|
Right. Now for some notes (crammed onto the backs of two business cards) from a talk some Washington FBI agents delivered today on "Battling Malicious Code."
First of all, writing like a script kiddie: Write "sub-this, sub-that," spell phonetically, and include words like 007 and trance. Modify logs—add spelling errors! When naming your hacker group, here are some keywords: Alliance, Clan, Zone, VX, Bad Sector, LSD. For example, you could name your login "trancedj007uberhacker." This will fit well amongst names like "smithj1." Not!—but the agents found some cracker's account by looking for names that didn't fit the norm.
And the duct tape hack! The l33t hacker renamed ls to .ls, ps to .ps, and such, replacing the originals with shell scripts that ran grep -v. Jackpot! The IP of his tunnel was right in netstat, and his formerly secret login, processes, and directories were a few files away!
Various forensics tools: Sleuthkit, Ilook, Encase, FTK, Safeback, and mystery scripts (this is where they steal all your personal information, the presenter joked.)
Stressing the importance of network diagrams, the presenter said that in the worst cases, companies have no idea what computers are running, and they write their network diagrams on napkins (which he's seriously received on cases.)
The virus internals presentation was awesome. “We have great tools” for analyzing operating system internals, Mike said. The agents test viruses in honeypots. They monitor the registry, network connections, and systems calls with tools like NGSSniff and IDA Pro. They especially look at intermediate files viruses create and delete.
But the real work is in disassembly. Some viruses contain up to 400,000 instructions (like BugBear.b,) and it can be like looking for a needle in a haystack, to overuse a cliché. Of course, they are aware of the basics tools (like strings(1).)
Virus writers love anti-analysis techniques, and they often riddle their viruses with obfuscation, compression, encryption, and tricks to keep the virus analyzers at bay—though generally just long enough to collect information from their drop URLs and e-mail addresses.
Assembly obfuscation is the easiest to spot. The agents are becomine quite proficient at noticing instructions designed to confuse disassemblers—like the 68 0F instruction, which can confuse certain disassemblers enough to miss instructions.
Virus writers often run their viruses through compression algorithms, like NEOLITE and tFlack, but tools exist to easily decode those.
Encryption isn't too hard to defeat. They showed one example where all the encrypted strings were processed by one function—duh, wonder what that XOR instruction in there does.
If you want to annoy the analysis team, use crc32 checks. Search for hardcoded CRC32 values contained in memory outside the function. These are tough to deal with and hard to detect.
That's all I have down… except that the FBI has been known to infiltrate cracking groups, monitoring their activities—or instead of immediately arresting people, having them gather data. Sort of like when drug dealing—sometimes you let the deal happen, you know?
| 
Age: Mid-19
