Advanced Persistant Threats and Chip Level Security

DAVE MARCUSDIRECTOR OF SECURITY RESEARCHAND COMMUNICATIONS, MCAFEE

Demystifying the Mighty APTDave MarcusDirector, Advanced Research and Threat IntelligenceMcAfee Labs

Agenda• A Brief History• Spot The APT• Rootkits and Stealth• A New Methodology

Historic Stages of Cyber AttacksMid-1980’s 2003 2005 Today

A Loose Classification of Attackers Nation-State Coordinated Kinetic/Cyber Operations CyberespionageCapability for Damage Cybercriminals Hacktivists/ Terrorists Threat Sophistication

But which one is an APT??

Is it an APT or is it “just” good malware?

What does malware ACTUALLY do?? File Properties Property Values McAfee Detection PWS-Zbot.gen.iThe following files were analyzed: Length 70144 bytesB025A4E813.ex MD5 b025a4e81336caedcccdec336811f461 SHA1 772e79026bef86044e308d290d4d4fdf1167091cThe following files have been added to the system: •%WINDIR%SYSTEM32twain32user.ds •%WINDIR%SYSTEM32twain32local.ds •%WINDIR%SYSTEM32twex.exeThe following registry elements have been changed: •HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWS NTCURRENTVERSIONWINLOGONUSERINIT = %WINDIR%SYSTEM32userinit.exe,%WINDIR%SYSTEM32twex.exe Activities Risk Levels Attempts to write to a memory location of a Windows system process Attempts to write to a memory location where winlogon resides Attempts to load and execute remote code in a previously loaded process Attempts to write to a memory location of a previously loaded process. Adds or modifies winlogon userinit registry value. Could be used to launch a program on startup. Modifies winlogon configuration settings in registry Enumerates process list No digital signature is present

Why malware works….. Traditional attacks—and defenses—focused Applications/RDBMS primarily on the application layer Attack and disablesecurity products and AV HIPS hence all protection Infect OS with malware Operating resulting in threats hidden System from security products Compromise virtual machine and Virtual Machine hence all guest Rogue peripherals & machines within firmware bypassing all I/O Memory Disk Network Display other security measures BIOS ―Ultimate Malware‖ compromise devices below OS, either before or CPU after shipment

Zeus/SpyEyePre-Execution CVE-2008-2992 Adobe Reader 8.1.2 and earlier, input validation issue in a JavaScript method that could potentially lead to remote code execution. Casper Blocks IPs from known malicious senders.

Zeus/SpyEyePost-Execution

“APT” Pre-Execution Legacy AV has limited capability to detect some of the most obfuscated URLs. Typically not detected with AV. IP/URL filtering known to block access IP/URL filtering blocks access to exploit URL. More likely to to some ―infected‖ URLs. For example, a block in this case as this page forum may be clean, and the post itself hosts the actual malware code. Legacy AV is more and more may be ok, but a link or a shortened URL challenged by the inherent may point to the actually bad site. Likely limitations in the “known 1000’s of posts to blogs, etc. threat detection” model Casper Blocks IPs from known malicious senders.

“APT” Post-Execution Common yet effective evasion techniques to maintain persistence New processes need to be monitored Need for IP/URL Monitoring Need for malicious process monitoring and behaviors Common self- preservation techniques. Oftentimes using multiple techniques

I Can Has Rootkit?

Subversion and Rootkit Techniques Process (Before Hook) Process (After Hook) Hacker Defender Headers Headers Code Section Code Section Replace first five … … bytes of code with Call FindNextFile Call FindNextFile … jmp 0x70034622User … Import data section Import data sectionMemory FindNextFile: 0x12345678 FindNextFile: 0x12345678 Kernel32.dll Kernel32.dll 0x12345678: FindNextFile Code 0x12345678: FindNextFile Rootkit Code. Code 0x70034622: MyfindnextFile … Rootkit.sys NtosKrnl.exe Index of SSDT Bombat Exported function Index of IRPTable (NtQuerySystemInfo) TDSSKernel of a device driverMemory Jmp “rootkit.sys‖ Index of IDT Apropos Legitimate Spam-Mailbot Device Driver SysEnter/Int2E (MSR) aka: Rustock PAGE

Host-Based kernel rootkit detection strategy TraditionalUser AV Code sent toMemory Initiate Rootkit scanner for Scanning scanning Kernel module of VirusScan Detect Detour Rootkit.sysKernel NtosKrnl.exe Index of SSDT BombatMemory Exported function Index of IRPTable (NtQuerySystemInfo) TDSS of a device driver Jmp “rootkit.sys‖ Index of IDT Apropos Legitimate Spam-Mailbot Device Driver SysEnter/Int2E (MSR) aka: Rustock PAGE

A New Methodology

Moving Beyond The Operating System with SiliconTechnology by McAfee and IntelIndustry’s First HardwareAssisted Security PlatformNew Vantage Point on Security—Operates Beyond the OSTechnology Foundation to DeliverFuture Products

Deep Defender - Stopping a Stealthy Rootkit  Real-time kernel-level monitor of memory  Identifies kernel-mode rootkits in real-time  Prevents the drivers from loading  DeepSAFE Technology loads before the OS  DeepSAFE technology informs Deep Defender of suspicious behavior DeepSAFE Loader/Agent Intel i3/i5/i7 CPU (BIOS VT-x Enabled) Boot Driver Application Boot Driver AV Driver Deep Rootkit Rootkit Driver Driver Driver McAfee Application OS Loader Defender DeepSAFE malware Agent Application DeepSAFE Loaded OS Beyond the OS Initialization Boot Drivers Other Drivers Services and Applications19

Silicon-enabled kernel rootkit prevention strategy User Traditional AV Code sent to Memory scanner for Initiate on demand scanning Rootkit ScanningOperating System Kernel module of VirusScan Detect other kernel Rootkit.sys anomalies Optional Kernel Bombat Memory NtosKrnl.exe Index of SSDT Exported function Index of IRPTable TDSS (NtQuerySystemInfo) of a device driver Jmp “rootkit.sys‖ Apropos Index of IDT Legitimate Device Rustock Driver SysEnter/Int2E (MSR) Initiate memory Code sent to monitoring and scanner for Kernel module of protection scanning DeepDefender The Vt-X Layer PAGE 20 Intel CPU PAGE

Deep Defender Architecture In-Depth GTI Cloud Update Applications Deep Defender/Casper Servers Servers (ring 3) (ring 3) 4 Drivers DeepSAFE Agent (ring 0d) Operating System (ring 0d) ePolicy DeepSAFE API Lib (vmx-non root) Orchestrator Register Access Memory Access Privileged Instruction Trapping Deep Defender DeepSAFE API VM Framework VMExit Handler DeepSAFE Agent Event Monitoring McAfee DeepSAFE Event Blocking (ring 0p, vmx-root) Operating System Firmware CPU (with VT-x) McAfee DeepSAFE™ Chipset Hardware21

Deep Defender Protection Tiers  Enhanced Self/System Protection Initial Top 20 Families • DeepSAFE is first to load 1 Adware-BDSearch • Driver self-protection 2 Backdoor-AWQ  Protection areas 3 TDSS • Kernel_IDT, Kernel_SSDT 4 Almanahe • Kernel_SysEnter 5 Generic rootkit.d 6 Backdoor-DoQ • Kernel_DKOM 7 Generic Backdoor.u • Kernel_inline 8 Spy-Agent.bw • Kernel_IAT, Kernel_EAT 9 Backdoor-CKB • Kernel_DispRoutine 10 LDPINCH • Kernel_IRP 11 StealthMBR.c • + additional areas specified by content 12 Puper 13 Lando  Additional Event Tracking Spam-Mailbot.l (Slenfbot) 14 • Driver Install Watch 15 Hidden Process.a  Top 20 prevalent families targeted for 16 PigSearch 17 Generic rootkit.g remediation 18 Generic rootkit.ec • New families added over time 19 W32/Routrobot.worm 20 DNSCHanger22 8 April, 2011

Deep Defender Details• Supported Intel chipsets – Intel® Core™ i3, i5, i7 processors – Utilizes Intel Virtualization Technology (VT)• Supports Windows 7; 32 & 64 bit• Managed by ePO 4.5 and 4.6• Supports VSE 8.7 and 8.8• Integrates with McAfee’s GTI cloud• Available Q1 2012

Advanced Persistant Threats and Chip Level Security

by FedScoop on Apr 16, 2012

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 120

Statistics

Advanced Persistant Threats and Chip Level Security Presentation Transcript