four stage process for ing and installing updates patches

Four Stage Process For Ing And Ing S Patches Download Our Malware

Four Stage Process For Ing And Ing S Patches Download Our Malware

In this case, we will provide the victim with a link to a remote server to download our malware.

Wouldnt it be nice if someone told us what exactly was vulnerable in an application or operating system Turns out, every time a patch is announced and released, we are given all the information about the vulnerability and where it can be found within the vulnerable software.

In order to identify exactly what changed, we need to have two things: The prepatched application The postpatched application Using tools such as IDA Pro, and the binNavi plug-in for IDA Pro (available at zynamics.com ), we can identify changes that are made at the assembly-language level.

Once we know what has changed, we can create exploits that target the vulnerability that is being patched.

The process of reverse engineering patches is becoming more and more established; it has even been suggested that the process could be automated, as discussed in the paper by Brumley, Poosankam, Song, and Zheng.

In their paper, the authors proposed that exploits could be generated rapidly and accurately before systems are widely patched.

In their experiments, they were able to generate a viable exploit in 30 s 6 considering that it takes 24 h for 80 percent of all computer systems to even check for the availability of a patch, rapidly generating an exploit would be extremely beneficial for the ninja hacker.

In small companies, the patching process relies on the operating systems built-in automatic updating service.

Since most systems using this method are patched relatively quickly, the window of opportunity to exploit vulnerable systems is small.

In large organizations, the window of opportunity is more complex, since patches may negatively impact performance and availability, especially critical systems.

National Institute of Standards and Technology (NIST) Special Publication 800-40 suggests that patches go through a process where an organization must 7: Determine the significance of the threat or vulnerability Determine the existence, extent, and spread of related worms, viruses, or exploits Determine the risks involved with applying the patch or nonpatch remediation Create an organization-specific remediation database Test remediations Deploy vulnerability remediations Distribute vulnerability and remediation information to administrators Verify remediation The time allowed to perform all these steps will vary, but once in a while a patch is deemed so critical that it must be installed almost immediately.

We can take advantage of this time lag by generating our own exploit, which we disguise as the real vulnerability patch.

The trick then becomes to get the users to install them on their system.

In a large organization, we also have to contend with the reality that corporate patch processes usually occur without user interaction.

Employee systems usually have processes that automatically fetch and install patches once they have been vetted by the organization.

To be successful, we must circumvent the patch process and convince the employees to install our malicious patch before the real patch hits their system and eliminates our ability to exploit the employees system.

Another option is to create an executable that we say is a patch, but is really malicious code instead.

Installing Malicious Software Locally E-mails, containing malware, requesting corporate employees to install patches have been successful for many years.

Once the employee clicks on the e-mail attachment posing as a patch, their system is compromised with the included malware.

Often, the malware has nothing to do with the actual security vulnerability, and is simply a ruse to get the victim to install the malware.

As Zukin, we could do the same thing, but then we have to run the gambit of e-mail scanners that might detect our malware.

Even if we have a zero-day exploit, the system may be configured to deny execution of exploit code in our attachment.

The advantage to including malware within the e-mail is that our identity will be secure, since our attack cannot be traced back without extensive malware analysis.

The disadvantage is that our target victims e-mail server may filter out attachments, meaning we would need to find another way to get the victim to install our malware for example, through a remote download.

Installing Malicious Software Remotely Similar to installing malicious software locally, when we perform remote attacks we are hoping the system user will install malware.

Four Stage Process For Ing And Installing Updates Patches