Hi everybody, and welcome back to Malicious Software and its Underground
Economy Two Sides to Every Story. This is the second lecture at unit one.
And what we're going to be talking about. So, the learning outcomes from, for these
lectures is that we're going to be peering through the early days of
malware. And we're going to be looking very
quickly about the AV industry. How, how well was it doing, and whether
malware were, were actually a problem back in the past.
Then we're going to be having a very quick glimpse at reverse engineering.
So static analysis, disassembly, assembly, how can we actually analyze a
piece of malware and understand what's going on?
Actually, reverse engineering is, is very complicated trop, topic, so we've broken
down that part in two units. But still we'll just be able to get a
glimpse out of it. The we'll have a very quick overview of
polymorphism. You know, how viruses know actually, can
repackage, and, themselves to withstand static analysis.
And we're going to be looking very quickly about few common techniques of
code [INAUDIBLE] . Then, as a last unit in this lecture,
we're going to be having a very fun, hopefully, walk through.
An example that shows how to analyze, disassemble and analyze a, a piece of
malware. It's actually benign code that I have
written specifically for this course, but we're going to be pretending that it's
actually a malicious piece of software. So now talking about the early days, so
we can chop up all the malware history in different eras.
In the very early days we can really talk about the error of discovery.
And this is something actually was adjusted by a friend of mine who is a
research at Semantic. and that gave a presentation who
presented this different eras and I like it very much and I though yeah, let's use
it because it seems to be quite smart. So in the era of discovery we have a few
things that are happening but everything seemed to be quite alright.
We can, just to name a few points, this is not an exhaustive list but in a few
points. That Elk Cloner is supposed to be one of
the first viruses for Apple to actually spread in the wild.
It was actually created as a joke from a 15 year old student that actually at it
fiftieth execution will actually show up. So something you know kind of harmless.
Then you have Fred Cohen is not a virus but is famous as a guy who actually
termed the name computer virus in a way. Then we are going to jump ahead in a few
years later to 1986 roughly can talk about Brain Boot.
Brain Boot is probably one of, of the first IBM PC virus.
And as the name suggests it just infects the boot sector, infected the boot sector
of floppies. For instance, as, as the floppy was
accessed on the computer. It was actually written by two Pakistani
brothers in a way to protect their intellectual properties.
Then we can see Virdem it was presented also at CCC, it stands for Chaos Computer
Club. Is an underground very famous conference
held in Germany and in a way Virdem infected com files.
A specific type of MS-DOS files and then proposed a game to to the, to the user,
to the victim. In a way that the, the victim had to
guess a number between zero and the number representing the generation of, of
the virus. Then we step ahead again, a few years
later, it's November the second 1988 is a very interesting date.
Because the Internet Worm collapsed basically the Internet that was known at
that time. And the worm was Coded and spread by
Robert Morris Junior who is now, by the way, a faculty professor at MIT.
So you can be successful, of course, and he is a very successful guy.
And the way that the worm worked, very briefly high level, is just it exploited
weaknesses, vulnerabilities like memory errors and also misconfigurations.
But the problem is that the spreading mechanism, the infection process was.
flawed in a way because basically the worm didn't check whether a system was
already infected. And therefore it acted pretty much like a
fork bomb on the system that it was able to attack.
Then we move on again, a few years again down the line.
And we, we found chameleon that, it can be fought as first polymorphic worms
sorry first polymorphic virus. So polymorphic in the way that it uses
incription. So the main payload of the virus
encrypted and the [INAUDIBLE] also use the inserted junk bytes.
To make it harder to properly disassemble, disassemble the virus.
What was the reason behind everything like this in this era of discovery?
Well, you know, I remember Asimov saying that, about size, that at the beginning,
was just curiosity. This is, what it was, it was just to show
off someone's skills. So, you know, the way that actually that
could do it and they knew the systems intimately that actually can create they
can control the system. So really, no, no big harm or no
intentional harm at that time even for the Morris worm.
the internet worm it was not meant to be destructive by itself, it just happened
to be. then we actually moving ahead, there was
kind of a weird area that can be dubbed the era of transition.
And we can find just to name a few important points here.
Michelangelo, that overrode basically the partition table or the very initial
product base, making the system unbootable in certain cases.
Then we had the appearance of the first micro virus, for Word.
So, the way that Word worked is that every document that is created, it is
based. So inherits a bunch of properties from
models, in that case the model is called, was called, normal dot, dot.
And, and the system, so the, the, the, the software support scripting language
That allows you to perform actions up on verification on certain events.
and, this is how people took advantage of this system to create microvirus.
And we can see in the next era again how this microvirus started basically the era
of mass-mailing worm. microvirus worm, or micro, micro worm.
Then we can, we can find in 1998, mid 1998 Chernobyl, that's called CIH which
is, which is quite interesting. because it was basically created in
response to claims that AV industries were actually good at detecting malware.
So the authors basically took the challenge and created something that was
really hard to detect. And it was quite interesting, because it
was very destructive in that case, and it turned out that roughly 60 millions of
computers were infected at that time. And the estimated damage to the industry
and users was roughly around one billion of US dollars so it's kind of a, we're
getting to our era in a way. However, the reason, the main reason is
still to show off skill. So even for [INAUDIBLE] the authors took
the challenge to show that he could evade systems.
So there was no really, financial motivation behind that.
It was just to show that, one can know the system better.
So for the AV industry, that time, back in the old world days, it was not really
the effort to collect samples. They were not really many, many samples
out there. So, was quite straightforward and in the
way that they could detect whether, a binary was representing a threat like a
virus or something like that. it was just to reverse engineer manually,
initially the virus and to analyze it so we'll get back to this point in the next
unit but, but ideally. After they had, they understood what the
virus was up to, the idea was to create a signature.
So a sequence of bytes representing the virus itself, part of the virus code or
data that could actually detect the virus with a very low false positive rate.
So It means that while it had to detect the high accuracy of the virus, it didn't
have to raise any alarm whenever an unknown, unrelated virus was actually
examined. And, in this case, the common technique
that is still kind of used today, even though there are a few evolutions It's,
it's based on a simple signature based detection hash function.
Usually hash function are used like MP5 or Schobon on the virus to represent
unequivocally the virus. So, about the AV industry in the early
days. again, besides signature based detection,
hash signatures or string signatures. So, different portion of the virus to be
matched against a, a database. there were other, other heuristics.
For instance f, the execution would start it.
So, each binary can be divided in different sections.
So, you have code sections, you have data sections and things like that.
We can have others of course, and usually legitimate binaries, they're called
legitimate binaries, always start at the same location or from the same section.
So, the way that viruses worked at the time to infect a victim was to reorganize
in a way, without going into too much details.
But reorganize the layout of the sections or to override the initial portional of
the section jumped to the very end of the binary.
Where malicious code was located and then to go back to resume the execution later
on, the original code. Of course, this is a very specific
pattern that is not found or was not found at the time in legitimate software.
So it was a very nice [UNKNOWN] too catch whether something was fishy or not.
So in a way, viruses at that time were written mostly in assembly.
The internet worms kind of defense, so a worm was written in C, also.
And then we had the prevalence in the transition era of macro-viruses.
So written in scripting language. Such as um, [UNKNOWN] script for
instance. The way that they spread well through the
network but also in the very old days through physical devices, floppy disk for
instance. There was no really huge connective,
dense connectivity. was not a problem.
The payload was not neither protected nor obfuscated.
And therefore, we said that signature based detection was generate enough.
How does the signature work? I mean how can we depict the signature?
Its quite easy so AV industry the anti virus maintains the database of
signatures hmm, byte patterns, regular expressions, consecutive bytes, hash
functions. Whatever can be used to represent.
Unequivocally, the file that we want to detect without raising too many false
alarms. And the problem is just consider matches,
if it matches the signature. So, if we imagine we have an application
code, then the signature can just extract known sequences of bytes.
That represent unequivocally with the best accuracy possible this particular
application. At that point, if we observe other
software, we, we go at the same offset we extract those bytes patterns.
And we look whether those resemble or actually match the signature in the V
database. And we can see whether something is
malicious ,or sorry, is benign or malicious for instance, as the picture
shows. So how was the industry doing back in the
old, good days? Very good.
So this is a very fun pictures. And very nice.
Actually, I like it a lot. From SourcesEcher Security Software.
And it shows, you know, the good guys on the right-hand side of the picture
chasing and, and really. Fighting their, effectively, viruses at
that time. This is 1998.
So, how things are going nowadays. With the AV industry, the detection
mechanisms pretty much stayed the same, but of course many things evolved.
So It is primarily still based on signature detection.
although, now, because AV industries have many customers, they have sensors spread
all over the globe. So, there's a lot of telemetry
information they can use to decide whether a binary or software or data.
There's observed, in a certain, location with certain customers is malicious or
not. And then the observed partition based
system that can actually flag, a threat, sorry, a malware as a likely threat or
not, or an unknown binary as likely malicious or suspicious.
then of course, signature based detection is not the end of the story.
there is a, there is a shift toward behavioral based detection that requires
in general dynamic execution. So not just static extraction of pot,
properties. Unfortunately we will see dynamic
analysis has limitation because it's generally it has a higher override.
If the analysis system was to be as transparent as possible and of course it
can not see everything about the program. So and its still not for end users really
at the moment so although there are certain AV companies, AV products that I
have the chance to run, the binary in a sandbox and confined environment.
This is something that the user has to decide most of the time.
And so, therefore, it cannot be used like for detection strategy by default and
thank you. This concludes unit one.
And in the next units we're going to be talking about reverse engineering.