Spyware and Trojan Horses

1. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Spyware and Trojan Horses Computer Security Seminar Series [SS1]

2. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Your computer could be watching your every move! Image Source - http://www.clubpmi.it/upload/servizi_marketing/images/spyware.jpg

3. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Introduction

4. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Seminar Overview • Introduction to Spyware / Trojan Horses • Spyware – Examples, Mechanics, Effects, Solutions • Tracking Cookies – Mechanics, Effects, Solutions • Trojan Horses – Mechanics, Effects, More Examples • Solutions to the problems posed • Human Factors – Human interaction with Spyware • “System X” – Having suitable avoidance mechanisms • Conclusions – Including our proposals for solutions

5. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Definitions A general term for a program that surreptitiously monitors your actions. While they are sometimes sinister, like a remote control program used by a hacker, software companies have been known to use Spyware to gather data about customers. The practice is generally frowned upon. SPYWARE Definition from: BlackICE Internet Security Systems - http://blackice.iss.net/glossary.php TROJAN HORSE An apparently useful and innocent program containing additional hidden code which allows the unauthorized collection, exploitation, falsification, or destruction of data. Definition from: Texas State Library and Archives Commission - http://www.tsl.state.tx.us/ld/pubs/compsecurity/glossary.html

6. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Symptoms • Targeted Pop-ups • Slow Connection • Targeted E-Mail (Spam) • Unauthorized Access • Spam Relaying • System Crash • Program Customisation SPYWARE SPYWARE / TROJAN SPYWARE TROJAN HORSE TROJAN HORSE SPYWARE / TROJAN SPYWARE

7. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Summary of Effects • Collection of data from your computer without consent • Execution of code without consent • Assignment of a unique code to identify you • Collection of data pertaining to your habitual use • Installation on your computer without your consent • Inability to remove the software • Performing other undesirable tasks without consent

8. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Similarities / Differences Source – Table derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

9. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Spyware Image Source – The Gator Corporation – http://www.gator.com

10. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Software Examples • GAIN / Gator • Gator E-Wallet • Cydoor • BonziBuddy • MySearch Toolbar • DownloadWare • BrowserAid • Dogpile Toolbar Image Sources… GAIN Logo – The Gator Corporation – http://www.gator.com BonziBuddy Logo – Bonzi.com - http://images.bonzi.com/images/gorillatalk.gif DownloadWare Logo – DownloadWare - http://www.downloadware.net

11. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Advantages • Precision Marketing • Relevant pop-ups are better than all of them! • You may get some useful adverts! • Useful Software • DivX Pro, IMesh, KaZaA, Winamp Pro • (Experienced) people understand what they are installing. • Enhanced Website Interaction • Targeted banner adverts • Website customisation User Perspective - I

12. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Disadvantages • Browsing profiles created for users without consent • Used for target marketing and statistical analysis • Unable to remove Spyware programs or disable them • Increased number of misleading / inappropriate pop-ups • Invasion of user privacy (hidden from user) • Often badly written programs corrupt user system • Automatically provides unwanted “helpful” tools • “20 million+ people have Spyware on their machines.” Source - Dec ’02 GartnerG2 Report User Perspective - II

13. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Example Pop-up Misleading Pop-up User Perspective - III Image Source – Browser Cleanser – Directed pop-up from http://www.browsercleanser.com/

14. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Network Overview • Push • Advertising • Pull • Tracking • Personal data Technical Analysis - I Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

15. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Client-Side Operation Technical Analysis - II Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

16. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Server-Side Operation • Server-side operation is relatively unknown. However, if we were to develop such a system, it would contain… Technical Analysis - III Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

17. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Spyware Defence User Initiatives… • Issue Awareness • Use Legitimate S/W Sources • Improved Technical Ability • Choice of Browser • Choice of OS • Legal action taken against breaches of privacy • Oct ’02 Doubleclick Technical Initiatives... • Spyware Removal Programs • Pop-up Blockers • Firewall Technology • Disable ActiveX Controls • Not Sandboxed • E-Mail Filters • Download Patches

18. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk GAIN Case Study • Installed IMesh, which includes Gator Installation • We accessed multiple internet sites • We simultaneously analyzed network traffic (using IRIS) • We found the packets of data being sent to GAIN • Packets were encrypted and we could not decrypt them • See Example ->

19. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Image Source – Screenshot of IRIS v3.7 Network Analyser – Professional Networks Ltd. See http://www.pnltools.com.

20. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Spyware Removers Ad-aware (by Lavasoft) • Reverse Engineer Spyware • Scans Memory, Registry and Hard Drive for… • Data Mining components • Aggressive advertising components • Tracking components • Updates from Lavasoft • Plug-ins available • Extra file information • Disable Windows Messenger Service Image Source – Screenshot of Ad-aware 6.0. LavaSoft. See http://www.lavasoft.com

21. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Vulnerable Systems • Those with an internet connection! • Microsoft Windows 9x/Me/NT/2000/XP • Does not affect Open Source OSs • Non - fire-walled systems • Internet Explorer, executes ActiveX plug-ins • Other browsers not affected

22. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Tracking Cookies

23. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Cookies • A Cookie is a small text file sent to the user from a website. • Contains Website visited • Provides client-side personalisation • Supports easy Login • Cookies are controlled by… • Website’s Application Server • Client-side Java Script • The website is effectively able to ‘remember’ the user and their activity on previous visits. • Spyware companies working with websites are able to use this relatively innocent technology to deliver targeted REAL TIME marketing, based on cookies and profiles.

24. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Case Study - DoubleClick • Most regular web users will have a “doubleclick.net” cookie. • Affiliated sites request the DoubleClick cookie on the users computer. • The site then sends… • Who you are • All other information in your cookie file • In return for… • All available marketing information on you - collected from other affiliated sites which the you have hit.

25. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Case Study – DoubleClick • Site targets banner adverts, e-mails and pop-ups to the user. • If the user visits an affiliated site without a DoubleClick cookie, then one is sent to the user. • The whole process is ‘opaque’ to the user and occurs without their consent.

26. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Tracking Cookie Implementation • Protocol designed to only allow the domain who created a cookie to access it. • IE has a number of security holes… • Up to IE 5, domain names specified incorrectly. • Up to IE 6, able to fool IE into believing it is in another domain. • Patches and IE 6 solved a number of problems • Since then, tracking cookies are still proving a large problem, there are still a number of holes still open.

27. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Tracking Cookie Implementation Image Source – Image produced by Andrew Brown, Tim Cocks and Kumutha Swampillai; partially inspired by a diagram from [16].

28. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Tracking Cookie Defence • Replace tracking cookies with write protected zero length files of the same name. • DoubleClick offer an opt-out cookie, which can be obtained from their website. • Disable cookies • Makes many websites unusable • Delete cookies after session • Spyware remover (Ad-aware) Image Source – Screenshot of DoubleClick OptOut Cookie displayed in Microsoft Notepad.

29. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Trojan Horses

30. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Installation • Secretly installed when an infected executable is run • Much like a virus • Executables typically come from P2P networks or unscrupulous websites • ActiveX controls on websites • ActiveX allows automatic installation of software from websites • User probably does not know what they are running • Misleading descriptions often given • Not sandboxed! • Digital signatures used, signing not necessary

31. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Installation • Certificate Authority • Misleading Certificate Description • Who is trusted? Image Source – Screenshot of Microsoft Internet Explorer 6 security warning, prior to the installation of an ActiveX Control from “Roings”.

32. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Effects • Allows remote access • To spy • To disrupt • To relay a malicious connection, so as to disguise the attacker’s location (spam, hacking) • To access resources (i.e. bandwidth, files) • To launch a DDoS attack

33. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Operation • Listen for connections • Memory resident • Start at boot-up • Disguise presence • Rootkits integrate with kernel • Password Protected

34. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Example: Back Orifice • Back Orifice • Produced by the “Cult of the Dead Cow” • Win95/98 is vulnerable • Toast of DefCon 6 • Similar operation to NetBus • Name similar to MS Product of the time

35. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk BO: Protocol • Modular authentication • Modular encryption • AES and CAST-256 modules available • UDP or TCP • Variable port • Avoids most firewalls • IP Notification via. ICQ • Dynamic IP addressing not a problem

36. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 ICQ SERVER Victim CONNECTION TROJAN IP ADDRESS AND PORT IP ADDRESS AND PORT Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk BO: Protocol Example (1) INFECTION OCCURS Attacker Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

37. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Attacker Victim CONNECTION COMMAND REQUEST FOR INFORMATION INFORMATION Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk BO: Protocol Example (2) COMMAND EXECUTED Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

38. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Attacker Victim CLEANUP COMMAND Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk BO: Protocol Example (3) EVIDENCE DESTROYED Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

39. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Trojan Horse Examples • M$ Rootkit • Integrates with the NT kernel • Very dangerous • Virtually undetectable once installed • Hides from administrator as well as user • Private TCP/IP stack (LAN only)

40. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Trojan Horse Examples • iSpyNOW • Commercial • Web-based client • Assassin Trojan • Custom builds may be purchased • These are not found by virus scanners • Firewall circumvention technology

41. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Trojan Horse Examples • Hardware • Key loggers • More advanced? • Magic Lantern • FBI developed • Legal grey area (until recently!) • Split virus checking world

42. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Demonstration

43. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Vulnerable Systems Number of trojans in common use… RELATIVELY SAFE DANGEROUS MacOS WinNT Win 9x MacOS X Linux/Unix WinNT refers to Windows NT 4, 2000, XP and Server 2003. Win9x refers to Windows 95, 95SE, 98 and ME.Information Source: McAfee Security - http://us.mcafee.com/ Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

44. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Vulnerable Systems Ease of compromise… DANGEROUS RELATIVELY SAFE WinNT MacOS Win 9x MacOS X Linux/Unix WinNT refers to Windows NT 4, 2000, XP and Server 2003. Win9x refers to Windows 95, 95SE, 98 and ME.Information Source: McAfee Security - http://us.mcafee.com/ Image Source – Image derived and produced by; Andrew Brown, Tim Cocks and Kumutha Swampillai, February 2004.

45. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Conclusions

46. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Security Implications • Divulge personal data • Backdoors into system • System corruption • Disruption / Irritation • Aids identity theft • Easy virus distribution • Increased spam Short Term Long Term • Mass data collection • Consequences unknown • Web becomes unusable • Web cons outweigh pros • Cost of preventions • More development work • More IP addresses (IPv6)

47. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Solutions • Firewall • Virus Checker • Spyware Remover • Frequent OS updates • Frequent back-up • Learning problems Short Term Long Term • Add Spyware to Anti-Virus • Automatic maintenance • Legislation • Education on problems • Biometric access • Semantic web (and search)

48. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Firewalls Network / Internet • 3 Types… • Packet Filtering – Examines attributes of packet. • Application Layer – Hides the network by impersonating the server (proxy). • Stateful Inspection – Examines both the state and context of the packets. • Regardless of type; must be configured to work properly. • Access rules must be defined and entered into firewall.

49. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Firewalls Network / Internet http - tcp 80 telnet - tcp 23 http - tcp 80 Packet Filtering ftp - tcp 21 Web Server Firewall Allow only http - tcp 80 202.52.222.10: 80 192.168.0.10 : 1020 202.52.222.10: 80 Stateful Inspection 192.168.0.10 : 1020 PC Firewall Only allow reply packets for requests made out Block other unregistered traffic Image Source – Image produced by Andrew Brown, Tim Cocks and Kumutha Swampillai; partially inspired by a diagram from [4].

50. Spyware and Trojan Horses – Computer Security Seminar 12th February 2004 Andrew Brown, Tim Cocks and Kumutha Swampillai http://birmingham.f9.co.uk Intrusion Detection Systems Network Server Switch Firewall IDS • Intrusion Detection – A Commercial Network Solution • An “Intelligent Firewall” – monitors accesses for suspicious activity • Neural Networks trained by Backpropagation on Usage Data • Could detect Trojan Horse attack, but not designed for Spyware • Put the IDS in front of the firewall to get maximum detection • In a switched network, put IDS on a mirrored port to get all traffic. • Ensure all network traffic passes through the IDS host. Server PC Image Source – Image produced by Andrew Brown, Tim Cocks and Kumutha Swampillai; partially inspired by a diagram from [4].