Upload File

kernel malware: the attack from within - f-secure · kernel malware “kernel malware is malicious...

  • Home
  • Documents
  • Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring
20
Kernel Malware: The Attack from Within Kimmo Kasslin / 5 th December 2006

Upload: dotruc

Post on 28-Jan-2019

249 views

Category:

Documents


3 download

Report

TRANSCRIPT

Page 1: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Kernel Malware:The Attack from WithinKimmo Kasslin / 5th December 2006

Page 2: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 2

Contents

Kernel Malware

Past and Present

Key Techniques

Case Studies

Conclusions

Page 3: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 3

Kernel Malware

“Kernel malware is malicious software that runs

fully or partially at the most privileged execution level, ring 0, having full access to memory, all

CPU instructions, and all hardware.”

Can be divided into to subcategories

• Full-Kernel Malware

• Semi-Kernel Malware

Page 4: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 4

Kernel Malware – Past

Kernel malware is not new – it has just been rare

WinNT/Infis

• Discovered in November 1999

• Full-Kernel malware

Virus.Win32.Chatter

• Discovered in January 2003

• Semi-Kernel malware

Page 5: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 5

Kernel Malware – Present

Today, the number of kernel malware compared

to all malware is still very small

To see how the trend has changed a statistical

analysis of malware samples was conducted

• Two separate collections from Jan 2003 to Aug 2006

• On average 100000 samples per collection

• Kernel-Mode drivers were selected based on their PE header information

• Their detection names were used to identify families using kernel-mode components

Page 6: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 6

Kernel Malware – Present

0

10

20

30

40

50

60

70

80

Jan-

03Apr

-03

Jul-0

3Oct-

03Ja

n-04

Apr-0

4Ju

l-04

Oct-04

Jan-

05Apr

-05

Jul-0

5Oct-

05Ja

n-06

Apr-0

6Ju

l-06

No.

sam

ples

0

1

2

3

4

5

6

No.

new

fam

ilies

Malware Families Vendor X Vendor Y

Page 7: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 7

Kernel Malware – Present

Spam-Mailbot.c trojanBackdoor.Rustock.BTrojan-Clicker.Win32.Costrat

Spam-Mailbot trojanBackdoor.Rustock.ASpamTool.Win32.Mailbot

Adware-AproposSpyware.Apropos.CTrojan.Win32.Crypt.t

PWS-Goldun trojanTrojan.GoldunTrojan-Spy.Win32.Goldun

BackDoor-CKB trojanBackdoor.FormadorBackdoor.Win32.PcClient

PWS-Banker trojanInfostealer.BancosTrojan-Spy.Win32.Banker

HackerDefender trojanBackdoor.HackDefenderBackdoor.Win32.HacDef

Backdoor-BACBackdoor.HaxdoorBackdoor.Win32.Haxdoor

McAfeeSymantecF-Secure

Page 8: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 8

Key Techniques

Implementing a full-kernel malware can vary from

hard to impossible depending on its features

Basic downloader does following tasks when it

executes:

• Allocates memory for storing temporary data

• Accesses internet to download the new payload

• Stores the file on the file system

• Modifies the registry to add a launch point

• (Executes the new payload)

Page 9: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 9

Executing Code in Ring 0

The only documented way to execute third party KM code is to load a kernel-mode driver

They are loaded at boot time if they have an entry in HKLM\System\CurrentControlSet\Services

• Type = 0x1 or 0x2

• Start = 0x0 or 0x1 or 0x2

They can also be installed and loaded at run time• CreateService + StartService Windows APIs

There is also an undocumented way to do this

• ntdll!ZwSetSystemInformation

Page 10: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 10

Executing Code in Ring 0

There are other undocumented ways of executing

third party code in ring 0

• Code injection into system address space

• Exploits

• Call gates

Both ways require write access to system address

space from ring 3

• \Device\PhysicalMemory

• ntdll!ZwSystemDebugControl

Page 11: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 11

Kernel-Mode Support Routines

Windows kernel provides an API for kernel-mode

drivers to do basic tasks

• ExAllocatePoolWithTag / ExFreePoolWithTag

• ZwCreateFile / ZwWriteFile / ZwClose

• ZwCreateKey / ZwSetValueKey / ZwClose

Only a subset of Native API functions exported by

ntdll.dll are available for drivers

The solution - use ntdll.dll to get correct index to nt!KiServiceTable and fetch the pointer

Page 12: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 12

Kernel-Mode Support Routines

Page 13: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 13

Executing Code in Ring 3

In some cases it is not feasible for kernel malware

to execute all code in ring 0

• Launching of new processes

• Complex libraries

• Information stealing and encryption

Two different approaches

• Injecting payload into target process context

• Queuing an user-mode Asynchronous Procedure Call

Page 14: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 14

Executing Code in Ring 3pMdl = IoAllocateMdl(pPayloadBuf, dwBufSize, FALSE, FALSE, NULL);

// Lock the pages in memory

__try {

MmProbeAndLockPages(pMdl, KernelMode, IoWriteAccess);

}

__except (EXCEPTION_EXECUTE_HANDLER){}

// Map the pages into the specified process

KeStackAttachProcess(pTargetProcess, &ApcState);

MappedAddress = MmMapLockedPagesSpecifyCache(pMdl,

UserMode, MmCached, NULL, FALSE, NormalPagePriority);

KeUnstackDetachProcess(&ApcState);

// Initialize APC

KeInitializeEvent(pEvent, NotificationEvent, FALSE);

KeInitializeApc(pApc, pTargetThread, OriginalApcEnvironment,

&MyKernelRoutine, NULL, MappedAddress, UserMode, (PVOID)NULL);

// Schedule APC

KeInsertQueueApc(pApc, pEvent, NULL, 0)

Page 15: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 15

Case Study 1: Haxdoor

Haxdoor is a powerful backdoor with rootkit and spying capabilities

Consists of a PE executable, a DLL and a kernel-mode driver

Uses the driver to make its detection and removal more difficult and to bypass personal firewalls

• Hides its process and files

• Protects its own threads and processes against termination

• Protects its own files against any access

• Injects payload into created processes

Page 16: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 16

Case Study 2: Mailbot aka Costrat

Mailbot is the most powerful and stealthiest rootkit

seen so far

Consists of a single kernel-mode driver

Carries an encrypted DLL as a payload that is a

sophisticated spambot with backdoor capabilities

Its detection and removal is still a challenge to

most rootkit detectors and antivirus solutions

Page 17: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 17

Case Study 2: Mailbot aka Costrat

Mailbot uses lots of unique techniques• Driver is stored in “hidden” and protected ADS

• Hooking of nt!KiServiceTable on a thread-level basis

• INT 0x2E and SYSENTER hooks reside inside ntoskrnlmodule

• Has an advanced rootkit anti-detection engine

• Bypasses filter drivers by finding the lowest device object and sending IRPs directly to it

• Bypasses NDIS hooks by getting original pointers from ndis.sys image file

Page 18: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Demo

Page 19: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

Tuesday, 20 February 2007 Page 19

Conclusions

Kernel Malware is becoming more popular

• Mostly driven by high interest in rootkits

One reason is that more documentation and

examples is available to the public

Current security solutions, including antivirus

scanners and firewalls, have not been designed to protect against kernel malware

Prevention might be the only solution

Page 20: Kernel Malware: The Attack from Within - F-Secure · Kernel Malware “Kernel malware is malicious software that runs fully or partially at the most privileged execution level, ring

THANK YOU – QUESTIONS?

[email protected]


Malicious Code Virus, malware, worms - index-of.co.ukindex-of.co.uk/presentation/EHP_14_malicious_code_eng.pdf · Malicious Code Virus, malware, worms ... • Shamoon, also known

Malware Analysis and Antivirus Technologies: Kernel ... · • Kernel malware is a threat that has to be taken seriously • Wide distribution – Srizbi and Pandex spam runs, Mebroot

Intelligence Driven Malware Analysis (IDMA) Malicious ... · PDF fileIntelligence Driven Malware Analysis (IDMA) ... (GCIH) o GIAC Certified ... Intelligence Driven Malware Analysis

Android Malware Clustering through Malicious Payload Mining

Instrumenting Point-of-Sale Malware - DEF CON · Instrumenting Point-of-Sale Malware ... adoption of better practices in the publication and demonstration of malicious software (malware)

Kernel Malware Analysis with Un-tampered and … · Kernel Malware Analysis with Un-tampered and ... This allows attacks such as process hiding and kernel-level. ... affect the detection

Malware 101 “Basics” Berman Enconado. Malware 101 Malware is malicious software How to identify? Stealing information Unauthorized access Exploits Fooling

Malware: Malicious Software€¦ · •Benign example: Easter Eggs in DVDs and software 9/18/2013 Malware 4 . Logic Bombs •A logic bomb is a program that performs a malicious action

Practical Malware Analysis: Ch 10: Kernel Debugging with WinDbg

What is Malware? What Kinds of Malware Are There? Malware: Fighting Malicious Code, ... – Computer Security: Art and Science, ... Malicious logic is a set of instructions that cause

Secure Programming Lecture 18: Malware€¦ · Browser Addon N Y app N Y Y Botnet malware both Y kernel+ Y Y Memory resident Y N kernel+ Y Y Y. Outline Overview Malware Taxonomy Malicious

Malicious Attacks. Introduction Commonly referred to as: malicious software/ “malware”, computer viruses Designed to enter computers without the owner’s

Malware Detection Based on Malicious Behaviors Using Artificial Neural Network

Malicious Malware Softwareathena.csus.edu/~cookd/115/notes/CSC 115 - Summer...Malware that Spreads A virus is a malicious program that is able to infect files with copies of itself

Introduction to Malicious Code (Malware) - Chalmers · Introduction to Malicious Code (Malware) ... • But what type of content is safe? Targeted attacks ... • Salami attack

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

4-1 Last time Malicious code: Malware Viruses Trojan horses Logic bombs Worms Other malicious code: web bugs

DROIDETEC: Android Malware Detection and Malicious Code

Introduction to Malicious Code (Malware) Malicious Code... · • Malicious code can be many things: viruses, worms, Trojan horses, rabbits, etc. ... – is a virus (or worm) that

The diffusion of malware by malicious development environment (FFRI Monthly Research 2016.01)

Malware (MALicious softWARE) Malware Taxonomycs.wellesley.edu/~cs342/fall14/lectures/22_viruses_and_worms.pdfDepartment of Computer Science Wellesley College Viruses and Worms Thrursday,

Malicious Code Virus, malware, worms - Högskolan Dalarnausers.du.se/~hjo/cs/dt1058/presentation/pdf/EHP_14_malicious_code... · Malicious Code Virus, malware, worms ... • Common

Malicious Activity and Risky Behavior in Residential Networks · Malicious Activity and Risky Behavior in Residential Networks 1 1 ... o Spamming o Known malware ... Malicious Activity

1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity

Behavioral Clustering of HTTP-Based Malware and Signature ...€¦ · The battle against malicious software (a.k.a. malware) is becoming more difficult. Today’s malware writers

AVAR 2009@kyoto FFR GreenKiller GreenKiller Analyzing malicious driver from VMM version 0.0.1 ring 0 FFR GreenKiller(based on BitVisor) Agent malware Kernel log ring 3 Tracer Guest

Malicious software(Malware)

Practical Malware Analysis: Ch 7: Analyzing Malicious Windows Programs

Kernel Malware Analysis with Un-tampered and … · This allows attacks such as process hiding and kernel-level ... Kernel Malware Analysis with Un-tampered ... affect the detection

MALWARE - cybok.org · Malware and Attack Technologies Wenke Lee January 2019 INTRODUCTION Malware is short for ’malicious software’, that is, any program that performs malicious

Malicious Cryptography Techniques for Unreversable ...€¦ · Use cryptography to build totally undetectable and invisible malware (Uber-malware ). Use malware to perform cryptanalysis

Malware is Called Malicious for a Reason: The Risks of Weaponizing Code

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Undermining the Linux Kernel: Malicious Code Injection via /dev/mem

Malicious Malware Softwareathena.ecs.csus.edu/~cookd/115/notes/CSC 115 - Summer... · 2018-06-30 · 1 Malware Week 1 – Part 2 Malicious Software Basics of Dangerous Software Malware