Upload File

xs boston 2008 malware & training

23
June 23, 2008 Stephen Brueckner ATC-NY Ithaca, NY Novel Applications of Novel Applications of Xen Xen : : Virtual Training & Virtual Training & Malware Evaluation Malware Evaluation ATC-NY Architecture Technology Corporation

Upload: the-linux-foundation

Post on 25-Jul-2015

375 views

Category:

Technology


2 download

Report

Tags:

TRANSCRIPT

Page 1: XS Boston 2008 Malware & Training

June 23, 2008

Stephen BruecknerATC-NY

Ithaca, NY

Novel Applications of Novel Applications of XenXen: : Virtual Training & Virtual Training &

Malware EvaluationMalware Evaluation

ATC-NYArchitecture Technology Corporation

Page 2: XS Boston 2008 Malware & Training

2ATC-NY 08-018 Xen Summit Boston 2008

Novel applicationsNot typical enterprise usageUser works both inside & outside VMsOne user interacts with many VMsMinimize external footprint inside VMs

User spaceMinimal changes to XenScripting using “xm” commands

IntroductionIntroduction

Page 3: XS Boston 2008 Malware & Training

3ATC-NY 08-018 Xen Summit Boston 2008

CYDEST (virtual training environment)Management interfaceAutomating access to VM internals

EXAMIN (malware testing environment)VM configuration toolVM introspection work

Started 3 and 2 years ago, respectively

ProjectsProjects

Page 4: XS Boston 2008 Malware & Training

4ATC-NY 08-018 Xen Summit Boston 2008

Inform you of our projects’ requirements

Show you the tools we developedDescribe Xen features we built upon

While seeking advice on alternatives

Provide feedback to Xen communityProblemsWish listsQuestions

ObjectivesObjectives

Page 5: XS Boston 2008 Malware & Training

5ATC-NY 08-018 Xen Summit Boston 2008

RealismReal attacks & defense toolsBoth network and hostsFull fidelity (not a simulator)

AvailabilityWeb accessUp 24/7/365

AutomationAuto-assessmentAutomated dynamic attacks

CYDEST: Cyber Defense TrainerCYDEST: Cyber Defense Trainer

Page 6: XS Boston 2008 Malware & Training

6ATC-NY 08-018 Xen Summit Boston 2008

CYDEST ArchitectureCYDEST Architecture

Page 7: XS Boston 2008 Malware & Training

7ATC-NY 08-018 Xen Summit Boston 2008

Goal: Maintain trainee’s situational awarenessGraphical representation (with labels)

Net topology, hostnames, IPs, OSsComponent Status (using colors)

VMs & bridges: “up,” down, booting/shutting downControls (buttons)

Start, Stop, VNCImplementation

Web-enabledManually configured

TraineeTrainee’’s Management Interfaces Management Interface

Page 8: XS Boston 2008 Malware & Training

8ATC-NY 08-018 Xen Summit Boston 2008

CYDEST Management GUICYDEST Management GUI

Page 9: XS Boston 2008 Malware & Training

9ATC-NY 08-018 Xen Summit Boston 2008

RequirementsAutomatableOut-of-band (network traffic not visible to trainee)Reliable (not network dependent)

SolutionSeparate networks (physical & virtual )Use guest’s serial consolesProgram to negotiate guest interaction

Consoles to control Windows VMsWindows serial console listener and shell

Unfortunately, violates guest sanctity

Monitor & Control ChannelsMonitor & Control Channels

Page 10: XS Boston 2008 Malware & Training

10ATC-NY 08-018 Xen Summit Boston 2008

CYDEST Network SeparationCYDEST Network Separation

Page 11: XS Boston 2008 Malware & Training

11ATC-NY 08-018 Xen Summit Boston 2008

open2xm.plAutomated console interactionsQueueing of access requestsExternal & internal timeoutsBuffering I/O (for processes, not humans)XML encapsulation (separation of stdout and sterr)Handles login (handles various users & prompts)Batch mode

ImplementationScripted using “xm console”Currently experimenting with Xen API (XML RPC)

Monitor & Control Channels (cont.)Monitor & Control Channels (cont.)

Page 12: XS Boston 2008 Malware & Training

12ATC-NY 08-018 Xen Summit Boston 2008

A testing/reverse engineering platform

Motivation:Closed-sourced software has uncertain pedigreeMay therefore include embedded malicious code

Virtualization is common approachVM detection currently an anti-tamper technique…Not anticipated to be an issue in the future

EXAMIN: EXAMIN: Exploit and Malware IncubatorExploit and Malware Incubator

Page 13: XS Boston 2008 Malware & Training

13ATC-NY 08-018 Xen Summit Boston 2008

Native kernels (HVMs)Stealthy malware may not execute in paravirt

E.g., LKM rootkit expecting “sysenter_entry”

ComponentsIncubator: the VM networkInstrumentation

Internal: standard toolsExternal: VM introspection

EXAMIN DesignEXAMIN Design

Page 14: XS Boston 2008 Malware & Training

14ATC-NY 08-018 Xen Summit Boston 2008

Objective:User-configurable heterogeneous VM network

Virtual Network Builder (VNB)Front-end topology editorBack-end VM provisioning

Linux (dead image manipulation)mount, chroot, rpm

Windows (provisioning live VMs)Because registry can’t be modified w/o Win API

EXAMIN Incubator CreationEXAMIN Incubator Creation

Page 15: XS Boston 2008 Malware & Training

15ATC-NY 08-018 Xen Summit Boston 2008

EXAMIN VNBEXAMIN VNB

Page 16: XS Boston 2008 Malware & Training

16ATC-NY 08-018 Xen Summit Boston 2008

High-assurance security monitoring servicesVM introspection of guest kernel’s memoryUsing XenAccess (open source introspection library)

Current services:Integrity checking kernel & processes

Code segmentsSpecific structures (IDT, system call table)“Mostly static” structures (module list)

Cross-view checkingHigh assurance versions of standard HIDSNIDS (not true VM introspection)

EXAMIN External InstrumentationEXAMIN External Instrumentation

Page 17: XS Boston 2008 Malware & Training

17ATC-NY 08-018 Xen Summit Boston 2008

EXAMIN: Bridging Semantic GapEXAMIN: Bridging Semantic Gap

Page 18: XS Boston 2008 Malware & Training

18ATC-NY 08-018 Xen Summit Boston 2008

AutomatedDetermine data structure layouts and magic numbers

Generalizable to most OSsImplemented for both Linux and Windows

Run same code on host and guestNo learning curve for a new language or APIEase porting of existing apps

Attend VMsec/CCS in October for detailsPaper submitted…

Bridging Semantic Gap: Bridging Semantic Gap: Preview of WIPPreview of WIP

Page 19: XS Boston 2008 Malware & Training

19ATC-NY 08-018 Xen Summit Boston 2008

EXAMIN: guest isolation guarantees importantContinuous security bug fixes Hypervisor inspection/validation concept practical?Others are working hard on this

Xen’s rapid developmentChanging APIsEmerging toolsBoth are poorly documented

ProblemsProblems

Page 20: XS Boston 2008 Malware & Training

20ATC-NY 08-018 Xen Summit Boston 2008

Faster serial console or equivalent channelEXAMIN’s cross-view checking needs to stream large pcap files from guest to host

Multiple serial consolesCYDEST’s queueing of simultaneous access requests isn’t optimal

Limit of >3 vif’s on a guest?Never mind…new Xen handles up to 8 vifs

Wish ListWish List

Page 21: XS Boston 2008 Malware & Training

21ATC-NY 08-018 Xen Summit Boston 2008

Are there other management interfaces we should look at?

We have unusual requirementsGraph-drawing capability for network topologyIntegrated remote VNC/shell accessDisplay & control of bridgesDisplay of VM internals (hostnames, IPs, OSs)Web browser interface

QuestionsQuestions

Page 22: XS Boston 2008 Malware & Training

22ATC-NY 08-018 Xen Summit Boston 2008

Are there other VM builders we should be considering?

MLN was originally UML, not a very active project

Our requirements:GUI network builderVM configuration: network, users, softwareSupport Linux and Windows

Questions (cont.)Questions (cont.)

Page 23: XS Boston 2008 Malware & Training

23ATC-NY 08-018 Xen Summit Boston 2008

Contact InformationContact InformationATC-NY Cornell Business & Technology Park33 Thornwood Drive, Suite 500Ithaca, NY 14850

Technical Contacts:Mr. Stephen Brueckner, PI

Dr. Frank Adelstein, Co-PI(607) 266-7118

(607) [email protected]

[email protected]

Management Contact:

Business Development Contact:Ms. Julie Baker

Mr. Gene Proctor(607) 266-7125

(202) 293-9701 [email protected]

[email protected]

mailto:[email protected]
mailto:[email protected]
mailto:[email protected]
mailto:[email protected]

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Using Information Economics & Spam to Thwart Malware Marshall Van AlstyneSarah Zatko Boston University & MITBoston University [email protected] [email protected]

Bring die Sonne nach Hause - GOODWE...Technische Daten GW700-XS GW1000-XS GW1500-XS GW2000-XS GW2500-XS GW3000-XS PV String Eingangsdaten Max. DC Eingangsleistung (W) 910 1300 1950

ESTUDIO HH (PARTE A) - PR.gov - Portal Oficial del …€¦ · Flwre 1 0: ark-Noda Bdatro - unnarmd 2 . Flgure 11 : xs 35.5 "(S 35.4 OFFBITE xs 35.3 xs 35 xs 35.2 xs 34 '(S 35.1 xs

XS Boston 2008 XenLoop

hoikhuyenhoc.angiang.edu.vnhoikhuyenhoc.angiang.edu.vn/DesktopModules/NEWS/DinhKem/79_T… · XS Khá Tôt Khá xs Khá XS Khá xs xs Khá Tôt Tôt Khá Khá Khá Khá Khá Tôt

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

XS Boston 2008 Paravirt Ops in Linux IA64

XS-35 XTRA 1008130 XS-40 XTRA Series

€¦ · sek sternkreuz fortsetzung / continuation citizen citizen referenz-nr. order- mb xs xs xs xs xs xs xs xs xs xs xac xac xag xac xac xac xag xac xac xac xac xac xag xac xac

SoundWare XS Digital Cinema - Boston · PDF fileSoundWare XS Digital Cinema Surround Sound Speaker System ... and can radiate radio frequency energy and, if ... • Dedicated music

SoundWare XS Digital Cinema - Boston Acoustics€¦ · SoundWare XS Digital Cinema Surround Sound Speaker System Español Sistema de parlantes multi-canal / Manual de propietario

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

XS Boston 2008 Self IO Emulation

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

XS C2 / XS C4ppp XSpC4pppM12

XS 2008 Boston Project Snowflock

SoundWare XS Digital Cinema - Boston Acoustics AP€¦ · Thanks for choosing Boston Acoustics and selecting the SoundWare XS Digital Cinema as ... subwoofer features 8-inch ... Audio

XS SERIES USER MANUAL - GOODWE · 2020. 11. 22. · GW700-XS/GW1000-XS/GW1500-XS GW2000-XS/GW2500-XS/GW3000-XS Recommended circuit breaker specifications 16A 25A Note: it is not

Data Structures UW CSE 190p Summer 2012. >>> xs = range(3) >>> xs = [1,2,3] >>> xs = [‘a’,’b’,’c’] >>> xs = [1, ‘a’, 3] >>> xs = [[1,2,3], [‘a’,’b’,’c’]]

XS Energy Drink - XS Ενεργειακό Ποτό

XS 2008 Boston VTPM

SoftGloss XS RYKO Manufacturing Company. SoftGloss XS

S90 XS/S70 XS Reference Manual

XS Boston 2008 Guest Spinning

S90 XS/S70 XS Owner’s Manual

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

XS Boston 2008 Stub Domains

5.1 Home Theater Speakers - Boston Acousticsowner’s manual / safety instructions / compliance information 5.1 home theater speakers soundware xs special edition home theater speakers

XS Boston 2008 Memory Overcommit

XS Boston 2008 Networking Direct Assignment

PDF Compressor - ktkthcm.edu.vnktkthcm.edu.vn/uploads/Phong CTCT-HSSV/Files... · 3.27 3.27 3.20 3.20 3.13 3.13 3.05 3.00 KQ Khá Khå ,xs Tét T6t Khá Khá xs Khá xs ,xs XS xs

XS Boston 2008 Fault Tolerance

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………