more on each of these) Security at the Desktop is a MUST! Who knows how to do this? Auditing the internal and external network policy is, at minimum, a show of due diligence Penetration Tests are great for raising internal awareness Watch your website Web auditing Fuzzing for security and robustness Securing software … we hope the OS will continue to get stronger as well Responding to Security Incidents (IR) Being prepared or know who to call
11. Desktop Security Could we go to a thin client that doesn’t save settings Pwned on Monday, clean on Tuesday? Probably would save desktop support costs AV Does it really help? Show proof. DLP Does it really work? Show proof. Host hardening Local policy lockdown, registry tweaks, etc No local Admin? Looks like XP might hang on until Windows 7?
12. Network Management Wireless security WEP, right? (not … how about WPA2 with AES) Database security Talk to our British friend, Mr. Litchfield Server security Lock ‘em down in VLANs while you’re at it Failover (Disaster/Continuity) Redundant Internet links Multiple servers Nightly backups
13. Net Admin (Cont.) Network auditing: Yesterday protection (not 0day) Think something like Nessus to be sure your hosts are all up-to-date Is there a better way to be sure boxes are built right the first time? Imaging type solution Allow real time updates from M$? Network activity monitoring and logging The network is hostile, can your IDS find the needle? Probably not … though anomaly could work on SCADA or other “quiet” networks Keep good system logs anyway, this will be important again someday, when IDS finds a way to add value again
14. Web Auditing Think about all the issues we’ve seen SQL injections Input sanitization is the root problem for many bug types PHP file inclusions Old school CGI command injections XSS Insecure permissions on pages Weak login schemes Etc. Some one needs to be thinking about this for your organization http://www.owasp.org/
15. Fuzzing Fuzzing for security and robustness Since many application still have to be developed in C type languages (able to manually manage memory) For bonus pts, why isn’t the Vista Kernel dev’ed in .py? Other languages could have stability issues if not exploitable overflows A telecoms 0day == interruption of service Mutation vs. Generation One is often quicker while the other tends to get better coverage. Boils down to cost. Read our book.
16. Incident Response (IR) Responding to Security Incidents. (How big is this onion anyway?) 1st response team The key here is handling information well Disk forensics Remember when the FBI came knocking? Old-school preservation style. Snag disk. Image it. Search it. Send you to jail. Do not pass go. Do not collect $200. E-discovery Live memory analysis Malware analysis Can these actions be scaled to the Enterprise? Probably, for the right price… but, process is key for court.
17. Enterprise Tools You can’t physically pull the disk off each workstation, can you? No, but virtually you can: Agent based Push kernel module to desired hosts via SMS or PsExec Host code is called “the servlet” by Guidance, Inc (EnCase). Used to suck off permanent storage (hard disk data) and “live” memory (RAM) Catalogs; only does full suckage when required Scan disk for anomalous files Guidance uses bit9 database; good, bad, or unknown lots Rate which ones look “worst” Mandiant’s red curtain is freeware … I’m surprised EnCase Enterprise doesn’t have this feature
18. E-Discovery Key word searching across file, email, and even memory in some cases Used to discover interesting data An example might be searching for the text string “SECRET” on an UNCLASSIFIED network Why would we do that? Litigation is the word you’ll hear The way hip Lawyers role Indicates a search for evidence during a particular court case to support one side or the other
19. Live Memory Analysis The kernel agent can collect all or some of running memory as well A tool like HBGary’s Responder could be used to analyze this memory Memory-only Rootkits are TODAYS threat Good malware/rootkits maybe able to avoid dirtying the disk altogether If that’s so, how are you going to detect them with your current forensic toolkit?
20. Malware Analysis This is where it gets interesting So, you’ve found some executable code and you either don’t know if it’s malware, or you know it is, but aren’t sure what it’s doing How can you understand what this nasty business is doing to/on your host/network?? Perhaps like other fields an “Art+Science” but here I think we need more science. We need a repeatable methodology that holds water in court if need be
21. High level thoughts on Malware For malware to be doing something useful (like stealing data) it’s likely got to be doing some type of network comms Will likely use a covert channel, such as DNS or HTTP. Think Command & Control to do Data Exfil It will likely not want to be discovered May download and install a rootkit and delete itself Might just hide in plain sight … what’s in your sys32 dir? If discovered it desires to make analysis difficult Packed, obfuscated, encrypted, jacked up in some other interesting way
22. Malware Analysis != IR So as we stated before IR includes many steps Analyzing potential malware is just one of the steps Some guys at Intel have done some cool new work addressing the IR information handling problem at large Rapid Assessment & Potential Incident Examination Report http://code.google.com/p/rapier
23. My Home Grown Malware Analysis(Not an exhaustive or “best” list) Document how the malware was discovered Get the filename(s) of malware View the file properties for kicks, though this information can easily be spoofed. Note if much file property information is included Vendor, etc What is the modified time? What is the file size? File hash? Use the WinMD5 utility Google for this hash, you might get lucky Mandiant’s Freeware Red Curtain will give you a threat score guess as to whether or not the file is Malicious If you’re not worried about sharing, you can upload to http://www.virustotal.com (multiple virus scans) http://www.norman.com/microsites/nsic/Technology/en-us (see in a bit)
24. Home Grown: File Inspection If possible, determine how the file was created and if it includes obfuscation. Open the file in PEid. If possible, determine if the PE headers look normal. Open the file in PEView. Open the file in IDA pro Are there any interesting strings? Are the strings visible or obfuscated? Is the code flow normal or does is start with funny decryption/unpacking routines? Save further REing for later unless something really sticks out. A dynamic run trace is the next best step in understanding your malware.
25. Home Grown: Execution Prepare to execute in your test lab Take a VM snapshot so you can roll back after execution Launch Wireshark. Launch other utilities such as process explorer, file explorer, and filemon if desired Execute RegShot to get a baseline of the system Launch the malware and note Registry changes and Network connections Note whatever else interesting happens. CAUTION: At this point you are probably infected with something. If it’s dialing out, it may be desirable to set up a fake server to play with command and control plus any data exfiltration it may have.
26. Home Grown: Dynamic Investigation Reversing the Malware with Immunity debugger, windbg, Responder Yes, we’re talking just about Windows here Roll back to the previous snap shot For Inspector Open the Wintel Node Agent Debugger in the VM Start a new Inspector project Connect to the debugger with Inspector Start the malware via Inspector Analyze the binary (may set bps) Run the malware analysis plugin script to see what pops out Cool freeware tools like: Malware Unpacking Framework For ImmDbg http://muffi.googlecode.com/ by JMS
27. Home Grown: Dynamic Investigation Analyze key .dlls and set further breakpoints W32_32.dll and winsock.dll for network activity WSARecvFrom, WSASendTo, etc. Kernel32.dll for process manipulation and file modification LoadLibrary, CreateProces, FindFile, etc. advapi32.dll for registry modifications CreateNewKey, SetKeyValue, etc Execute the software to begin a runtrace A graph will begin to appear as the software is executed Could be useful to search runtrace samples for strings such as IP address, passwords, etc How to proceed depends on the nature of the investigation/malware … more of an Art … ooops…
28. However, SandBoxes are cool A Sandbox/Sandnet attempts to automate prior steps and boil down results Quicker/Scales No hardcore RE person required Repeatable (Hold water in court?) However, could fail if Too tricky Virtualization detection and/or escape Would be a problem for VM home grown solution too Only an air gapped net solves this slow to use network, like 1 week after install Will only run if in, for example, the Outlook directory, etc Manual/Static RE is required for complete analysis
29. Sample Output from Norman [Name]: W32/Backdoor. Sig Name: Suspicious_P.gen [ Detection Info ] * Compressed: NO. TLS hooks: NO * Executable type: Application * Executable file structure: OK [ General information ] * Drops files in %WINSYS% folder. * File length: 237562 bytes. [ Changes to filesystem ] * Creates file C:\WINDOWS\SYSTEM32\service.exe. * Deletes file 256. [ Changes to registry ] * Creates key "HKLM\Software\\Microsoft\\Windows". * Sets value "Microsoft Update"="service.exe" in key “HKLM\Software\\Microsoft\\Windows". * Creates key "HKCU\Software\". * Sets value "Microsoft Update"="service.exe" in key “HKCU\Software\".
30. Sample Norman Output (cont.) [ Network services ] * Looks for an Internet connection. * Connects to [REMOVED] on port 6667 (TCP). * Connects to [REMOVED] * IRC: Uses password [REMOVED] * IRC: Uses nickname [REMOVED] * IRC: Uses username [REMOVED] * IRC: Joins channel [REMOVED] with password [REMOVED] * IRC: Sets the usermode for user [REMOVED] to i. [ Process/window information ] * Creates a mutex By Crash. * Creates process "C:\WINDOWS\SYSTEM32\service.exe". [ Signature Scanning ] * C:\WINDOWS\SYSTEM32\service.exe (237562 bytes) : Suspicious_P.gen.
31. Case Study Got a file called sample.exe from a friend He wanted me to take a quick peek at it, since he though it was ugly but no AV product he had could confirm that Lets see what Norman says…
32. Hmm… in this case Norman pooped sample.exe : Not detected by Sandbox (Signature: NO_VIRUS) [ DetectionInfo ] * Sandbox name: NO_MALWARE * Signature name: NO_VIRUS * Compressed: NO TLS hooks: NO * Executable type: Application * Executable file structure: OK [ General information ] * File length: 210944 bytes. * MD5 hash: 27f4b3938997383576137cd7036dda25. [ Process/window information ] * Attempts to open CLSID {148BD52A-A2AB-11CE-B11F-00AA00530503}.
33. Case study: Try my home brew Received a file from a friend Name = “sample.exe” File properties Not much listed Time: Looks unreliable Size: 206KB MD5: 27f4b3938997383576137cd7036dda25 Red Curtain reports that it looks malicious, as the threat score is over 1.0. See next slide.
34. Hash and Properties: Fairly normal here
35. Mandiant Red Curtain: >1 == badness
36. Case Study (cont.) PEid No build type detectable, Win32 GUI PEView Looks Normal IDA Pro Initial Interesting Strings: Looks like a bunch of strings are present but are unreadable statically Code looks funny … a lot of moving, XORing, etc and than a LoadLibraryA + GetProcAddress to begin with First func from main took ~100 int’s as parameters
37. PEID and PEView
38. IDA Pro
39. Case Study (cont.) Upon Execution Regshot noticed a bunch of changes Wireshark snagged an outbound connection Very suspect here “GET /upd/check?version=0.1unk&fxp=1d8af2a6eeb2863b26ca5ac162b60d5c784b0f4e5d972acacad8d535529e5ac14f14a867 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: KRSystem v1.0 Host: upd.host-domain-lookup.com Connection: Keep-Alive” “HTTP/1.1 304 Not Modified Connection: close Server: Yaws/1.68 Yet Another Web Server Date: Wed, 30 Jan 2008 13:59:05 GMT Content-Length: 13 Content-Type: text/html not modified”
40. Case Study (cont.) Inspector Reverted to clean snapshoot, started remote debugger, started new project, connected to debugger, analyzed sample (this is cool can bypass anti debugging and packing), analyzed .dlls, viewed strings, etc… Difficult to know which API calls to hook MAP script provided convoluted results Run trace not trivial to apply correctly Graph unclear All-in-all, not a great tool for a “first pass” look Better for very advanced users I am looking forward to their new “Responder” product, which attempts to find rootkits in running memory
41. Inspector Screen Shot
42. Other Sandboxes Norman pooped on this one This one did better CWSandbox Tried some others as well ThreatExpert Joebox Etc.
43. Sample XML from CWSandBox <connections_outgoing> <connection transportprotocol="TCP" remoteaddr="66.220.17.200" remoteport="80" protocol="HTTP" connectionestablished="1" socket="1692"> <http_data> <http_cmd method="GET" url="66.220.17.200/upd/check&#x3F;version=0.1unk&#x26;fxp=34725efb44b6c53a0f323af08723c7209ddec5327818c6c9ef573936c1303af0f542640b" http_version="HTTP/1.1"><header_data><header>Accept: &#x2A;/&#x2A;</header><header>Accept-Encoding: gzip, deflate</header><header>User-Agent: KRSystem v1.0</header><header>Host: upd.host-domain-lookup.com</header><header>Connection: Keep-Alive</header></header_data></http_cmd> </http_data> Small sampling of the total CW output
44. New CW Look
45. Hmm… states one of it’s primary actions, but have hunch it’s worse than that. Didn’t provide as much information as CWSandbox.
46. Joebox Gave some good information But doesn’t include network information, etc. yet Seems to have good potential, but lacks robustness as of now
47. Boiling down results For large corps, scalability is important and Sandboxes give us that However, like anything else, they’re not fail proof Norman boils down the results well But didn’t work in this case ThreatExpert Seemed ok Joebox has great potential Missing key features CWSandbox did the best here IMHO XML is busy, so new web interface is nice Recent work to escape CW has been made public for kiddies
48. Summary Onions smell … security can to, but we keep at it.  We need to find ways to stem the tide of 0days We need to find ways to detect memory-only Rootkits Responder via Encase? Or Mandiant’s MIR technology? Once we do, malware won’t go away Insider threat, thumb drive, hacked hardware in transit, etc We’ll need some sort of reliable computing help from our operating system/hardware Hypervisor protection? Monitoring, IR, and many other branches will always be important, even as roles and technology change