Upload File

web-based malware obfuscation: the kung-fu and the detection · owasp web-based malware,...

  • Home
  • Documents
  • Web-based Malware obfuscation: the kung-fu and the detection · OWASP Web-based malware, specifically, drive-by-downloads, have been rapidly evolving. Web-based malware are written
44
Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP http://www.owasp.org Web-based Malware obfuscation: the kung-fu and the detection Wayne Huang OWASP Taiwan Chapter CEO, Armorize 2008-10-27

Upload: dangphuc

Post on 09-Nov-2018

214 views

Category:

Documents


0 download

Report

TRANSCRIPT

  • Copyright The OWASP FoundationPermission is granted to copy, distribute and/or modify this document under the terms of the OWASP License.

    The OWASP Foundation

    OWASP

    http://www.owasp.org

    Web-based Malware obfuscation: the kung-fu and the detection

    Wayne HuangOWASP Taiwan ChapterCEO, Armorize

    2008-10-27

  • OWASP 2

    Title

    Javascript

  • OWASP

    Web-based malware, specifically, drive-by-downloads, have been rapidly evolving. Web-based malware are written mostly in script languages, whose dynamic features make it easy for obfuscation and therefore difficult for static detection. Recently, many new obfuscation methods have been observed, some of which actually took malware obfuscation to the next era--they were malware steganography methods instead of obfuscation. This talk discusses what Web-based malware are, what threats they bring, why they are difficult to detect, and discuss free resources within OWASP and also free ones outside of OWASP, that can help us flight this threat.

    3

  • OWASP

    OWASP Top 10

    OWASP10Web Security(2007 Top 10)

    1 CrossSiteScripting(XSS)

    2 InjectionFlaws (SQLInjection,CommandInjection)

    3 MaliciousFileExecution(NEW)

    4 InsecureDirectObjectReference

    5 CrossSiteRequestForgery(CSRF)(NEW)

    6 InformationLeakageandImproperErrorHandling

    7 BrokenAuthenticationandSessionManagement

    8 InsecureCryptographicStorage

    9 InsecureCommunications(NEW)

    10 FailuretoRestrictURLAccess

  • OWASP

    Malware Botnet MalwareExploit

    Botnet

    5

  • OWASP

    6

  • OWASP

    Malicious Webpage Report In Taiwan

    582582 malicious Webpages (Malicious link Insided)

    221 221 active malicious links (Drive-By-Download)

    72 72 different spywares

    7

    Maliciouslink

    MaliciousMaliciouslinklink

    Exploit CodeExploit Code

    Maliciouslink

    MaliciousMaliciouslinklink

    Maliciouslink

    MaliciousMaliciouslinklink

    Maliciouslink

    MaliciousMaliciouslinklink

    Maliciouslink

    MaliciousMaliciouslinklink

    Obfuscated ScriptObfuscated Script

    Obfuscated ScriptObfuscated Script

    Obfuscated ScriptObfuscated ScriptSpyware

    Only 72 Spywares221 is active! (Drive-by-download)

    Spyware

    Spyware

    582 Webpages had been compromised.

  • OWASP

    Symantec Global Internet Security Threat Report Jul-Dec 2007

  • OWASP

    ?

    9

    URL Decodehttp://uin1.cnhttp://uin2.cn

    URL Decodehttp://uin1.cnhttp://uin2.cn

  • OWASP

    Exploit

    10

  • OWASP

    11

  • OWASP

  • OWASP

  • OWASP

    (Obfuscated Scripts)

    JavascriptJavascriptJavascript

    14

    e = '0x00' + '5F';str1 = "%E4%BC%B7%AA%C0%AD%AC%A7%B4%BB%E3%FE%AA%B7%AD%B7%BE%B7%B4%B7%AC%A7%E6%B8%B7 %BC%BC%BB%B2%FE%E2%E4%B7%BA%AE%BF%B3%BB%C0%AD%AE%BD%E3%FE%B8%AC%AC%B0%E6%F1 %F1%B0%AE%BF%BC%B1%E9%F2%BD%B1%B3%F1%AC%AE%BA%F1%FE%C0%A9%B7%BC%AC%B8%E3%EF %C0%B8%BB%B7%B9%B8%AC%E3%EF%E2%E4%F1%B7%BA%AE%BF%B3%BB%E2%E4%F1%BC%B7%AA%E2";str=tmp='';for(i=0;i

  • OWASP

    (Javascript Packer)

    HTML, ScriptAdvanced HTML Protector

    http://www.creabit.com/htmlprotect/

    Yahoo Javascript Packer (YUI Compressor)http://developer.yahoo.com/yui/compressor/

    Other Online JS Obfuscatorhttp://www.iwebtool.com/html_encrypterhttp://www.cha88.cn/safe/fromCharCode.php

  • OWASP

    Javascript

    Name ObfuscationJavascript

    String Splitting

    Code Encryption

    16

  • OWASP

    Code Encryption

    String.formCharCode()

    By 8Bit, 16Bit, Unicode 8Bits string

    17

    alert("Exploit !");

    alert("Exploit !");

    t="97,108,101,114,116,40,34,69,120,112,108,111,105,116,32,33,34,41,59"t=eval("String.fromCharCode("+t+")");document.write(t);

    t="97,108,101,114,116,40,34,69,120,112,108,111,105,116,32,33,34,41,59"t=eval("String.fromCharCode("+t+")");document.write(t);

    t=eval("\141\154\145\162\164\50\42\105\170\160\154\157\151\164\40\41\42\51\73\12");document.write(t);

    t=eval("\141\154\145\162\164\50\42\105\170\160\154\157\151\164\40\41\42\51\73\12");document.write(t);

  • OWASP

    Javascript Analysis

    eval, unescape, document.writeDocument.writealert Javascript

    (Debugger / Interpreter / Decoder)Rhino http://www.mozilla.org/rhino/NJS http://www.njs-javascript.org/SpiderMonkey http://www.mozilla.org/js/spidermonkey/Malzilla http://malzilla.sourceforge.netFreShow http://www.jimmyleo.com/work/FreShowStart.htm

    18

    http://www.mozilla.org/rhino/http://www.njs-javascript.org/http://www.mozilla.org/js/spidermonkey/http://malzilla.sourceforge.net/http://www.jimmyleo.com/work/FreShowStart.htm

  • OWASP

    19

  • OWASP

    Anti-Analysis Javascript

    Anti-Analysis

    Anti-Javascript InterpreterInterpreter/Debugger

    Hiding Sensitive Calls with Member EnumerationDocument.write(), eval()

    Self Code Integrity Check

    20

  • OWASP

    Anti-Interpreter

    ContextDOM, Java Applet, Flash, VBScript, ActiveX

    21

    var count =0;function loaded (name){

    if(name!="bad")count++;}window.onload = function evil(){

    if(count == 1) document.write("In Browser!");}

    var count =0;function loaded (name){

    if(name!="bad")count++;}window.onload = function evil(){

    if(count == 1) document.write("In Browser!");}

  • OWASP

    Hiding Sensitive Calls with Member Enumeration

    document.write? KolisarPOC

    22

    h = this;for ( i in h) //find document object{

    if( i.length == 8) {if( i.charCodeAt(0) == 100 && i.charCodeAt(7) == 116){

    break;}

    }}for ( j in h[i]) //find member function write(){

    if( j.length == 5 ){if( j.charCodeAt(0) == 119 && j.charCodeAt(1) == 114){

    break;}

    }}h[i][j](...Cool!); // document.write()

    h = this;for ( i in h) //find document object{

    if( i.length == 8) {if( i.charCodeAt(0) == 100 && i.charCodeAt(7) == 116){

    break;}

    }}for ( j in h[i]) //find member function write(){

    if( j.length == 5 ){if( j.charCodeAt(0) == 119 && j.charCodeAt(1) == 114){

    break;}

    }}h[i][j](...Cool!); // document.write()

  • OWASP

    Javascripteval ( ) document.write(..)

    23

    function I71gyIm5s( ){

    .codeeval(string);

    }

    I71gyIm5s('9AB6a4a7A);

    function I71gyIm5s( ){

    .codeeval(string);

    }

    I71gyIm5s('9AB6a4a7A);

    Document.write

  • OWASP

    Demo

    24

  • OWASP

    Demo

    Code

    25

  • OWASP

    Self Integrity Check

    Source Codekey

    26

    Code

    function testCallee(){return arguments.callee}document.write( testCallee() );

    Code

    function testCallee(){return arguments.callee}document.write( testCallee() );

    function testCallee(){return arguments.callee}function testCallee(){return arguments.callee}

    Arguments.callee functional programmingrecursive anonymous functions

  • OWASP

    Javascript

    Javascript script language Interpreter / Debugger

    Meta-ProgrammingFunctional-Programming

    Run-Time(SMC)Dynamic Typing Language

    Javascript Interpreter Browser Behavior

    27

  • OWASP

    PE Packer v.s. JS Packer

    28

    PE Packer JS Packer

    Code Type Low level Binary CodeHigh Level Dynamic Typing Language

    Self Modify Code (SMC) YES YES (Meta-Programming, use Document.write(), Very Easy )

    Code Encryption YES YES (Very Easy)

    Self Integrity Check YES YES (Functional-Programming)

    Debugger Detection YES YES (Check Brower)

    Anti-Instruction stepping RDTSC Check Timer Check

  • OWASP

    Malicious Report

    SandboxDrive-By-DownloadSandbox

    29

    Web CrawlerWeb CrawlerWeb Crawler

    MalinkMalinkMalink

    HTML AnalysisHTML AnalysisHTML Analysis

    HTMLHTMLHTML

    Behavior AnalysisBehavior AnalysisBehavior Analysis

    MalwareMalwareMalware

    Javascript Decoder

    Javascript Decoder

    Spyware Behavior Extractor

    Spyware Behavior Extractor

    Find the final malware source

  • OWASP

    30

  • OWASP

    31

    Drive-By-Download the malware source !!Drive-By-Download the malware source !!

  • OWASP

    Demo

    http://tw.lovechina.tw.cn/count/js/gif.gif

    32

  • OWASP

    Demo

    33

  • OWASP

    Demo

    34

    Flash Exploit (CVE-2007-0071)Flash Exploit (CVE-2007-0071)

  • OWASP 35

  • OWASP

    Drive-By-Download Flow

    36All Your iFRAMEs Point to Us, 2008

    Victim Machine

    Malware Distribution Site

    Landing Site

    Hop Point

    1

    2

    3

    Redirect to get exploit

    Drop Malware

    Victim v

    isit the la

    nding site

  • OWASP

    37

  • OWASP

    38

    5Mass SQL Injection 60

    5Mass SQL Injection 60

  • OWASP

    ITHome, 2008/05ITHome, 2008/05

  • OWASP

    SQL Injection

    40

  • OWASP

    Mass SQL Injection

    SQL InjectionSQL InjectionDatabase(19)

    WebBonetDataBase

    41

  • OWASP

    42

    Google! Orz

  • OWASP

    Javascript

    ISPwww.malwaredomainlist.com www.shadowserver.org

    43

  • OWASP

    Reference

    Symantec Global Internet Security Threat Report Jul-Dec 2007, http://eval.symantec.com/mktginfo/enterprise/ white_papers/b-whitepaper_internet_security_threat_report_xiii_04-2008.en-us.pdfReverse Engineering Malicious Javascript. Jose Nazario, Ph.D, CanSecWest 2007All Your iFRAMEs Point to Us, Niels Provos, Panayiotis MavrommatisMoheeb Abu Rajab, Fabian Monrose, Google, Inc. The Ghost In The Browser, Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang and Nagendra Modadugu. Google, Inc.Circumventing Automated JavaScript Analysis, Billy Hoffman ([email protected] ). HP Web Security Research Group, BlackHat 2008WhiteSpace: A Different Approach to JavaScript Obfuscation, Kolisar, DEFCON 16

    44

    Web-based Malware obfuscation: the kung-fu and the detectionTitleOWASP Top 10Malicious Webpage Report In Taiwan? Exploit (Obfuscated Scripts)(Javascript Packer)Javascript Code EncryptionJavascript AnalysisAnti-Analysis JavascriptAnti-InterpreterHiding Sensitive Calls with Member EnumerationDemoDemoSelf Integrity CheckJavascriptPE Packer v.s. JS PackerSandboxDrive-By-DownloadDemoDemo Demo Drive-By-Download FlowITHome, 2008/05SQL InjectionMass SQL Injection Reference


Malware Detection Based on Permissions on Android Platform ... · installing the applications to monitor the malware behavior, or by taking actions after installing the application

El Malware

Frequent Subgraph Based Familial Classification of Android ...csxluo/FalDroid.pdf · challenges to anti-malware systems because the sheer number of malware samples overwhelm malware

TMPA-2013 Keynote: Zakharov Obfuscation

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Checkmate to crypto malware. Scacco matto ai crypto malware

Malware aitor

La primera será malwarebytes anti-malware. Un vez ... · Malwarebytes Anti-Malware Malware ANTI-MALWARE Registros Lista de ignorados Configuración Más herramientas Escáner Protección

Hypervisor-Based Systems for Malware Detection …...Anti-malware software is effective to detect and/or prevent attacks of malware But, the anti-malware approach has several problems

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Obfuscation d'applications écrites en Python - python-pack · 2014. 6. 13. · Obfuscation d’applications ecrites en Python python-pack Ninon EYROLLES [email protected] Serge

Script based malware detection in online banking

BernhardPOS Malware

LusyPOS Malware

CAS: A FRAMEWORK OF ONLINE DETECTING ADVANCE MALWARE FAMILIES FOR CLOUD-BASED SECURITY

OWASP Foundation - Web-based Malware obfuscation: the ...OWASP Web-based malware, specifically, drive-by-downloads, have been rapidly evolving. Web-based malware are written mostly

Information Obfuscation: Protecting Corporate Data

HinDroid: An Intelligent Android Malware Detection …yqsong/papers/2017-KDD-HINDROID.pdfHinDroid: An Intelligent Android Malware Detection System Based on Structured Heterogeneous

Analisis dan Deteksi Malware Menggunakan Metode Malware

Php web backdoor obfuscation

Malware-multzokatze Teknikak (Malware Clustering ...joxeankoret.com/download/hack_beers_malware_multzokatzea.pdf · Malware Eboluzioa: 2000an 2000. urtean, astean behin ikusten zen

Lab 5: Android Application Reverse Engineering and Obfuscation · Lab 5: Android Application Reverse Engineering and Obfuscation Introduction Reverse Engineering is a popular hacking

Analysis of Bayesian Classification based Approaches for ... · Author’s personal copy Analysis of Bayesian Classification based Approaches for Android Malware Detection Suleiman

Obfuscation Curstate Review

UNTANGLE: Unlocking Routing and Logic Obfuscation Using

Mobile malware

HinDroid: An Intelligent Android Malware Detection …community.wvu.edu/~yaye/files/HinDroid_KDD2017_Paper_Ye.pdfHinDroid: An Intelligent Android Malware Detection System Based on

Potao Malware

Drive-By Download & JavaScript Obfuscation

Obfuscation de code Python : amélioration des techniques … · 2014. 6. 11. · Obfuscation de code Python : amélioration des techniques existantes Serge Guelton et Ninon Eyrolles

Remaiten malware

Apresentação malware

W97m malware

자바스크립트 난독화(Javascript Obfuscation) 이해하기image.ahnlab.com/file_upload/tech/javascript.pdf · 자바스크립트 난독화(Javascript Obfuscation) 이해하기

Trabajo Malware