Download Malicious Logic and Defenses

Malicious Logic and Defenses
Malicious Logic
• Trojan Horse
– A Trojan horse is a program with an overt
(documented or known) effect and covert
(undocumented or unknown) effects.
– A Propagating Trojan horse is a Trojan horse that
creates a copy of itself
– Example of Trojan horse is the game animal.
– The central idea is that the Trojan horse modifies
the compiler to insert itself into specific programs,
including future version of the compiler itself.
Malicious Logic
• Computer Viruses
– When Trojan horse can propagate freely and insert a
copy of itself into another file, it becomes a computer
virus.
– A computer virus is a program that insert itself into
one or more files and then performs some action.
– The first phase in which the virus insert itself into a
file is called the insertion phase and the second phase,
in which it perform some action, is called the
execution phase.
– Computer viruses have no covert purpose it only have
overt purpose which is to infect and execute
Malicious Logic
• Types of Computer Viruses
– Boot Sector Infectors
• A boot sector injector is a virus that insert itself into the
boot sector of a disk.
– Executable Infector
• An executable infector is a virus that infects executable
program.
• Generally .exe, .com files are infected by this virus.
– Multipartite viruses
• A multipartite virus is one that can infect either boot sector
or applications.
Malicious Logic
– TSR Viruses
• A terminate and stay resident (TRS) virus is one that
stays active in the memory after application has been
terminated.
• TSR virus can be boot sector or executable infectors.
– Stealth Virus
• Stealth viruses are viruses that conceal the infection of
files.
– Encrypted viruses
• An encrypted virus is one that enciphers all the virus
code except for a small decryption routine
Malicious Logic
– Polymorphic Virus
• A polymorphic virus is a virus that changes its form
each time it inserts itself into another program.
– Macro Virus
• A macro virus is a virus composed of a sequence of
instructions that is interpreted, rather than executed
directly.
• This type of virus can execute on any system that can
interpret the instruction.
• It can infect either executable or data files.
Malicious Logic
• Computer Worms
– Computer worm is a program that copies itself from
one computer to another computer.
• Other Forms of Malicious Logic
– Rabbits and Bacteria
• A Bacterium or a rabbit is a program that absorbs all of some
class of resource.
• Creates DOS attacks.
– Logic Bombs
• A logic bombs is a program that performs an action that
violates the security policy when some external event
occurs.
Defenses
• Defending against malicious logic takes advantage of
several different characteristics of malicious logic to
detect or to block, its execution.
• Sandboxing
– Sandboxing are Virtual machines implicitly restrict process
right.
– Common implementation of this approach is to restrict the
program by modifying it.
– Special instructions inserted into the object code cause
traps whenever an instruction violates the security policy.
– The executable dynamically loads libraries, special libraries
with the desired restrictions replace the standard libraries.
Defenses
• Information flow metrics
– This approach is to limit the distance a virus can
spread.
• Reducing the rights
– The user can reduce her/his associated protection
domain when running a suspect program.
– It follows the principle of least privilege.
• Malicious logic altering files
• Proof-carrying code
• Notion of trust
Introduction to Virtual Machine
• Virtual Machine(VM) structure
– A VM runs on a virtual monitor.
– Monitor virtualizes the resources of the underlying system and
presents to each VM the illusion that it and it alone is using the
hardware.
• Virtual machine monitor(VMM)
– The VMM runs at the highest level of privilege.
– Keeps track of the state of each VM just as an ordinary Operating
System keeps track of the state of its processes.
– When a privileged instruction is executed, the hardware cause a trap
to the VMM.
– The monitor services the interrupt and restores the state of the caller.