Upload File

weekend malware research 2012

25
Weekend Malware Research Andrew Morris

Upload: andrew-morris

Post on 07-Aug-2015

50 views

Category:

Data & Analytics


0 download

Report

TRANSCRIPT

Page 1: Weekend Malware Research 2012

Weekend Malware Research

Andrew Morris

Page 2: Weekend Malware Research 2012

About

• Over the weekend I collected two different categories of malware

• Dionaea Honeypot malware (Conficker)– Windows– SMB-Based Exploits

• JBoss ZECMD worm– Cross platform/Java– JMX Console-based Exploits

Page 3: Weekend Malware Research 2012

Dionaea

Page 4: Weekend Malware Research 2012

Dionaea

• Dionaea is an open-source honeypot daemon used to catch malware samples

• Installed and run on Linux• Emulates a Windows 2000 Server

Page 5: Weekend Malware Research 2012

Protecting yourself

• Whenever you are doing any type of malware research, be sure to protect yourself

• Segment the honeypot/analysis machine from the rest of your network

Page 6: Weekend Malware Research 2012

Dionaea Log piped to “tail –f”

Tcpdump on port 445

Binaries collected

Page 7: Weekend Malware Research 2012

Commands

# tail -f dionaea.log# tcpdump -i eth0 –XX –vvv tcp port 445

(-w capture.pcap)# while [ 1 ]; do ls –lah ; ls | wc ; sleep 1 ; done

Page 8: Weekend Malware Research 2012

Results

• Over 24 hours, the Dionaea honeypot collected over 100 malware samples

• There were more attacks, but the honeypot failed to capture binaries for more sophisticated malware

• Over five attacks per minute

Page 9: Weekend Malware Research 2012
Page 10: Weekend Malware Research 2012
Page 11: Weekend Malware Research 2012

Anyone interested?

• I have over 100 malware samples directly from the wild

• If anyone is interested in setting up an offline lab with me for manual analysis, shoot me an email

• Makes good practice for reverse engineering

Page 12: Weekend Malware Research 2012

ZECMD

Page 13: Weekend Malware Research 2012

ZECMD

• Steve Nawoichik and I first encountered this during a penetration test one year ago

• Our client thought they would be cool and stand up an intentionally vulnerable server to test if we were doing our jobs

• They got hit with a Jboss worm

Page 14: Weekend Malware Research 2012

Worming Mechanism

• I did a bit of OSINT on the term “ZECMD.jsp” and found a couple writeups by Carnal0wnage, Kaspersky, and a few others

• The worm infects machines over the internet by attacking exposed Jboss JMX consoles

• Deploys it’s own custom malicious WAR file

Page 15: Weekend Malware Research 2012

So…

• I set up a Linux box and install Jboss• Exposed the JMX console, no username, no

password

Page 16: Weekend Malware Research 2012

Infected

• Jboss worm hit me within 24 hours• Again, ZECMD• Good part about this worm– Modular malware– Portions are in Perl, C, and Java– Drops the source code, relies on the machine to

compile– No reversing necessary!

Page 17: Weekend Malware Research 2012

Perl

Page 18: Weekend Malware Research 2012

C

Page 19: Weekend Malware Research 2012

Java

Page 20: Weekend Malware Research 2012

Nicks

Page 21: Weekend Malware Research 2012

Scanning

Page 22: Weekend Malware Research 2012

Digging Deeper

Page 23: Weekend Malware Research 2012

What I learned from the malware

• C2 (command and control) servers• Propagation mechanism• Able to identify compromised machines• Handles of botmaster• Methods of data exfiltration• How to tell if a machine is infected

Page 24: Weekend Malware Research 2012

Questions?

Page 25: Weekend Malware Research 2012

Thanks!

[email protected]


Malware Research at SMU

Vampire Weekend Research

A Case Study in Malware Research Ethics Education When ... · A Case Study in Malware Research Ethics Education When teaching bad is good . ... Cyber-security Research Ethics Dialog

Public Meeting to Discuss “Weekend Effect” Research June 23, 1999

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Harnessing Intelligence from Malware Repositories · 2018-05-11 · Harnessing Intelligence from Malware Repositories Arun Lakhotia and Vivek Notani Software Research Lab University

Weekend Effect Research

Annual General Practice and Primary Care Research Weekend

Touch Interface and Keylogging Malware - Semantic Scholar€¦ · Touch Interface and Keylogging Malware. IT Innovations 2015, Dubai, UAE. Cybersecurity Research Laboratory. Brigham

Research Article Malware Analysis Using …cavazos/cisc850-spring2017/...Research Article Malware Analysis Using Visualized Image Matrices KyoungSooHan, 1 BooJoongKang, 2 andEulGyuIm

Malware & Anti-Malware

FooCodeChu - Services for Software Analysis, Malware Detection, and Vulnerability Research

Kuluoz: Malware and botnet analysis - IDCportal.idc.ac.il/en/schools/cs/research/documents/shaked-bar.pdf · Kuluoz – malware and botnet analysis Shaked Bar, IDC, Hertzelia,

An alternative approach to malware research

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

NPR Weekend Edition Social Media Research

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Using File Relationships in Malware Classification File... · Using File Relationships in Malware Classification Nikos Karampatziakis, Cornell/Microsoft Jay Stokes, Microsoft Research

The Mac Malware of 2018 - Objective-See · The Mac Malware of 2018 a comprehensive analysis of the new mac malware of '18 January 1, 2019 Our research, tools, and writing, are supported

How Android Malware Fights (and we fight back!) or ... · PDF fileor Research on obfuscation in Android malware ... Basic4Android yet? ... (and we fight back!) or Research on obfuscation

Kharon dataset: Android malware under a microscope · Kharon dataset: Android malware under a microscope ... 1 Introduction Android malware have become a very active research

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Finding Malware on a Web Scale Ben Livshits Microsoft Research Redmond, WA

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

StealthWare – Social Engineering Malware...5 Jul 2015 4 StealthWare – Social Engineering Malware Research Approach Networking Reachability Detection Conclusion Introduction Having

Big Game Hunting - Peculiarities In Nation State Malware Research

Public Meeting to Discuss “Weekend Effect” Research

Challenges and Pitfalls in Malware Research

Android Malware Detection Based on System Calls · Android Malware Detection Based on System Calls ... malware detection has been an active area of research in the past several years,

Weekend Times Research

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

nullcon 2011 - Vulnerabilities and Malware: Statistics and Research for Malware Identification

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Research Article Detection of Malware Propagation in ...downloads.hindawi.com/journals/ijdsn/2015/530250.pdf · Research Article Detection of Malware Propagation in Sensor Node and