Upload File

1 operating systems security. 2 where malware hides ? autoexec.bat or autoexec.nt can start malware...

  • Home
  • Documents
  • 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf
23
1 Operating Systems Security

Upload: laureen-rogers

Post on 30-Dec-2015

223 views

Category:

Documents


2 download

Report

Tags:

TRANSCRIPT

Page 1: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

1

Operating Systems Security

Page 2: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

2

Where Malware hides ?

•Autoexec.bat or autoexec.nt can start malware before windows start•Config.sys, config.nt•Autorun.inf on CD-ROMs or even hard drives•Boot.ini, bootsect.dos, command.com, dosstart.batmsdos.sys, io.sys•Desktop.ini -Can be used to hide files and auto-•launch programs when a folder is viewed Host, lmhost•Manipulating SMTP server settings or the Host file and intercepting sent e-mail.

Page 3: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

3

Malware (cont)

• Nested archives (zip, rar, tar, cab)

-detected only by recursive scanning• Auto-run files in archives• Embedded applications in Documents (word, • PowerPoint, excel)• Embedded macros in documents

-Can secretly send a named doc to a remote sender• OLE2 formatted documents can be executed• Rasphone.pbk -Can modify dialup network setting

including DNS and make long distance calls

Page 4: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

4

Malware (cont)

• Startup folder• Web cache -malware dropped in by websites• Path variable -illegitimate program will run then load

legitimate program• Trusted publishers -can execute programs w/o user

approval• Registry entries• Embedded URLs in HTML Emails (can execute

programs)

Page 5: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

5

Malware Trends

• Moving from hobby to criminals

⇒ more attempts to gain financial information• Viruses are distributed through compromised websites• Compromised clients are then directed to download

more malware

Page 6: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

6

Magnitude of the Problem

Page 7: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

7

Defenses

Don't give users Admin access

⇒ Windows Vista requires "run as administrator" for

Privileged operations: Install or uninstall programs Configure windows system settings View or change security permissions Change networking configuration Stop, start, load, or pause services Modify drivers Registry etc.

Page 8: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

8

Defenses (Cont)

• Update often• Use Personal firewall• Use antivirus software -keep updated• Use anti-spam• Use anti-spyware• Boot-up password• Boot only from primary hard drive -Can't load

NTFS4DOS• Password protect the bios

Page 9: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

9

Defenses (Cont)

• Disable guest account• Rename administrator account -unlimited retries• Rename guest account to administrator -helps catch • hackers• Run services on non-default ports https://x.com:3809• Install software on non-default folders• Use encrypted file system (EFS)• Disable LM and NTLM authentication• Enable account lockout after a certain number of tries

Page 10: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

10

Defenses (Cont)

• Use two factor authentication -biometric, • smart card, USB token, etc.

• Disable Simple File Sharing. SFS removes most NTFS permissions to close to Share. All connecting

users come in as administrator or guests

Page 11: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

11

Passwords

Page 12: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

12

Windows Login Passwords

Page 13: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

13

Password Attacks

Page 14: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

14

Password Attacks

Page 15: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

15

Password Attacks

Page 16: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

16

Password Authentication Mistakes

Page 17: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

17

Application Security

Page 18: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

18

Email

• Phishing• Attachments• HTML content (autopreview)• Spam: Spamming tools to introduce misspellings to avoid detection, to harvest emails from web sites, usenet groups, chat channels• Most email is plain text Can be read by any one⇒• Match the senders domain with IP address• Set rate control on: Connections per client, emails per client, number of recipients per email• Personal black and white lists

Page 19: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

19

Browsing

• IE MIME type mismatch -Declare skin but send java script• IE Plug-ins, Active X controls, Java scripts• Password and form input saving in browsers and in-line auto complete• Empty Temporary Internet Files folder when browser is closed

Page 20: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

20

Web Servers

• Directory Traversal: http://hostdomain/../../../../../../../windows/system32/cmd.exe?/c+dir+c will be converted to c:\windows\system32\cmd.exe in unpatched versions

of IIS 5. Allows a command shell access to the hacker

Page 21: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

21

Summary

• Need to secure systems against theft of data

–bios password, boot password

Passwords must be strong. • Use two-factor authentication for critical applications.• 10 Immutable Laws of Security• Secure email and browsing

Page 22: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

22

Page 23: 1 Operating Systems Security. 2 Where Malware hides ? Autoexec.bat or autoexec.nt can start malware before windows start Config.sys, config.nt Autorun.inf

23

Any question ?


Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

SUPPORT DE FORMATION : Organisation et …d1n7iqsz6ob2ad.cloudfront.net/document/pdf/533a982516219.pdfMSDOS.SYS COMMAND.COM CONFIG.SYS AUTOEXEC.BAT WINA20.386 : résout les conflits

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Reversing malware analysis training part8 malware memory forensics

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection

Metamorphic Malware 1 Metamorphic Malware Research

Windows Malware Firewall: Remove Windows Malware Firewall

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Malware & Anti-Malware

Malware and Anti-Malware Seminar by Benny Czarny

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

¿QUÉ ES MS-DOS · los archivos CONFIG.SYS, AUTOEXEC.BAT y COMMAND.COM en el disco del sistema. El archivo CONFIG.SYS es un archivo de texto que contiene comandos especiales. Estos

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Advanced malware analysis training session6 malware sandbox analysis

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

DOS - Celal Karaca Kişisel Web Sitesicelalkaraca.com/dersler/bahar/Sunucu_Isletim_Sistemi/... · Web viewÖrneğin : COMMAND.COM, CONFIG.SYS, AUTOEXEC.BAT ve LATS.DOC gibi Dosya

Menghapus Virus Recycler Dan Autorun.inf

1 Automated malware audit service Automatischer Malware Audit

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Introduction to the Operating Systems: - Caussanel …caussanelcollege.com/Notes/LN0008.doc · Web viewAUTOEXEC.bat Config.sys Files: Directory Ranjan.doc

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Evaluating Open Source Malware Sandboxes with Linux malware

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Autorun.inf. Un peligro potencial * Teleport Pro …Autorun.inf. Un peligro potencial * Teleport Pro v1.54 * InfraRecorder * Indicador de línea telefónica libre * Eliminar el ctfm