Viruses and Malicious Code

Chapter Overview

• Chapter focuses on viruses and malicious code
• Outlines secure programs, non-malicious program errors, viruses and other malicious code, and targeted malicious code

Secure Programs

• Security implies that the program enforces the expected CIA (Confidentiality, Integrity, Availability)
• Software security can be assessed similarly to software quality
• Practitioners look at the quantity and types of faults as evidence for a product's quality
• One approach to quality in security is fixing faults
• Human error can lead to a fault in a computer program, such as an incorrect step, command, process, or data definition
• A failure is a departure from the system's required behavior and can be discovered before or after system delivery
• A fault is an inside view from developers, while a failure is an outside view seen by the user
• Early security work was based on "penetrate and patch," which often led to less secure systems
• Comparing requirements and behavior helps, and unexpected behavior is a program security flaw

Security Flaws

• A security flaw is inappropriate program behavior caused by a program vulnerability, and can be caused intentionally or unintentionally
• Program flaws are divided into inadvertent (unintentional) human errors and malicious (intentional) flaws
• Intentional flaws have two categories: malicious and non-malicious
• Inadvertent flaws fall into six categories:
  • Validation errors, like incomplete permission checks
  • Domain errors, like controlled access to data
  • Serialization and aliasing, like program flow order
  • Inadequate identification/authentication for authorization
  • Boundary condition violation, or failure on first/last case
  • Other exploitable logic errors

Non-malicious Program Errors

• A buffer is a space where data is held in memory and has a finite capacity
• A buffer overflow happens when a program writes more data to a buffer than it can actually hold, potentially leading to adjacent memory corruption
• It can cause a program crash or allow an attacker to execute malicious code

Security Definitions

• Program security flaw: Inappropriate program behavior caused by a program vulnerability due to malicious code or poorly developed code
• Buffer (Array or String): Space in memory where data is held with finite capacity
• Buffer Overflow: Occurs when program writes more data to a buffer than it can contain leading to program crash or attacker gaining access to execute malicious code
• Incomplete Mediation: Access to resources isn't consistently checked/authorized in system operations
• Time-of-Check to Time-of-Use (TOCTOU) Errors: Security vulnerabilities when system state isn't consistently verified between access check and resource use
• Malicious code/Rogue program: General name for unanticipated/undesired effects in programs/program parts caused by an agent intent on damage

Types of Malicious Code and Their Definitions

• Virus: Attaches and propagates copies of itself to other programs
• Trojan Horse: Contains unexpected additional functionality
• Trapdoor: Allows unauthorized access to functionality
• Worm: Propagates copies of itself through a network
• Logic Bomb: Triggers action based on specified conditional occurence
• Time Bomb: Triggers action based on specific time occurrence
• Rabbit: Replicates without limits to exhaust resources, like a virus/worm

Virus Actions and Types

• Virus replication and passing malicious code to non-malicious programs by modifying them
• Program acts like a biological virus and infects healthy subjects by attaching itself to program
• Can either destroy the program or coexist with it
• Good programs can become carriers once infected
• Transient Viruses: Dependent on the life of its host
• Runs when attached program executes and terminates when its attached program ends
• Resident virus: Locates itself in memory and can remain active/activated as a stand-alone program

How Viruses Attach

• Appended Viruses

• Appends itself to program and whenever program runs, virus is activated Original program and the virus code insertion

• Viruses can have control before and after its execution

• Integrated Viruses and Replacement: -Virus replaces some of its targets integrating itself into the original code of its target

• Document Viruses: Implemented within formatted documents/databases/slide presentations Uses features of the programming language to perform malicious actions

How Viruses Gain Control

• Overwriting Target: Virus has to push target for calling itself instead of target
• Change Pointers Virus invocation can replace parts of resident operating system by modifying pointers to those resident parts such as the table of handlers for different kinds of interrupts

Ways to Implement Virus Control

• Hiding Qualities of Viruses: Qualities appealing for writers to make it harder to detect/destroy/deactivate

• Distribution: -Transmit by e-mail using direct or indirect attachments that lead to spreading malicious code

• Boot Sector Viruses: Control starts w/firmware that determines hardware components & transfers control to the OS

• Virus installation

• Virus' writer can break chain & point to the virus code & reconnect the chain after virus installation

• Virus hides in the boot area

• Hiding Viruses in Specific Systems

• On DOS and MS-Windows systems, a virus can infect system files or add entries for loaded programs to CONFIG.SYS or AUTOEXEC.BAT

• Load viruses to memory because it has broad effect and is shared between users

• Virus writers also like Attaching viruses to resident code as it is activated many times while the machine is running

• Can be attached to Applications

• Word processing and spreadsheets contain macro feature for use with code and they get the ability to be executed in the app, every time

• Libraries are Excellent places for viruses

Detection and Precautions:

• Virus scanner program signature allows a user
• Virus execution happens in a particular way by certain methods to spread which yields an informative pattern called signature
• Use Virus detectors regularly and frequently to update Daily
• The virus scanners monitors execution and watches for the signatures
• A signature is important for a scanner program

Virus Patterns

• Look for Storage patterns -Check the invariant files attached and file sizes
• Execution patterns -To affect damage or the running the harddisk.
• Polymorphic viruses - change to make the scanners ineffective
• Detection avoidance: -Polymorphic viruses: encrypting viruses contain: decryptionkey/ encrypted objects.

Virus Prevention Methods

• Use Only commercial software acquired from reliable vendors
• Make a recoverable Image file
• Write-protect the image file before booting and keep it write-protected
• Retain backup copies of executable system files and database.

Targeted Malicious Codes

• In great lengths, the security attempts to reestablish itself and operate as root to the privileged user in a Unix system