9780131014053

- Real-world tools needed to prevent, detect, and handle malicious code attacks. - Computer infection from viruses, worms, Trojan Horses etc., collectively known as malware is a growing cost problem for businesses. - Discover how attackers install malware and how you can peer through their schemes to keep systems safe. - Bonus malware code analysis laboratory.

TERM	PRICE	DUE
SEMESTER	$41.82	Dec 13
QUARTER	$39.73	Aug 16
SHORT TERM	$37.64	Jul 03

Ed Skoudis is a computer security consultant with International Network Services Lenny Zeltser is an information security consultant and an instructor at the SANS Institute where he teaches courses in malware reverse-engineering

Foreword	p. xv
Acknowledgments	p. xxi
Introduction	p. 1
Defining the Problem	p. 2
Why Is Malicious Code So Prevalent?	p. 4
Mixing Data and Executable Instructions: A Scary Combo	p. 5
Malicious Users	p. 9
Increasingly Homogeneous Computing Environments	p. 10
Unprecedented Connectivity	p. 11
Ever Larger Clueless User Base	p. 12
The World Just Isn't a Friendly Place	p. 12
Types of Malicious Code	p. 13
Malicious Code History	p. 15
Why This Book?	p. 19
What To Expect	p. 21
References	p. 24
Viruses	p. 25
The Early History of Computer Viruses	p. 28
Infection Mechanisms and Targets	p. 31
Infecting Executable Files	p. 32
Companion Infection Techniques	p. 33
Infecting Boot Sectors	p. 37
Infecting Document Files	p. 40
Other Virus Targets	p. 46
Virus Propagation Mechanisms	p. 48
Removable Storage	p. 49
E-Mail and Downloads	p. 50
Shared Directories	p. 51
Defending against Viruses	p. 51
Antivirus Software	p. 52
Configuration Hardening	p. 58
User Education	p. 63
Malware Self-Preservation Techniques	p. 64
Stealthing	p. 64
Polymorphism and Metamorphism	p. 64
Antivirus Deactivation	p. 65
Thwarting Malware Self-Preservation Techniques	p. 67
Conclusions	p. 67
Summary	p. 68
References	p. 69
Worms	p. 71
Why Worms?	p. 73
Taking over Vast Numbers of Systems	p. 73
Making Traceback More Difficult	p. 74
Amplifying Damage	p. 75
A Brief History of Worms	p. 76
Worm Components	p. 79
The Worm Warhead	p. 80
Propagation Engine	p. 82
Target Selection Algorithm	p. 84
Scanning Engine	p. 86
Payload	p. 87
Bringing the Parts Together: Nimda Case Study	p. 88
Impediments to Worm Spread	p. 91
Diversity of Target Environment	p. 91
Crashing Victims Limits Spread	p. 93
Overexuberant Spread Could Congest Networks	p. 93
Don't Step on Yourself!	p. 94
Don't Get Stepped on By Someone Else	p. 94
The Coming Super Worms	p. 95
Multiplatform Worms	p. 96
Multiexploit Worms	p. 96
Zero-Day Exploit Worms	p. 97
Fast-Spreading Worms	p. 97
Polymorphic Worms	p. 99
Metamorphic Worms	p. 101
Truly Nasty Worms	p. 102
Bigger Isn't Always Better: The Un-Super Worm	p. 102
Worm Defenses	p. 104
Ethical Worms?	p. 105
Antivirus: A Good Idea, but Only with Other Defenses	p. 108
Deploy Vendor Patches and Harden Publicly Accessible Systems	p. 109
Block Arbitrary Outbound Connections	p. 109
Establish Incident Response Capabilities	p. 110
Don't Play with Worms, Even Ethical Ones, Unless...	p. 111
Conclusions	p. 112
Summary	p. 114
References	p. 115
Malicious Mobile Code	p. 117
Browser Scripts	p. 120
Resource Exhaustion	p. 121
Browser Hijacking	p. 123
Stealing Cookies via Browser Vulnerabilities	p. 126
Cross-Site Scripting Attacks	p. 132
ActiveX Controls	p. 143
Using ActiveX Controls	p. 144
Malicious ActiveX Controls	p. 146
Exploiting Nonmalicious ActiveX Controls	p. 151
Defending against ActiveX Threats: Internet Explorer Settings	p. 153
Java Applets	p. 157
Using Java Applets	p. 158
Java Applet Security Model	p. 159
Malicious Java Applets	p. 163
Mobile Code in E-Mail Clients	p. 165
Elevated Access Privileges via E-Mail	p. 166
Defending against Elevated E-Mail Access	p. 167
Web Bugs and Privacy Concerns	p. 169
Defending against Web Bugs	p. 170
Distributed Applications and Mobile Code	p. 172
Additional Defenses against Malicious Mobile Code	p. 174
Antivirus Software	p. 175
Behavior-Monitoring Software	p. 176
Antispyware Tools	p. 178
Conclusions	p. 181
Summary	p. 182
References	p. 184
Backdoors	p. 187
Different Kinds of Backdoor Access	p. 189
Installing Backdoors	p. 190
Starting Backdoors Automatically	p. 191
Setting Up Windows Backdoors to Start	p. 192
Defenses: Detecting Windows Backdoor Starting Techniques	p. 198
Starting UNIX Backdoors	p. 201
Defenses: Detecting UNIX Backdoor Starting Techniques	p. 206
All-Purpose Network Connection Gadget: Netcat	p. 206
Netcat Meets Standard In and Standard Out	p. 207
Netcat Backdoor Shell Listener	p. 210
Limitation of Simple Netcat Backdoor Shell Listener	p. 213
Shoveling a Shell with Netcat Backdoor Client	p. 214
Netcat + Crypto = Cryptcat	p. 215
Other Backdoor Shell Listeners	p. 216
Defenses against Backdoor Shell Listeners	p. 217
GUIs Across the Network, Starring Virtual Network Computing	p. 224
Let's Focus on VNC	p. 227
VNC Network Characteristics and Server Modes	p. 229
Shoveling a GUI with VNC	p. 230
Remote Installation of Windows VNC	p. 231
Remote GUI Defenses	p. 233
Backdoors without Ports	p. 234
ICMP Backdoors	p. 234
Nonpromiscuous Sniffing Backdoors	p. 236
Promiscuous Sniffing Backdoors	p. 239
Defenses against Backdoors without Ports	p. 243
Conclusions	p. 247
Summary	p. 248
References	p. 249
Trojan Horses	p. 251
What's in a Name?	p. 252
Playing with Windows Suffixes	p. 253
Mimicking Other File Names	p. 257
The Dangers of Dot "." in Your Path	p. 262
Trojan Name Game Defenses	p. 265
Wrap Stars	p. 267
Wrapper Features	p. 268
Wrapper Defenses	p. 270
Trojaning Software Distribution Sites	p. 270
Trojaning Software Distribution the Old-Fashioned Way	p. 271
Popular New Trend: Going after Web Sites	p. 271
The Tcpdump and Libpcap Trojan Horse Backdoor	p. 273
Defenses against Trojan Software Distribution	p. 276
Poisoning the Source	p. 278
Code Complexity Makes Attack Easier	p. 279
Test? What Test?	p. 281
The Move Toward International Development	p. 283
Defenses against Poisoning the Source	p. 284
Co-opting a Browser: Setiri	p. 286
Setiri Components	p. 286
Setiri Communication	p. 287
Setiri Defenses	p. 290
Hiding Data in Executables: Stego and Polymorphism	p. 293
Hydan and Executable Steganography	p. 294
Hydan in Action	p. 296
Hydan Defenses	p. 298
Conclusions	p. 299
Summary	p. 300
References	p. 301
User-Mode RootKits	p. 303
UNIX User-mode RootKits	p. 306
LRK Family	p. 309
The Universal RootKit (URK)	p. 322
File System Manipulation with RunEFS and the Defiler's Toolkit	p. 326
A Brief Overview of the ext2 File System	p. 327
UNIX RootKit Defenses	p. 335
Windows User-Mode RootKits	p. 344
Manipulating Windows Logon with FakeGINA	p. 347
WFP: How It Works and Attacks against It	p. 351
DLL Injection, API Hooking, and the AFX Windows RootKit	p. 359
User-Mode RootKit Defenses on Windows	p. 370
User-Mode RootKit Response on Windows	p. 373
Conclusions	p. 373
Summary	p. 374
References	p. 377
Kernel-Mode RootKits	p. 379
What Is the Kernel?	p. 379
Kernel Manipulation Impact	p. 383
The Linux Kernel	p. 387
Adventures in the Linux Kernel	p. 388
Methods for Manipulating the Linux Kernel	p. 397
Defending the Linux Kernel	p. 420
The Windows Kernel	p. 429
Adventures in the Windows Kernel	p. 429
Methods for Manipulating the Windows Kernel	p. 444
Defending the Windows Kernel	p. 454
Conclusions	p. 458
Summary	p. 458
References	p. 462
Going Deeper	p. 465
Setting the Stage: Different Layers of Malware	p. 466
Going Deeper: The Possibility of BIOS and Malware Microcode	p. 471
The Possibility of BIOS Malware	p. 471
Microcode Malware	p. 484
Combo Malware	p. 502
Lion: Linux Worm/RootKit Combo	p. 504
Bugbear: Windows Worm/Virus/Backdoor Combo	p. 508
But That's Not All (Unfortunately)	p. 513
Combo Malware Defenses	p. 513
Conclusions	p. 514
Summary	p. 514
References	p. 517
Scenarios	p. 519
A Fly in the Ointment	p. 520
Invasion of the Kernel Snatchers	p. 529
Silence of the Worms	p. 541
Conclusions	p. 553
Summary	p. 554
Malware Analysis	p. 557
Building a Malware Analysis Laboratory	p. 557
Caveats: Using Nonproduction Systems and Staying off of the Internet	p. 558
Overall Lab Architecture	p. 558
Virtualizing Everything	p. 561
Malware Analysis Process	p. 564
Analysis of Malware and Legitimate Software	p. 566
Preparation and Verification	p. 567
Loading the Specimen and Getting Ready for Analysis	p. 574
Static Analysis	p. 576
Dynamic Analysis	p. 594
Foiling Malware Analysis with Burneye	p. 615
Conclusion	p. 619
Summary	p. 620
References	p. 622
Conclusion	p. 625
Useful Web Sites for Keeping Up	p. 625
Packet Storm Security	p. 626
Security Focus	p. 627
Global Information Assurance Certification	p. 627
Phrack Electronic Magazine	p. 628
The Honeynet Project	p. 629
Mega Security	p. 630
Infosec Writers	p. 630
Counterhack	p. 631
Parting Thoughts	p. 631
Parting Thoughts: Pessimist's Version	p. 632
Parting Thoughts: Optimist's Version	p. 634
Index	p. 637
Table of Contents provided by Ingram. All Rights Reserved.

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

ForewordSeveral years ago I attended a special conference on intrusion detection in McLean, Virginia. Each attendee was assigned to one of four teams charged with assessing the state of the art and making recommendations for future research in various areas related to intrusion detection. At the end, a representative from each team presented the output of that team's work to all attendees. Although each team's report was very interesting and worthwhile, the malicious code team's assessment of progress in that area particularly caught my attention. This team's conclusion was that not much genuine progress in characterizing and identifying malicious code had been made over the years. Given that viruses have been in existence for at least two decades and that all kinds of malicious code has been written and deployed "in the wild," it would not at all have been unexpected to hear that great strides in understanding malicious code have occurred to the point that sophisticated programs can now accurately and efficiently identify almost every instance of malicious code. But such was not the case. Some researchers who were not at the conference would undoubtedly disagree with the malicious code team's assessment, but I am confident that they would be in the minority. A considerable amount of work to better identify and deal with malware is underway, but genuine progress in understanding and detecting malware has indeed been frustratingly slow.The irony of it all is that today's computing world is saturated with malware. Viruses and worms are so prevalent that newspaper, magazine, and television accounts of the "latest and greatest" virus or worm are now commonplace. Even young computer users typically understand basically what a virus is and why viruses are undesirable. "Create your own virus" toolkits have been available for years. Public "hacker tool" sites, relatively rare ten years ago, are now prevalent on the Internet. Going to a "hacker tool" site to obtain malware is not, however, necessary for someone to obtain malware. In August 2002, the Computer Emergency Response Team Coordination Center (CERT/CC) reported that a perpetrator had modified copies of the source code for OpenSSH such that they contained Trojan horse routines. Unsuspecting users went to the OpenSSH site and mirror sites to download OpenSSH in the expectation that they would be tightening security by encrypting network traffic between hosts. Instead, they introduced routines within the OpenSSH source that allowed attackers to gain remote control of their systems. And even Ed Skoudis, one of the few people in the world who can identify virtually every type of attack and also the author of this book, Malware: Fighting Malicious Code, reports in the first chapter that he found several Trojan horse programs that performed brute force password cracking in one of his systems. Malware is not a rarity; it is prevalent, and the problem is getting worse.Malware does not exist in a vacuum--it cannot magically infuse itself into systems and network devices. Just as biological parasites generally exploit one or more weaknesses in the host, malware requires special conditions if it is to execute and then produce the intended results. Today's computing world, fortunately for the authors of malware but unfortunately for the user community, provides a nearly ideal environment. Why? Primarily, it is because of the many vulnerabilities in software that is commonly used today. Too many software vendors typically rush the software development process in an attempt to cut development costs and to get a competitive edge for their software products, thereby maximizing profits. The code they produce is often not carefully designed, implemented, or adequately tested. The result is bug-riddled software--software that behaves abnormally or, worse yet, causes the system on which it runs to behave abnormally, in many cases allowing perpetrators a chance to ex

Amazon no longer offers textbook rentals. We do!

Malware Fighting Malicious Code

Malware Fighting Malicious Code

0131014056

Summary

Author Biography

Table of Contents

Supplemental Materials

Excerpts

Write a Review