Presentation by Marco Slaviero at Tshwane University Of Technology. This presentation is about protecting your your computer against malware. The presentation begins with a look at different types of malware. Determining program intent in a general way is discussed. The presentation ends with discussions on practice strategies for both home and enterprise users to protect their computers from infection.

1. Marco Slaviero
Proofing against malware
attacks
PROOF AGAINST MALWARE

2. Summary
• State of anti-malware
• Chronic malware treatment
PROOF AGAINST MALWARE

3. Malware? What‟s that?
• Obvious • Less obvious
– Virii – “Legal” rootkits (ala
– Spyware Sony)
– Worms – EULA-protected tools
– Trojans – Dual purpose tools
– Poorly designed tools
PROOF AGAINST MALWARE

4. INTENT MATTERS
PROOF AGAINST MALWARE

5. CAN WE DETERMINE
PROGRAM INTENT IN A
GENERAL WAY?
PROOF AGAINST MALWARE

6. Specific solutions
• Real-time / point-in-time
• Signatures
– Byte sequences on disk
– Byte sequences over the network
– Known suspicious system calls
PROOF AGAINST MALWARE

7. Antimalware fails
• Polymorphic malware
– Encrypt the virus, and include a tiny
decryption engine that runs first.
– Response: virtualise the first couple of
hundred instructions, then see if known
signatures are present
• Metamorphic malware
– Alter the instruction sequence such that it
remains semantically identical, but
syntactically different
PROOF AGAINST MALWARE

8. Examples
• Signature stream:
“Our computing systems are generally very
insecure.”
• Polymorphic manipulation:
“Replace each „ZZ‟ with an „e‟ in the next sentence.
Our computing systZZms arZZ gZZnZZrally vZZry
insZZcurZZ”.
• Metamorphic manipulation:
“Mankind‟s information systems do not exhibit safe
security practices.”
PROOF AGAINST MALWARE

9. Dan Geer‟s security monoculture
PROOF AGAINST MALWARE

10. Artificial distinctions
PROOF AGAINST MALWARE

11. SO, CAN WE MALWARE-
PROOF A COMPUTER?
PROOF AGAINST MALWARE

12. Safe from infection
PROOF AGAINST MALWARE

13. Safe from infection #2
PROOF AGAINST MALWARE

14. Safe from infection #3
&
PROOF AGAINST MALWARE

15. State of the art
PROOF AGAINST MALWARE

16. And it ignores the unexpected
PROOF AGAINST MALWARE

17. Verdict
NO
PROOF AGAINST MALWARE

18. DOES IT GET LESS GLOOMY?
PROOF AGAINST MALWARE

19. Side bar: Attack Graphs
Create and host
malicious Obtain target‟s Entice user to
website contact details click on link
Exploit flaw in
unpatched Download body Execute
Adobe Flash of malware malware
Player
Upload
Search disk for documents via
information configured
proxy
PROOF AGAINST MALWARE

20. LENGTHEN THE ATTACK
GRAPH
PROOF AGAINST MALWARE

21. Not like this
PROOF AGAINST MALWARE

22. Or this
PROOF AGAINST MALWARE

23. Better…
PROOF AGAINST MALWARE

24. MOST IMPORTANT: PROTECT
THE ORGANISATION, NOT
THE COMPUTER
PROOF AGAINST MALWARE

25. Where does your risk lie?
PROOF AGAINST MALWARE

26. Practical strategies: Home users
• Not much infrastructure to lengthen attack
chains
• Consider
– Decentralising your online life
– Multiple (virtual) machines, each devoted to a
single level of task
– Security by isolation
– Examples: VMWare, Qubes
PROOF AGAINST MALWARE

27. Qubes
http://qubes-os.org/Architecture.html
PROOF AGAINST MALWARE

28. Practical strategies: Enterprise users
• Regular stuff (remove unneeded software, patch,
segregated networks, etc)
• Expect that you‟re infected
• Develop rapid response measures to detect and
isolate infection using signatures on both the host
and network.
• Monitor and log process execution
• Whitelist binaries
• Close access channels (no browsing, severe email
limitations, no flash disks)
• Risk management: loss is inevitable, absorb the
cost
• Introduce heterogeneity
PROOF AGAINST MALWARE

29. Side bar: walled gardens
PROOF AGAINST MALWARE

30. BUT DON’T FOOL YOURSELF.
YOU’RE STILL NOT
MALWARE-PROOF.
PROOF AGAINST MALWARE

31. Thank you to Prof. Ojo and TUT for the
opportunity
marco@sensepost.com
Questions? PROOF AGAINST MALWARE