Reverse Engineering Malware – Foundations – Part 2


Instructions

  • Instructions are the building blocks of assembly programs.
  • In x86 assembly Instructions has two components: Mnemonic and operands.
  • Mnemonic is a word that identifies the instruction to execute, such as mov, which moves data.
  • Operand, used to identify the information used by the instruction, such as registers or data:
    • Mnemonics have 0, 1, or more operands (arguments).
    • Operands can be:
      • A register
      • A memory location
      • An immediate value (e.g, 0x6453).

Mnemonic

Destination Operand

Source Operand

mov

ecx

0x42

Continue reading Reverse Engineering Malware – Foundations – Part 2

Reverse Engineering Malware – Foundations – Part 1


Disassembly

Before we dive into the code analysis and how we can utilize it to serve our purpose of getting a good understanding of the malware and its characteristics, let’s take a basic look into the architecture of a computer and we’ll start this by discussing the levels of abstraction.

Levels of Abstraction

  • A computer architecture can be represented as several levels of abstraction.
  • A windows Operating system can be installed on many different types of hardware because the hardware is abstracted (separated) from the operating system.
  • Malware authors create programs at high level language and use uses compilers to generate machine code to be executed by the CPU.
  • Malware analysts and reverse engineers work at the low-level language level.
  • Disassemblers are used to generate assembly code that we can read and analyse.
  • Computer systems are described with the following six different levels of abstraction, higher levels are placed near the end.
  • The lower you get the less portable the level will be across a computer systems.

Continue reading Reverse Engineering Malware – Foundations – Part 1

Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 10 – Wrapping Up


Future work

Although IDSs have matured and gone through tremendous amount of development throughout the years to this day there are however quite a few limitations that still and will continue to exist. This is because currently there isn’t a way to reliably detect unknown attacks and all the existing products seem to focus on attacks that are already known. It is true that anomaly-based detection can be classed as a method of detecting unknown attacks; it is still unreliable and can be easily defeated. It would make a difference if there’s a way to utilise all these methods of detection to make IDSs smarter and make them able to predict new attacks using the same concept professional hackers use to invent new exploits and methods of attacking the network. The following points highlight important facts researchers should focus on:

Continue reading Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 10 – Wrapping Up

Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 9 – Results Discussion


Discussion

To achieve the objectives of this study the experiments needed to be as realistic as possible, meaning that the same steps an attacker takes to compromise a network would need to be taken. This is to investigate the effectiveness of the IDS in detecting each stage at the same time there’s a need for a way to ensure that any attacks managed to evade detection have done so because of the effectiveness of the technique and not because of misconfiguration or any other issues. For this reason the experiments were divided into two scenarios. These scenarios were further divided into the experiments discussed in the previously (part 1 – part 8).

As explained by (Bejtlich 2004, p.19), in certain phases of a compromise it becomes very difficult to detect the attack; taking this under consideration it was decided to carry out the tests on the phases where if detected would mean that it was very obvious that an attack is being carried out. Table 7.1 taken from (Bejtlich 2004, p.19) shows these phases.

Phases of compromise

Description

Probability of Detection

Attacker’s Advantage

Defender’s Advantage

Reconnaissance

Enumerate hosts, services, and application version.

Medium to high

Attackers perform host and service discovery over a long time frame using normal traffic patterns.

Attackers reveal themselves by differences between their traffic and legitimate user traffic.

Exploitation

Abuse, subvert, or breach services.

Medium

Attackers may attack services offering encryption or obfuscate exploit traffic.

Exploits don’t appear as legitimate traffic, and IDSs will have signatures to detect attacks.

Reinforcement

Retrieve tools to elevate privileges and/or disguise presence.

High

Encryption hides the content of tools.

Outbound activity from servers can be closely monitored and identified.

Consolidation

Communicate via backdoor, typically using covert channel.

Low to medium

With full control over communication endpoints, the attacker’s creativity is limited only by the access and traffic control offered by intervening network devices.

Traffic profiling may reveal unusual patterns corresponding to the attacker’s use of a backdoor.

Pillage

Steal information, damage the asset, for further compromise the organisation.

Low to medium

Once operating from a “trusted host”, the attacker’s activities may be more difficult to notice.

Smart analysts know the sorts of traffic that internal systems should employ and will notice deviations.

Table 7.1: Phases of a compromise (Bejtlich 2004, p.19)

The highlighted top two columns in the above table are the stages chosen to be investigated for this study.

Continue reading Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 9 – Results Discussion

Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 8 – Scenario Two Findings – Encryption


SCENARIO 2.3 – ENCRYPTION
EXPERIMENT 8 – SSH TUNNELS

Encrypted data makes it very difficult for IDSs to examine the payload for any attacks because it can’t actually see it, which is one of the limitations that exist in IDSs. For this part of the experiment the author used SSH tunnels to encrypt the traffic between the attacker and the target. Figure 6.45 shows the attacker creating a dynamic SSH port listening on the localhost on port 8888 and an SSH forwarder listening on localhost port 8881 forwarding the traffic to destination target 192.168.59.130 on destination port 3632 (DISTCC).

Continue reading Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 8 – Scenario Two Findings – Encryption

Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 7 – Scenario Two Findings – Evasion


Evasion Techniques

SCENARIO 2.1 – FRAGMENTATION

In this section different evasion techniques have been implemented to evade Snort. The first task of this setup was to run fragtest on the attacker, feeding it the IP address of the target to determine if the target system processes fragmented and overlapped data correctly and not being dropped by a firewall. Then fragroute was executed to fragment packets destined to the target using different fragmentation methods. The tests started with the default fragmentation settings and then the settings were changed accordingly.

Tcpdump was also started to capture the traffic for later analysis. Figure 6.17 illustrates this setup.


Figure 6.17: Evasion Techniques – Fragmentation Test Block Diagram


Figure 6.18: Evasion Techniques – Fragmentation – Testing target’s handling of fragmentation data

Fragtest’s results illustrates the target’s handling of fragmented and overlapped data, such as the target’s distance being one hop away from the attacker, the target’s IP options (sec, ts, esec, rr, satid), the target handles fragmented data correctly, handles overlapped data favouring new data and the target’s timeout setting is 29.99 seconds. All this information is very important to an attacker and would aid the attacker in deciding which fragmentation patterns to use.

The experiments presented in this scenario used the following fragmentation settings:

  • Fragroute’s default configuration.
  • An 8-byte fragments favouring old data.
  • 4-byte TCP segments favouring new data.

EXPERIMENT THREE: DEFAULT SETTINGS

The default settings are as follows:

  • tcp_seg 1 new – breaks the data into one byte segments favouring new data.
  • ip_frag 24 – breaks IP packets up into 24 byte fragments with duplicate IP chaffing (ip_chaff dup) to confuse the IDS.
  • Order random – orders the data into random order.
  • Print – prints the output on screen in tcpdump format.

As described by fragroute’s manual page ip_chaff is:

“Interleave IP packets in the queue with duplicate IP packets containing different payloads, either scheduled for later delivery, carrying invalid IP options, or bearing short time-to-live values.”

Continue reading Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 7 – Scenario Two Findings – Evasion

Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 6 – Scenario One Findings – No Evasion


Scenario One – No evasion

The overall purpose of this stage was really to confirm that the IDS was configured correctly and to ensure it can detect the attacks that will be used.

When attackers attack networks they first perform some reconnaissance to map out the target network, at this stage they’d want to know the IP range used by the organisation, DNS servers, email addresses, etc. then a network scan is performed to find out which hosts are live, what services and version of services they’ve running and what operating systems they use, this is so they can choose suitable exploits to launch at the systems. There are many tools available out there to perform such steps; however nmap is the most popular tool that’s being used by the majority of professionals as well as attackers and it is the tool of choice for this study. All the attacker needs to do to achieve this is provide nmap with an IP address or a range of IP addresses and the type of scans to use.

To test the IDS it was configured to monitor network 192.168.0.0/16 and two types of scans were performed using nmap. These were as follows:

  • Nmap SYN scan.
  • Nmap fragmented SYN scan using nmap fragmentation option.

It is also important to note that for the experiments throughout the study the emphasis is not the returned results of the attack, the aim here is weather snort detects the attack or not.

Experiment one – Normal SYN Scan

RULES ONLY

Command:    nmap –sS –n 192.168.59.130     ß target system

Continue reading Investigating the efficiency of modern Intrusion Detection Systems (IDS) in detecting current evasion techniques – Part 6 – Scenario One Findings – No Evasion