How an attacker can maintain control over their victim’s system without being discovered.

13
How an attacker can maintain control over their victim’s system without being discovered. Rootkits

TAGS:

Transcript of How an attacker can maintain control over their victim’s system without being discovered.

Page 1: How an attacker can maintain control over their victim’s system without being discovered.

How an attacker can maintain control over their victim’s

system without being discovered.

Rootkits

Page 2: How an attacker can maintain control over their victim’s system without being discovered.

What is a Rootkit?

• A rootkit is a collection of tools used by intruders to keep the legitimate users and administrators of a compromised machine unaware of their presence[1].

The keyword to remember for a rootkit is undetectable; and the most common purposes for a rootkit are sustained access and eavesdropping.

Page 3: How an attacker can maintain control over their victim’s system without being discovered.

Some History

• Early 1990’s – Internet becomes popular

• 1st Generation rootkits- Replaced potential tattletale binaries (e.g. netstat, ls)

• Easy to detect- Compare the hashes of the original binary with current one.

• First rootkits were mostly written for Unix based systems (hence rootkit,

instead of Administratorkit)

• 1999- NTRootkit, an early Windows rootkit

• Rootkits did not really become part of security admin vernacular until mid

2000’s

• Kicked off an arms race- rootkit developers vs detection/prevention measures

Page 4: How an attacker can maintain control over their victim’s system without being discovered.

Main things to hide

• Processes

• Files

• Network Connections

• Also: Various system statistics (e.g. CPU percentage)

Page 5: How an attacker can maintain control over their victim’s system without being discovered.

Current mindset on rootkits:• Uh oh, you have a rootkit?

Page 6: How an attacker can maintain control over their victim’s system without being discovered.

This mindset solves nothingZen quote

Page 7: How an attacker can maintain control over their victim’s system without being discovered.

Small POCProof of concept

The Hello World of Rootkits

Page 8: How an attacker can maintain control over their victim’s system without being discovered.

What’s going on?

Page 9: How an attacker can maintain control over their victim’s system without being discovered.

What’s going on in a userland rootkit?

• Hooking- Overwriting target function to act in favor of the rootkit

• Example 1- Overwrite legitimate function in memory

• Example 2- Overwrite legitimate function’s address in IAT to point to

rootkit’s custom function instead

Page 10: How an attacker can maintain control over their victim’s system without being discovered.

What’s going on in a kernel rootkit?

Similar concept, but different memory spaces, tables, functions…

Page 11: How an attacker can maintain control over their victim’s system without being discovered.

CODE

Page 12: How an attacker can maintain control over their victim’s system without being discovered.

Detecting the Invisible• Detecting a Presence

• Guard the Doors- Think intrusion detection• Roaming Guard- Periodic System scans

• Detecting Behavior• Sysinternals RootkitRevealer example

• Live Detections-• Rootkit revealer• GMER- Free, GNU-based. • Helios- Behavioral analysis (can be used to detect many forms of malware)• Sophos Anti-Rootkit- Free. Scans other forms of malware. Can scan a network,

not just a single host.

• If kernel rootkit is suspected-• Need to analyze system under a kernel debugger (kd.exe)

Page 13: How an attacker can maintain control over their victim’s system without being discovered.

End notes

• Still need to nuke system from orbit

• Questions?


A victim’s view of HS2 noise

A victim’s view of HS2 noise

Thames Valley PCC Victim’s Commissioning Update March 2015

Thames Valley PCC Victim’s Commissioning Update March 2015

Surprise Police Department’s Identity Theft Victim’s Packet

Surprise Police Department’s Identity Theft Victim’s Packet

DEAR ABBY Abuse, alcohol cloud victim’s perception

DEAR ABBY Abuse, alcohol cloud victim’s perception

Attacker aproach for attacking ics

Attacker aproach for attacking ics

Tempe Police Department Victim’s Fraud Packet

Tempe Police Department Victim’s Fraud Packet

Insider Attacker Detection

Insider Attacker Detection

Securing Frame Communication in BrowsersGadget Attacker. A gadget attacker is a web attacker with one additional ability: the integrator embeds a gad-get of the attacker’s choice.

Securing Frame Communication in BrowsersGadget Attacker. A gadget attacker is a web attacker with one additional ability: the integrator embeds a gad-get of the attacker’s choice.

Strategies of the Attacker

Strategies of the Attacker

Single Packet Authorization on the WEB -- WEB-SPA · Single Packet Authorization Client Attacker 1 Attacker 2 Attacker 3 Server. OWASP 10 Attacks Latency Denial of Service Replay

Single Packet Authorization on the WEB -- WEB-SPA · Single Packet Authorization Client Attacker 1 Attacker 2 Attacker 3 Server. OWASP 10 Attacks Latency Denial of Service Replay

Consequences of a Jailbroken iDevice · 2020-01-17 · Jailbreakme.com (“Star”) iOS 4.0.1 Attacker can silently jailbreak victim’s device by tricking victim into visiting a

Consequences of a Jailbroken iDevice · 2020-01-17 · Jailbreakme.com (“Star”) iOS 4.0.1 Attacker can silently jailbreak victim’s device by tricking victim into visiting a

Attacker POV to computer networks Attacker profiles and ...users.jyu.fi/~timoh/TIES327/L3.pdf · • Attacker POV to computer networks • Attacker profiles and public cases ... Product

Attacker POV to computer networks Attacker profiles and ...users.jyu.fi/~timoh/TIES327/L3.pdf · • Attacker POV to computer networks • Attacker profiles and public cases ... Product

Walmart / Sam’s Club Identity Theft Victim’s Affidavit ... · PDF fileIdentity Theft Victim’s Affidavit . ... A valid government -issued photo identification card (i.e. driver’slic

Walmart / Sam’s Club Identity Theft Victim’s Affidavit ... · PDF fileIdentity Theft Victim’s Affidavit . ... A valid government -issued photo identification card (i.e. driver’slic

Session Fixation OWASP Attack sketch Attacker sets victim’s session ID instead of session ID theft Victim authenticates using attacker provided session ID Attacker resumes authenticated

Session Fixation OWASP Attack sketch Attacker sets victim’s session ID instead of session ID theft Victim authenticates using attacker provided session ID Attacker resumes authenticated

Motor Vehicle Collisions: A Victim’s Handbook...Motor Vehicle Accidents: A Victim’s Handbook - Alabama Edition - PREFACE Being injured in a motor vehicle accident, or having a

Motor Vehicle Collisions: A Victim’s Handbook...Motor Vehicle Accidents: A Victim’s Handbook - Alabama Edition - PREFACE Being injured in a motor vehicle accident, or having a

Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)

Attacker Ghost Stories (CarolinaCon / Area41 / RVASec)

NETWORKDEFENCEUSING ATTACKER-DEFENDER ... - Masaryk …

NETWORKDEFENCEUSING ATTACKER-DEFENDER ... - Masaryk …

Tomcat Vulnerabilities - IKKISOFT · Agenda • What are the main vulnerabilities discovered in the past years in Apache Tomcat? • How can a potential attacker exploit these weaknesses?

Tomcat Vulnerabilities - IKKISOFT · Agenda • What are the main vulnerabilities discovered in the past years in Apache Tomcat? • How can a potential attacker exploit these weaknesses?

CSE509 System Security · 2015. 4. 19. · –Attacker [s Facebook app •Attacker has no other access to user machine! •Variation: iframe attacker _ –An iframe with malicious

CSE509 System Security · 2015. 4. 19. · –Attacker [s Facebook app •Attacker has no other access to user machine! •Variation: iframe attacker _ –An iframe with malicious

THE VICTIM’S ASSISTANCE PROGRAMME - BBA

THE VICTIM’S ASSISTANCE PROGRAMME - BBA