The Future of Internet Worms

1. The Future of Internet Worms Jose Nazario Crimelabs Research Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

2. Disclaimer • Will not build • Intrusion detection Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

3. Overview • Introduction • Six Components • Problems in Current Worm Paradigms • Evolution of Worm Networks • Detection Strategies • Conclusions Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

4. Worms Defined • Automated intrusion agents • Infect one host, launch, infect again • Self propelled • viruses require carrier programs Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

5. Worms in History • Morris worm • Persistent Windows worms • Rise of Linux worms (2000 …) • Examples: Win32.Bremer, Ramen, sadmind/IIS Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

6. Why Worms? • Ease • write and launch once • many acquisitions • continually working • Pervasiveness • weeds out weakest targets • penetrates difficult networks Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

7. Two Futures • Small increases • better rootkits • encryption • increased attack capabilities • Paradigm shift Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

8. Six Components of Worms • Reconnaissance • Specific Attacks • Command Interface • Communication Mechanisms • Intelligence Capabilities • Unused and Non-attack Capabilities Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

9. Reconnaissance • Target identification • Active methods • scanning • Passive methods • OS fingerprinting • traffic analysis Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

10. Specific Attacks • Exploits • buffer overflows, cgi-bin, etc. • Trojan horse injections • Limited in targets • Two components • local, remote Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

11. Command Interface • Interface to compromised system • administrative shell • network client • Accepts instructions • person • other worm node Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

12. Communications • Information transfer • Protocols • Stealth concerns Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

13. Intelligence Database • Knowledge of other nodes • Concrete vs. abstract • Complete vs. incomplete Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

14. Unused and Non-attack Capabilities • Remainder of exploits • Non-exploit capabilities • Various possibilities Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

15. Assembled Pieces Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

16. Questions? Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

17. Current Limitations • Limited capabilities • Growth and traffic patterns • Network structure • Intelligence Database Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

18. Limited Capabilities: Recon Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

19. Limited Capabilities: Attack Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

20. Traffic Growth Rates Tworm=kN(Tscansnscans)(Tcommncomms)t Tworm fTworm= _______ Ttot Traffic, hence profile, increases with time. Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

21. Traffic Growth Patterns Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

22. Network Structure Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

23. Network Topology Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

24. Limitations of Directionality Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

25. Intelligence Database Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

26. Limitations Conclusions • Highly visible • Easily Blocked • need a signature • Unable to achieve a specific target • Readily caught Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

27. Questions? Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

28. Future Considerations • Dynamic behavior • Dynamic updates • Communications mechanisms • Infection mechanisms • Network topologies • Communications topology • New targets Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

29. Dynamic Behavior Communications channels Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

30. Dynamic Behavior Dynamic invocation of capabilities Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

31. Dynamic Network Roles Not every node contains all components Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

32. Updates to the Nodes Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

33. Embedding Messages • Images • Text • MP3 files • Usenet, web, mailing lists • Freenet, Gnutella, Napster Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

34. Stealth Broadcasts Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

35. Signed Updates Source verification Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

36. Communications Topology Broadcast from central site Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

37. Communications Topology Store and forward Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

38. Passive Methods Target acquisition Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

39. Payload Injection Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

40. Network Topology Guerilla network Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

41. Network Topology Directed tree Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

42. New Targets • Embedded devices • bugs • prevalence on broadband • Large audience targets • Akamai clients • Political, financial motivations Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

43. Questions? Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

44. Worm Detection • Challenges • Fast moving • Always adding new nodes • Traditional Worm Paradigm • Analyze one node, know all • Same signature for all nodes Hard to distinguish between worms and aggressive or scripted attackers Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

45. Worm Signatures • Correlation Analysis • Scans, attacks • Quick succession of scans across hosts • Quick follow up of attacks with scans • Growth of Traffic • exponential Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

46. New Challenges • Identifying communications channels • Identifying all scans, attacks • Constantly changing • Larger Picture Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

47. Defenses • Traditional paradigms • Detection • anomaly detection • agent based IDS • focus on common parts Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

48. Defenses • NIDS • Hone in on common parts • Poison Injections • Null, shutdown payloads • Traffic analysis • Identifying communications partners All are labor intensive Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

49. Conclusions • Worms will evolve • increased use of hiding tools • Impending paradigm shift • not all nodes look alike • update capable • No one signature Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”

50. Crimelabs Rick Chris Jeremy Brandon Ben Michal Zalewski Simple Nomad Dug Song Blackhat Acknowledgements Blackhat 2001 Las Vegas, Nazario, “The Future of Internet Worms”