CEHv8 Module 07 Viruses and Worms.pdf

Viruses Viruses and Worms rms Module Modu le 07 07

Ethical Hacking and Countermeasures Viruses Viruses and Worm s

Exam 312-50 Certified Ethical Hacker

V i r u s e s a n d W o r m s M o d u le 0 7

Engineered by Hackers. Presented by Professionals.

M

E th ic a l H a c k in g

a n d

C o u n t e rm e a s u re s v 8

M o d u l e 0 7 : V ir ir u s e s a n d W o r m s Exam 312-50

Mo dule 07 Page Page 1007

Ethical Hacking and Coun termea sures Copyright © by EC-C0li EC-C0linCil nCil All Rights Reserved. Reproduction is Strictly Prohibited.



CEH

Security Securi ty New s I GlobalRese arch

Home

Products

About

5«rv*cc 5«rv*ccss

Octo ber 19, 201 2

Global Cyber-Warfare Tactic s: New Flame-linked M a l w a r e u s e d i n “ C y b e r - Es Es p i o n a g e ” A new cyb er espionage program linked to the noto rious Flame and Gauss m alware has been detecte d by Russia' Russia'ss Kaspersky Kaspersky Lab. Lab. The anti-virus giant's chief warns that global cyber w arfare is in "full s wing " and w ill probably escalate in 2013. 2013. The virus, dubbed m iniFlame, and also know n as SPE, SPE, has has already infec ted com puters in Iran, Lebanon, France, France, the U nited States and Lithuania. It was discovered in July July 2012 and is described described as "a s mall and highly flexible malicious malicious program designed Kaspersky Lab said said in a statem ent po sted to steal data and control infecte d systems systems during target ed cyber espionage espionage operations," Kaspersky o n i t s w e b s i te te . The malw are was originally identified as an appendage of Flame - the program used for targeted cyber espionage in the the M iddle East and acknow ledged to be part o f join t US -lsraeli -lsraeli effor ts to underm ine Iran's nuclear program. But later, Kaspersky Kaspersky Lab analysts discovered tha t miniFlam e is an "interoperable tool that could be used as an independent malicious malicious program , o r concurrently as as a plug-in fo r both th e Flame and Gauss Gauss malw are." ^ ^ ^ ^ T h e a n a l y s i s a l so so s ho ho w e d n e w e vi vi de de nc nc e o f c o o p e ra ra t io io n b et et w e e n t h e c r ea ea t o orr s o f F la la me me a n d G a u s s ^ ^ ^ ^ ^ —

ht tp ://w ww. globa/rese globa/research, arch, ca ca Copyright © by EC-C EC-Cauactl. auactl. All Rights Reserved. Reserved. Reproduction is Strictly Prohibit ed.

S e c u r i ty ty N e w s an

M

M

G l o b a l C y b e r - W a r f a r e T a c t ic s : N e w

F la m e - lin k e d

M a lw a r e u s e d in “ C y b e r-E s p io n a g e ” Source: h t t p : / / w w w . g l o b a l r e s e a r c h . c a A new cyber espionage program linked to the notorious Flame and Gauss malware has been d e t e c t e d b y R u s si si a' a' s K a s p er er s k y L ab ab . T he he a n t i v i r u s g i a n t ' s c h i e f w a r n s t h a t g l o b a l c y b e r w a r f a r e is in "full swing" and probably escalate in 2013. The virus, dubbed miniFlame, and also known as SPE, has already infected computers in Iran, Lebanon, France, the United States, and Lithuania. It was discovered in July 2012 and is described as "a small and highly flexible malicious program designed to steal data and control infected systems during targeted cyber espionage operations," Kaspersky Lab said in a statement posted on its website. The malware was originally identified as an appendage of Flame, the program used for t a r g e t e d c y b e r e s p i o n a g e i n t h e M i d d l e E as as t a n d a c k n o w l e d g e d t o b e p a r t o f j o i n t U S - l sr sr a el el i e f f o r t s t o u n d e r m i n e I r a n' n' s n u c l e a r p r o g r a m .

Module 07 Page 1008

Ethical Hacking and Countermeasures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.



B u t l a te te r , K a s p e rs r s k y La La b a n a l ys ys t s d i s c o v e r e d t h a t m i n i F l a m e is a n " i n t e r o p e r a b l e t o o l t h a t c o u l d be used as an independent malicious program, or concurrently as a plug-in for both the Flame a n d G au au s s m a l w a r e . " The analysis also showed new evidence of cooperation between the creators of Flame and Gauss, as both viruses can use miniFlame for their operations. " M i n i F l a m e ' s a b i l i t y t o b e u s e d as as a p l u g - in in b y e i t h e r F l a m e o r G a us us s c l e a r l y c o n n e c t s t h e c o l l a b o r a t i o n b e t w e e n t h e d e v e l o p m e n t t e a m s o f b o t h F l a m e a nd n d G au au ss ss . S in in c e t h e c o n n e c t i o n between Flame and Stuxnet/Duqu has already been revealed, it can be concluded that all these advanced threats come from the same 'cyber warfare' factory," Kaspersky Lab said. H ig h -p r e c is io n

a t ta c k t o o l

S o f a r j u s t 5 0 t o 6 0 c as a s es es o f i n f e c t i o n h a v e b e e n d e t e c t e d w o r l d w i d e , a c c o r d i n g t o K a s p e r s ky ky L ab ab . B u t u n l i k e F l a m e a n d G a us us s , m i n i F l a m e i n m e a n t f o r i n s t a l l a t i o n o n m a c h i n e s a l r e a d y i n f e c t e d b y t h o s e v i r u s es es . " M i n i F l a m e is a h ig i g h - p r e c i s i o n a t t a c k t o o l . M o s t l i ke ke l y i t is is a t a r g e t e d c y b e r w e a p o n u s e ed d in w h a t c a n b e d e f i n e d a s t h e s e c o n d w a v e o f a c y b e r a t t a c k , " K a s p er e r s k y' y' s C h i e f S e c u r i ty ty E x p e r t A l e x a n d e r G o s t e v e x p l a in in e d . " F i r s t , F l a m e o r G au au s s a r e u s e d t o i n f e c t a s m a n y v i c t i m s a s p o s s i b l e t o c o l l e c t l a r g e q u a n t i t i e s of information. After data is collected and reviewed, a potentially interesting victim is defined a n d i d e n t i f i e d , a n d m i n i F l a m e i s i n s t a llll e d i n o r d e r t o c o n d u c t m o r e i n - d e p t h s u r v e i l l a n c e a n d cyber-espionage." T h e n e w l y - d i s c o v e r e d m a l w a r e c a n a ls ls o t a k e s c r e e n s h o t s o f an an i n f e c t e d c o m p u t e r w h i l e i t is is running a specific program or application in such as a web browser, Microsoft Office program, Adobe Reader, instant messenger service or FTP client. Kaspersky Lab believes miniFlame's developers have probably created dozens of different m o d i f ic ic a t i o n s o f t h e p r o g r a m . " A t t h is i s t i m e , w e h a vve e o n l y f o u n d s ix ix o f th th e s e , d a t e d 2 0 1 0 - 2 0 1 1 , " t h e f i r m s ai a i d. d. ‘ C y b e r w a r f a r e i n f u ll s w i n g ’ Meanwhile, Kaspersky Lab's co-founder and CEO Eugene Kaspersky warned that global cyber warfare tactics are becoming more sophisticated while also becoming more threatening. He urged governments to work together to fight cyber warfare and cyber-terrorism, Xinhua news agency reports. S p e a k in in g a t a n I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n T e l e c o m W o r l d c o n f e r e n c e i n D ub ub a i, i, t h e a n t i v i r u s t y c o o n s a id id , " c y b e r w a r f a r e is i n f u l l s w i n g a n d w e e x p e c t i t t o e s c a l a t e i n 2 0 1 3 . " "The latest malicious virus attack on the world's largest oil and gas company, Sau di Aramco, last August shows how dependent we are today on the Internet and information technology in g e n e r a l , a n d h o w v u l n e r a b l e w e a r e , " K a s p er e r s ky k y s ai ai d. d. He stopped short of blaming any particular player behind the massive cyber-attacks across the M i d d l e E as as t, t, p o i n t i n g o u t t h a t " o u r j o b i s n o t t o i d e n t i t y h a c k e r s o r c y b e r - t e r r o r i s t s . O u r f i r m is

Module 07 Page 1009




like an X-ray machine, meaning we can scan and identify a problem, but we cannot say who or what is behind it." Iran, who confirmed that it suffered an attack by Flame malware that caused severe data loss, b l a m e s t h e U n i t e d S t a t e s a n d I s ra ra el el f o r u n l e a s h i n g t h e c y b e r - a t t a c k s .

C o p y r i g h t © 2 0 0 5 - 2 0 1 2 G l o b a lR lR e s e a r c h . c a B y R u s s ia ia T o d a y

http://www.globalresearch.ca/global-cyber-warfare-tactics-new-flame-linked-malware-used-incyber-espionage/5308867

Module 07 Page 1010




CEH

M odule odul e Ob j ectives J

Introducti on to Viruses

J

Comp uter Wo rms

J

Stages of Virus Life

J

Wo rm Analys is

J

Work ing of Viruses

J

Wo rm Maker

J

Indications of Virus Attack

J

Ma lwa re Analysis Pro cedure

J

How do es a Co mp uter Get Infected by Viruses

J

Online Ma lwa re Analysis Services

y

Virus Virus Analysis Analysis

J

Virus and Wo rm s Coun terme asures

J

Types of Viruses

J

Antivirus Tools

J

Virus M aker

J

Penet ration Testing for Virus

Copyright Copyright © by

Reproduction is Strictly Prohibit ed. EC-Cauactl.All Rights Reserved. Reproduction

M o d u l e O b j e c ti ti v e s T h e o b j e c t i v e o f th th i s m o d u l e i s t o e x p o s e y o u t o t h e v a r i o u s v ir ir u s e s a n d w o r m s a v a i l ab a b l e t o d a y . I t g i ve ve s y o u i n f o r m a t i o n a b o u t a llll th th e a v a i l a b l e v i r u se s e s a n d w o r m s . T h is is m o d u l e e x a m i n e s t h e w o r k i n g s o f a c o m p u t e r v i ru ru s , i ts ts f u n c t i o n , c l a s s i f ic ic a t i o n , an an d t h e m a n n e r i n w h i c h it affects systems. This module will go into detail about the various countermeasures available t o p r o t e c t a g a i n s t t h e s e v i r u s i n f e c ti t i o n s . T h e m a i n o b j e c t i v e o f t h is is m o d u l e i s t o e d u c a t e y o u a b o u t t h e a v a i l ab a b l e v i ru r u s e s a nd n d w o r m s , i n d i c a t i o n s o f t h e i r a t t a c k an an d t h e w a y s t o p r o t e c t against various viruses, and testing your system or network against viruses or worms presence. This module will familiarize you with: 0

I n t r o d u c t i o n t o V i ru ru s e s

0

Computer Worms

0

Stages of Virus Life Life

0

W o r m A n al al y si si s

0

W o r k i n g o f V ir i r u se se s

0

W o r m M a k er er

0

I n d i c a t i o n s o f V i r us us A t t a c k

0

M a l w a r e A n a ly ly s i s P r o c e d u r e

0

How

0

O n l i n e M a l w a r e A n a l y s i s S e r vi vi c es es

0

V i ru r u s a nd nd W o r m s

Does

a

Co mp uter

Viruses? 0

Virus Analysis

0

Types of Viruses

Modut odute0 e07 7

!M a k e r

Get

Infected

by

Countermeasures 0

A n t i v i r u s T o o ls ls

E th ic a l H ac a c ki k if ^ a n P ^ f i t F i S t i a n e T e ^ Q g t f e f y V i F W f i llll C i l All Rights Reserved. Reproduction is Strictly Prohibited.



Module Flow Flow

Virus and Worms Concepts

Ty p e s o f Viruses

Penetration Testing

Computer Worms

Countermeasures

Malware Analysis


Reproduction is Strictly Prohibit ed. E&Ctlllcil.All Rights Reserved. Reproduction

M o d u l e F lo lo w T h is is s e c t i o n i n t r o d u c e s y o u t o v a r i o u s v ir ir u s e s a nd n d w o r m s a v a i l a b le l e t o d a y a n d g i v es es y o u a b r i e f o v e r v i e w o f e a c h v i ru ru s a n d s t a t i s t i c s o f v ir ir u s e s a n d w o r m s i n t h e r e c e n t y e a r s. s . I t l is i s ts ts v a r i o u s t y p e s o f v i r u s es e s a n d t h e i r e f f e c t s o n y o u r s y s t e m . T h e w o r k i n g o f v i ru ru s e s i n e a c h p h a s e has will be discussed in detail. The techniques used by the attacker to distribute malware on the web are highlighted.

Malware Analysis

V i ru r u s a n d W o r m s C o n c ep ep t

, •

Types of Viruses

/—

Compute Computerr Worms

V

f|j||

Countermeasures

^

Penetration Testing Testing

—

Module 07 Page 1012




Introducti Introduction on to V iru se s

C EH

_l A virus is is a self-replicating program tha t produces its own c opy by attaching itself to another program, program, computer boot sector or document J

Viruses a re generally trans mitted through file d ownl oads , infected disk/flash drives and as email attach ments

Virus Characteristics

Infects Other Program

Alters Data

Corrupts Files and Programs

Transforms Itself

m

F*

Encrypts Itself

m


Self Propagates

V %

% # 1 f §

1


I n t r o d u c t i o n t o V i ru ru s e s C o m p u t e r v ir ir u s e s h a v e t h e p o t e n t i a l t o w r e a k h a v o c o n b o t h b u s i n es es s an an d p e r s o n a l c o m p u t e r s . W o r l d w i d e , m o s t b u s in i n e s se se s h a v e b e e n i n f e c t e d a t s o m e p o i n t . A v i r u s is is a s e lf lf replicating program that produces its own code by attaching copies of it into other executable c o d e s . T h i s v i r u s o p e r a t e s w i t h o u t t h e k n o w l e d g e o r d e s i r e o f t h e u s e r . L i ke ke a r e a l v i r u s , a c o m p u t e r v i ru r u s is is c o n t a g i o u s a n d c an a n c o n t a m i n a t e o t h e r f i le le s . H o w e v e r , v ir ir u s e s c a n i n f e c t outside machines only with the assistance of computer users. Some viruses affect computers as soon as their code is executed; other viruses lie dormant until a pre-determined logical c i r c u m s t a n c e i s m e t . T h e r e a r e t h r e e c a t e g o r i e s o f m a l i c io io u s p r o g r a m s : 0

Trojans and rootkits

0

Viruses

0

Worms

A w o r m i s a m a l i c i o u s p r o g r a m t h a t c a n in in f e c t b o t h l oc oc a l a n d r e m o t e m a c h i n e s . W o r m s s p r e a d a u t o m a t i c a l l y b y i n f e c t i n g s y s te te m a f t e r s y s t e m in in a n e t w o r k , a n d e v e n s p r e a d i n g f u r t h e r t o other networks. Therefore, worms have a greater potential for causing damage because they do not rely on the user's actions for execution. There are also malicious programs in the wild t h a t c o n t a i n a llll o f t h e f e a t u r e s o f t h e s e t h r e e m a l ic i c i o u s p r o g ra ra m s .

Module 07 Page 1013




Viru Vi russ and Worm Statist Sta tistics ics

75,000,000

60,000,000

45,000,000

30,000,000

15,000,000

2008

2010

2011

2012 http://www. http://www.av-test.org


Reserved. Reproduction Reproduction is Strictl y Prohibited. E&Ctinctl.All Rights Reserved.

^ V i r u s a n d W o r m S t a ti t i s ti ti c s Source: h t t p : / / w w w . a v - t e s t . o r g T h is is g ra ra p h i c a l r e p r e s e n t a t i o n g i v e s d e t a i l e d i n f o r m a t i o n o f t h e a t t a c k s t h a t h a v e o c c u r r e d i n t h e r e c e n t y e a rs rs . A c c o r d i n g t o t h e g r a p h , o n l y 1 1 ,,6 6 6 6 , 6 6 7 s y s t e m s w e r e a f f e c t e d b y v ir ir u s e s a nd nd worms in the year 2008, whereas in the year 2012, the count drastically increased to 70,000,000 systems, which means that the growth of malware attacks on systems is increasing expo nentially year by year.

Module 07 Page 1014




75.000.000

60.000.000

45.000.000

30.000.000

15.000.000

0 2008

2009

2010

2011

2012

FIGURE 7.1: 7.1: Virus and and Wo rm Statistics


Ethical Hacking and Coun termea sures Copyright © by EC-C EC-COU OUIlC IlCilil All Rights Reserved. Reproduction is Strictly Prohibited.



Design Developing virus

Replication Virus replicates for

Launch It gets activated with the user performing

code using

a period period of time

programming

within the target

languages or

system and then

certain actions such as running an

construction kits

spreads itself

infected program

Incorporation

Detection

Users install

Elimination

A n t i v ir ir u s s o f t w a r e

A virus is identified

antivirus updates and eliminate the

developers

as threat infecting

assimilate defenses

target systems

virus threats

against the virus

S t a g e s o f V i r u s L i fe fe C o m p u t e r v i r u s a tt t t a c k s s p re re a d t h r o u g h v a r i o u s s ta t a g es es f r o m i n c e p t i o n t o d e s i g n t o elimination.

1.

Design: A v ir ir u s c o d e i s d e v e l o p e d b y u s in in g p r o g r a m m i n g l a n g u a g es e s o r c o n s t r u c t i o n k it i t s. s. A n y o n e w i t h b as as ic ic p r o g r a m m i n g k n o w l e d g e c an a n c r e a te t e a v ir i r us us .

2.

Replication: A v ir ir u s f i r s t r e p l ic ic a t e s i t s e l f w i t h i n a t a r g e t s y s t e m o v e r a p e r i o d o f t i m e .

3.

Launch: It is activated when a user performs certain actions such as triggering or running an infected program.

4.

Detection: A virus is identified as a threat infecting target systems. Its actions cause considerable d a m a g e t o t h e t a r g e t s y s t e m ' s d at at a .

Module 07 Page 1016



5.


Incorporation: Antivirus software developers assemble defenses against the virus.

6.

Elimination: Users are advised to install antivirus software updates, thus creating awareness among user groups

Module 07 Page 1017




Working of Viru Viruses ses: : Infe Infect ctio ion n Phase Infection Phase

J

In the infection phase, the virus repl icates itself and attaches to an .exe file in the system

Before Infection

After Infection

* Clean File

Virus Infected File


Reproduction is Strictly Prohibit ed. EG-G0llicil.All Rights Reserved. Reproduction

W o r k i n g o f V i ru ru s e s : I n f e c t i o n P h a s e Viruses

attack

a

target

host's

system

by

using

various

methods.

They

attach

t h e m s e l v e s t o p r o g r a m s a n d t r a n s m i t t h e m s e l v e s t o o t h e r p r o g r a m s b y m a k i n g u s e o f c e r ta ta i n events. Viruses need such events to take place since they cannot: ©

Self sta rt

©

Infect othe r hardware

©

C a us us e p h y s i c a l d a m a g e t o a c o m p u t e r

©

T r a n s m i t t h e m s e l v e s u s in i n g n o n - e x e c u t a b l e f ilil e s

G e n e r a l l y v i r us u s e s h a v e t w o p h as a s e s, s, t h e i n f e c t i o n p h a s e a n d t h e a t t a c k p h a s e . I n t h e i n f e c t i o n p h as as e , t h e v i r u s r e p l i c a t e s i t s e l f a n d a t t a c h e s t o a n . e x e f ilil e i n t h e s y s t e m . Programs modified by a virus infection can enable virus functionalities to run on that system. Viruses get enabled as soon as the infected program is executed, since the program code leads t o t h e v i r u s c o d e. e. V i r u s w r i t e r s h a v e t o m a i n t a i n a b a l a n c e a m o n g f a c t o r s s u c h as as : ©

H o w w i l l t h e v i r u s i n f e c t? t?

©

How will it spread?

©

H o w w i llll it it r e si si d de e in in a t a r g e t c o m p u t e r ' s m e m o r y w i t h o u t b ei ei n ng g detected?


Ethical Hacking and Coun termea sures Copyright © by EC-C0 EC-C0Un UnCi Cill All Rights Reserved. Reproduction is Strictly Prohibited.



O b v i o u s l y , v i r us us e s h a v e t o b e t r i g g e r e d a n d e x e c u t e d i n o r d e r t o f u n c t i o n . T h e r e a r e m a n y w a y s to execute programs while a computer is running. For example, any setup program calls for n u m e r o u s p r o g r a m s t h a t m a y b e b u i l t i n t o a s y s te t e m , a n d s o m e o f t h e s e a re re d i s t r i b u t i o n m e d i u m p r o g r a m s . T h u s , i f a v i r u s p r o g r a m a l r e a d y e xi x i s ts ts , i t ca ca n b e a c t i v a t e d w i t h t h i s k i n d o f execution and infect the additional setup program as well. There are virus programs tha t infect and keep spreading every tim e they are executed.

Some

p r o g r a m s d o n o t i n f e c t t h e p r o g r a m s w h e n f i r s t e x e c u t e d . T h e y r e si s i d e in in a c o m p u t e r ' s m e m o r y and infect programs at a later time. Such virus programs as TSR wait for a specified trigger event to spread at a later stage. It is, therefore, difficult to recognize which event might trigger t h e e x e c u t io i o n o f a d o r m a n t v i r u s i n f e c ti ti o n . R e f e r t o t h e f i g u r e t h a t f o l l o w s t o s ee ee h o w t h e EXE f i le le i n f e c t i o n w o r k s . In the following figure, the .EXE file's header, when triggered, executes and starts running the application. Once this file is infected, any trigger event from the file's header can activate the virus code too, along with the application program as soon as it is run. Q

A f i l e v i r u s in in f e c t s b y a t t a c h i n g i t s e l f t o a n e x e c u t a b l e s y s t e m a p p l i c a t i o n p r o g r a m . T e x t files such as source code, batch files, script files, etc., are considered potential targets for virus infections.

©

B o o t s e c t o r v i ru ru s e s e x e c u t e t h e i r o w n c o d e i n t h e f i r s t p l a c e b e f o r e t h e t a r g e t PC PC is booted

Before Infection

After Infection

.exe

N

_ u

Clean File

Virus Infected File

FIGURE 7.2: Working of Viruses in Infection Phase

Module 07 Page 1019




Working of Viru Viruse ses: s: Attack

r cu V t

D U o q p ^ ^

11

Ur t fW< ttkxjl NmIm

J

Viruses a re progr ammed with trigger ev ents to activ ate and c orrupt systems

J

Some viruses infect each tim e t hey a re run and o thers infect only w hen a cer tain predefined condition is met such as a user's specific task, a day, time, or a particular event

Unf ragmented File Before Att Att ack File: A

Page: 1

1

Page:2

J _____________ 1 Page:3

A

A

11

File: B

1

P age:2

Page: 1

P age :3

File Fragmented Due to Virus Att ack Page: 1 File: A

P age:3 File: B

P a g e :3 File: A

Page: 1 File: B


P age:2 File: B

P a g e :2 File: A

Reproduction is Strictly Prohibit ed. E&Cauactl. All Rights Reserved. Reproduction

W o r k i n g o f V i ru ru s e s : A t t a c k P h a s e Once viruses spread themselves throughout the target system, they start corrupting t h e f i l e s a n d p r o g r a m s o f t h e h o s t s y s t e m . S o m e v i ru ru s e s h a v e t r i g g e r e v e n t s t h a t n e e d t o b e activated to corrupt the host system. Some viruses have bugs that replicate themselves, and p e r f o r m a c t i v i t ie ie s s u c h as as d e l e t i n g f i l e s a n d i n c r e a s i n g s e s s io io n t i m e . They corrupt their targets only after spreading as intended by their developers. Most viruses t h a t a t t a c k t a r g e t s y s t e m s p e r f o r m a c t i o n s su s u c h as as : Q

D e l e t i n g f i le le s a nd nd a l t e r i n g c o n t e n t i n d a t a fifi le le s , t h e r e b y c a u s in in g t h e s y s t e m t o s l o w down

e

Perform ing

ta ta s k s

not

related

to

applications,

s uc uc h

as as

p l a y in in g

music

and

c r e a t in in g

animations

Module 07 Page 1020




U n f r a g m e n t e d F il e B e f o r e A t t a c k

File: A

Page: 1

Page: 2

File: B

Page: 3

Page: 1

Page: 2

Page: 3

A

F i le l e F r a g m e n t e d D u e t o V ir ir u s A t t a c k

Page: 1 File: A

Page: 3 File: B

Page: 1 File: B

Page: 3 File: A

Page: 2 File: B

A

Page: 2 File: A A

FIGURE 7.3: Working of Viruses in Attack Phase

R e f e r t o t h i s f i g u r e , w h i c h h as as t w o f i l e s , A a n d B. B. In In s e c t i o n o n e , t h e t w o f i l e s a r e l o c a t e d o n e after the other in an orderly fashion. Once a virus code infects the file, it alters the positioning o f t h e f i le le s t h a t w e r e c o n s e c u t i v e l y p l a ce c e d , t h u s l e a d i n g t o i n a c c u r a c y i n f i le le a l l o c a t i o ns ns , c a u s i n g t h e s y s t e m t o s l o w d o w n a s u se s e rs rs t r y t o r e t r i e v e t h e i r fi fi l es es . I n t h i s p h a s e: e: ©

V i ru ru s e s e x e c u t e w h e n s o m e e v e n t s a r e t r i g g e r e d

0

S o m e e x e c u t e an a n d c o r r u p t v ia ia b u i l t - in in b u g p r o g r a m s a f t e r b e i n g s t o r e d i n t h e h o s t ' s memory

0

M o s t vi vi r u s e s a r e w r i t t e n t o c o n c e a l t h e i r p r e s e nc nc e , a t t a c k i n g o n l y a f t e r s p r e a d i n g i n t h e host to the fullest extent

Module 07 Page 1021




W h y Do D o Peopl eople e Create Compu Co mpute ter r Viruses

r cu |

UrtifWd

ttkiul Km Im

Comp Co mput uter er Viruses Inflict damage to competitors

J J J

Financial benefits Research projects

Play prank

Vandalism

Cyber terrorism Distribute political messages

Vulnerable System


Reproduction is Strictly Prohibit ed. E&Cauactl. All Rights Reserved. Reproduction

W h y D o P e o p l e C r e a t e C o m p u t e r V i ru ru s e s ? Source: h t t p : / / w w w . s e c u r i t y d o c s . c o m C o m p u t e r v i r us u s e s ar ar e n o t s e lf lf - g e n e r a t e d , b u t a r e c r e a t e d b y c y b e r - c r i m i n a l m i n d s , i n t e n t i o n a l l y designed to cause destructive occurrences in a system. Generally, viruses are created with a disreputable motive. Cyber-criminals create viruses to destroy a company's data, as an act of v a n d a l i s m o r a p r a n k , o r t o d e s t r o y a c o m p a n y ' s p r o d u c t s . H o w e v e r , i n s o m e c as a s es es , v i r u se se s a r e actually intended to be good for a system. These are designed to improve a system's performance by deleting previously embedded viruses from files. S o m e r e a s o n s v i r u se se s h a v e b e e n w r i t t e n i n c l u d e : e

I n f lili c t d a m a ge ge t o c o m p e t i t o r s

e

R e s e a rc rc h p r o j e c t s

0

Pranks

Q

Vandalism

e

Attack the products of specific companies

©

Distribute political messages

0

Financial gain

Module 07 Page 1022



Q

Iden tity the ft

Q

Spyware

Q

Cryptoviral exto rtion

Module 07 Page 1023



Ethical Hacking and Counterm easures Viruses Viruses and Worm s

Exam Exam 312-50 Certified Ethical Hacker

Processes take take mo re resources and time

C o m p u t e r s l ow ow s down when programs start

Computer freezes frequently or encounters error

I n d i c a t i o n s o f V i ru r u s A t ta ta c k s An effective virus tends to multiply rapidly and may infect a number of machines within three to five days. Viruses can infect Word files which, when transferred, can infect the m a c h i n e s o f t h e u s e r s w h o r e c e i ve v e t h e m . A v i r u s ca c a n a ls ls o m a k e g o o d u se se o f f i le le s e r v e rs rs i n o r d e r t o i n f e c t f ilil e s . T h e f o l l o w i n g a r e i n d i c a t io io n s o f a v i r u s a t t a c k o n a c o m p u t e r s y s t e m : Q

P r o g r a m s t a k e l o n g e r t o lo lo a d

Q

The hard drive is always full, even wit ho ut installing any programs

Q

T h e f l o p p y d i s k d r i v e o r h a r d d r i v e r u n s w h e n i t is is n o t b e i n g us us e d

9

U n k n o w n f i le le s k e e p a p p e a r i n g o n t h e s y s t e m

0

T h e ke k e y b o a r d o r t h e c o m p u t e r e m i t s s t ra r a n g e o r b e e pi p i n g s o u nd nd s

Q

T h e c o m p u t e r m o n i t o r d i sp s p l a ys ys s t r a n g e g r a p h i c s

Q

F ilil e n a m e s t u r n s t r a ng ng e , o f t e n b e y o n d r e c o g n i t i o n

Q

T h e h a r d d r i v e b e c o m e s i n a c c e s s i b le le w h e n t r y i n g t o b o o t f r o m t h e f l o p p y d r i v e

©

A p r o g r a m ' s s iz iz e k e e p s c h a n g i n g

Q

T h e m e m o r y o n t h e s y s te t e m s e e m s t o b e in in us us e a n d t h e s y s t e m s l o w s d o w n

Module 07 Page 1024




H o w does a Compute Comp uter r Get Get Infe Infect cted ed by Viruses Whe n a user accepts accepts file files s and dow nloads w ithout checking checking properlyforthe source

ing infected e-mail attachm ents

Installing Installing pirated pirated so ftwa re

Not upda tingand not installing installing new versions of plug-i plug-ins ns

: running the latest anti-virus anti-virus application

Copyright © by EC-C EC-Cauactl. auactl. All Rights Reserved. Reserved. Reproduction is Strictly Prohibited.

H ow D o e s a C o m p u t e r G e t I n fe c t e d b y V i ru s e s ? T h e r e a r e m a n y w a y s i n w h i c h a c o m p u t e r g e t s in in f e c t e d b y v i ru ru s e s . T h e m o s t p o p u l a r m e t h o d s a r e as as f o l l o w s : ©

W h e n a u s e r a c c e p t s f i le le s a n d d o w n l o a d s w i t h o u t c h e c ki k i n g p r o p e r l y f o r t h e s o ur ur c e .

©

A t t a c k e r s u s u a l l y s e n d v i r u s - i n f e c t e d f i le le s as as e m a i l a t t a c h m e n t s t o s p r e a d t h e v i r u s o n t h e v i c t i m ' s s y s t e m . I f t h e v i c t i m o p e n s t h e m a i l , th th e v i r u s a u t o m a t i c a l l y i n f e c t s t h e system.

©

A t t a c k e r s i n c o r p o r a t e v ir ir u s e s i n p o p u l a r s o f t w a r e p r o g r a m s a n d u p l o a d t h e i n f e c t e d software on websites intended to download software. When the victim downloads i n f e c t e d s o f t w a r e a n d i n s t a llll s it i t , th th e s y s t e m g e t s i n f e c t e d .

©

F a ilil in i n g t o i n s t al al l n e w v e r s io io n s o r u p d a t e w i t h l a t e s t p a t c h e s i n t e n d e d t o f ix ix t h e k n o w n b u g s m a y e x p o s e y o u r s y s t e m t o v i r us us e s .

©

W i t h t h e i n c r e a s i n g t e c h n o l o g y , a t t a c k e r s a l so so a r e d e s i g n i n g n e w v i r u s e s . F ai ai l in in g t o u s e latest antiv irus applications may expose you to virus attacks

Module 07 Page 1025




C o m m o n T e c h n i q u e s U s e d to to D i s t ri ri b u te M a l w a r e o n t h e W e b

H

B l a c k h a t S e ar ar c h E n g i n e Optimization (SEO)

CEH

Malvertising

Ranking malware pages highly in search results

Embedding malware in ad-networks ad-networks that display across hundreds of legitimate, high-traffic high-traffic sites

Social Engineered Click-jacking

Compromised Legitimate Websites

Tricking users into clicking cli cking on innocent-looking webpages

Hosting Hosting embedded malw are that spreads to unsuspecting visitors

S p e a r p h i s h i n g S i t es es

Drive-by Downloads

Mimicking legitimate institutions, such as banks, in an attempt to steal account login credentials

Exploiting flaws in browser software to install malware just by by visiting visiting a web page page

^ jl.

Source: Security Threat Report 2012 ( http://www.sophos.com http://www.sophos.com)) Copyright Copyright © by

^


C o m m o n T e c h n i q u e s U s e d t o D i s t r ib ib u t e M a l w a r e o n th e W eb

S o u rc rc e : S e c u r i t y T h r e a t R e p o r t 2 0 1 2 ( h t t p : / / w w w . s o p h o s . c o m )

Blackhat Search Engine Optimization (SEO): U s i n g t h i s t e c h n i q u e t h e a t t a c k e r r a n k s m a l w a r e pages high in search results

Social Engineered Click-jacking: T h e a t t a c k e r s t r i c k t h e u s e r s i n t o c l i c k i n g o n i n n o c e n t - l o o k i n g w e b p ag a g es es t h a t c o n t a i n m a l w a r e is t e c h n i q u e is u s e ed d f o r m i m i c k i n g l e g i t i m a t e i n s t i t u t i o n s , s u c h as a s b an an k s , Spearphishing Sites: T h is in an attempt to steal account login credentials

Malvertising: E m b e d s m a l w a r e i n a d n e t w o r k s t h a t d i s p l a y a c r o s s h u n d r e d s o f l e g i t i m a t e , h i g h traffic sites

Compromised Legitimate Websites: H o s t e m b e d d e d m a l w a r e t h a t s p r e a d s t o u n s u s p e c t i n g visitors s t a llll m a l w a r e j u s t b y Drive-by Drive-by Downloa ds: T h e a t t a c k e r e x p l o i t s f l a w s i n b r o w s e r s o f t w a r e t o i n st visiting a web page

Module 07 Page 1026




Viru Virus s Hoaxes and an d Fake Antiviruses J

J

H o a xe xe s a r e f a l s e a l a r m s c l a im im i n g r e p o r t s

A t t a c k e r s d is is g u i s e m a l w a r e s a s a n a n t i v i ru ru s

about a non-ex isting virus which m ay

a n d t r i c k u s e r s t o in in s t a l l t h e m i n t h e i r

contain virus attachments

systems

W a r n i n g m e s s a ge ge s p r o p a g a t i n g t h a t a

O n c e i n s t a l le le d t h e s e f a k e a n t i v i r u s e s c a n

c e r t a in in e m a i l m e s s a g e s h o u l d n o t b e v ie ie w e d

damage targ et systems similar to other

and doing so w ill damage one's system

malwares

***

tif ifai* i*ft ft-F0RWAI1r)T )T14l'WA«NINflAM0Nn'RlFN0VtAMIIVANnrONTArn ntAsc rmv/Aflo mu wa rnin g among rniCNDS.rAMiiv and contacts Ho* •houMt* »k«t d*'•* tbv mat fmv Jwy v Co ikx cptn «1 « 1»yi i«im« « with 411etMchmvH vntlltvO>OSTCAAO'RO M •Uir. O ■ RtMONATION Of BARACK OBAMA . regjrdl«»l0f WhOsent IttO you It ISJ vlruStlWt Opers A Kttr tAftU lMAOt, t hen Dim* th«-whole run) Ca « ol YOU' computer. rih b lIvmNHM lWdil iuum nl UyCNNUni

1

Imk Hid) U••• I

jyMlllWA

l « HUM

1 4 j* j*for:h&

A WC

»—

(*•sifjctivtv jct ivtv irasawf iras awf Thevirw ...1 v«t erdiv. «ndthpp nortear ...1 .discoveredbvMcAfeev«terdiv.

1>tSeZeto Setloiof llie llodDiM., mIivictl.r viulxifoimatbonk«vL

jy j y y | r J ! ! L

w-

if srsr* •

l

:— = «= —

Reproduction is Strictly Prohibit ed. 0llicil. All Rights Reserved. Reproduction

Copyright Copyright © by EG-G

V i r u s H o a x e s a n d F a k e A n t iv i v i ru ru s e s V ir u s H o a x e s A virus hoax is simply a bluff. Viruses, by their nature, have always created a horrifying impression. Hoaxes are typically untrue scare alerts that unscrupulous individuals s e n d t o c r e a t e h a v o c . I t i s f a i r l y c o m m o n f o r i n n o c e n t u s e r s t o p a s s t h e s ep ep h o n y messages along thinking they are helping others avoid the "virus." ©

Hoaxes are false alarms claim ing reports abou t non -existing viruses

©

T h e se se w a r n i n g m e s s ag a g e ss,, w h i c h c a n be b e p r o p a g a t e d r a p i d ly ly , s t a t in i n g t h a t ac e r t a i n

email

m e s s a ge ge s h o u l d n o t b e o p e n e d , a n d t h a t d o i n g s o w o u l d d a m a g e o n e ' s s y s te te m ©

I n s o m e c as as es es , t h e s e w a r n i n g m e s s a g es e s t h e m s e l v e s c o n t a i n v ir ir u s a t t a c h m e n t s

©

T h e se s e p os os s es es s t h e c a p a b i l it it y o f v a s t d e s t r u c t i o n o n t a r g e t s y s t e m s

Many hoaxes try to "sell" things that are technically nonsense. Nevertheless, the hoaxer has to b e s o m e w h a t o f an an e x p e r t t o s p r e ad ad h o a x e s i n o r d e r t o a v o i d b e i n g i d e n t i f i e d a n d c a u g h t . Therefore, it is a good practice to look for technical details about how to become infected. Also search for information in the wild to learn more about the hoax, especially by scanning bulletin boards where people actively discuss current happenings in the community.

Module 07 Page 1027




T r y t o c r o s s c h e c k th t h e i d e n t i t y o f t h e p e r s o n w h o h as as p o s t e d t h e w a r n i n g . A l s o l o o k f o r m o r e i n f o r m a t i o n a b o u t t h e h o a x / w a r n i n g f r o m s e c o n d a ry ry s o ur u r c es es . B e f o re r e j u m p i n g t o c o n c l u s io io n s b y r e a d in in g c e r t a in i n d o c u m e n t s o n t h e I n t e r n e t , c h ec ec k t h e f o l l o w i n g : Q

I f i t is p o s t e d b y n e w s g r o u p s t h a t a re re s u s p ic ic i o u s , c ro ro s s c h e c k t h e i n f o r m a t i o n

with

a n o t h e r s o u rc rc e ©

I f t h e p e r s o n w h o h a s p o s t e d t h e n e w s is is n o t a k n o w n p e r s o n i n t h e c o m m u n i t y o r a n e x p e r t, t , c r o s sc s c h e ck ck t h e i n f o r m a t i o n w i t h a n o t h e r s o u rc rc e

0

I f a g o v e r n m e n t b o d y h as as p o s t e d t h e n e w s , t h e p o s t i n g s h o u ld l d a ls ls o ha ha v e a r e f e r e n c e t o the corresponding federal regulation

Q

O n e o f t h e m o s t e f f e c t i v e c he he c k s is is t o l o o k u p t h e s u s p e c t e d h o a x v i r u s b y n a m e o n antivirus software vendor sites

Q

I f t h e p o s t i n g is is t e c h n i c a l , h u n t f o r s i te te s t h a t w o u l d c a t e r t o t h e t e c h n i c a l i t i e s , a n d t r y t o a u t h e n t i c a t e t h e i n f o rm rm a t i o n Subject : FORWARD THIS WARNI NG AM ONG FRIENDS, FRIENDS, FAMILY AND CONTACTS ACTS PLEASE ASE FORWARD FORWARD THIS WARNI NG AMO NG FRIENDS, FRIENDS, FAMILY AND CONTACTS CONTACTSII You sho uld be aler t duri ng the next f ew days. Do not ope n any message message with an at tachm ent enti tled 'POSTCARD FROM BEJING BEJING or 'RESIGNATION OF 8ARACK 8ARACK OBAMA , regardless of wh o sent it t o you. It is a virus that opens A POSTCARD IMAGE, then 'burns' the whole hard C disc of your computer. This is the worst virus announced by CNN last evening. It has been classified by Microsoft as the most destruct ive virus ever. The The virus was discovered by McAf ee yesterday, and there is no repair yet f or this kind of virus. This virus simply destroys the Zero Sector Sector of t he Hard Disc, Disc, where the vital informat ion is kept. COPYTHIS E MAIL, A ND SEND IT TO YOUR FRIENDS.REME FRIENDS.REMEMBER: MBER: IF YOU SEND IT TO TO THEM, YOU WILL BENEFIT ALL OF US. End-of-mail Thanks.

FIGURE 7.3: 7.3: Hoaxes Warning Message

F a k e A n t iv i r u s e s Fake antiviruses is a method of affecting a system by hackers and it can poison your s y s t e m a n d o u t b r e a k t h e r e g i s t r y a n d s y s t e m f ilil e s t o a l l o w t h e a t t a c k e r t o t a k e f u l l c o n t r o l a n d a cc c c es es s t o y o u r c o m p u t e r . I t a p p e a r s a nd n d p e r f o r m s s i m i l a r l y t o a r ea ea l a n t i v i r u s p r o g r a m . Fake antivirus programs first appear on different browsers and warn users that they have d i f f e r e n t s e c u r i t y t h r e a t s o n t h e i r s y s t e m , a n d t h i s m e s s a ge g e i s b a c k e d u p b y r e a l s u s p i c io io u s v i ru r u s e s . W h e n t h e u s e r t r i e s t o r e m o v e t h e v i r u s e s , t h e n t h e y a r e n a v i g a te t e d t o a n o t h e r p ag ag e where they need to buy or subscribe to that antivirus and proceed to payment details. These f a k e a n t i v i ru r u s p r o g r a m s a re re b e e n f a b r i c a t e d i n s u ch ch a w a y t h a t t h e y d r a w t h e a t t e n t i o n o f th th e unsuspecting user into installing the software. Some of the m ethod s used to extend the usa ag g e a nd n d i n s t a l l a t i o n o f f a k e a n t i v i ru ru s p r o g r a m s include: ©

E m a i l a n d m e s s a g i n g : A t t a c k e r s u s e s p a m e m a i l a n d so s o c ia ia l n e t w o r k i n g m e s s a ge ge s t o spread this type of infected email to users and probe the user to open the attachments for software installation.

Module 07 Page 1028



Q


S ea ea rc r c h e n g i n e o p t i m i z a t io io n : A t t a c k e r s

generate pages related to public or current

search terms and plant them to appear as extraordinary and the latest in search engine results. The web pages show alerts about infection that encourage the user to buy the fake antivirus. Q

Compromised websites: Attackers secretly break into popular sites to install the fake

antiviruses, which can be used to entice users to download the fake antivirus by relying on the site's popularity.

J a Protection

a

q

0,

'S( 'S (

-wacy

M

p«0M<1*©r» * # S4

Path

C \ w » C « C ^ S \ J N t 5 ^ c ^ « U J r ^ 4 i fV fV * g 0 a 5 7 2

Inlrctiom

35

I

I

SMtWI

FIGURE 7.4: Example of a Fake Antivirus

Module 07 Page 1029

Ethical Ethical Hacking and Countermeasures C opyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.



Virus Analysis: An alysis: DNSChanger DNSChanger (Alureon) modifies ifies the the DNS DNS settings setti ngs on the victim victim PC to divert Internet traffic traffic to malicious malicious websites in order to generate fraudulent ad revenue, sell fake services, or steal personal personal financial information

CEH

J It acts as a bot an and can be organize ized in into a BotNet and controll controlled ed from from a remote remote location J It sprea reads thro throu ugh em emails, ils, so social ial engineering tricks, tricks, and untrusted untrusted downloads from the Inter Internet net

UHU $ DNSChanger malware achieves the DNS redirection redirecti on by modifying the following registry regist ry key settings settings against against a interface device such as as network card HK HKEY_LOCAL_MACHINE\SY \SYSTEM\Curre rrentContro trol Set\Services\Tcpip\Param Set\Services\Tcpip\Parameters\lnterfaces\%Ra eters\lnterfaces\%Ra ndom CLSID%NameServer

t

J DNSChanger has rec receive ived sign ignific ifica ant attention attention due to the large l arge number of affected systems worldwide andthe fact that as part of the BotNet BotNet takedown the FBI took ownership ownership of the rogue DNSservers servers to ensure those affect affected ed did not immediately lose the abili ability ty to resolv resolve e DNS names h ttp://www. ttp:// www. totaldefense. com com

Copyright © by E&Cauactl. All Rights Reserved. Reproduction is Strictly Prohibited.

V i r u s A n a l y s is is : D N S C h a n g e r Source: h t t p : / / w w w . t o t a l d e f e n s e . c o m DNSChanger (Alureon) is malware that spreads through emails, social engineering tricks, and untrusted downloads from the Internet. It acts as a bot and can be organized into a botnet and c o n t r o l l e d f r o m a r e m o t e l o c a t i o n . Th Th i s m a l w a r e a c h i e v e s D N S r e d i r e c t i o n b y m o d i f y i n g t h e s y s t e m r e g i s t ry ry k e y s e t t i ng n g s a g a i n s t an an i n t e r f a c e d e v i c e s uc u c h as as n e t w o r k c a r d . DNSChanger has received significant attention due to the large number of affected systems w o r l d w i d e a n d t h e f a c t t h a t a s p a r t o f t h e b o t n e t t a k e d o w n , t h e FBI t o o k o w n e r s h i p o f r o g u e DNS servers to ensure those affected did not immediately lose the ability to resolve DNS names. This can even modify the DNS settings on the victim's PC to divert Internet traffic to malicious websites in order to generate fraudulent ad revenue, sell fake services, or steal personal financial information.

Module 07 Page 1030




Virus Analysis: An alysis: DNSChanger (Cont’d)

The rogue DNS servers can exist in any of the following ranges: L

DNSChanger

64.28.176.0 - 64.28.191.255, 67.210.0.0 - 67.210.15.255 77.67.83.0 - 77.67.83.255, 93.188.160.0 - 93.188.167.255 85.255.112.0 - 85.255.127.255, 213.109.64.0 - 213.109.79.255

DNSChanger sniffs the credential and redirects the request to real website Real Website ww.xrecyritY-tP1 IP: 200.0.0.45

DNSChanger infects victim's computer by change her DNS IP address to: 64.28.176.2 64.28.176.2

Attac ker runs DNSServer in Russia (IP: 64.28.176.2)

http://www. ttp: //www. tota!defense, !defense,com

Copyright © by EC-Cauactl. All Rights Reserved. Reproduction is Strictly Prohibited.

tout V i r u s A n a l y s is i s : D N S C h a n g e r ( C o n t ’d ’d ) ’

Source: h t t p : / / w w w . t o t a l d e f e n s e . c o m

T h e r o g u e D NS NS s e r v e rs rs c a n e x is is t i n a n y o f t h e f o l l o w i n g r a n g e s: s:

64.28.176.0 - 64.28.191.255, 67.210.0.0

67.210.15.255

77.67.83.0 - 77.67.83.255 , 93.188.160.0 - 93.188.167.255 85.255.112.0 - 85.255.127.255, 213.109.64.0 - 213.109.79.255

Module 07 Page 1031




Whal is the IP address of ww w. *security. corn corn

©

>

DNSChanger sniffs the credential and redirects the request to real website

Fake Website IP: 65.0.0.2

» Real Website wvAv.xsecuritv.com IP: 200.0.0.45

©

DNS Request do to 64.28.176.2

> DNSChanger infects victim's computer by change her DNS IP address to: 64.28.176.2

© Attacker runs DNS Server in Russia (IP: 64.28.176.2)

FIGURE 7.5: Virus Analysis Using DNSChanger

T o i n f e c t t h e s y s t e m a n d s t e a l c r e d e n t i a l s , t h e a t t a c k e r h as as t o f i r s t r u n D NS NS s e r v e r . H e r e t h e attacker runs his or her DNSserver in Russia with an IP of, say, 64.28.176.2. Next, the attacker infects the victim's computer by changing his or her DNS IP address to: 64.28.176.2. When this m a l w a r e h as as i n f e c t e d t h e s y s t e m , i t e n t i r e l y c h a n g e s t h e D NS NS s e tt tt i n g s o f t h e i n f e c t e d m a c h i n e and forces all the DNS request to go to the DNSserver run by the attacker. After altering the s e t t i n g o f t h e D NS NS , a n y r e q u e s t t h a t i s m a d e b y t h e s y s t e m i s s e n t t o t h e m a l i c i o u s D N S s e r v e r. r. Here,

the

victim

sent

DNS

Request

what is the IP address of www.xsecurity.com

to

( 6 4 . 2 8 . 1 7 6 . 2 ) . T h e a t t a c k e r g a v e a r e s p o n s e t o t h e r e q u e s t a s w w w . x s e c u r i t v . c o m . which is l o c a t e d a t 6 5 . 0 .0 .0 . 2 . W h e n v i c t i m ' s b r o w s e r c o n n e c t s t o 6 5 . 0 .0 .0 . 2 , i t r e d i re re c t s h i m o r h e r t o a f a k e w e b s i t e c r e a t e d b y th t h e a t t a c k e r w i t h I P: 6 5 .0 .0 . 0 . 2. 2 . D N S C h a n ge g e r sn s n i ff ff s t h e c r e d e n t i a l ( u s e err n a m e , p a s s w o r d s ) a n d r e d i r e c t s t h e r e q u e s t t o r e al al w e b s i t e (w (w w w . x s e c u r i t y . c o m ) with IP: 200.0.0.45.


Ethical Hacking and Coun termea sures Copyright © by EC-C0l1nCil All Rights Reserved. Reproduction is Strictly Prohibited.



M odule Flow Flow

CEH

Virus and Worms Concepts

Computer Worms

Penetration Testing

Counter• measures

Malware A n al y s i s

Copyright © by E&Caincil. All Rights Reserved. Reproduction is Strictly Prohibited.

■ = || M o d u l e F l o w P r i o r t o t h i s , w e h a v e d is is c u ss s s e d a b o u t v i ru ru s e s a n d w o r m s . N o w w e w i l l d is is c us us s a b o u t d i f f e r e n t t y p e s o f v ir ir u s e ess .

X

V ir ir u s a n d W o r m s C o n c e p t

i•

y

—

v —

C

M a l w a r e A n al a l y si si s

Types of Viruses

Com puter Worms

Countermeasures

^

)

P e n e t r a t i o n T e s t in in g

T h is is s e c t i o n d e s c r i be b e s a b o u t d i f f e r e n t t y p e s o f V ir ir u s e ess .

Module 07 Page 1033



System or Boot Sector Viruses


Stealth Virus/ Tunneling Virus

Encryption

Polymorphic

Metamorphic

Sparse Infector Virus

Cluster Viruses

Direct Action or Transient

Multipartite

T y p e s o f V i ru ru s e s So far, we have discussed various virus and worm concepts. Now we will discuss v a r i o u s t y p e s o f v i r us us e s . T h is is s e c t i o n h i g h l i g h t s v a r io io u s t y p e s o f v ir ir u s e s a n d w o r m s s u c h as as fifi l e a n d m u l t i p a r t i t e v i r u s e s , macro

viruses,

cluster

viruses,

stealth/tunneling

viruses,

encryption

viruses,

metamorphic

viruses, shell viruses, and so on. Computer viruses are the malicious software programs written b y a tt t t a c k e rs rs t o i n t e n t i o n a l l y e n t e r th t h e t a r g e t e d s y s te t e m w i t h o u t t h e u s e r ' s p e r m i s s i o n . As As a r e su s u l t, t, t h e y a f f e c t t h e s e c u r i t y sy s y s t em e m a n d p e r f o r m a n c e o f t h e m a c h i n e . A f e w o f tth he most common types of computer viruses that adversely affect security systems are discussed in d e t a i l o n t h e f o l l o w i n g s lili de d e s. s.

T y p e s o f V i ru ru s e s V i ru ru s e s a r e c la l a s s if if i ed e d d e p e n d i n g o n t w o c a t e g o r ie ie s : Q

W h a t D o T h e y I n f e c t? t?

©

H o w Do Do T h e y I n f e c t ?

Module 07 Page 1034




W hat Do Do They Infe Infe ct? System or Boot Boot Sector Viruses _

f*.

T h e m o s t c o m m o n t a r g e t s f o r a v i r u s a r e t h e s y s t e m s e c t or or s , w h i c h a r e n o t h i n g b u t

the Master Boot Record and the DOS Boot Record System sectors. These are the areas on the disk that are executed when the PC is booted. Every disk has a system sector of some sort. They s p e c i a llll y i n f e c t t h e f l o p p y b o o t s e c t o r s a n d r e c o r d s o f t h e h a r d d is is k . F o r e x a m p l e : D is is k K ilil le le r and Stone virus.

File Viruses Executable files are infected by file viruses, as they insert their code int o the original file and get executed. File viruses are larger in number, but they are not the most commonly fou nd . They infec t in a va riety of ways and can be fou nd in a large num be r of file types.

M ultipartite ultipartite Virus T h e y i n f e c t p r o g r a m f i le le s , a n d t h is is f i le le i n t u r n a f f e c t s t h e b o o t s e c t o r s s uc u c h as a s I n v a d er er , Flip, and Tequila.

C luster Viruses Viruses C l u s t e r v i ru ru s e s i n f e c t f i le l e s w i t h o u t c h a n g i n g t h e f i l e o r p l a n t i n g e x t r a f i le le s ; t h e y c h a n g e t h e D OS OS d i r e c t o r y i n f o r m a t i o n s o t h a t e n t r i e s p o i n t t o t h e v i r u s c o d e i n s t e ad ad o f t h e a c t u a l program.

M acro Virus Virus M i c r o s o f t W o r d o r a s i m i la l a r a p p lil i c a t io io n c a n b e i nf n f e c t e d t h r o u g h a c o m p u t e r v ir ir u s c a llll e d a m a c r o v i r us u s , w h i c h a u t o m a t i c a l l y p e r f o r m s a s e q u e n c e o f a c t io io n s w h e n t h e a p p l i c a t i o n i s t r i g g e r e d o r s o m e t h i n g e ls ls e . M a c r o v i r u s es e s a r e s o m e w h a t l e ss ss h a r m f u l t h a n o t h e r types. They are usually spread via an email.

How Do Do They Infect? ■

Stealth V iruses T h e s e v i ru ru s e s t r y t o h i d e t h e m s e l v e s f r o m a n t i v i r u s p r o g r a m s b y a c t i v e l y a l t e r i n g a n d

corrupting the chosen service call interrupts when they are being run. Requests to perform operations in respect to these service call interrupts are replaced by virus code. These viruses state false information to hide their presence from antivirus programs. For example, the stealth virus hides the operations that it modified and gives false representations. Thus, it takes over p o r t i o n s o f t h e t a r g e t s y s t e m a n d h i d e s i ts ts v i r u s c o d e . Life :

Tu nneling Viruses Viruses T h es e s e v ir ir u s e s t ra r a c e t h e s t ep e p s o f i n t e r c e p t o r p r o g r a m s t h a t m o n i t o r o p e r a t i n g s y s te te m

r e q u e s t s s o t h a t t h e y g e t i n t o B IO IO S a n d D OS OS t o i n s t a llll t h e m s e l v e s . T o p e r f o r m t h i s a c t i v it it y , t h e y e v en e n t u n n e l u n d e r a n t i v ir i r u s s o f t w a r e p r o gr gr a m s .


Ethical Hacking and Coun termea sures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.


\


Enc ryption ryption V iruses iruses

c_ —

T h is is t y p e o f v i r u s c o n s is i s t s o f an an e n c r y p t e d c o p y o f t h e v i ru r u s a nd nd a d e c r y p t i o n m o d u l e .

T h e d e c r y p t i n g m o d u l e r e m a i n s c o n s t a n t , w h e r e a s t h e d i f f e r e n t k ey e y s ar ar e u se se d f o r e n c r y p t i o n .

iri) ,

Polymorphic Viruses These viruses were developed to confuse antivirus programs that scan for viruses in

the system. It is difficult to trace them, since they change their characteristics each time they i n f e c t , e .g .g ..,, e v e r y c o p y o f th th i s v i ru ru s d i f f e r s f r o m i ts ts p r e v i o u s o n e . V i r u s d e v e l o p e r s h a v e e v e n c r e a t e d m e t a m o r p h i c e n g i ne n e s a n d v ir i r u s w r i t i n g t o o l k i ts ts t h a t m a k e t h e c o d e o f an a n e x i s ti t i n g v i ru ru s look different from others of its kind.

M e t a m o r p h i c V i r u se se s A code that can reprogram itself is called metamorphic code. This code is translated i n t o t h e t e m p o r a r y c o d e , an a n d t h e n c o n v e r t e d b a cckk t o t h e n o r m a l c o de d e . T hi hi s t e c h n i q u e , i n w h ic ic h t h e o r i g i n a l a l g o r i t h m r e m a i n s i n t a c t , is is u s e ed d t o a v o i d p a t t e r n r e c o g n i t i o n o f a n t iv iv i r u s s o f t w a r e . T h is is is is m o r e e f f e c t i v e i n c o m p a r i s o n t o p o l y m o r p h i c c o d e . T h is is t y p e o f v i ru r u s c o n s is is t s o f c o m p l e x extensive code.

O verw riting riting File or Cavity V iruses S o m e p r o g r a m f i le le s h a v e a r ea ea s o f e m p t y s p ac ac e . T h is is e m p t y s p a c e is is t h e m a i n t a r g e t o f these viruses. The Cavity Virus, also known as the Space Filler Virus, stores its code in this empty space. The virus installs itself in this unoccupied space without any destruction to the o r i g i n a l c o d e . I t i n s t a l l s i t s e l f i n t h e f i l e i t a tt e m p t s t o i n f e c t .

Sparse Infector Viruses

a®

A s p ar ar s e i n f e c t o r v ir i r u s i n f e c t s o n l y o c c a s i o n a l l y ( e .g .g ..,, e v e r y t e n t h p r o g r a m e x e c u t e d )

o r o n l y f ilil e s w h o s e l e n g t h s f al al l w i t h i n a n a r r o w r a n ge ge .

C o m p a n i o n V i r us us e s T h e c o m p a n i o n v i r u s s t o r e s it it s e l f b y h a v in in g t h e i d e n t i c a l f i l e n a m e a s t h e t a r g e t e d p r o g r a m f i le le . A s s o o n a s t h a t f i le l e is e x e c u t e d , t h e v i r u s i n f e c ts ts t h e c o m p u t e r , a n d h a r d d i s k d a ta ta is modified.

C a m o u f la la g e V i r us us e s

^ W

-------

-

They disguise them selve s as genu ine applications

of the user. These viruses are not

difficult to find since antivirus programs have advanced to the point where such viruses are e a s i ly ly t r a c e d .

Shell Viruses ____ _ ____

T h is is v i r u s c o d e f o r m s a l a y e r a r o u n d t h e t a r g e t h o s t p r o g r a m ' s c o d e t h a t c a n be be

Module 07 Page 1036




c o m p a r e d t o a n " e g g s h e l l / m a k i n g i t s e l f t h e o r i g i n a l p r o g r a m a n d t h e h o s t c o d e it i t s s ub ub routine. Here e,, t h e o r i g i n a l c o d e i s m o v e d t o a n e w l o c a t i o n b y t h e v i r u s c o d e a n d t h e v i r u s a s s u m e s i ts ts i d e n t i t y .

File Extension Viruses F.

F ilil e e x t e n s i o n v i r u s e s c h a n g e t h e e x t e n s i o n s o f f ilil e s ; . T XT XT is is s a f e, e, a s i t i n d i c a t e s a p u r e

t e x t ffii l e. e. I f y o u r c o m p u t e r ' s f i l e e x t e n s i o n s v i e w is t u r n e d o f f a n d s o m e o n e s e n d s y o u a f i le le named BAD.TXT.VBS, you will see only BAD.TXT.

>'« f| Add -on V iruses M o s t v i r u s e s ar ar e a d d - o n v i r u s es e s . T h is is t y p e o f v ir ir u s a p p e n d s i ts ts c o d e t o t h e b e g i n n i n g o f t h e h o s t c o d e w i t h o u t m a k i n g a n y c h a n g es es t o th t h e l a t t e r . T h u s, s, t h e v ir ir u s c o r r u p t s t h e s t a r t u p i n f o r m a t i o n o f t h e h o s t c o d e , a n d p l ac ac e s i t s e lf l f in in i ts ts p l ac ac e , b u t i t d o e s n o t t o u c h t h e h o s t c o d e . However, the virus code is executed before the host code. The only indication that the file is c o r r u p t e d i s t h a t t h e s iz iz e o f t h e f i l e h a s in in c r e a s e d .

Intrusive V iruses iruses T h is is f o r m o f v i ru ru s o v e r w r i t e s itit s c o d e e i t h e r by b y c o m p l e t e l y re r e m o v i n g t h e t a r g e t h os o s t 's 's program code, or sometimes it only overwrites part of it. Therefore, the original code is not executed properly.

Direct Action Action or T ransient V iruses iruses Transfers all controls to the host code where it resides, selects the target program to be modified, and corrupts it.

=—

T erm inate an d Stay Stay R esiden t V iruses (TSRs TSRs))

ffr

A T SR SR v i r u s r e m a i n s p e r m a n e n t l y i n m e m o r y d u r i n g t h e e n t i r e w o r k s e ss s s i on on , e v e n

a f t e r t h e t a r g e t h o s t p r o g r a m i s e x e c u t e d a n d t e r m i n a t e d . I t c an an b e r e m o v e d o n l y b y r e b o o t i n g the system.

Module 07 Page 1037




Syste Sy stem m or Boot Sector V iru ir u ses se s Boot Sector Virus Boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR

CEH

Execution

©

o

When system boots, virus code is executed first and then control is passed passed to original MBR

Before Infection

A f t e r I n f e ct ct i o n

Virus Code

MBR Copyright © by E&Cauactl. All Rights Reserved. Reproduction is Strictly Prohibited.

S y s t e m o r B oo oo t S e c t o r V i r u s e s m

S y s t e m s e c t o r v ir ir u s e s ca ca n b e d e f i n e d a s t h o s e t h a t a f f e c t t h e e x e c u t a b l e c o d e o f t h e

d is is k , r a t h e r t h a n t h e b o o t s e c t o r v ir i r u s t h a t a f f e c t s t h e D OS OS b o o t s e c t o r o f th th e d is is k . A n y s y s t e m is divided into areas, called sectors, where the programs are stored. T h e t w o t y p e s o f s y s t e m s e c t o r s ar ar e : Q

M B R ( M a s t e r B o o t R ec ec o r d )

MBRs are the m ost virus-p rone zone ess b e c a u s e i f t h e M B R i s c o r r u p t e d , a l l d a t a w i l l b e lost. 0

D B R ( D OS OS B o o t R e c o r d )

T h e D O S b o o t s e c t o r is is e x e c u t e d w h e n e v e r t h e s y s t e m i s b o o t e d . T h is is is is t h e c r u c i a l p o i n t o f a t t a c k f o r v i ru r u s es es . T h e s y s t e m s e c t o r c o n s is is t s o f 5 1 2 b y t e s o f m e m o r y . B e ca ca u sse e o f t h i s , s y s te t e m s e c t o r v i ru ru s e s conceal their code in some other disk space. The main carrier of system sector viruses is the f l o p p y d i sk sk . T h es es e v i r u s e s g e n e r a l l y r e s i d e i n t h e m e m o r y . T h e y c a n a l so so b e c a u s e d b y T r o ja ja n s . S o m e s e c t o r v ir i r u s e s al al s o s p r e a d t h r o u g h i n f e c t e d f i le l e s , a nd n d t h e y a r e ca c a l le le d m u l t i p a r t v i r u s e s .

Module 07 Page 1038



1


Virus Virus Rem oval System sector viruses are designed to create the illusion that there is no virus on the s y s t e m . O n e w a y t o d e a l w i t h t h i s v ir ir u s is is t o a v o i d t h e u s e o f t h e W i n d o w s o p e r a t i n g

system, and switch to Linux or Macs, because Windows is more prone to these attacks. Linux and Macintosh have a built-in safeguard to protect against these viruses. The other way is to carry out antivirus checks on a periodic basis. Before Infection

G After Infection V

O Virus Code

FIGURE 7.6: System or Boot Sector Viruses

Module 07 Page 1039




F ile and M ultipartite ultipa rtite V iruses iru ses

CEH

F i le l e a n d M u l t ip ip a r t it e V i r u s e s F ile Viruses Viruses File viruses infect files that are executed or interpreted in the system such as COM, EXE, SYS, OVL, OVL, OBJ OBJ,, PRG, PRG, MN U, and BAT files. File viruses can be eit he r dir ec t-a ct ion (no n-re sid en t) or memory-resident. Overwriting viruses cause irreversible damage to the files. These viruses m a i n l y t a r g e t a ra r a n g e o f o p e r a t i n g s y s t e m s t h a t i n c l u d e W i n d o w s , U N I X, X, D OS OS, a nd nd M a c i n t o s h .

C harac terizing File File Viruses Viruses File

viruses

are

mainly

characterized

and

described

based

on

their

physical

behavior

or

c h a r a c t e r i s t i c s . T o c l a s s if if y a f i l e v i r u s i s b y t h e t y p e o f f i l e t a r g e t e d b y i t , s uc uc h a s EX EXE o r C O M f i le le s , t h e b o o t s e c t o r , e t c . A f i l e v i ru ru s c a n al al s o be be c h a r a c t e r i z e d b a s e d o n h o w i t i n f e c t s t h e targeted file (also known as the host files): Q

P r e p e n d i n g : w r i t e s i t s e l f i n t o t h e b e g i n n i n g o f t h e h o s t f i l e 's 's c o d e

Q A p p e n d i n g : w r i t e s i t s e l f t o t h e e n d o f t h e h o s t fi fi l e ©

Overwriting: overwrites the host file's code with its own code

Q

Inserting: inserts itself into gaps inside the host file's code

Module

07

Page Page 1040

Ethical Hacking and Coun termea sures Copyright © by EC-C0UnCil All Rights Reserved. Reproduction is Strictly Prohibited.



©

C o m p a n i o n : r e n a m e s t h e o r i g in in a l f i le le a n d w r i t e s i t s e l f w i t h t h e h o s t f ilil e 's 's n a m e

©

le s e c t i o n s o f 3 2 - b i t fi fi l e C a v i t y i n f e c t o r : w r i t e s i t s e l f b e t w e e n f i le

F ilil e v i r u se s e s a re re a ls l s o cl cl a ss s s i fi fi e d b a se se d o n w h e t h e r t h e y a r e n o n - m e m o r y r e s i d e n t o r m e m o r y resident. Non-memory resident viruses search for EXE files on a hard drive and then infect them, whereas memory resident viruses stays actively in memory, and trap one or more system functions. File viruses are said to be polymorphic, encrypted, or non-encrypted. A polymorphic or encrypted virus contains one or more decryptors and a main code. Main virus code is d e c r y p t e d b y t h e d e c r y p t o r b e f o r e i t s t a rt rt s . A n e n c r y p t e d v i r u s u s u a l l y us us es es v a r ia ia b l e o r f i x e d key decryptors, whereas polymorphic viruses have decryptors that are randomly generated f r o m i n s t r u c t i o n s o f p r o c e s s o r s an a n d t h a t c o n s i st s t o f a l o t o f c o m m a n d s t h a t a r e n o t u s ed ed i n t h e d e c r y p t i o n p ro r o c es es s . Execution of Payload:

Q

©

Direct action: Imm ediate ly upon execution

©

T i m e b o m b : A f t e r a s p e c i f ie ie d p e r io io d o f t i m e

©

Condition triggered: Only unde r certain cond itions

M ultipa ultipa rtite rtite Viruses A m u l t i p a r t i t e v i r us u s i s a ls ls o k n o w n as a m u l t i - p a r t v i ru ru s t h a t a t t e m p t s t o a t t a c k b o t h

t h e b o o t s e c t o r a n d t h e e x e c u t a b l e o r p r o g r a m f i l e s a t t h e s a m e t i m e . W h e n r g w v i ru ru s i s attached to the boot sector, it will in turn affect the system files, and then the virus attaches to t h e f i le le s , a nd nd t h i s t i m e i t w i llll i n t u r n i n f e c t t h e b o o t s e c t o r .

FIGURE 7.7: File and Multipartite Viruses

Module 07 Page 1041




CEH

M a cr o V ir u s e s

Urt1fw4 ilhiul lUtbM

0

0 11. 11. Infects Macro Enabled Documents

0

Attacker

User

0 r

0

0 0 Macro viruses infect templates or convert infected documents into template files, files, while maintainingtheir appearance of ordinary documentfiles

0 Most macro macro viruses are written using using macro language Visual Basic for Applications (VBA)

r

V

0

0

0

0

Copyright © by EC-CaIllic it Al 1Rights 1Rights Reserved. Reproduction is Strictly Prohibited.

M a c r o V i ru ru s e s M i c r o s o f t W o r d o r s i m ili l a r a p pl p l i ca c a t i o n s ca c a n b e in in f e c t e d t h r o u g h a c o m p u t e r v i r u s c a llll e d m a c r o v i ru r u s , w h i c h a u t o m a t i c a l l y p e r f o r m s a s e q u e n c e o f a c t io io n s w h e n t h e a p p l i c a t i o n i s triggered or something else. Most macro viruses are written using the macro language Visual Ba ass ic ic f o r A p p l i c a t i o n s ( V B A ) a nd nd t h e y i n f e c t t e m p l a t e s o r c o n v e r t i n f e c t e d d o c u m e n t s i n t o t e m p l a t e f i le le s , w h i l e m a i n t a i n in i n g t h e i r a p p e a r an a n c e o f o r d i n a r y d o c u m e n t f ili l e ess . M a c r o v i r u s e s a r e s o m e w h a t l es es s h a r m f u l t h a n o t h e r t y p e s . T h e y a re r e u s u a l l y s p r e a d v ia ia a n e m a i l . P u re re d a t a f i le le s d o n o t a l l o w t h e s p r e a d o f v i r us us e s , b u t s o m e t i m e s t h e l in in e b e t w e e n a d a t a f ilil e a n d a n executable file is easily overlooked by the average user due to the extensive macro languages in some programs. In most cases, just to make things easy for users, the line betwe en a data file a n d a p r o g r a m s t a r t s t o b l u r o n l y i n c as as es es w h e r e t h e d e f a u l t m a c r o s a r e s e t t o r u n a u t o m a t i c a l l y e v e r y t i m e t h e d a t a f ilil e is is l o a d e d . V i r u s w r i t e r s c an an e x p l o i t c o m m o n p r o g r a m s w i t h m a c r o capability such as Microsoft Word, Excel, and other Office programs. Windows Help files can also contain macrocode. In addition, the latest exploited macrocode exists in the full version of t h e A c r o b a t p r o g r a m t h a t r e a d s a nd nd w r i t e s P DF DF f ilil e s. s.

Module 07 Page 1042




Infects Macro Enabled Documents

Attacker

User FIGURE 7.8: Macro Viruses

Module 07 Page 1043




C EH

C lu s t e r V ir u s e s Cluster Viruses J

a

Cluster Cluster viruses viruses modify directory table entries so so that it points users or system processes to the virus code instead of the actual program

: I :*]

Virus Copy J

There There is only one one copy of the virus virus on on the the disk disk infe infectin cting g all the programs in the compu ter system

Launch Itself J

It will will launch launch itself first when when any progr program am on the computer system is started and then the control is passed to actual program

Copyright © by EC-Cauactl.All Rights Reserved. Reproduction Reproduction is Strictly Prohibited

C l u s t e r V ir u s e s C l u s t e r v i r us us e s i n f e c t f i le l e s w i t h o u t c h a n g i n g t h e f i l e o r p l a n t i n g e x t r a f i l es es t h e y c h a n g e t h e D OS OS d i r e c t o r y i n f o r m a t i o n s o t h a t e n t r i e s p o i n t t o t h e v i r u s c o d e i n s t e ad ad o f t h e a c t u a l program. When a program runs DOS, it first loads and executes the virus code, and then the v i r u s l o c a t e s t h e a c t u a l p r o g r a m a n d e x e c u t e s i t. t. D i r - 2 i s a n e x a m p l e o f t h i s t y p e o f v i ru ru s . Cluster viruses modify directory table entries so that directory entries point to the virus code. T h e r e i s o n l y o n e c o p y o f t h e v i r u s o n t h e d i s k i n f e c t i n g a llll t h e p r o g r a m s i n t h e c o m p u t e r system. It will launch itself first when any program on the com pu ter system is started and then t h e c o n t r o l is p a ssss e d t o t h e a c t u a l p r o g r a m .

Module 07 Page 1044




S t e a lt h / T u n n e lin g V ir u s e s

CEH

These viruses evade the anti-virus software by intercepting its requests to the operating system A virus can hide itself by intercepting the anti-virus software's request to read the file and passingthe request to the virus, instead of the OS The virus can then return an un infec ted version of the file to the antiantivirus software, so that it appears as if the file is "clean"

Hides Infected TCPIP.SYS

i f

Here you go

Original TCPIP.SYS Copyright © by EC-Cauactl.All Rights Reserved. Reproduction is Strictly Prohibited.

S t e a l th / T u n n e l in g V ir u se s I

Stealth V iruse s T h e s e v i ru ru s e s t r y t o h i d e t h e m s e l v e s f r o m a n t i v i r u s p r o g r a m s b y a c t i v e ly l y a l t e r i n g an an d

corrupting the chosen service call interrupts when they are being run. Requests to perform operations in respect to these service call interrupts are replaced by virus code. These viruses state false information to hide their presence from antivirus programs. For example, the stealth virus hides the operations that it modified and gives false representations. Thus, it takes over p o r t i o n s o f t h e t a r g e t s y s t e m a n d h i d e s i ts ts v i ru ru s c o d e . T h e s t e a l t h v i r u s h i d es e s i t s e l f f r o m a n t i v i r u s s o f t w a r e b y h i d i n g t h e o r i g i n a l s iz iz e o f t h e f i l e o r t e m p o r a r i l y p l a c i n g a c o p y o f i t s e l f i n s o m e o t h e r d r i v e o f t h e s y s t e m , t h u s r e p l a c in in g t h e i n f e c t e d f i l e w i t h t h e u n i n f e c t e d f i l e t h a t i s s t o r e d o n t h e h a r d d r iv iv e . A s t e a l th th v i r u s h i de de s t h e m o d i f i c a t i o n s t h a t i t m a k e s . I t t a k e s c o n t r o l o f t h e s y s t e m ' s f u n c t i o n s that read files or system sectors and, when another program requests information that has a l re r e a d y b e e n m o d i f ie i e d b y t h e v i ru r u s , th t h e s t e a l t h v i r u s r e p o r t s t h a t i n f o r m a t i o n t o t h e r e q u e s t in in g p r o g r a m i n s t e a d. d. T h is is v i ru ru s a l s o r e si s i d es es i n t h e m e m o r y . To avoid detection, these viruses always take over system functions and use them to hide their presence.

Module 07 Page 1045




O n e o f t h e c a r r ie ie r s o f t h e s t e a l t h v i r u s i s t h e r o o t k i t . I n s t a lll l i ng n g a r o o t k i t g e n e r a l l y r e s u lt l t s i n th th i s virus attack because rootkits are installed via Trojans, and thus are capable of hiding any malware. Removal: Q

A l w a y s d o a c o l d b o o t ( b o o t f r o m w r i t e - p r o t e c t e d f l o p p y d is is k o r C D) D)

©

N e v e r us us e D OS OS c o m m a n d s s u c h a s F DI DI SK SK t o f i x t h e v i r u s

e

U se se a n t i v i r u s s o f t w a r e

/

Tun neling neling Viruses These viruses trace the steps of interceptor programs that monitor operating system

r e q u e s t s s o t h a t t h e y g e t i n t o B IO IO S a n d D OS OS t o i n s t a llll t h e m s e l v e s . T o p e r f o r m t h i s a c t iv iv i t y , t h e y e v en e n t u n n e l u n d e r a n t i v i r u s s o f t w a r e p r o g ra ra m s . Give me the system file file

tcpip.syi to icon

Anti-virus Software

Hides Infected TCPIP.SYS

*

VIRUS

Here you go Original TCPIP.SYS FIGURE 7.9: Working of Stealth/Tunneling Stealth/Tunneling Viruses Viruses

Module 07 Page 1046




CEH

E n c r y p tio n V ir u s e s This type of virus uses simple encryption to encipher encipher the the code code

Virus Code

V r

The virus is encrypted with a different different key for each each infected file

V.

AV scanner cannot directly detect these types of viruses using signature detection methods

Encryption Virus 2

Encryption Virus 3

-/


E n c r y p t io i o n V i ru ru s e s T h is i s t y p e o f v ir ir u s c o ns n s i s ts ts o f a n e n c r y p t e d c o p y o f t h e v i r u s a n d a d e c r y p t i o n m o d u l e . The decrypting module remains constant, whereas the different keys are used for encryption. T h e s e v i ru ru s e s g e n e r a l l y e m p l o y X O R o n e a c h b y t e w i t h a r a n d o m i z e d k e y. y. ©

T h e v i r u s is is e n c i p h e r e d w i t h a n e n c r y p t i o n k e y t h a t c o n s i st st s o f a d e c r y p t i o n m o d u l e a n d an encrypted c opy of the code.

Q

For each infected file, the virus is encrypted by using a different combination of keys, but the decrypting m odule part remains unchanged. It is not possible for the virus scanner to directly detect the virus by means of s i g n a tu t u r e s , b u t t h e d e c r y p t i n g m o d u l e c an an b e d e t e c t e d .

e

T h e d e c r y p t i o n t e c h n i q u e e m p l o y e d i s x o r e ac ac h b y t e w i t h a r a n d o m i z e d k e y t h a t is is g e n e r a t e d a n d s a ve ve d b y t h e r o o t v i ru ru s .

Module 07 Page 1047




Virus Code

Encryption

Encryption

Encryption

Virus 1

Virus 2

Virus B

FIGURE 7.10: 7.10: Working of Encryption Viruses

Module 07 Page 1048




CEH

P o ly m o r p h ic C o d e J

Polym orphic cod e is a code that muta tes whil e keeping the original algorithm intact

J

To enable po lymor phic code, the virus has to have a po lymor phic engine (also called mutating engine or mutation engine

J

A well-written polym orphic virus theref ore has no pa rts tha t stay th e sam e on each infection

39Encrypted Mutation Engine

Encrypted Virus Code

Decryptor Routine

............ Decryptor routine decrypts virus code and mutation engine engine

New Polymorphic Virus User Runs an Infected Program

RAM RAM Copyright © by E&Cauactl. All Rights Reserved. Reproduction is Strictly Prohibited.

Polym orphic Code Polymorphic viruses modify their code for each replication in order to avoid detection. They accomplish this by changing the encryption module and the instruction sequence. A r a n d o m n u m b e r g e n e r a to t o r is is u se se d fo fo r i m p l e m e n t i n g p o l y m o r p h i s m . A mutation engine is generally used to enable polymorphic code. The mutator provides a sequence of instructions that a virus scanner can use to optimize an appropriate detection algorithm. Slow polymorphic codes are used to prevent antivirus professionals from accessing t h e c o d e s. s. Virus samples, which are bait files after a single execution is infected, contain a similar copy of t h e v i r u s . A s i m p l e i n t e g r i t y c h e c k e r i s us us e d t o d e t e c t t h e p r e s e n c e o f a p o l y m o r p h i c v i r u s i n th th e system's disk.

Module 07 Page 1049




Encrypted Mutation Engine (EME)

ncrypted ncrypted M utation Encry Engine

j

i I

A

©

Encrypted Virus Code

I

Decryptor Routine

A

Instruct to0 •

i

• Instruct to

Decryptor routine decrypts virus code and mutation engine

New Polymorphic Polymorphic

*

©

Virus Does the Damage

User Runs an Infected Program

Virus

RA M

FIGURE 7.11: How Polymorphic Code Work

P o l y m o r p h i c v i ru ru s e s c o ns n s i st st o f t h r e e c o m p o n e n t s . T h e y a r e t h e e n c r y p t e d v i r u s c o d e , t h e d e c r y p t o r r o u t i n e , a n d t h e m u t a t i o n e n g in i n e . T he he f u n c t i o n o f th th e d e c r y p t o r r o u t i n e i s t o d e c r y p t t h e v i r u s c od o d e . I t d e c ry r y p t s t h e c o d e o n l y a f t e r ta ta k i n g c o n t r o l o v e r t h e c o m p u t e r . T h e m u t a t i o n e n g i n e g e n e r a t e s r a n d o m i z e d d e c r y p t i o n r o u t i n e s . Th T h is is d e c r y p t i o n r o u t i n e s v a ri r i e s e v e ry ry t i m e w h e n a n e w p r o g r a m is i n f e c t e d b y t h e v i ru ru s . With a polymorphic virus, both the mutation engine and the virus code are encrypted. When a p r o g r a m t h a t i s i n f e c t e d w i t h a p o l y m o r p h i c v ir ir u s is is r u n b y t h e u s e err , t h e d e c r y p t o r r o u t i n e t a k e s c o m p l e t e c o n t r o l o v e r t h e s y s t e m , a f t e r w h i c h i t d e c ry ry p t s t h e v i ru ru s c o d e a n d t h e m u t a t i o n e n g i n e. e. N e x t , t h e c o n t r o l o f y o u r s y s t e m i s t r a n s f e r r e d b y t h e d e c r y p t i o n r o u t i n e t o t h e v i r u s , which locates a new program to infect. In RAM (Random Access Memory), the virus makes a replica of itself as well as the mutation engine. Then the virus instructs the encrypted mutation engine

to

generate

a

new

randomized

decryption

routine,

which

has

the

capability

of

decrypting virus. Here, this new copy of both the virus code and mutation engine is encrypted by the virus. Thus, this virus, along with the newly encrypted virus code and encrypted m u t a t i o n e n g i n e ( EM E M E ), ), a p p e n d s t h is is n e w d e c r y p t i o n r o u t i n e o n t o a n e w p r o g r a m , t h e r e b y c o n t i n u i n g t h e p r oc oc e s s. s. P o l y m o r p h i c v i ru r u s e s t h a t r e s p r e ad a d b y t h e a t t a c k e r i n t a r g e t e d s y s t e m s a r e d i f f ic ic u l t t o d e t e c t because here the virus body is encrypted and the decryption routines changes each time from i n f e c t i o n t o i n f e c t i o n a n d n o t w o i n f e c t i o n s l o o k t h e s a m e ; t h is is m a k e i t d i f f i c u l t f o r t h e v i r u s s c a n n e r t o i d e n t i f y t h i s v i r u s. s.

Module 07 Page 1050




M e ta m o r p h ic V ir u s e s M e t a m o rp h i c Vir u s e s

M e t a m o rp h i c C Co ode

Metamorphic viruses rewrite themselves completely each time they are to infect new executable

Metamorphic Metamorphic code can reprogram itself by translating transl ating its own code into a temporary representation and then back to the normal code again

MotaphoR VI by tHE moNTAL Dill lei/2 9*

CEH

UrtM UrtMM M itkNjI itkNjI lUilwt

For example, example, W32/Simile W32/Si mile consisted of over 14000 14000 lines of assembly code, 90% of it is part of the metamorphic engine

E3

MetaphoRVI bj •HEmtfJTA EmtfJTALD
E l a.) Variant ariant A

c.) The"Unoffi fficial” cial” Variant C at IAHMJ1 IL bYiHfc ni Ntnl cttllller/^JA cttllller/^JA

mEtAPHGR1bBYtH• GR1bBYtH•

A1LER/2*\

r£TAfSC« iCbVlHEn£ iCbVlHE n£W»4l dFIIUi/ dFIIUi/2^ 2^

E l

[1E

b.) V ar ia nt B

I

d.) The .D variant (which was the *official' C of the original author)


M e ta m o r p h i c V iru s es Some viruses rewrite themselves to infect newly executed files. Such viruses are c o m p l e x a n d u se se m e t a m o r p h i c e n g in in e s f o r e x e c u t io io n . A code that can reprogram itself is called metamorphic code. This code is translated into the temporary code, and then converted back to the normal code. This technique, in which the o r i g in in a l a l g o r i t h m r e m a i n s i n t a c t , is is u s e ed d t o a v o id id p a t t e r n r e c o g n i t i o n o f a n t i v i r u s s o f t w a r e . T h is is is is m o r e e f f e c t i v e i n c o m p a r i s o n t o p o l y m o r p h i c c o d e . T h is is t y p e o f v i r u s c o n s is is t s o f c o m p l e x extensive code. T h e c o m m o n l y k n o w n m e t a m o r p h i c v ir i r u se s e s a re re : W i n 3 2 / S im i m i l e: e:

This virus is written in assembly language and destined for Microsoft Windows. This process is c o m p l e x , a n d n e a r l y 9 0 % o f v i ru r u s c o d e s a r e g e n e r a t e d b y t h is is p r o c es es s . Zmist:

Zmist is also known as the Zombie. Mistfall is the first virus to use the technique called "code integration." This code inserts itself into other code, regenerates the code, and rebuilds the executable.

Module 07 Page 1051




a.) Variant A

c.) The "Unofficial" Variant C

ImElAPHOR 1b BY tHe MeNTAI drilLER/29A

12

i!LER/ mEtAPHOR 1b BY tHe MeNTAI di!LER/ ro in

b.) Variant B

aA

m

mETAPhOr 1C 1C bY tHE mENtal dRllle1/29A dRllle1/29A

Q

mETAPhOr 1C bY (HE mENtal dRlller/29A

..... o k

...

d.) The .D variant (which was the "official" C of the original author) FIGURE 7.12: Metamorphic Viruses Screenshot


Ethical Hacking and Coun termea sures Copyright © by EC-C0l1nCil All Rights Reserved. Reproduction is Strictly Prohibited.



File Overwriting Overw riting or or Cavity Viruses Viru ses

CEH

Cavity Virus overwrites a part of the host file with a constant (usually nulls), without increasingthe length of the file and preserving its functionality

Sales and marketing management management is the leading authority authori ty for execu executives tives in the sales sales and marketing management management industries industries The suspect, Desmo Desmond nd Turner, surrendered surrendered to to authorities authoriti es at a downtown Indianapolis Indianapolis fast-food restaurant

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

NUll

Nu l l

Nu l l

Nu l l

Nu l l

Nu l l

Original File Size: 45 KB

> 23a

Nu l l

Infected File Size: 45 KB


F i le l e O v e r w r i ti t i n g o r C a v i t y V i ru ru s e s These are also known as space-fillers since they maintain a constant file-size while infected by installing themselves into the target program. They append themselves to the end o f f ilil e s a n d a l so s o c o r r u p t t h e s t a r t o f f i le l e s . Th Th i s t r i g g e r e v e n t f i r s t a c t i v a t e s a n d e x e c u t e s t h e v i r us us code, and later the original application p rogram. S o m e p r o g r a m f i le le s h a v e a r e as a s o f e m p t y s p a c e . T h is is e m p t y s p ac ac e i s t h e m a i n t a r g e t o f t h e s e viruses. The Cavity Virus, also known as the Space Filler Virus, stores its code in this empty space. The virus installs itself in this unoccupied space without any destruction to the original code. It installs itself in the file it attempts to infect. T h is is t y p e o f v i r u s is is ra ra r e l y u s e d b e c a u s e i t is is d i f f i c u l t t o w r i t e . A n e w W i n d o w s f i le le c a l l ed ed t h e Portable Executable it designed for the fast loading of programs. However, it leaves a certain gap in the file while it is being executed that can be used by the Space Filler Virus to insert itself. The most popular virus family is the CIH virus.

Original File Size: 45 KB

I

h

............ ............................................ .....................^

PDF

L

>PDF1

Infected File Size: 45 KB

FIGURE 7.13: File Overwriting or Cavity Virus

Module 07 Page 1053




S p a r s e I n f ec to r V ir u s e s M

ir S p a r s e I n f e c t o r Vi Vi r u s J

Sparse infector virus infects on ly occasiona lly (e.g. every tenth program executed), or only files whose lengths fall within a narrow range

D i f fi fi c u l t t o D e t e c t J

By infecting less often, such viruses try to minimize the probability of being being discovered discovered

Infection Process

Wake up on 15* of every month and execute code

Copyright © by EC-Cauactl.All Rights Reserved. Reproduction is Strictly Prohibited.

S p a r s e I n f e c t o r V i ru ru s e s S p ar ar s e i n f e c t o r v i r u s es e s i n f e c t o n l y o c c a s i o n a l ly l y ( e. e . g. g. , e v e r y t e n t h p r o g r a m e x e c u t e d o r o n p a r t i c u l a r d a y o f t h e w e e k ) o r o n l y f ilil e s w h o s e l e n g t h s f a llll w i t h i n a n a r r o w

range. By

infecting less often, these viruses try to minimize the probability of being discovered.

Wake up on 15th of every month and execute code

FIGURE 7.14: 7.14: Working of Sparse Infector Viruses

Module 07 Page 1054




Comp Co mpan anio ion/ n/Ca Camo mouf ufla lag ge Virus ruses I

C EH

A Companion virus creates a companion file for each executable executable file the virus infec i nfects ts

A

Therefore, a companion virus may save itself itsel f as as notepad.com notepad.com and every time ti me a user executes notepad.exe (good program), program), the computer comput er will load notepad.com (virus) and infect the system

Virus infects the system with a file notepa d.com and saves it in c:\winnt\system32directory

...

1 Attacker

1

/

£

Notepad.exe

Notepad.com


C o m p a n i o n /C a m o u f la g e V iru se s Com panion Viruses 4

T h e c o m p a n i o n v i ru ru s s to t o r e s it it s e lf l f b y ha h a v in i n g t h e i d e n ti ti c a l f i le le n a m e a s t h e t a r g e t e d

p r o g r a m f i l e . A s s o o n a s t h a t f i le l e is e x e c u t e d , t h e v i r u s i n f e c t s t h e c o m p u t e r , a n d h a r d d i s k d a t a is modified. Companion viruses use DOS that run COM files before the EXE files are executed. The virus installs an identical COM file and infects the EXE files. Source: h t t p : / / w w w . c k n o w . c o m / v t u t o r / C o m p a n i o n V i r u s e s . h t m l Here is what happens: Suppose a companion virus is executing on your PC and decides it is time to infect a file. It looks around and happens to find a file called PGM.EXE. It now creates a file c a llll e d P G M . C O M , c o n t a i n i n g t h e v i r u s . T h e vi vi r u s u s u a l l y p l a n ts t s t h i s f i le le i n t h e s a m e d i r e c t o r y a s t h e . EX EXE f i l e , b u t i t c o u l d p l a c e i t i n a n y d i r e c t o r y o n y o u r D OS OS p a t h . I f y o u t y p e P G M a n d p r e ssss Enter, DOS executes PGM.COM instead of PGM.EXE. (In order, DOS will execute COM, then EXE, a n d t h e n B AT AT f i l e s o f t h e s a m e r o o t n a m e , i f t h e y a r e a llll i n t h e s a m e d i r e c t o r y . ) T h e v i r u s executes, possibly infecting more files, and then loads and executes PGM.EXE. The user p r o b a b l y w o u l d f a i l t o n o t i c e a n y t h i n g i s w r o n g . I t is i s e a ssyy t o d e t e c t a c o m p a n i o n v i r u s j u s t b y the presence of the extra COM file in the system.

Module 07 Page 1055




Virus infects the system with a file notepad.com and saves It In c:\wlnnt\system32 directory

Attacker

V Notepad.exe

Notepad.com

FIGURE 7.15: 7.15: Working of Companion/Camouflage Companion/Camouflage Viruses

Module 07 Page 1056




c EH

S h e ll V ir u s e s J

(citif ifwd IthMJl lUckM

Virus code forms forms a shell around the target host program's program's code, code, making making itself the original program and host code a s its sub-routine

J

[4U«1

Almost all boot program viruses are shell viruses

Before Infection

Original Program

A f t e r I n f e ct ct i o n

Virus Virus Cod e --- >

Original Program


I l f

S h e ll ll V i r u s e s A s he he l l v i r u s c o d e f o r m s a l a y er e r a r o u n d t h e t a r g e t h o s t p r o g r a m ' s c o d e t h a t c a n be be

c o m p a r e d t o a n " e g g s h e l l / ' m a k i n g i t s e l f t h e o r i g i n a l p r o g r a m a n d t h e h o s t c o d e i ts ts s u b routin e. Here e,, t h e o r i g i n a l c o d e i s m o v e d t o a n e w l o c a t i o n b y t h e v i r u s c o d e a n d t h e v i r u s assumes its identity. Before Infection

Original Program

A f t e r In f e c t i o n

Virus Code

Original Program

FIGURE FIGURE 7.16: W ork ing o f Shell Shell Viruses

Module 07 Page 1057




CEH

F i l e E x t e n s io io n V i r u s e s

Folder Options ptions

File Extensio n Viruses General

J File ile extension viruses viruses change the the extensions extensions of file fil es

Search

Folder views You can apply the view (such as Detais or Icons) that you are us*1g for this folder to a l folders of this type Apply to Folders

J .TXT is safe as it indicates indicates a pure text file

Advanced settings: settings:

J With it h extensions extensions turned off, if someone eone sends you you a fi file named BAD.TXT.VBS, you will only only see BAD.TXT

Fies and Folders □ Always Always show icons, icons, never thum thumbna bnails ils I I Always show menus @ Display Me icon on thumbnails 0 Display ay He size nfoimation m folder tps □ Displa Displayy the full path in the the title bar bar Jl Hdde n Mes and folders Don show hidden files, folders, or dnves (§) Show hidden files, es, folders, and dnves y Hide cmgty dnves in the Computer folder

J If you have forgott forgotten en that that extens extensions ions are turned turned off, you might think think this is is a text fil file e and ope open n it

O

J This is an executabl execut able e Visual isual Basic Basic Script cript virus virus file file and could do serious damage

V. Ude folder merge merge conflicts conflicts Restore QfifoJls

J Counterme ountermeasure asure is is to turn off of f "Hide "Hide file extensions" in Windows

*PP*y


F i le le E x t e n s i o n V i r u s e s

u

Source: h t t p :/ : / / w w w . c k n o w . c o m / v tu t u t o r /F / F i le l e E x t e n s i o n s . h tm tm l ©

F ilil e e x t e n s i o n v i r u s e s c h a n g e t h e e x t e n s i o n s o f f i le le s

Q

.TXT is safe as as it indicate s a pure te xt file

Q

W i t h e x t e n s i o n s a r e t u r n e d o f f , i f s o m e o n e s e n d s y o u a f i l e n a m e d B A D .T .T X T. T. VB VB S , y o u can only see BAD.TXT

Q

I f y o u h a v e f o r g o t t e n t h a t t h e e x t e n s i o n s a re re a c t u a l ly ly t u r n e d o f f , y o u m i g h t t h i n k t h is is is is a text file and open it

0

T h i s i s a n e x e c u t a b l e V i s u a l B a s ic ic S c r i p t v i r u s f i l e t h a t c o u l d d o s e r i o u s d a m a g e

T h e c o u n t e r m e a s u r e i s t o t u r n o f f " H i d e f i l e e x t e n s i o n s " i n W i n d o w s , as s h o w n i n th th e f o l l o w i n g screenshot:

Module 07 Page 1058




Folder Folder Option s General View

Search

Folder Folder views views You can apply the view (such as Detate or Icons) that you you are usng for this folder der to to al folders folders of ths type. Apply to Folders

Reset Folders

Advanced settngs Frfesand Folders H I Always Always show show icons, never thumb thumbnate nate ( ) Always show menus @ Display f

CEHv8 Module 07 Viruses and Worms.pdf

Recommend Documents