Date post: | 06-May-2015 |
Category: |
Technology |
Upload: | charles-lim |
View: | 2,677 times |
Download: | 0 times |
M l LMalware L
25 MeWorkshop AcWorkshop Ac
Institut TeknologiSurabaya,y ,
Charles Lim, Msc., ECSADipl-inf. Randy An
MiMicWillia
L b SLab Setup
i 2011, cademy CERT cademy CERT, Sepuluh Nopember, Indonesia,A, ECSP, ECIH, CEH, CEI
nthony, S.Kom, CEHh lchael
am Ang
A
BackgroundThe Search for MalwarThe Search for MalwarSGU Malware ResearcHoneypot – Randy AnDionaea – Michael & WDionaea Michael & WMalware Sample ResuThe call for Indonesia Dionaea – Setting up (Dionaea Setting up (Questions & Answers
S W I S S G E R M A N U N I V E R S I T Y Malware
Agenda
re Samplesre Samplesch & Malware LabnthonyWilliam AngWilliam Angults
Honeynet(step-by-step)(step by step)
e Setup Workshop 2
Bac
It all began with …Students wants to learnStudents wants to learn using data mining technWe contacted ThorstenWe contacted Thorsten gave us their malware saBut we need Indonesian
We invited Aat Shadewshare his experienceshare his experienceHe had several local st lto analyzeBut, we need more sam
S W I S S G E R M A N U N I V E R S I T Y Malware
ckground
about analyzing malwareabout analyzing malware iquesHolz (U of Mannheim), heHolz (U of Mannheim), he amples
n (local) samples( ) pwa (virologi.info) to
samples that we can use
mples …
e Setup Workshop 3
The search fo
After discussing with best ways to collect m
User submitting malwarehttp://anubis.iseclab.orgCollect from public sites People Flash Disk)Purchase email accountget malware from SPAMCatch your own malwarethis later)
S W I S S G E R M A N U N I V E R S I T Y Malware
r malware samples
several experts, the malware is the following:
e (e.g. , http://virustotal.com) (Copy Center, Warnet,
ts on several ISP and begin M email etc.e using honeypot (more about
e Setup Workshop 4
SGU M
We began with our goTo be able to obtain malTo be able to obtain malTo be able to analyze mTo be able to analyze mTo be able to analyze manalysis
Our Research focusesOur Research focusestechniques to classify
The results have been pConference in Decembe
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
als:lware sampleslware samplesalware using static analysisalware using behavioralware using behavior
s on using Data Minings on using Data Mining y Local Malware.published in IEEE International er 2010.
e Setup Workshop 5
SGU M
Our MethodologyStatStatAna
MalwareMalwareCapture
DynaAna
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
icic lysis
ReportingReporting
amiclysis
e Setup Workshop 6
SGU M
Our Methodology (in d
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
detail)
e Setup Workshop 7
SGU M
We began with the Ro
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
om Blueprint
e Setup Workshop 8
SGU M
We simulate using 3D
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
images of the room
e Setup Workshop 9
SGU M
SGU Malware Lab
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
e Setup Workshop 10
SGU M
We design the isolated
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
d network
e Setup Workshop 11
SGU M
Our Hardware SpecProcessor: Dual CoreProcessor: Dual CoreRAM 2GB DDRIIHard Disk 160GB
The tools for analysThe tools for analysDebugger : OllyDBGPacker Detector : PEMonitoring tools (regig ( gRegshot, Wireshark,
S W I S S G E R M A N U N I V E R S I T Y Malware
Malware Lab
cificatione 2 5 Ghze 2.5 Ghz
sis that used:sis that used:
iDstry, network, process): y, , p )Process Monitor
e Setup Workshop 12
SGU Malware ReFirdausi I., Lim C., Erwin A., NugrohTechniques Used in Behavior-BaseInternational Conference on AdvanT l i ti T h l iTelecommunication Technologies,
Simanjuntak D. A., Ipung H. P., Lim Techniques Used to Faciliate CyberSecond International Conference oand Telecommunication Technolog
Christian R., Lim C., Nugroho A. S.,Christian R., Lim C., Nugroho A. S.,Analysis Using Clustering Techniqu2010 Second International ConferenControl, and Telecommunication Te2010.
Endy, Lim C., Eng K.I., Nugroho A.SSearching Using Self-Organizing MSearching Using Self Organizing MContaining Information in Relation International Conference on AdvanTelecommunication Technologies,
S W I S S G E R M A N U N I V E R S I T Y Malware
esearch Publicationsho A. S., “Analysis of Machine learning ed Malware Detection,” 2010 Second ces in Computing, Control, and J k t 2 D b 2010Jakarta, 2 December 2010.
C., Nugroho A. S., “Text Classification r Terrorism Investigation,” 2010 n Advances in Computing, Control,
gies, Jakarta, 2 December 2010.
, Kisworo M., “Integrating Dynamic, Kisworo M., Integrating Dynamic ues for local Malware in Indonesia,” nce on Advances in Computing, echnologies, Jakarta, 2 December
S., “Implementation of Intelligent Map for Webmining Used in DocumentMap for Webmining Used in Document
to Cyber Terrorism,” 2010 Second ces in Computing, Control, and Jakarta, 2 December 2010.
e Setup Workshop 13
SGU Curr
Indonesia Malware Forensic ResearchForensic Research Cloud Securityy
S W I S S G E R M A N U N I V E R S I T Y Malware
rent Research
Profilingon Remnant Dataon Remnant Data
e Setup Workshop 14
A
BackgroundThe Search for MalwarThe Search for MalwarSGU Malware ResearcHoneypot – Randy AnDionaea – Michael & WDionaea Michael & WMalware Sample ResuThe call for Indonesia Dionaea – Setting up (Dionaea Setting up (Questions & Answers
S W I S S G E R M A N U N I V E R S I T Y Malware
Agenda
re Samplesre Samplesch & Malware LabnthonyWilliam AngWilliam Angults
Honeynet(step-by-step)(step by step)
e Setup Workshop 15
Ho
S W I S S G E R M A N U N I V E R S I T Y Malware
oneypot
e Setup Workshop 16
Why Using Honeypo
Used to capture AutonoMalware / Worm.We as a CERT ( CompuResponse Team) mustResponse Team) must spreading and the counLate response on WormLate response on Wormmassive damage.Example : Conficker WoCaused around 9.1 Bill78 triliun Rupiah
S W I S S G E R M A N U N I V E R S I T Y Malware
ot in Malware Analysis Lab
omous Spreading
uter Emergency find a way to stop thefind a way to stop the ter measure.
m infection can causem infection can cause
orm (2008 – 2009)ion USD /
e Setup Workshop 17
Introductio
“Is a decoy that is used to lu(hacker).”
“It is a computer that have ncompromised or destroyed shof the companies.”
S W I S S G E R M A N U N I V E R S I T Y Malware
on to Honeypot
ured malware or attacker
no production value, so if it is hould not affect the activities
e Setup Workshop 18
Honeypot Bas
Two kinds of honeypoTwo kinds of honeypo
Low Interaction Honeypo
High Interaction Honeyp
S W I S S G E R M A N U N I V E R S I T Y Malware
sed on Interaction
ot :ot :
ot
pot
e Setup Workshop 19
Low Intera
Do not implements Disguise as a real sDisguise as a real sGood for finding kngexpected behaviorUsually automatedUsually automatedLower cost neededExample : Nepenthe
S W I S S G E R M A N U N I V E R S I T Y Malware
ction Honeypot
actual servicesystemsystem
own attack and
es, Amun, Dionaea
e Setup Workshop 20
High Intera
It is a “real” systemdifferent configuratgsystem.Riskier than Lo InRiskier than Low-In“Allow all” configurDifficult to maintainconfigureconfigureHigher cost neededExample : Physical
S W I S S G E R M A N U N I V E R S I T Y Malware
action Honeypot
m usually with ion than the real
teracti it d e toteractivity due to rationn and manually
HIH, Virtual HIH
e Setup Workshop 21
Table of
Low-inte
Degree of interaction Lo
Real operating system N
Risk Lo
Knowledge gain ConnectioKnowledge gain Connectio
Can be conquered NCan be conquered N
Maintenance time Lo
S W I S S G E R M A N U N I V E R S I T Y Malware
f Comparison
eraction High-interaction
ow High
No Yes
ow High
on/Request Everythingon/Request Everything
No YesNo Yes
ow High
e Setup Workshop 22
Choosin
Must know the puDetecting attackerDetecting attacker Risk Identification ?Risk Mitigation & AId tif i thIdentifying new threResearch ?
S W I S S G E R M A N U N I V E R S I T Y Malware
ng Honeypot
urpose :???
Analysis ?t ?eats ?
e Setup Workshop 23
SWISS GERMASWISS GERMAHONEYPOT 201
S W I S S G E R M A N U N I V E R S I T Y Malware
AN UNIVERSITYAN UNIVERSITY 0 - NEPENTHES
e Setup Workshop 24
Nep
Low interaction HonResource needed :Resource needed : New Vulnerabilities : New Exploits : Maintenance Time :Maintenance Time : Risk :
I t ll d VMWInstalled on VMWarWindows -> Ubuntu -
S W I S S G E R M A N U N I V E R S I T Y Malware
penthes
neypotLowLowNoYesLowLowLow
re-> Nepenthesp
e Setup Workshop 25
SGU Honeyne
S W I S S G E R M A N U N I V E R S I T Y Malware
et Physical Design
e Setup Workshop 26
SGU Honeyn
S W I S S G E R M A N U N I V E R S I T Y Malware
net Logical Design
e Setup Workshop 27
Malware Capture
427 Malwares and 111 Uniqu
S W I S S G E R M A N U N I V E R S I T Y Malware
427 Malwares and 111 Uniqu
ed ( 3.06.10 – 24.07.10)
ue Malwares
e Setup Workshop 28
ue Malwares
Dynamic AnaType Na
Trojan Horse Backdoor Rbot.INTrojan Horse Generic15.EHTTrojan Horse Generic17.ASMDTrojan Horse Generic2_c.AGVTrojan Horse IRC/Backdoor SdBot2.HHBTrojan Horse IRC/Backdoor SdBot2.KWDTrojan Horse IRC/Backdoor SdBot2.RJWTrojan Horse SpamTool.EZWVi B kD Rb tVirus BackDoor.RbotWin32 Virus HeurWin32 Virus VirutWin32 Virus Virut AAWin32 Virus Virut.AAWorm Allaple.AWorm Allaple.BWorm Allaple.CWorm Allaple.CWorm Allaple.DWorm Allaple.EWorm Allaple.L
S W I S S G E R M A N U N I V E R S I T Y
pUnknown Unknown
Malware
alysis Using AVGame Total
11
D 1VC 1
741911127339307711312
e Setup Workshop 29
Dynamic AnalysType Na
Backdoor FlyAgent.k
Backdoor Nepoe mkBackdoor Nepoe.mk
Backdoor Nepoe.tv
Backdoor Rbot.adqd
Backdoor Rbot.advj
Backdoor Rbot.aftu
Backdoor Rbot.bniBackdoor Rbot.bni
Backdoor Rbot.bqj
Net-Worm Allaple.b
N t W All l dNet-Worm Allaple.d
Net-Worm Allaple.e
Trojan-PSW Kukudva.ad
Trojan Agent.ayuc
Trojan VB.ahzy
Virus Virut av
S W I S S G E R M A N U N I V E R S I T Y
Virus Virut.av
Unknown Unknown
Malware
sis Using Kasperskyame Total
1
11
1
7
1
21
44
6
39
22
17
1
1
1
33
5
e Setup Workshop 30
A
BackgroundThe Search for MalwarThe Search for MalwarSGU Malware ResearcHoneypot – Randy AnDionaea – Michael & WDionaea Michael & WMalware Sample ResuThe call for Indonesia Dionaea – Setting up (Dionaea Setting up (Questions & Answers
S W I S S G E R M A N U N I V E R S I T Y Malware
Agenda
re Samplesre Samplesch & Malware LabnthonyWilliam AngWilliam Angults
Honeynet(step-by-step)(step by step)
e Setup Workshop 31
D
S W I S S G E R M A N U N I V E R S I T Y Malware
ionaea
e Setup Workshop 32
D
Dionaea is NepheDionaea is lo intDionaea is low intDionaea has manyDionaea has manysuch as using libeand IPv6and IPv6.Dionaea using PyDionaea using Pylanguage
S W I S S G E R M A N U N I V E R S I T Y Malware
ionaea
entes predecessor.teraction hone potteraction honeypoty new functions,y new functions, emu, support TLS
yhton as scriptingyhton as scripting
e Setup Workshop 33
How Dio
Dionaea works like Dionaea intentisonDionaea intentisonexposed by servicenet orknetwork.In order to minimizebugs, dionaea can dchroot.chroot.Dionaea using SMB
t lprotocol
S W I S S G E R M A N U N I V E R S I T Y Malware
onaea works
Nephentes.is to trap malwareis to trap malware s offered by a
e the possible of pdrop privileges and
B protocol as the main
e Setup Workshop 34
How Diona
Dionaea using SMBprotocol.pDionaea using libeme al ate the pa loaevaluate the payloaOnce dionaea gainegfile, the attacker wafrom the shellcode,from the shellcode, download the file.
S W I S S G E R M A N U N I V E R S I T Y Malware
aea Work(Cont.)
B protocol as the
mu to detect and dd.
ed the location of the nts it to downloads dionaea will trydionaea will try
e Setup Workshop 35
Malwares co
70
60
64
40
50 6264
30
10
20
10
1
1
S W I S S G E R M A N U N I V E R S I T Y Malware
12/5/2011 13/5/2011 14/5/2011
ollected in a day
56 5356
1010
e Setup Workshop 36
18/5/2011 19/5/2011 20/5/2011
Attack in a week1600
1400
1600
1200
Attack in a w
1000
Attack in a w
600
800
400
200
S W I S S G E R M A N U N I V E R S I T Y Malware
00 1 2 3 4 5 6 7 8 9 10 11
k (List every one hour)
week (List every one hour)week (List every one hour)
e Setup Workshop 37
12 13 14 15 16 17 18 19 20 21 22 23 24
A
BackgroundThe Search for MalwarThe Search for MalwarSGU Malware ResearcHoneypot – Randy AnDionaea – Michael & WDionaea Michael & WMalware Sample ResuThe call for Indonesia Dionaea – Setting up (Dionaea Setting up (Questions & Answers
S W I S S G E R M A N U N I V E R S I T Y Malware
Agenda
re Samplesre Samplesch & Malware LabnthonyWilliam AngWilliam Angults
Honeynet(step-by-step)(step by step)
e Setup Workshop 38
Malware M
S W I S S G E R M A N U N I V E R S I T Y Malware
ap in Indonesia
e Setup Workshop 39
Future Malwar
IndoneMalwar
S W I S S G E R M A N U N I V E R S I T Y Malware
re Map in Indonesia
sia Honeynetre Repository
e Setup Workshop 40
The call for In
Malware collected fIndonesia
All malware sampleMalware repositoryp y
Lots of research cathese malware sam
S W I S S G E R M A N U N I V E R S I T Y Malware
ndonesia Honeynet
rom all universities in
es sent to IDSIRTII for
n be performed on plesp
e Setup Workshop 41
A
BackgroundThe Search for MalwarThe Search for MalwarSGU Malware ResearcHoneypot – Randy AnDionaea – Michael & WDionaea Michael & WMalware Sample ResuThe call for Indonesia Dionaea – Setting up (Dionaea Setting up (Questions & Answers
S W I S S G E R M A N U N I V E R S I T Y Malware
Agenda
re Samplesre Samplesch & Malware LabnthonyWilliam AngWilliam Angults
Honeynet(step-by-step)(step by step)
e Setup Workshop 42
La
Setup D(step-b
S W I S S G E R M A N U N I V E R S I T Y Malware
ab Time
Dionaeaby-step)
e Setup Workshop 43
Setup
Requirement:Ubuntu 9 10 or 10 1Ubuntu 9.10 or 10.1Honeypot ( Dionaeay (Internet Connection
Software downloadSoftware download
S W I S S G E R M A N U N I V E R S I T Y Malware
Information
00a))n (IP Public)
from:from:
e Setup Workshop 44
Question
S W I S S G E R M A N U N I V E R S I T Y Malware
ns & Answers
e Setup Workshop 45