Scribd Logo
Upload

Welcome to Scribd!

  • 22 views

    CH 14

    Uploaded by

    chyon
    This document discusses network signatures for malware detection. It describes common network countermeasures like firewalls and proxies. Deep packet inspection tools like IDS and IPS can detect malware by examining layer 7 network data. Passively monitoring live network traffic from infected hosts can reveal accurate indicators of malicious activity without detection. The document outlines methods for safely investigating attackers online anonymously. It also provides examples of how malware can mimic legitimate network protocols to evade detection and techniques for analyzing malware network behavior to develop effective signatures.

    Copyright:

    © All Rights Reserved
    Download as KEY, PDF, TXT or read online from Scribd

    CH 14

    Uploaded by

    chyon
    22 views48 pages
    This document discusses network signatures for malware detection. It describes common network countermeasures like firewalls and proxies. Deep packet inspection tools like IDS and IPS can detect malware by examining layer 7 network data. Passively monitoring live network traffic from infected hosts can reveal accurate indicators of malicious activity without detection. The document outlines methods for safely investigating attackers online anonymously. It also provides examples of how malware can mimic legitimate network protocols to evade detection and techniques for analyzing malware network behavior to develop effective signatures.

    Original Description:

    test

    Original Title

    ch14

    Copyright

    © © All Rights Reserved

    Available Formats

    KEY, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses network signatures for malware detection. It describes common network countermeasures like firewalls and proxies. Deep packet inspection tools like IDS and IPS can detect malware by examining layer 7 network data. Passively monitoring live network traffic from infected hosts can reveal accurate indicators of malicious activity without detection. The document outlines methods for safely investigating attackers online anonymously. It also provides examples of how malware can mimic legitimate network protocols to evade detection and techniques for analyzing malware network behavior to develop effective signatures.

    Copyright:

    © All Rights Reserved
    Download as KEY, PDF, TXT or read online from Scribd
    Download as key, pdf, or txt
    22 views48 pages

    CH 14

    Uploaded by

    chyon
    This document discusses network signatures for malware detection. It describes common network countermeasures like firewalls and proxies. Deep packet inspection tools like IDS and IPS can detect malware by examining layer 7 network data. Passively monitoring live network traffic from infected hosts can reveal accurate indicators of malicious activity without detection. The document outlines methods for safely investigating attackers online anonymously. It also provides examples of how malware can mimic legitimate network protocols to evade detection and techniques for analyzing malware network behavior to develop effective signatures.

    Copyright:

    © All Rights Reserved
    Download as KEY, PDF, TXT or read online from Scribd
    Download as key, pdf, or txt
    You are on page 1of 48

    Practical Malware Analysis

    Ch 14: Malware-Focused Network


    Signatures
    Network Countermeasures
    Common Network Countermeasures

    Filtering with firewalls and routers


    By IP address, TCP and UDP ports
    DNS Servers
    Resolve malicious domain names to an
    internal host (a sinkhole )
    Proxy servers
    Can detect or prevent access to specific
    domains
    Content-Based Countermeasures

    These devices can look at layer 7 data


    (deep packet inspection)

    IDS (Intrusion Detection System)


    IPS (Intrusion Prevention System)
    Email proxy
    Web proxy
    Observing the Malware in Its Natural
    Habitat

    Before static or dynamic analysis


    Mine logs, alerts, and packet captures
    generated by malware in its original
    location
    Advantages of Real Networks
    Live-captured data is the most accurate
    Some malware detects lab environments
    Real traffic contains information about
    both ends, infected host and C&C server
    Passively monitoring traffic cannot be
    detected by the attacker
    OPSEC (Operational Security)
    Indications of Malicious Activity
    OPSEC
    Preventing adversaries from obtaining
    sensitive information
    Running malware at home may alert
    attackers
    Who expected it to be run in a company
    Ways an Attacker Can Identify
    Investigative Activity

    Send spear-phishing email with a link to a


    specific individual
    Watch for access attempts outside the
    expected geographic area
    Design an exploit that logs infections
    In a blog comment, Twitter, Pastebin, etc.
    Embed an unused domain in malware
    Watch for attempts to resolve the domain
    Safely Investigate an Attacker
    Online
    Indirection Tactics
    Proxy server, Tor, Web-based
    anonymizer
    Not subtle—it's obvious that you are hiding
    Use a dedicated VM for research
    Hide its location with a cellular or VPN
    connection
    Use an ephemeral cloud machine
    Such as an Amazon E2C virtual machine
    Search Engines
    Usually safe
    If the domain was previously unknown to
    the search engine, it may be crawled
    Clicking results still activates secondary
    links on the site
    Even opening cached resources
    Getting IP Address and Domain
    Information
    Command-Line v.Web-Based Lookups

    whois and dig can be used, but they will


    expose your IP address
    Websites that do the query for you
    provide anonymity
    May give more information
    DomainTools

    Historical DNS records


    Reverse IP lookups
    Reverse whois (lookup based on contact information
    metadata)
    RobTex
    Finds
    multiple
    domain
    names that
    point to a
    single IP
    address
    Checks
    blacklists
    BFK DNS Logger
    Gathers
    data with
    passive
    DNS
    monitorin
    g
    Stealthy
    Content-Based Network
    Countermeasures
    Intrusion Detection with Snort
    Rule-based detection, can use:
    TCP or IP headers
    Size of payload
    Connection state (such as ESTABLISHED)
    Layer 7 payload data
    Snort Rule to Block HTTP Traffic by
    User-Agent
    Taking a Deeper Look
    Running the malware
    several times shows
    these User-Agent strings
    Rules can be fine-tuned
    to capture the malware
    without false positives
    Combining Dynamic and
    Static Analysis Techniques
    Two Objectives of Deeper Analysis
    Full coverage of functionality
    Provide new inputs to drive the malware down
    unused paths
    Using iNetSim or custom scripts
    Understanding functionality, including inputs
    and outputs
    Static analysis finds where and how content is
    generated
    Dynamic analysis confirms the expected
    behavior
    Danger of Overanalysis
    Hiding in Plain Sight
    Attackers mimic existing protocols
    Often HTTP, HTTPS, and DNS
    HTTP for beaconing (request for instructions)
    HTTPS hides the nature and intent of
    communications
    Information can be transmitted in DNS
    requests
    For example, in long domain names
    GETs
    Used to send a command prompt
    followed by a directory listing
    User Agents
    Early malware used strange User-Agent
    strings
    This made it easy to block
    Valid user agent:
    3 Possible User Agents
    Malware alternates between these to
    defeat detection
    Attackers Use Existing Infrastructure

    Botnet commands concealed in source


    code of a Web page
    Leveraging Client-initiated Beaconing

    Hosts behind NATs or proxy servers have


    a concealed IP address
    Makes it difficult for attackers to know
    which bot is phoning home
    Beacon identifies host with an unique
    identifier
    Such as an encoded string with basic
    information about the host
    Understanding Surrounding Code

    Malware beacon

    URIs
    Example Malware
    Uses InternetOpen and HTTPOpenRequest
    URI is generated from calls to
    GetTickCount, Random, gethostbyname
    Sources of Network Content
    Random data
    Data from networking libraries
    Such as the GET created from a call to
    HTTPSendRequest
    Hard-coded data
    Data about the host and its configuration
    Hostname, current time, CPU speed
    Data received from other sources
    Remote server, file system, keystrokes
    Hard-Coded vs. Ephemeral Data
    Malware using lower-level networking
    APIs such as Winsock
    Requires more manually-generated content
    to mimic common traffic
    More hard-coded data
    Likely the author makes a mistake that
    leaves a signature in the network traffic
    May misspell a word like Mozilla
    How URI is Generated
    Identifying and Leveraging the
    Encoding Steps
    Creating a Signature
    Avoid excessive complexity
    Slows down the IDS
    Include enough detail to eliminate false
    positives
    Analyzing the Parsing Routines
    Malware strings and the Web page
    comments both include the string adsrv?
    Parser looks
    for 3
    elements
    <!—
    text
    -->
    Possible Signatures
    The five possible commands
    These will work, but any change in the
    malware will evade them
    Targeting Multiple Elements
    These are more general
    The first one accepts any Base64 in a
    comment with the adsrv prefix
    Making General Signatures

    Demo: capture GET in Wireshark


    User-Agent and Accept always appear
    together for normal browser traffic
    Understanding the Attacker's
    Perspective
    Rules of Thumb
    Focus on elements of the protocol that
    are part of both end points
    Look for elements that use code on both the
    client and server
    It will be hard for the attacker to change
    them both
    Rules of Thumb
    Focus on elements of the protocol known to
    be part of a key
    Such as a User-Agent that identifies bot traffic
    Again, it would require updating both ends to
    change
    Identify elements of the protocol that are
    not immediately apparent in traffic
    This will be less likely to be used by other,
    sloppy, defenders who leak info to the attacker

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy