Security Solution 2008.pptx

Size: px

Start display at page:

Download "Security Solution 2008.pptx"

はるまさよしなが
4 years ago
Views:

1 Security Solution 2008

3 Windows DOS (apack, lzexe, diet, pklite) Linux (gzexe, UPX)

6 PE PE

7 DOS Stub Space Section Header.idata PE Header & Optional Header Space.unpack (unpack code) Section Header.unpack Space Section Table Section Header.data Sections.data Space.idata

8 DOS Stub Space Section Header.idata Space PE Header & Optional Header.unpack (unpack code) DOS Stub Space PE Header & Optional Header Section Header.text Section Header.data Section Header.idata Section Header.unpack Space Section Header.rsrc Section Table Sections Section Header.data.data ( ) pack Section Header.reloc Space.text Space.data Space Space.idata.idata Space.rsrc Space.reloc

9 VirtualAlloc() API PE Section Windows Import (IAT) LoadLibrary() GetProcAddress() IAT (OEP) long jump retn OEP OEP C/C++ GetStartupInfoA() GetVersion()

10 WORM_ALLAPLE.IK Microsoft Crypto API

11 Anti-Debugging Anti- Reversing Obfuscating OEP JUMP

12 API IsDebuggerPresent() TRUE CheckRemoteDebuggerPresent() WindowsXP SP1 API INVALID_HANDLE_VALUE(-1) ZwQueryProcessInformation() ProcessInformationClass ProcessDebugPort

13 (SEH Structured Exception Handling) CloseHandle() CloseHandle() CloseHandle() EXCEPTION_INVALID_HANDLE STATUS_INVALID_HANDLE

14 GetTickCount() Time Stamp Counter call _do_rdtsc // 1 mov ecx, eax call _do_rdtsc // 2 sub eax, ecx je _exit // cmp eax, 100 // 100 ja _exit _do_rdtsc: rdtsc retn _exit

15 Windows PE PE NumOfRvaAndSizes OllyDbg

16 INT3 INT3(0xCC) INT3 INT3

17 OutputDebugString OutputDebugString() OutputDebugString() WinBase.h void VOID WINAPI OutputDebugStringA( in LPCSTR lpoutputstring); OutputDebugString() OutputDebugString() 1

18 VMware VirtualPC

$VMware I/O OS OS I/O VMware DWORD p = 0; try { _asm { pushfd$ $mov p, eax }; } except(exception_execute_handler) {} if (p &$

19 VMware I/O OS OS I/O VMware DWORD p = 0; try { _asm { pushfd or dword ptr [esp], 0x100 popfd // TF pushfd // pop eax // mov p, eax }; } except(exception_execute_handler) {} if (p & 0x100) { MessageBox(NULL, " Debugger Detected", "Result", 0); }

$VirtualPC OS Windows Unknown OP code VirtualPC OS DWORD rc; try { _asm xor ebx, ebx _asm mov eax, 1 // VPC function number // call VPC _asm emit 0Fh _asm$

20 VirtualPC OS Windows Unknown OP code VirtualPC OS DWORD rc; try { _asm xor ebx, ebx _asm mov eax, 1 // VPC function number // call VPC _asm emit 0Fh _asm emit 3Fh _asm emit 07h _asm emit 0Bh rc = TRUE; MessageBox(NULL, "Virtual PC Detected", "Result", 0); } except (EXCEPTION_EXECUTE_HANDLER) { rc = FALSE; }

OllyDbg OllyDbg "FLD TBYTE PTR [address]" address OllyDbg DAH :0040D031 db 0DBh ; FLD TBYTE PTR [0x40d037] DAH :0040D032 db 2Dh ; - DAH :0040D033 db 37h ; 7 DAH :0040D034 db 0D0h ; DAH :0040D035 db

21 OllyDbg OllyDbg "FLD TBYTE PTR [address]" address OllyDbg DAH :0040D031 db 0DBh ; FLD TBYTE PTR [0x40d037] DAH :0040D032 db 2Dh ; - DAH :0040D033 db 37h ; 7 DAH :0040D034 db 0D0h ; DAH :0040D035 db 40h DAH :0040D036 db 0 DAH :0040D037 db 0FFh ; FLD DAH :0040D038 db 0FFh DAH :0040D039 db 0FFh DAH :0040D03A db 0FFh DAH :0040D03B db 0FFh DAH :0040D03C db 0FFh DAH :0040D03D db 0FFh DAH :0040D03E db 0FFh DAH :0040D03F db 3Dh ; = DAH :0040D040 db 40h

22 API PE_VIRUT.K 4 API API ZwCreateFile MOV EAX, 25 MOV EDX, 7FFE0300 CALL [EDX] ZwCreateProcess MOV EAX, 2F MOV EDX, 7FFE0300 CALL [EDX] ZwCreateProcessEx MOV EAX, 30 MOV EDX, 7FFE0300 CALL [EDX] ZwOpenFile MOV EAX, 74 MOV EDX, 7FFE0300 CALL [EDX] CALL 7FFA22ED MOV EDX, 7FFE0300 CALL [EDX] CALL 7FFA2341 MOV EDX, 7FFE0300 CALL [EDX] CALL 7FFA234E MOV EDX, 7FFE0300 CALL [EDX] CALL 7FFA233A MOV EDX, 7FFE0300 CALL [EDX]

23 API ntdll Zw????? 0x7FFE0300 "MOV EAX xx" "CALL <malicious-code>"

24 WORM_POEBOT.I [W32.Linkbot.M] ftpd http ftp tftp

25 C&C IRC HTTP WORM_POEBOT.I [W32.Linkbot.M] ftpd http ftp tftp

26 1.killthread.massscan.imspread.keylog.visit.udp.opencmd.upgrade WORM_RANDEX.AI [W32.Randex.GEL] all TCP http UDP cmd.exe

27 2 n s rh vm ud ef df pf WORM_SDBOT.GEN-1 [W32.Kwbot.B.Worm] 1 2 OS DNS IP URL HTTP HTTP ping

28 3 WORM_SDBOT.AIH [IRC.Backdoor.Trojan] 4 0x447EB9D9 0x63AFD836 0x9D9E8858 IE 0x020A3F58 PC 0x ID 0x2F92C451

29 Inline Function Hooking DKOM(Direct Kernel Object Manipulation)

30 DKOM Direct Kernel Object Manipulation Windows API ProcessExplorer

31 DKOM Windows PsInitialSystemProcess

33 W32.Linkbot W32.IRCBot PE_BOBAX.AH-O PE_BOBAX.AH-O PE_BOBAX.AH-O PE_SALITY.AS-O PE_SALITY.AS-O PE_BOBAX.AH-O

36 Process Monitor Microsoft TechNet: Windows Sysinternals

37 OS

38 IDA Pro Hex-Rays SA.

39 SecureBrain Zero-Hour Response System ( zhr/index.html) Sunbelt CWSandbox ( CWSandbox/) Norman Sandbox Malware Analyzer ( malwareanalyzer/) XML HTML Zero-Hour Response System

40 SecureBrain Zero-Hour Response System

42 Security Solution 2008

shio SA.ppt[読み取り専用]

shio SA.ppt[読み取り専用] 2005 213 Rootkit 2 ...... GPG EFS Windows 3 Rootkit + ifconfig, ps, ls, login Tripwire lkm-rootkit NT Rootkit, AFX Rootkit OS 4 HD... NTFS ADS Alternate Data Stream... NTFS HD HD...