Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
|
|
|
- Amberlynn Bennett
- 8 years ago
- Views:
Transcription
1 Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009
2 Agenda Part 1: Introduction (~5 ) Infection machanism of a new drone Rendez-vous mechanism (DNS algorithms) Components of Mebroot/Torpig Part 2: Demo - how to get a copy of unpacked bootkit (~20 ) Usermode vs. Kernel (Ring0) debugging Kernel debugger setup using VMWare Static analysis to find breakpoint for dynamic analysis (using Interactive Disassembler IDA + HexRays decompiler) Dynamic analysis to get unpacked bootkit from an infected drone (using Windbg and VMWare) Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot, Andreas Greulich, 18. April
3 Domains For Drive-By Infection (Neosploit)
4 Neosploit Drive-By, Step 1: Unpatched PC Accesses Compromised Website PC (clean) Hacked website (Neosploit) in Switzerland Obfuscated Javascript: Redirection DNS-name = f(date) Rendez-vous point for infection: 1 new name all 3 days Example: dtugidfir.com (Apr 18) 4
5 Step 2: Search For Vulnerabilities PC (clean) Obfuscated Javascripts: Check for vulnerabilities, Download and execute exploit dtugidfir.com One location, Somewhere in the world 5
6 Step 3: Execution Of Exploit + Reboot PC (about to be infected) Exploit executes, Wait random time (~20 minutes) Copy Bootkit into unpartitioned part of disk Overwrite Master Boot Record (MBR) Reboot 6
7 Step 4: Software Updates (Every Reboot) Infected Drone MBR xtjhvcjh.com MBR Command&Control (MBR CC) Encrypted and hashed! Every week 1024 new rendezvous points are generated, queried until reply with correct encryption is found (the order is random after the first few tries) Uses BIP protocol Drone reports version of bootkit and plugins (Torpig) Server sends updates for bootkit and plugins (initially there are no plugins installed) 7
8 Step 5: Configuration File, Webinjects, Stelaing Of Data Some E-banking site Webbrowser Infected Drone with Torpig plugins MBR Torpig yfesyrpa.com Configuration file Patterns of target banks Webinjects and Dropbox for stolen data Listed as IP address In configuration file! 8
9 Overview Of Attacker Infrastructure 3 different DNS-algorithms, different encryption algorithms (but Only the MBR CC one is advanced) Configuration: visited All ~20 minutes yfesyrpa.com Configuration file Patterns of target banks Hacked webserver Hacked (Neosploit) webserver in Hacked Switzerland (Neosploit) webservers in Switzerland (Neosploit) in Switzerland Software updates: visited One time per reboot xtjhvcjh.com MBR Command&Control (MBR CC) Dropbox: As soon as User uses E-banking Webinjects and Dropbox for stolen data Listed as IP address In configuration file! dtugidfir.com One location, Somewhere in the world Infection: visited one time 9
10 Obfuscated Javascript (Shortened), Layer 1 10
11 Obfuscated Javascript (Shortened), Layer 2 11
12 Obfuscated Javascript (Shortened), Layer 3 12
13 Encryption Algorithms Configuration file: XOR-11 (Torpig) okc phtc?ut1sp^?zx^?v?uzs?ut1sp^?zx^?v? pcex^?sp^?z?ut Subconfig: BASE64-XOR (Torpig) POST /3AEFBA86C8B89862/MGJmlWUXX1Q1HzTrf/4QUBAixtXBZbsCILtWHF1sIgHgB9OgIAfeIIUfFJ9+ rkeh4kdzjefcwxwhk6br6g/auhasbgwrbh/arl4go0p7def0zrnbdsobbvdaqdq6wyxqenjwluxxwkx AK1ELqmslESCScgE Advanced encryption algorithm in Mebroot (MAOS) 13
14 Components in Infected Drone MBR (3 sectors) Kernel-Mode: Stealth functions Updates User-Mode: API Hooking, Stealing of data API Stealth Torpig Plugin gc00 Bootkit (~250KB packed, ~500KB unpacked) Torpig Plugin gs00 Malware Operating System (MAOS) Inject into executables, Steal data, Webinjects Hidden TCP connections TCP-Stack KERNEL MODE USER MODE 14
15 Boot Procedure 0: Master Boot Record 60: Kernel patcher 61: Payload patcher 62: Original MBR MBR-code hooks INT13 patches OSLOADER to call kernel patcher scans and patches NTOSKRNL.EXE to call payload loader loads, decrypts and installs rootkit Disk partitions system32/ contains 2 or more encrypted drivers (currently 3) Main funcionality of malware (Anserin) Data area behind disk partitions (slack space), ~650 raw sectors: SYS driver (encrypted) Stealth functionality Used part of disk Torpig part for malware functions: hooks into programs, intercepts sessions, accesses configuration files. Can easily be replaced by other malware! Installs, Updates (at bootup) Mebroot part for stealth functions: own TCP stack, hides disk sectors, implements system calls, : Like an OS within Windows : Malware-OS (MAOS)? System calls into MAOS API (20 functions) 15
16 Bootkit Hidden Behind Partitions 16
17 Kernel Debugging (WinDbg) Two Physical Systems! Kernel Debugger (WinDbg) Serial Interface or Firewire Debuggee (infected drone) Serial Interface or Firewire 17
18 Kernel Debugging (WinDbg) Using VMWare HOST Kernel Debugger (WinDbg) VMWARE (GUEST) Debuggee (infected drone) Named Pipe Serial Interface or Firewire 18
19 Encrypted Bootkit: Unpacker With Spaghetti-Code Obfuscation Unpacker Compressed and encrypted rootkit (~250KB) 19
20 Bootkit After Decryption (~500KB) Deobfusctaion is possible using a kernel debugger (WinDbg) Shown in Demo Bootkit hooks IRP_MJ_READ and IRP_MJ_WRITE (disk read and write) for stealth purposes (original MBR). Newer versions hook pointers all IRP_MJ_* pointers and add dummy handlers to avoid detection by anomalies in pointer table. CDROM.SYS dispatch table is hooked as well. Values in CLASSPNP.SYS Pointers are updated. Newer versions add a watchdog thread to avoid restoring the original pointers (Virus Bulletin, June 2008, pp 8-10) 20
21 Additional Obfuscation: State Machines state = 39; LABEL_2: result = STATUS_INSUFFICIENT_RESOURCES; while ( state <= 60 ) if ( state > 38 ) goto INIT39; if ( state == 14 ) fix22or19 = (fix96 ^ 115) + 3; if ( (*baseaddr_ * *baseaddr_ & 3) == 2 *baseaddr_ == 0 ) fix22or19 = fix96 ^ 115; state = fix22or19; fix71 = fix96 ^ 39; result = STATUS_ADDRESS_ALREADY_ASSOCIATED; } else if ( state == 19 ) pool = ExAllocatePoolWithTag(poolType, size_, ' kdd');... goto LABEL_2; }... INIT39: // initial state (state==39) fix14or22 = 14; if ( (baseaddr 2) + (baseaddr^2)!= 0 & baseaddr==0 (size 2) + (size^2)!= 0 & size_ == 0 ) fix14or22 = 22; state = fix14or22; result = STATUS_INVALID_PARAMETER; fix96 = 96; } } 21
22 It Can Be Really Hard state = 28; resstate = (unsigned int *)state; if ( state > 27 ) break; if ( state!= 7 )// STATE 7 goto INIT_28; 22
23 Commands Used in Mebroot Protocol INFO (client to server): send secondary key used by Torpig/Anserin BASE64-XOR-encryption PLUG (client to server): send information about installed plugins (currently the Torpig/Anserin modules) INST (server to client): install or update plugins Other unknown commands (found in binary, not seen in actual traffic): DUPL UNST (deinstalls Torpig/Anserin and/or Mebroot) DUMP Bootkit contains an uninstallation function 23
24 Sinowal Domains for Main Configuration Used by Torpig in order to get the main configuration file; it comes in a daily changing and a weekly changing version backup for fix servers: <Start Tag=1 RawData=1D:01 IntValue=285/> <Timestamp Tag=2 Value= Date='Wed Oct 8 12:01: '/> <PollInterval Tag=10 Seconds=600/> <TmpFile1 Tag=5 Filename='$_ TMP'/> <TmpFile2 Tag=6 Filename='$_ TMP'/> <Host1 Tag=19 Hostname='fonzi.info'/> <IP1 Tag=21 IP=' '/> <HostList1 Tag=34 entries=3> fibido.com givuifib.com nirkaza.com </HostList1> <HostList2 Tag=31 entries=2> firkan.com kctfdiij.com </HostList2> <TargetHostPatterns1 Tag=25 entries=11> *bank1.com *barnsley-bs.co.uk *cimbanque.com Server for Sub-Configuration Fix servers for main configuration Main patterns (level 1) 24
25 Questions? 25
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Overview. Common Internet Threats. Spear Phishing / Whaling. Phishing Sites. Virus: Pentagon Attack. Viruses & Worms
Overview Common Internet Threats Tom Chothia Computer Security, Lecture 19 Phishing Sites Trojans, Worms, Viruses, Drive-bydownloads Net Fast Flux Domain Flux Infiltration of a Net Underground economy.
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips Agenda Overview W32/Xpaj analysis Overview of a virtual machine Software protection trends W32/Winemmem analysis W32/Induc
Mobile Application Hacking for Android and iphone. 4-Day Hands-On Course. Syllabus
Mobile Application Hacking for Android and iphone 4-Day Hands-On Course Syllabus Android and iphone Mobile Application Hacking 4-Day Hands-On Course Course description This course will focus on the techniques
The Value of Physical Memory for Incident Response
The Value of Physical Memory for Incident Response MCSI 3604 Fair Oaks Blvd Suite 250 Sacramento, CA 95864 www.mcsi.mantech.com 2003-2015 ManTech Cyber Solutions International, All Rights Reserved. Physical
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating System
ZeroAccess. James Wyke. SophosLabs UK
ZeroAccess James Wyke SophosLabs UK Abstract ZeroAccess is a sophisticated kernel-mode rootkit that is rapidly becoming one of the most widespread threats in the current malware ecosystem. ZeroAccess ability
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments
Spyware Analysis. jan.monsch@csnc.ch. Security Event - April 28, 2004 Page 1
Spyware Analysis jan.monsch@csnc.ch Security Event - April 28, 2004 Page 1 Content Definition & types of spyware Statistics Hooks Static vs. dynamic software analysis Test environment for spyware Analysis
Reverse Engineering and Computer Security
Reverse Engineering and Computer Security Alexander Sotirov alex@sotirov.net Introduction Security researcher at Determina, working on our LiveShield product Responsible for vulnerability analysis and
Detecting Malware With Memory Forensics. Hal Pomeranz SANS Institute
Detecting Malware With Memory Forensics Hal Pomeranz SANS Institute Why Memory Forensics? Everything in the OS traverses RAM Processes and threads Malware (including rootkit technologies) Network sockets,
CIT 480: Securing Computer Systems. Malware
CIT 480: Securing Computer Systems Malware Topics 1. Anti-Virus Software 2. Virus Types 3. Infection Methods 4. Rootkits 5. Malware Analysis 6. Protective Mechanisms 7. Malware Factories 8. Botnets Malware
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Inside the Storm: Protocols and Encryption of the Storm Botnet
Inside the Storm: Protocols and Encryption of the Storm Botnet Joe Stewart, GCIH Director of Malware Research, SecureWorks To be covered in this talk: Quick-and-dirty unpacking of Storm Structure of the
Sandy. The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis. Garage4Hackers
Sandy The Malicious Exploit Analysis. http://exploit-analysis.com/ Static Analysis and Dynamic exploit analysis About Me! I work as a Researcher for a Global Threat Research firm.! Spoke at the few security
Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs
Code Injection From the Hypervisor: Removing the need for in-guest agents Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs SADE: SteAlthy Deployment and Execution Introduction
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess
Malware B-Z: Inside the Threat From Blackhole to ZeroAccess By Richard Wang, Manager, SophosLabs U.S. Over the last few years the volume of malware has grown dramatically, thanks mostly to automation and
Hypervisor-Based, Hardware-Assisted System Monitoring
Horst Görtz Institute for IT-Security, Chair for System Security VMRay GmbH Hypervisor-Based, Hardware-Assisted System Monitoring VB2013 October 2-4, 2013 Berlin Carsten Willems, Ralf Hund, Thorsten Holz
Network Incident Report
To submit copies of this form via facsimile, please FAX to 202-406-9233. Network Incident Report United States Secret Service Financial Crimes Division Electronic Crimes Branch Telephone: 202-406-5850
CSE534 Fundamentals of Computer Networking
CSE534 Fundamentals of Computer Networking Malware and bots Nick Nikiforakis nick@cs.stonybrook.edu Malware Malware, short for malicious software, is software designed to gain access to confidential information,
Information. Product update Recovery. Asset manager. Set console address Create recovery point. Client properties
SysReturn works from PC to control all remote Client PCs through LAN or even WAN and perform instant recovery and hard disk backup. SysReturn is a two-in-one product providing system recovery and hard
ENEE 757 CMSC 818V. Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park
21. Botnets ENEE 757 CMSC 818V Prof. Tudor Dumitraș Assistant Professor, ECE University of Maryland, College Park http://ter.ps/757 https://www.facebook.com/sdsatumd Today s Lecture Where we ve been AuthenDcaDon
for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory
Visualizing Compiled Executables for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory Overview Explanation of Problem Overview of Reverse Engineering Process
Quick Start Guide. Version R91. English
Using StorageCraft Recovery Environment Quick Start Guide Version R91 English May 20, 2015 Agreement The purchase and use of all Software and Services is subject to the Agreement as defined in Kaseya s
CSE509 System Security
CSE509 System Security Malware and bots Nick Nikiforakis nick@cs.stonybrook.edu Malware Malware, short for malicious software, is software designed to gain access to confidential information, disrupt computer
Implementation and Implications of a Stealth Hard-Drive Backdoor
March 3rd 2014 OSSIR/JSSI 2014 Paper first presented at ACSAC 2013 Awarded Best Student Paper Award Implementation and Implications of a Stealth Hard-Drive Backdoor Jonas Zaddach Davide Balzarotti Aure
Fine-grained covert debugging using hypervisors and analysis via visualization
Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Fine-grained covert debugging using hypervisors and analysis via visualization Daniel A. Quist Lorie M. Liebrock Offensive
A Hypervisor IPS based on Hardware assisted Virtualization Technology
A Hypervisor IPS based on Hardware assisted Virtualization Technology 1. Introduction Junichi Murakami (murakami@fourteenforty.jp) Fourteenforty Research Institute, Inc. Recently malware has become more
Online Payments Threats
July 3, 2012 Introduction...2 Tested Products...2 Used Configuration...3 Real Malware Inspiration...3 Total Scores Chart...4 Conclusion...4 About matousec.com...4 Detailed Descriptions of Tests...5 Detailed
Debugging Windows Applications with IDA WinDbg Plugin Copyright 2011 Hex-Rays SA
Debugging Windows Applications with IDA WinDbg Plugin Copyright 2011 Hex-Rays SA Quick overview: The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng)
Virtualization System Vulnerability Discovery Framework. Speaker: Qinghao Tang Title:360 Marvel Team Leader
Virtualization System Vulnerability Discovery Framework Speaker: Qinghao Tang Title:360 Marvel Team Leader 1 360 Marvel Team Established in May 2015, the first professional could computing and virtualization
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Some Anti-Worm Efforts at Microsoft. Acknowledgements
Some Anti-Worm Efforts at Microsoft Helen J. Wang System and Networking Research Group Microsoft Research Oct 29, 2004 1 Acknowledgements Matt Braverman, Opher Dubrovsky, John Dunagan, Louis Lafreniere,
A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows
: Managing, Maintaining, and Troubleshooting, 5e Chapter 3 Installing Windows Objectives How to plan a Windows installation How to install Windows Vista How to install Windows XP How to install Windows
Attacking Obfuscated Code with IDA Pro. Chris Eagle
Attacking Obfuscated Code with IDA Pro Chris Eagle Outline Introduction Operation Demos Summary 2 First Order Of Business MOVE UP AND IN! There is plenty of room up front I can't increase the font size
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
That Point of Sale is a PoS
SESSION ID: HTA-W02 That Point of Sale is a PoS Charles Henderson Vice President Managed Security Testing Trustwave @angus_tx David Byrne Senior Security Associate Bishop Fox Agenda POS Architecture Breach
Uroburos Highly complex espionage software with Russian roots
G Data Red Paper 2014 Uroburos Highly complex espionage software with Russian roots G Data discovers alleged intelligence agency software G Data SecurityLabs Contact: intelligence@gdata.de Red Paper_February-2014
ArcGIS Server Security Threats & Best Practices 2014. David Cordes Michael Young
ArcGIS Server Security Threats & Best Practices 2014 David Cordes Michael Young Agenda Introduction Threats Best practice - ArcGIS Server settings - Infrastructure settings - Processes Summary Introduction
Botnets Die Hard Owned and Operated
Botnets Die Hard Owned and Operated,,, Las Vegas, 2012 Aditya K Sood Richard J Enbody SecNiche Security Department of Computer Science and Engineering Michigan State University Aditya K Sood About Us PhD
Ethical Hacking and Information Security. Foundation of Information Security. Detailed Module. Duration. Lecture with Hands On Session: 90 Hours
Ethical Hacking and Information Security Duration Detailed Module Foundation of Information Security Lecture with Hands On Session: 90 Hours Elements of Information Security Introduction As technology
OS Security. Malware (Part 2) & Intrusion Detection and Prevention. Radboud University Nijmegen, The Netherlands. Winter 2015/2016
OS Security Malware (Part 2) & Intrusion Detection and Prevention Radboud University Nijmegen, The Netherlands Winter 2015/2016 A short recap Different categories of malware: Virus (self-reproducing, needs
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
LASTLINE WHITEPAPER. In-Depth Analysis of Malware
LASTLINE WHITEPAPER In-Depth Analysis of Malware Abstract Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse).
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE. Summary. Distribution and Installation
VISA SECURITY ALERT December 2015 KUHOOK POINT OF SALE MALWARE Distribution: Merchants, Acquirers Who should read this: Information security, incident response, cyber intelligence staff Summary Kuhook
Operation Liberpy : Keyloggers and information theft in Latin America
Operation Liberpy : Keyloggers and information theft in Latin America Diego Pérez Magallanes Malware Analyst Pablo Ramos HEAD of LATAM Research Lab 7/7/2015 version 1.1 Contents Introduction... 3 Operation
Networks and Security Lab. Network Forensics
Networks and Security Lab Network Forensics Network Forensics - continued We start off from the previous week s exercises and analyze each trace file in detail. Tools needed: Wireshark and your favorite
NUIT Tech Talk. Peeking Behind the Curtain of Security. Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance
NUIT Tech Talk Peeking Behind the Curtain of Security Jeff Holland Security Vulnerability Analyst Information & Systems Security/Compliance Definitions Malware: The Virus/Trojan software we ve all come
1 hours, 30 minutes, 38 seconds Heavy scan. All scanned network resources. Copyright 2001, FTP access obtained
home Network Vulnerabilities Detail Report Grouped by Vulnerability Report Generated by: Symantec NetRecon 3.5 Licensed to: X Serial Number: 0182037567 Machine Scanned from: ZEUS (192.168.1.100) Scan Date:
This is DEEPerent: Tracking App behaviors with (Nothing changed) phone for Evasive android malware
This is DEEPerent: Tracking App behaviors with (Nothing changed) phone for Evasive android malware What I will talk about.. Challenges we faced on android malware analysis: Fast code analysis (Reversing)
Virtually Secure. a journey from analysis to remote root 0day on an industry leading SSL-VPN appliance
Virtually Secure a journey from analysis to remote root 0day on an industry leading SSL-VPN appliance Who am I? Tal Zeltzer Independent security researcher from Israel Reverse engineering (mostly embedded
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? A Typical Attack Scenario
DRIVE-BY DOWNLOAD WHAT IS DRIVE-BY DOWNLOAD? Drive-by Downloads are a common technique used by attackers to silently install malware on a victim s computer. Once a target website has been weaponized with
Adi Hayon Tomer Teller
Adi Hayon Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory in a remote process (and write to it) Executes the code in that memory region Frees the code Memory dump
Inside Windows Rootkits
Chris Ries Security Research Engineer VigilantMinds Inc. 4736 Penn Avenue Pittsburgh, PA 15224 info@vigilantminds.com Introduction Although they have been around for quite some time, rootkits have become
Real World and Vulnerability Protection, Performance and Remediation Report
Real World and Vulnerability Protection, Performance and Remediation Report A test commissioned by Symantec Corporation and performed by AV-Test GmbH Date of the report: September 17 th, 2014, last update:
CSE331: Introduction to Networks and Security. Lecture 32 Fall 2004
CSE331: Introduction to Networks and Security Lecture 32 Fall 2004 Hackers / Intruders External attacks Typical hacker Exploits carried out remotely Does not have an account on the remote machine Insider
Certified Secure Computer User
Certified Secure Computer User Course Outline Module 01: Foundations of Security Essential Terminologies Computer Security Why Security? Potential Losses Due to Security Attacks Elements of Security The
Hardware Enabled Zero Day Protection
Hardware Enabled Zero Day Protection Cyber Security Division 2012 Principal Investigators Meeting October 11, 2012 Paul A. Rivera President/CEO Def-Logix, Inc. Email: privera@def-logix.com Phone: 210-478-1369
Malicious Programs. CEN 448 Security and Internet Protocols Chapter 19 Malicious Software
CEN 448 Security and Internet Protocols Chapter 19 Malicious Software Dr. Mostafa Hassan Dahshan Computer Engineering Department College of Computer and Information Sciences King Saud University mdahshan@ccis.ksu.edu.sa
Redline Users Guide. Version 1.12
Redline Users Guide Version 1.12 Contents Contents 1 About Redline 5 Timeline 5 Malware Risk Index (MRI) Score 5 Indicators of Compromise (IOCs) 5 Whitelists 5 Installation 6 System Requirements 6 Install
Smartphone Security. A Holistic view of Layered Defenses. David M. Wheeler, CISSP, CSSLP, GSLC. (C) 2012 SecureComm, Inc. All Rights Reserved
Smartphone Security A Holistic view of Layered Defenses David M. Wheeler, CISSP, CSSLP, GSLC 1 The Smartphone Market The smartphone security market is expected to grow at a rate of 44 percent annually
ERNW Newsletter 42 / December 2013
ERNW Newsletter 42 / December 2013 Dangers of Disabled Pre-Boot Authentication in Corporate Environments: Attacking Check Point s Full Disk Encryption with Activated WIL Version: 1.1 Date: 12/16/2013 Author(s):
Radware Security Research. Reverse Engineering a Sophisticated DDoS Attack Bot. Author: Zeev Ravid
Reverse Engineering a Sophisticated DDoS Attack Bot Author: Zeev Ravid July 2015 Introduction In July 2015, Radware s Emergency Response Team (ERT) noticed a significant increased usage of the Tsunami
Security Evaluation CLX.Sentinel
Security Evaluation CLX.Sentinel October 15th, 2009 Walter Sprenger walter.sprenger@csnc.ch Compass Security AG Glärnischstrasse 7 Postfach 1628 CH-8640 Rapperswil Tel.+41 55-214 41 60 Fax+41 55-214 41
Eugene Tsyrklevich. Ozone HIPS: Unbreakable Windows
Eugene Tsyrklevich Eugene Tsyrklevich has an extensive security background ranging from designing and implementing Host Intrusion Prevention Systems to training people in research, corporate, and military
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
Contents. vii. Preface. P ART I THE HONEYNET 1 Chapter 1 The Beginning 3. Chapter 2 Honeypots 17. xix
Honeynet2_bookTOC.fm Page vii Monday, May 3, 2004 12:00 PM Contents Preface Foreword xix xxvii P ART I THE HONEYNET 1 Chapter 1 The Beginning 3 The Honeynet Project 3 The Information Security Environment
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
Spam and All Things Salty: Spambot v2013
Spam and All Things Salty: Spambot v2013 Jessa dela Torre 1 and Sabrina Lei Sioting 2 1 Forward-Looking Threat Research Team 2 Threat Cleanup and Analysis Team Trend Micro, Inc., Philippines Abstract.
Installing, Uninstalling, and Upgrading Service Monitor
CHAPTER 2 Installing, Uninstalling, and Upgrading Service Monitor This section contains the following topics: Preparing to Install Service Monitor, page 2-1 Installing Cisco Unified Service Monitor, page
USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides
UltraBac Documentation. UBDR Gold. Administrator Guide UBDR Gold v8.0
UltraBac Documentation UBDR Gold Bare Metal Disaster Recovery Administrator Guide UBDR Gold v8.0 UBDR Administrator Guide UBDR Gold v8.0 The software described in this guide is furnished under a license
Operating System Installation Guidelines
Operating System Installation Guidelines The following document guides you step-by-step through the process of installing the operating systems so they are properly configured for boot camp. The document
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Abstract. 1. Introduction. 2. Threat Model
Beyond Ring-3: Fine Grained Application Sandboxing Ravi Sahita (ravi.sahita@intel.com), Divya Kolar (divya.kolar@intel.com) Communication Technology Lab. Intel Corporation Abstract In the recent years
Optimized Mal-Ops Hack ad networks like a boss
Optimized Mal-Ops Hack ad networks like a boss Vadim KOTOV vadim.kotov@bromium.com @vadimkotov Rahul KASHYAP rahul@bromium.com @rckashyap Virus Bulletin Seattle 2014 Agenda What is malvertising? Why is
International Journal of Enterprise Computing and Business Systems ISSN (Online) : 2230-8849
WINDOWS-BASED APPLICATION AWARE NETWORK INTERCEPTOR Ms. Shalvi Dave [1], Mr. Jimit Mahadevia [2], Prof. Bhushan Trivedi [3] [1] Asst.Prof., MCA Department, IITE, Ahmedabad, INDIA [2] Chief Architect, Elitecore
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime
The Citadel Banking Malware: Capabilities, Development History and Use in Cyber Crime ThreatScape Intelligence Cyber Crime Report November 5, 2013 Version: [1] Key Points Citadel is based on the publicly
Cyber Security in Taiwan's Government Institutions: From APT To. Investigation Policies
Cyber Security in Taiwan's Government Institutions: From APT To Investigation Policies Ching-Yu, Hung Investigation Bureau, Ministry of Justice, Taiwan, R.O.C. Abstract In this article, we introduce some
Virtualization Technology
Virtualization Technology A Manifold Arms Race Michael H. Warfield Senior Researcher and Analyst mhw@linux.vnet.ibm.com 2008 IBM Corporation Food for Thought Is Virtual Reality an oxymoron or is it the
Trend Micro Incorporated Research Paper 2012. Adding Android and Mac OS X Malware to the APT Toolbox
Trend Micro Incorporated Research Paper 2012 Adding Android and Mac OS X Malware to the APT Toolbox Contents Abstract... 1 Introduction... 1 Technical Analysis... 2 Remote Access Trojan Functionality...
Multifaceted Approach to Understanding the Botnet Phenomenon
Multifaceted Approach to Understanding the Botnet Phenomenon Christos P. Margiolas University of Crete A brief presentation for the paper: Multifaceted Approach to Understanding the Botnet Phenomenon Basic
Mass Pwnage 4 Dummies. Latest pen-testing tricks using Metasploit
Mass Pwnage 4 Dummies Latest pen-testing tricks using Metasploit What this talk will cover Quick Background Latest Metasploit 3.5 features Automated Attacking even a cave man could do it. Compromising
Getting Ahead of Malware
IT@Intel White Paper Intel Information Technology Security December 2009 Getting Ahead of Malware Executive Overview Since implementing our security event monitor and detection processes two years ago,
Penetration Test Methodology on Information-Security Product Utilizing the Virtualization Technology
Penetration Test Methodology on Information-Security Product Utilizing the Virtualization Technology JungDae Kim (jdcom@ksel.co.kr) ByongKi Park (bgbak@ksel.co.kr) CONTENTS 1 Background Information 2 Vulnerability
Operating System Security
Operating System Security Klaus Schütz Windows OS Security Microsoft Redmond Before I start My VP love(d) me A frustrated friend 1 Agenda Evolution of Threats Client vs. Server Security Operating System
Virtual Machine Security
Virtual Machine Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ 1 Operating System Quandary Q: What is the primary goal
CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE
CYBER ATTACKS EXPLAINED: THE MAN IN THE MIDDLE Due to the encouraging feedback this series of articles has received, we decided to explore yet another type of cyber intrusionthe Man In The Middle (MITM)
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
Avira Server Security. HowTo
Avira Server Security HowTo Table of Contents 1. Setup Modes... 3 1.1. Complete...3 1.2 Custom...3 2. Configuration... 8 2.1 Update configuration for the Avira Update Manager...8 2.2 Configuration of product
Advancements in Botnet Attacks and Malware Distribution
Advancements in Botnet Attacks and Malware Distribution HOPE Conference, New York, July 2012 Aditya K Sood Rohit Bansal Richard J Enbody SecNiche Security Department of Computer Science and Engineering
2010 Carnegie Mellon University. Malware and Malicious Traffic
Malware and Malicious Traffic What We Will Cover Introduction Your Network Fundamentals of networks, flow, and protocols Malicious traffic External Events & Trends Malware Networks in the Broad Working
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK
BOOTKITS: PAST, PRESENT & FUTURE Eugene Rodionov ESET, Canada Alexander Matrosov Intel, USA David Harley ESET North America, UK Email rodionov@eset.com; alexander.matrosov@ intel.com; david.harley.ic@eset.com
Security Awareness For Website Administrators. State of Illinois Central Management Services Security and Compliance Solutions
Security Awareness For Website Administrators State of Illinois Central Management Services Security and Compliance Solutions Common Myths Myths I m a small target My data is not important enough We ve
Spy Eye and Carberp the new banker trojans offensive
Spy Eye and Carberp the new banker trojans offensive The common way for a wanna-be hacker to fulfill his sick aspirations is to achieve a known trojan there is a plenty on the Internet, sometimes they
Bypassing Local Windows Authentication to Defeat Full Disk Encryption. Ian Haken
Bypassing Local Windows Authentication to Defeat Full Disk Encryption Ian Haken Who Am I? Currently a security researcher at Synopsys, working on application security tools and Coverity s static analysis
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com WHY PERFORM MALWARE ANALYSIS? What are some of the reasons that one might want to invest the (sometimes significant) resources required
Security A to Z the most important terms
Security A to Z the most important terms Part 1: A to D UNDERSTAND THE OFFICIAL TERMINOLOGY. This is F-Secure Labs. Learn more about the most important security terms with our official explanations from
OS KERNEL MALWARE DETECTION USING KERNEL CRIME DATA MINING
OS KERNEL MALWARE DETECTION USING KERNEL CRIME DATA MINING MONISHA.T #1 and Mrs.UMA.S *2 # ME,PG Scholar,Department of CSE, SKR Engineering College,Poonamallee,Chennai,TamilNadu * ME,Assist.professor,