how an attacker can maintain control over their victim’s system without being discovered

13

How an attacker can maintain control over their victim’s system without being discovered. Rootkits

Upload: frederick-houston

Post on 16-Dec-2015

219 views

Category:

Documents

1 download

Report

Download

Tags:

Embed Size (px):

TRANSCRIPT

Page 1: How an attacker can maintain control over their victim’s system without being discovered

How an attacker can maintain control over their victim’s

system without being discovered.

Rootkits

Page 2: How an attacker can maintain control over their victim’s system without being discovered

What is a Rootkit?

• A rootkit is a collection of tools used by intruders to keep the legitimate users and administrators of a compromised machine unaware of their presence[1].

The keyword to remember for a rootkit is undetectable; and the most common purposes for a rootkit are sustained access and eavesdropping.

Page 3: How an attacker can maintain control over their victim’s system without being discovered

Some History

• Early 1990’s – Internet becomes popular

• 1st Generation rootkits- Replaced potential tattletale binaries (e.g. netstat, ls)

• Easy to detect- Compare the hashes of the original binary with current one.

• First rootkits were mostly written for Unix based systems (hence rootkit,

instead of Administratorkit)

• 1999- NTRootkit, an early Windows rootkit

• Rootkits did not really become part of security admin vernacular until mid

2000’s

• Kicked off an arms race- rootkit developers vs detection/prevention measures

Page 4: How an attacker can maintain control over their victim’s system without being discovered

Main things to hide

• Processes

• Files

• Network Connections

• Also: Various system statistics (e.g. CPU percentage)

Page 5: How an attacker can maintain control over their victim’s system without being discovered

Current mindset on rootkits:• Uh oh, you have a rootkit?

Page 6: How an attacker can maintain control over their victim’s system without being discovered

This mindset solves nothingZen quote

Page 7: How an attacker can maintain control over their victim’s system without being discovered

Small POCProof of concept

The Hello World of Rootkits

Page 8: How an attacker can maintain control over their victim’s system without being discovered

What’s going on?

Page 9: How an attacker can maintain control over their victim’s system without being discovered

What’s going on in a userland rootkit?

• Hooking- Overwriting target function to act in favor of the rootkit

• Example 1- Overwrite legitimate function in memory

• Example 2- Overwrite legitimate function’s address in IAT to point to

rootkit’s custom function instead

Page 10: How an attacker can maintain control over their victim’s system without being discovered

What’s going on in a kernel rootkit?

Similar concept, but different memory spaces, tables, functions…

Page 11: How an attacker can maintain control over their victim’s system without being discovered

CODE

Page 12: How an attacker can maintain control over their victim’s system without being discovered

Detecting the Invisible• Detecting a Presence

• Guard the Doors- Think intrusion detection• Roaming Guard- Periodic System scans

• Detecting Behavior• Sysinternals RootkitRevealer example

• Live Detections-• Rootkit revealer• GMER- Free, GNU-based. • Helios- Behavioral analysis (can be used to detect many forms of malware)• Sophos Anti-Rootkit- Free. Scans other forms of malware. Can scan a network,

not just a single host.

• If kernel rootkit is suspected-• Need to analyze system under a kernel debugger (kd.exe)

Page 13: How an attacker can maintain control over their victim’s system without being discovered

End notes

• Still need to nuke system from orbit

• Questions?

HOW AN END-TO-END FILELESS ATTACK TAKES PLACE · GOAL: GAIN ACCESS The attacker gains remote access to the victim’s system, to establish a beachhead for his attack. 01 GOAL: STEAL

Detect Reverse Shell Attack - Triagingx · Detect Reverse Shell In order to initiate reverse shell connection from a victim’s system, attacker needs to get access to the victim’s

Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)

United States Court of Appeals Fifth Circuit F I L E D · 2005-02-17 · victim’s husband, arrived home from work shortly before 6:00 p.m. on September 21, 1994. He discovered his

Active Attacker July 14, 2012

ATTACKER ANTICS - ruxcon.org.au · ATTACKER ANTICS ILLUSTRATIONS OF INGENUITY ... \Program Files (x86)\McAfee\ePolicy ... csc.exe (Self-signed –Microsoft) MD5

Insider Attacker Detection

Human Rights Victim’s Claim Application Form and FAQs

HELP GIVEN TO VICTIM’S

Tempe Police Department Victim’s Fraud Packet

Tomcat Vulnerabilities - IKKISOFT · Agenda • What are the main vulnerabilities discovered in the past years in Apache Tomcat? • How can a potential attacker exploit these weaknesses?

1.Attacker targets workstations en masse 2.User running as local admin is compromised, attacker harvests credentials 3.Attacker uses credentials

Attacker POV to computer networks Attacker profiles and ...users.jyu.fi/~timoh/TIES327/L3.pdf · • Attacker POV to computer networks • Attacker profiles and public cases ... Product

Consequences of a Jailbroken iDevice · 2020-01-17 · Jailbreakme.com (“Star”) iOS 4.0.1 Attacker can silently jailbreak victim’s device by tricking victim into visiting a

Securing Frame Communication in BrowsersGadget Attacker. A gadget attacker is a web attacker with one additional ability: the integrator embeds a gad-get of the attacker’s choice

Single Packet Authorization on the WEB -- WEB-SPA · Single Packet Authorization Client Attacker 1 Attacker 2 Attacker 3 Server. OWASP 10 Attacks Latency Denial of Service Replay

Attacker Economics - F5

2980 Attacker BA E

Attacker aproach for attacking ics

Hunting Attacker Activities - Botconf 2021

NETWORKDEFENCEUSING ATTACKER-DEFENDER ... - Masaryk …

The Victim’s Directivevictimsupporteurope.eu/activeapp/wp-content/files_mf/14017141163J... · The Victim’s Directive – A Challenge for Probation? Confederation of European Probation

Attacker Ghost Stories - ShmooCon 2014

Cisco Kunden Webinar · DNS/DHCP Server ISC BIND DNS Server Attacker Internal Microsoft and BIND servers > DNS Firewall > Thwarted cache ... •Dan Kaminsky, who discovered the new

Surprise Police Department’s Identity Theft Victim’s Packet

Wireless Network Security - fac.ksu.edu.safac.ksu.edu.sa/sites/default/files/lab_10_-_wireless_security... · •Attacker may hack a victim’s personal computer and steal private

Fabian van den Broek · Attacker records an encrypted TMSI allocation command Replay the recorded command later to distinguish victim’s phone from others As long as the same keys

A victim’s view of HS2 noise

Motor Vehicle Collisions: A Victim’s Handbook...Motor Vehicle Accidents: A Victim’s Handbook - Alabama Edition - PREFACE Being injured in a motor vehicle accident, or having a

Attacker Behavior Boston Security Conference 2015

Session Fixation OWASP Attack sketch Attacker sets victim’s session ID instead of session ID theft Victim authenticates using attacker provided session ID Attacker resumes authenticated

The Victim’s Experience as Described in Civil Court

Walmart / Sam’s Club Identity Theft Victim’s Affidavit ... · PDF fileIdentity Theft Victim’s Affidavit . ... A valid government -issued photo identification card (i.e. driver’slic

DEAR ABBY Abuse, alcohol cloud victim’s perception

CS 380S - Great Papers in Computer Securityshmat/courses/cs395t_fall06/sop.pdf•Malicious code executes directly on victim’s computer •To infect victim’s computer, can exploit