Upload
stephan-chenette
View
12.171
Download
1
Tags:
Embed Size (px)
DESCRIPTION
Citation preview
1
The Future of Automated Malware Generation
Stephan ChenetteDirector of Security Research & Development
Who Am I?
• Stephan Chenette @StephanChenette (twitter)• Currently Director of Security R&D @ IOActive
•Building / Breaking / Hacking / Researching
• R&D @ eEye Digital Security 4+ years• Head Security Researcher @ Websense 6+ years• (Graduate Student @ UCSD - Network Security)
2
What I hope you learn…
• An understanding of the current malware landscape• Various malware/exploit defense techniques• Where I think detection/defense technologies are
headed• How malware authors will most likely react drive the future of automated malware generation
3
Statement
This particular topic/area is a personal research interest of mine –
I’m hoping to basically motivate you to think offensively when building or using defensive technologies…
For Example: I’m currently helping on an open source automated detection technology for the cuckoo sandbox – and am trying to evade/bypass it at the same time
4
Agenda
• Current State of Automated Malware Generation• Current State of Malware Defense (Tech.)• Malware Trends• The Future of Malware Defense• The Future of Automated Malware Generation
5
Malware Distribution Networks (MDNs)
6
Malware Distribution Networks
Malware has evolved into a profitable business for cyber criminals
•Complex/Organized/Distributed Network•Malware Distribution Network (MDNs)
•Pay-per-install (PPI) clients (RogueAV, SpamBot, keylogger)•PPI Services•PPI Affiliates (landing pages, redirection services, etc.)
7
Malware Distribution Networks (MDNs)
Source: Microsoft Security Intelligence Threat Report (http://www.microsoft.com/sir)
8
1 2 3 4
Malware Distribution Networks (MDNs)
9
Multiple Sample Repository A repository that performs updates to the malicious executable over time, but is not generating the samples for each request
Single Sample Repository A repository that does not update the malicious executable for the lifetime of the repository.
Polymorphic/Metamorphic Repository A repository that produces a unique malicious executable for every download request
Example: Blackhole Exploit Kit
Blackhole contains an integrated AV scanner and will auto-repackage if malware is detected
Figure: Blackhole exploit kit download chain
Source: Manufacturing Compromise: The Emergence of Exploit-as-a-Service (http://cseweb.ucsd.edu/~voelker/pubs/eaas-ccs12.pdf)
10
Exploit Kits and Malware
Blackhole | Ingognito || ZeroAccess | TDSS
Source: Manufacturing Compromise: The Emergence of Exploit-as-a-Service (http://cseweb.ucsd.edu/~voelker/pubs/eaas-ccs12.pdf)
11
Agenda
12
• Current State of Automated Malware Generation• Current State of Malware Defense (Tech.)• Malware Trends• The Future of Malware Defense• The Future of Automated Malware Generation
Current State of Malware Defense (Tech.)
13
Current Techniques
• Hash• Signatures• Heuristics• Semantics-aware detection
14
Current Techniques
15
Easier to bypassEasier to implement
Harder to changeHarder to implement
Attacker Defender
Hash-based detection
• Full file hashing (cryptographic checksum)•MD5, SHA1, SHA256
• Portable Executable (PE)•Sectional hashing•Custom hashing•Fuzzy hashing (ssdeep)
• Error on the side of caution
16
Defeating Hash-based detection
• Create Unique malware sample per user request•Randomizing single byte in irrelevant file offset•Re-packaging binary (FSG, ASPack, Themida)•Re-building malware dynamically
17
Signature-based detection
• Regular Expression based signatures (PCRE, RE2)• Byte-signatures
• Deeper contextual content scanning with proprietary language
18
rule ASPack{ strings: $ = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? (43 | 44) ?? B8 ?? ?? (43 | 44) ?? 03 C5 } $ = { 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 } $ = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A } $ = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD } $ = { 60 E8 41 06 00 00 EB 41 } $ = { 60 E8 7? 05 00 00 EB (33 | 4C) } condition: for any of them : ($ at entrypoint)}
Defeating Signature-based detection
• Syntax mutation easily defeats this technique• Garbage Code Insertion e.g. NOP, “MOV ax, ax”, “SUB ax 0”• Register Renaming• Subroutine Permutation• Code Reordering through Jumps• Equivalent instruction substitution
• Same behavior but different syntax
19
Call Emulated Call Misused Call
CALL <target> PUSH <PC + sizeof(PUSH) + sizeof(JMP)>JMP <target>
CALL <target>
.targetPOP <register-name>
Instruction Equivalent instruction
MOV EAX, EBX PUSH EBX, POP EAX
Heuristics are introduced…
AV engines were forced to evolve and use heuristics by way of emulation/behavioral analysis due to:
•Polymorphic engines• Encrypt body with randomly generated encryption
algorithm• Private key normally in decoding engine
•Metamorphic engines• Employs obfuscation/substitution techniques instead of encryption
• Junk insertion, equivalent instruction substitution, etc.
20
Heuristics-based detectionGeneral term for the different techniques used to detect malware by their behavior
21
Source: (http://http://hooked-on-mnemonics.blogspot.com)
Rule ARule B
Rule C
IF Rule A then Rule B then Rule C then Poison Ivy
Emulation, API hooking, sand-boxing, file anomalies and other analysis techniques
Defeating Heuristics-based detection
• Detect emulation and execute different code path• Break emulation engine• Avoid the heuristics
• Overall solid method• Possible false positives
22
Semantics-aware Detection
• Captured execution trace is transformed into a higher-level representation capturing its semantic meaning, i.e., the trace is first abstracted before being compared to a malicious behavior
• Make the time to build the code flow or extraction of a model infeasible for real-time AV using time lock puzzles
• Intermediate representation (IR)• Abstract Syntax Trees, Register Transfer Language
23
Semantics-aware detection
Good idea in theory, but unknown (to me) how widely implemented this is in security products
24
Defeating Semantics-aware detection
Implementation is difficultLimited support for equivalent code sequences
A left arithmetic shift by n is equivalent to multiplying by 2n (provided the value does not overflow)
Focus on same techniques used to defeat signatures and heuristics + likelihood of limited support less popular instructions
25
a = b * 2 a = b << 1
Recap
26
Agenda
27
• Current State of Automated Malware Generation• Current State of Malware Defense (Tech.)• Malware Trends• The Future of Malware Defense• The Future of Automated Malware Generation
Malware Trends
28
• How well are current detection techniques working?
Malware Detection Reality Check
29
33%!
Malware Samples
Observation: # of Malware Samples are increasing
Source: Mcafee Global Q12012 Threat Report (http://mcafee.com/us/resources/reports/rp-quarterly-threat-q1-2012.pdf)
30
Mobile Malware Samples
Observation: # of Android Malware Samples are increasing
Source: Kaspersky Q12012 Threat Report (http://www.securelist.com/en/analysis/204792231/IT_Threat_Evolution_Q1_2012)
31
Use of Behavior Sandboxes
Client binary is malware but isn’t detected.Suspicious files are sent back to “home base/cloud” lab for analysis 1.Sent to sandbox system 2.Meta data report is created for easier export of new rules
a. Hash and blacklist entries are added b. Signatures are addedc. Heuristic detection is added
32
The Overworked Malware Analyst
33
Solving the problem with people
Malware Analysts
34
Malware Samples Samples
OVERLOAD!!
Agenda
35
• Current State of Automated Malware Generation• Current State of Malware Defense (Tech.)• Malware Trends• The Future of Malware Defense• The Future of Automated Malware Generation
The Future of Malware Defense
Skynet? …probably not
36
But some of the concepts aren’t too far fetched…
The Future of Malware Defense
Perhaps malware detection should have more science applied to it.
37
The Malware Infinity Problem
38
Malware detectionAs malware samples approaches ∞ we can’t manually add detection for every file. We must model WHAT actions malware take, HOW it makes those actions and WHERE it makes connected.
Malware Attribution As Attack Surface approaches ∞ we can’t defend everything from everyone. We must model WHO is after WHICH assets and HOW they attack.
The Future of Malware Defense
IF we are going to start modeling we must make some assumptions:
1.Attackers are going to change their code and techniques only enough to avoid detection2.The majority of malware/exploits code and techniques will continue to represent future malware/exploits code and techniques
39
The Who is important…
40
“Researchers at Symantec traced the group’s work after finding a number of similarities between the Google attack code and methods and those used against other companies and organizations over the last few years.
The researchers, who describe their findings in a report published Friday, say the gang — which they have dubbed the “Elderwood gang” based on the name of a parameter used in the attack codes — appears to have breached more than 1,000 computers in companies spread throughout several sectors – including defense, shipping, oil and gas, financial, technology and ISPs. The group has also targeted non-governmental organizations, particularly ones connected to human rights activities related to Tibet and China”
Source: http://www.wired.com/threatlevel/2012/09/google-hacker-gang-returns/
Statistics
A discipline that makes you understand data and makes you make decisions based on data
41
STATISTICS
DecisionsData
Train the Machines
• Classify• Cluster
42
Automatic Classification
43
Steps:1.Extract features2.Train models using ML algorithms3.Feature Selection4.Use models as classifiers5.Use models to classify unknown files as 0 or 1
Source: http://eval.symantec.com/mktginfo/enterprise/white_papers/b-dlp_machine_learning.WP_en-us.pdf
Machine learning
Where we train computers to make statistical decisions on real-time data based on inputted data
While machine learning as a concept has been around for decades and has been used in everything from anti-spam engines to Google™ algorithms for translating text, it is only now being applied to web filtering, DLP and malware content analysis.
44
Historical Observation
Historically certain malware has•No icon•No description or company in resource section•Is packed•Lives in windows directory or user profile
These are the type of “features” that expert humans would feed to machine learning classifiers to train on
45
Expert Humans train Machines
“You can’t effectively and consistently manage what you can’t measure, and you can’t measure what you haven’t defined…”SOURCE: http://fairwiki.riskmanagementinsight.com/?page_id=3
•The job of the human•List features
•The job of the machine•Model which features are important, in what grouping and in what order
•Classify•Cluster
46
Machine Learning (ML) Algorithms
• Naive Baysian Classifier (each feature is independent of the other features)
• Support Vector Machine (SVM) when high dimensionality (high dimensionality.. more than a thousand of variables are in the model)
• Random Forest when you want an interpretable model (< 2000 features)
• Marchov Chains (Natural Language Processing) for when you want to assess the sequence probability
47
The Future of Malware Defense
48
Every Layer provides various degrees of “features” to inspect
NetworkFile System
Physical Memory
Inspection Point
The Future of Malware Defense
49
Existing Academic work…
• D. Plonka and P. Barford. Context-Aware Clustering of DNS Query Traffic. In Proceedings of the 8th ACM SIGCOMM conference on Internet Measurement, October 2008.
• R. Perdisci, W. Lee, and N. Feamster. Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces. In Proceedings of the 7th USENIX conference on Networked Systems Design and Implementation, April 2010.
• K. Rieck, P. Trinius, C. Willems, T. Holz. Automatic Analysis of Malware Behavior using Machine Learning. e Journal of Computer Security, 2011
50
Projects using machine learning
•Razorbacktm - http://sourceforge.net/projects/razorbacktm/files/
•Malheur - http://www.mlsec.org/malheur/•Malvic - http://www.malvic.org•Adobe Open Source Malware Classification Toolhttp://sourceforge.net/projects/malclassifier.adobe/
• 98.21% accuracy• 6.7% false positive rate• 7 features = DebugSize, ImageVersion, IatRVA, ExportSize,
ResourceSize, VirtualSize2, NumberOfSections
51
Statistics Based Detection Tools
52
The Future of Malware Defense
•Using Machine learning for malware detection is only as useful as the features you create and the good and bad sample sets it’s trained on.
• Features• Good Sample Set• Bad Sample Set
• If you have 1000’s of samples but on the same malware or sample exploit…not good!!!
53
PDF Example Features
• Compressed JavaScript• PDF header location e.g %PDF - within first 1024 bytes• Does it contain an embedded file (e.g. flash, sound file)• Signed by a trusted certificate • Encoded/Encrypted Streams e.g. FlatDecode• Names hex escaped• Bogus xref table
Reference: http://blog.fireeye.com/files/27c3_julia_wolf_omg-wtf-pdf.pdf
54
Detecting shellcode
• Marchov chains To determine probability of instruction sequences
• Technique clustering
55
XOR ECX, ECX ; ECX = 0 MOV ESI, [FS:ECX + 0x30] ; ESI = &(PEB) ([FS:0x30]) MOV ESI, [ESI + 0x0C] ; ESI = PEB->Ldr MOV ESI, [ESI + 0x1C] ; ESI = PEB->Ldr.InInitOrder next_module: MOV EBP, [ESI + 0x08] ; EBP = InInitOrder[X].base_address MOV EDI, [ESI + 0x20] ; EBP = InInitOrder[X].module_name (unicode) MOV ESI, [ESI] ; ESI = InInitOrder[X].flink (next module) CMP [EDI + 12*2], CL ; modulename[12] == 0 ? JNE next_module ; No: try next module.
0.3
0.70.4
0.6
Shellcode detection
Decoder routine clusteringDetect entropy of bytes to indicated encoded payload
...features =]
56
Malware features in action …
• Features:•Static:
• Packed• File size• Origin
•Dynamic (Network)• Makes a connection• Number of DNS request• Encrypted Communication• Burst/length of communication
•Dynamic (File)• Register keys• File level modifications
57
The Future of Malware Defense
• Choose features that are harder for the attacker to change. •E.g. bot network communication protocol (if not encrypted)
58
Agenda
59
• Current State of Automated Malware Generation• Current State of Malware Defense (Tech.)• Malware Trends• The Future of Malware Defense• The Future of Automated Malware Generation
The Future of Automated Malware Generation
60
The Future of Malware Offense
The Attacker has a few things in their favor:1.Prone to False Positives
Machine learning can be prone to false positives and false negatives if feature and sample sets aren’t extensive enough
2.Avoid Feature IndicatorsDetection via machine learning can be defeated if an attacker can find out where the features are and avoid them
3.New Features Come Out…You can't protect yourself from a new weapon if you don't know it exist
61
Prone to false positives
If the defense side creates models based on a small sample set or a sample set that doesn’t represent a diverse enough sample set than the model will be too restrictive – false negatives
If the defense creates models based only on malicious files and not enough good files there will be tons of false positives
An Attacker can always try poison the sample sets if they have enough manipulation power and resources (VirusTotal)
62
Avoid feature indicators
• Attackers can always do the same research and model generic malware and avoid features that are being used by most malware
• …to instead use features that that are more popular in benign software
• This will also avoid being placed in known clusters
63
New features come out…
• If format changes, or gets updated:
•A new file/protocol parser must be created/updated to understand and extract features
•The model must be retrained and shipped out
64
…OR Just keep is simple
Encrypt binaries with a user-specific key so that AV can’t decrypt it
•Targeted binary like Gauss •Encrypted DLL with user key
•Zeus•Encrypted the downloaded binary with user key
65
Conclusion
• Complex/Organized Network• Malware distribution network (MDNs)
•Pay-per-install (PPI) clients •Malware crypt services will include
• Feature verification• anti-clustering technology the Future?• anti-classification technology The Future?
66
Will this be the future of automated malware generation?Or will it just be more
of the same?
Conclusion
Today, what I hope that you learned is that if you want to truly understand your defensive technology you have to understand it’s limitations and look at things from an attacker/offensive viewpoint.
67
Conclusion
Proper security is all about a defense-in-depth strategy. Create multiple layers of defense.
Every layer presenting a different set of challenges, requiring different skill sets and technology.
So every layer will increase the time and effort to compromise your environment and exfiltration data.
68
Conclusion
External reconnaissance PenetrationInternal reconnaissance + stage persistent state Exfiltration
If security strategy is successful:via your layered defenses the attack is stopped before exfiltration of data can happen.
69
Questions?
questions.py:while len(questions) > 0:
if time <= 0:break
print answers[questions.pop()]
70
Thanks Pacsec!
Stephan Chenette | @StephanChenette
Director of Research and Development
IOActive, Inc. http://ioactive.com
71