Slashdot Mirror
Stealing Data With Obfuscated Code
Weblver1 writes "A recent report by web security firm Finjan shows how easily data can be accessed on PCs by malware which circumvents existing defenses. With the use of obfuscated code, antivirus
software and static Web filters could not identify the scrambled attack code as a threat. The report walks through a real-life scenario of the infection
process step-by-step, and tracks what happens to the stolen data. This demonstrates how stealing sensitive data has become unbearably easy — especially, given the abundance of easy-to-use DIY crimeware toolkits. Finjan's report is available
here (PDF, registration required). Shortly after this report, Security firm RSA has released their findings
of a huge amount of stolen 'virtual wallets' in one of the largest discoveries of stolen data from computers compromised by the Sinowal trojan. While the trojan can be traced back to 2006, it managed to become more productive over time with frequent variants. Given the scale, ease of use, and hiding techniques making infections extremely difficult to find, no wonder today's crimeware achieves such 'impressive' results."
X=1024; Y=768; A=3;
,0),b =E, a+(a>b ?-b:b)): -1.0);}Z;W;o ;n(e,f,g, h,i,j,d,a, b,V){o(0 ,e,f,g,h,i,j,a);d>0 :0,U+=V &4?b:0) :(d==P?(g+=2 / M,U=111 -85*U/M) ),d!=P?(Q/=2,T/=2 ;t(x,y ,a, b){n(M*J+M *40*(A*x +a)/X/A-M*20,M*K,M ;G+=T;B +=U;++a<A?t(x,y,a,
J=0;K=-10;L=-7;M=1296;N=36;O=255;P=9;_=1<<15;E;S;C;D;F(b){E="1""111886:6:??AAF"
"FHHMMOO55557799@@>>>BBBGGIIKK"[b]-64;C="C@=::C@@==@=:C@=:C@=:C5""31/513/5131/"
"31/531/53"[b ]-64;S=b<22?9:0;D=2;}I(x,Y,X){Y?(X^=Y,X*X>x?(X^=Y):0, I (x,Y/2,X
)):(E=X); }H(x){I(x, _,0);}p;q( c,x,y,z,k,l,m,a, b){F(c
);x-=E*M ;y-=S*M ;z-=C*M ;b=x* x/M+ y*y/M+z
*z/M-D*D *M;a=-x *k/M -y*l/M-z *m/M; p=((b=a*a/M-
b)>=0?(I (b*M,_
(c,x,y, z,k,l, m,a){Z=! c? -1:Z;c <44?(q(c,x ,y,z,k,
l,m,0,0 ),(p> 0&&c!= a&& (p<W ||Z<0) )?(W=
p,Z=c): 0,o(c+ 1, x,y,z, k,l, m,a)):0 ;}Q;T;
U;u;v;w
&&Z>=0? (e+=h*W/M,f+=i*W/M,g+=j*W/M,F(Z),u=e-E*M,v=f-S*M,w=g-C*M,b=(-2*u-2*v+w)
/3,H(u*u+v*v+w*w),b/=D,b*=b,b*=200,b/=(M*M),V=Z,E!=0?(u=-u*M/E,v=-v*M/E,w=-w*M/
E):0,E=(h*u+i*v+j*w)/M,h-=u*E/(M/2),i-=v*E/(M/2),j-=w*E/(M/2),n(e,f,g,h,i,j,d-1
,Z,0,0),Q/=2,T/=2, U/=2,V=V<22?7: (V<30?1:(V<38?2:(V<44?4:(V==44?6:3))))
,Q+=V&1?b:0,T +=V&2?b
,j=g>0?g/8:g/ 20):0,j >0?(U= j *j/M,Q =255- 250*U/M,T=255
-150*U/M,U=255 -100 *U/M):(U =j*j /M,U<M /5?(Q=255-210*U
/M,T=255-435*U /M,U=255 -720* U/M):(U -=M/5,Q=213-110*U
/M,T=168-113*U
,U/=2):0);Q=Q< 0?0: Q>O? O: Q;T=T<0? 0:T>O?O:T;U=U<0?0:
U>O?O:U;}R;G;B
*L-M*30*(A*y+b)/Y/A+M*15,0,M,0,P, -1,0,0);R+=Q
b):(++b<A?t(x,y,0,b):0);}r(x,y){R=G=B=0;t(x,y,0,0);x<X?(printf("%c%c%c",R/A/A,G
/A/A,B/A/A),r(x+1,y)):0;}s(y){r(0,--y?s(y),y:y);}main(){printf("P6\n%i %i\n255"
"\n",X,Y);s(Y);}
Comment removed based on user account deletion
But when people say that we should have only one distro, and that it's a problem that different distros use different versions of software and insert their own patches...this is why they are wrong wrong wrong.
Monocultures FTL.
"To any truly impartial person, it would be obvious that I am right."
Surfin'Shield sort of drowned. There is probably a similar scam behind this "research"....
Monstar L
http://www.ranum.com/security/computer_security/editorials/dumb/index.html
Why bother with anti-virus for the system itself? (Note: anti-virus is acceptable for mail servers or file servers.)
Instead, why not focus on identifying the known good code ... and quarantining anything else?
Maybe there aren't an infinite number of ways to obfuscate code (eventually your obfuscation would exceed the capacity of the local hard drive) but there are FAR more ways to obfuscate code so it bypasses the anti-virus scanners than there are bits of known good code.
I should be able to boot from some form of rescue CD with a HUGE list of filenames, checksums, etc ... and what application they are associated with ... and validate every single file on a workstation. And then quarantine everything else so it can be manually verified.
There, even if you get infected, the disinfection is simple AND effective.
For the truly paranoid, what are the best tools to run on your system to detect potential intrusion of this type?
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
Does this remind anyone else of the time someone tried to replace a conditional with an assignment and check it into the linux kernel to make a trigerable security hole?
I've heard about a project at cert called function extraction that might be relevant to this. It's been going on a few years and they've produced some tools. Don't know much more.
http://www.cert.org/sse/function_extraction.html
That's what I said. While there isn't an infinite number of variations, there are far more variations possible than there are known good bits.
So do NOT try to solve this problem by matching "bad" patterns.
Match known good patterns and quarantine everything else.
The user will ALWAYS be the weakest link. As the article I linked to stated, if education could work, it would have worked by now.
Instead, focus on building systems that MINIMIZE the vulnerability and that make it EASY to RECOVER when it is cracked.
That's your opinion. I can show that it does work.
Huh? How about some specifics? Because that isn't making sense to me.
How do you "re-write the registry"?
Instead, imagine an anti-virus system that refuses to allow code to be installed in they system directories (or registered) unless it matches the checksums, names, etc on a list of known good apps. Then it just becomes a issue of keeping that list updated with the latest patches and upgrades.
Instead of downloading the daily list of suspected BAD patterns, you'd be downloading a list of known good patterns. And that would only need to be updated prior to something being installed on the system.
For a business looking to manage thousands of PC's ... all with the same basic apps and patch levels and such ... this would be so much easier than trying to maintain the current anti-virus system (engine upgrades, signature upgrades). Nothing would be installed that was not pre-approved by their department.
WTF? You don't know how to make your own BugMeNot to help OTHER people?
You must be new here. You aren't supposed to read the file, just make comments about what it might say.
According to the Register article, the method of attack was DOM manipulation. The code waits until it sees a login form from a targeted site, and then it injects markup that sends the credentials to the bad guys on submit.
We can speculate on whether that's true or not, but if it is then it should be fairly easy to use a bit more javascript (why not? heh.) to check the integrity of the DOM. Banks should also be randomizing the structure of their forms and the names/ids of form fields as a matter of course.
Of course the attacks will evolve, but as long as you're going to play the game you've got to keep moving.
That will kill Web 2.0 technologies. Or anything where content/service providers expect you to run their code on your system. None of the schemes for whitelisting, signed certificates, checksums, etc. can handle the sheer volume of apps. that these new services expect you to handle. They work well for manually downloaded and installed applications and packages. But not when every kid with a FaceBook page has a game or other cure widget they want you to download.
The sheer volume of web apps of this type will provide numerous opportunities for people to find weakneses and use it to deliver something evil.
Have gnu, will travel.
Outbound firewalls are for people who don't know what they're doing
What an incredibly ignorant and stupid thing to say.
I definitely know what I'm doing and I use my outbound firewall to its fullest extent. Having the ability to proactively determine what software can and can't touch the network, be it establishing a connection or binding to a port, in conjunction with a proper hardware solution provides not only good protection, but also serves as an early warning system when an unknown program attempts to go to an unknown site for an unknown reason.
Granted, outbound firewalls are not perfect. If a whitelisted application is compromised, then it this firewall doesn't provide much protection. This is why outbound firewalls should be but one of several items in your security toolbox.
However, to wave your hand and claim they are only for people who don't know what they are doing shows a level of arrogance that usually gets corrected only after you are compromised.
The
We used to call it polymorphic code. A much prettier name if you ask me.
Been around since 1990:
http://en.wikipedia.org/wiki/1260_(computer_virus)
In fact you are wrong.
Computer aren't as complicated as that.
It's easy enough to design a system to make obscuring the purpose of a piece of code impossible and then have all programs define a contract with the system as to what resources they need to use on the system, this information is conveyed to the user in a nice way and now the user will know straight away if a program is going to act maliciously before they run it.
0-day arbitrary code execution vulnerabilities are created due to a small set of things that overworked programmers forget sometimes, and can be easily abstracted away (it's just that C is such a shit programming language yet it's so widely used)
...and that is all I have to say about that.
http://jessta.id.au
Comment removed based on user account deletion