Search

Abstract: NIST Special Publication 800-68 has been created to assist IT professionals, in particularly Windows XP system administrators and information security personnel, in effectively securing Windows XP systems. It discusses Windows XP and various application security settings in technical detail. The guide provides insight into the threats and security controls that are relevant for various operational environments, such as for a large enterprise or a home office. It describes the need to document, implement, and test security controls, as well as to monitor and maintain systems on an ongoing basis. It presents an overview of the security components offered by Windows XP and provides guidance on installing, backing up, and patching Windows XP systems. It discusses security policy configuration, provides an overview of the settings in the accompanying NIST security templates, and discusses how to apply additional security settings that are not included in the NIST security templates. It demonstrates securing popular office productivity applications, Web browsers, e-mail clients, personal firewalls, antivirus software, and spyware detection and removal utilities on Windows XP systems to provide protection against viruses, worms, Trojan horses, and other types of malicious code. This list is not intended to be a complete list of applications to install on Windows XP system, nor does it imply NIST's endorsement of particular commercial off-the-shelf (COTS) products.

Abstract: Government agencies and other organizations have begun to augment their computer security efforts because of increased threats to computer security. Incidents involving these threats, including computer viruses, malicious user activity, and vulnerabilities associated with high technology, require a skilled and rapid response before they can cause significant damage. These increased computer security efforts, described here as Computer Security Incident Response Capabilities (CSIRCs), have as a primary focus the goal of reacting quickly and efficiently to computer security incidents. CSIRC efforts provide agencies with a centralized and cost-effective approach to handling computer security incidents so that future problems can be efficiently resolved and prevented.

Mobile botnets have recently evolved owing to the rapid growth of smartphone technologies. The implications of botnets have inspired attention from the academia and industry alike, which includes vendors, investors, hackers and researcher community. Above all, the capability of botnets is exploited in a wide range of criminal activities, such as, Distributed Denial of Service (DDoS) attacks, stealing business information, remote access, online/click fraud, phishing, malware distribution, spam emails, and building mobile devices for illegitimate exchange of information/materials. In this paper, we investigate mobile botnet attacks by exploring attack vectors and a subsequent presentation of a well-defined thematic taxonomy. Through identification of significant parameters from the taxonomy, we conduct a comparison to explore effects of existing mobile botnets on commercial as well as open source mobile operating system platforms. The parameters for comparison include mobile botnet architecture, platform, target audience, vulnerabilities/loopholes, operational impact and detection approaches. Related to our findings, we present open research challenges in this domain. [ABSTRACT FROM AUTHOR]

NetEntropy is a plugin to the Orchids intrusion detection tool that is originally meant to detect some subtle attacks on implementations of cryptographic protocols such as SSL/TLS. Netentropy compares the sample entropy of a data stream to a known profile, and flags any significant variation. Our point is to stress the mathematics behind Netentropy: the reason of the rather incredible precision of Netentropy is to be found in theorems due to Paninski and Moddemeijer. [ABSTRACT FROM AUTHOR]

Current smartphones are based upon the concept of apps, which are lightweight applications that are distributed through on-line marketplaces, such as Google Play (for Android devices). Unfortunately, this market-centric model is affected by several major security and trust issues, due to the fact that anyone can easily create, and deploy through the market, a malicious app that could potentially lead to a massive malware spread. In this paper, we propose a framework to classify Android malware based upon the concept of common patterns of actions executed by malicious applications. The basic idea is to extract, from known malware, a subset of frequent subgraphs of system calls that are executed by most of the malware. This set of subgraphs constitutes a database of known malicious features. Then, when a new application is downloaded from a market, it is first run in a sandbox to monitor its behavior. This will result in an execution trace that may contain some of the subgraphs previously found in malware. The resulting vector of the found subgraphs is given to a classifier that returns its decision in terms of a likely malware or not. Preliminary tests executed both on known good apps and malware confirm the effectiveness and quality of our proposal. [ABSTRACT FROM AUTHOR]

Program obfuscation techniques have been widely used by malware to dodge the scanning from anti-virus detectors. However, signature based on the data structures appearing in the runtime memory makes traditional code obfuscation useless. Laika [2] implements this signature using Bayesian unsupervised learning, which clusters similar vectors of bytes in memory into the same class. We present a novel malware obfuscation technique that automatically obfuscate the data structure layout so that memory similarities between malware programs are blurred and hardly recognized. We design and implement the automatic data structure obfuscation technique as a GNU GCC compiler extension that can automatically distinguish the obfuscability of the data structures and convert part of the unobfuscable data structures into obfuscable. After evaluated by fourteen real-world malware programs, we present that our tool maintains a high proportion of obfuscated data structures as 60.19% for type and 60.49% for variable. [ABSTRACT FROM AUTHOR]

The importance of network security is rapidly increasing as more and more business is conducted via these systems. The proposed honeynet system can be used to detect bots or malware based on the evaluation of events occurring within a computer network. A honeypot is a trap set to detect, deflect or in some manner counteract attempts at unauthorized access to information systems. A honeynet (a network consisting of 2 or more honeypots) is used for surveillance of larger or more diverse networks for which one honeypot may not be sufficient. The detection algorithms of these systems are based on signatures derived from the analysis of various types of malicious software. The proposed honeynet system is a combination of a post intrusion detection system and a files analyzer. It has been implemented using multi-agent technology. [ABSTRACT FROM AUTHOR]

Software keyloggers are a fast growing class of malware often used to harvest confidential information. One of the main reasons for this rapid growth is the possibility for unprivileged programs running in user space to eavesdrop and record all the keystrokes of the users of the system. Such an ability to run in unprivileged mode facilitates their implementation and distribution, but, at the same time, allows to understand and model their behavior in detail. Leveraging this property, we propose a new detection technique that simulates carefully crafted keystroke sequences (the bait) in input and observes the behavior of the keylogger in output to univocally identify it among all the running processes. We have prototyped and evaluated this technique with some of the most common free keyloggers. Experimental results are encouraging and confirm the viability of our approach in practical scenarios. [ABSTRACT FROM AUTHOR]

Malicious software (malware) infects large numbers of computers around the world. This malware can be used to promote unwanted products, disseminate offensive content, or provide unauthorized access to personal and financial information. Until recently mobile networks have been relatively isolated from the Internet, so there has been little need to protect them against Botnets. Mobile networks are now well integrated with the internet, so threats on the internet such as Botnets have started to migrate onto mobile networks. Botnets on mobile devices will probably appear very soon, there are already signs that this is happening. This paper studies the potential threat of Botnets based on mobile networks, and proposes the use of computational intelligence techniques to detect Botnets. We then simulate anomaly detection followed by an interpretation of the simulated values. [ABSTRACT FROM AUTHOR]

We present an approach for proactive malware detection working by abstraction of program behaviors. Our technique consists in abstracting program traces, by rewriting given subtraces into abstract symbols representing their functionality. Traces are captured dynamically by code instrumentation, which allows us to handle packed or self-modifying malware. Suspicious behaviors are detected by comparing trace abstractions to reference malicious behaviors. The expressive power of abstraction allows us to handle general suspicious behaviors rather than specific malware code and then, to detect malware mutations. We present and discuss an implementation validating our approach. [ABSTRACT FROM AUTHOR]

We present Andromaly - a behavioral-based detection framework for Android-powered mobile devices. The proposed framework realizes a Host-based Intrusion Detection System (HIDS) that continuously monitors various features and events obtained from the mobile device, and then applies Machine Learning methods to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we evaluated Andromaly΄s ability to differentiate between game and tool applications. Successful differentiation between games and tools is expected to provide a positive indication about the ability of such methods to learn and model the behavior of an Android application and potentially detect malicious applications. Several combinations of classification algorithms, feature selections and the number of top features were evaluated. Empirical results suggest that the proposed detection framework is effective in detecting types of applications having similar behavior, which is an indication for the ability to detect unknown malware in the Android framework. [ABSTRACT FROM AUTHOR]

Web 2.0 platforms are ubiquitously used to share content and personal information, which makes them an inviting and vulnerable target of hackers and phishers alike. In this paper, we discuss an emerging class of attacks, namely content repurposing attacks, which specifically targets sites that host user uploaded content on Web 2.0 sites. This latent threat is poorly addressed, if at all, by current protection systems, both at the remote sites and at the client ends. We design and develop an approach that protects from content repurposing attacks at the client end. As we show through a detailed evaluation, our solution promptly detects and stops various types of attacks and adds no overhead to the user΄s local machine or browser where it resides. Further, our approach is light-weight and does not invasively monitor all the user interactions with the browser, providing an effective protection against these new and powerful attacks. [ABSTRACT FROM AUTHOR]

There are many analysis techniques in order to analyze malicious codes. However, recently malicious codes often evade detection using stealthy obfuscation techniques, and attack computing systems. We propose an enhanced dynamic binary instrumentation using hardware-assisted virtualization technology. As a machine-level analyzer, our system can be isolated from almost the whole threats of malware, and provides single step analysis environment. Proposed system also supports rapid system call analysis environment. We implement our malware analysis system (referred as MAS) on the KVM hypervisor with Intel VT-x virtualization support. Our experiments with benchmarks show that the proposed system provides efficient analysis environment with low overhead. [ABSTRACT FROM AUTHOR]

Chapter 2 of the book "How to Stop E-Mail Spam, Spyware, and Computer Viruses from Ruining Your Computer: The Complete Guide for Your Home and Work" is presented. It discusses a short introduction to computer viruses, their symptoms, and various threats that Internet surfers have encountered. It also provides definitions to several types of computer viruses including program file viruses which also known as binary file viruses, companion viruses, and script-based viruses.

Chapter 1 of the book "How to Stop E-Mail Spam, Spyware, and Computer Viruses from Ruining Your Computer: The Complete Guide for Your Home and Work" is presented. It discusses definition for the term malware, which states that it is a malicious software that is created to destroy networks, servers, or computers. It also discusses the efforts made by the U.S. Department of Justice (DOJ) in implementing strategies in fighting intellectual property and computer crimes around the world.

Botnet has gained the most prevalence in today΄s cyber-attacks, resulting in significant threats to our network assets and organization΄s property. A botnet is composed of a group of bots and controlled by a botmaster, serving as a powerful tool to enforce various attacks, e.g., launching massive attacks like spamming and DDoS, stealing sensitive information. While a bunch of anti-bot techniques have been proposed, the evolution trend of botnets show that sophisticated botmasters can always manage to evade the botnet countermeasures. From the standpoint of potential attackers, and by examining the vulnerabilities of the existing botnets, this paper aims at exploring the means for hardening botnets, especially the obfuscation of communication channels between bot and botmaster. In particular, a stronger botnet variant named bot-enclave, is proposed to illustrate how the robustness of C&C (command-and-control) servers can be enhanced, and how the botnet communications can be protected from being tracked and intercepted. More practically, by identifying the trade off between botnet utility metrics, we show that the sophistication level of bot-enclave can be tuned up by a rational botmaster in order to construct more economical, feasible and effective botnet variants. The findings may significantly help us to gain insight into the characteristics of next-generation botnets, to be aware of the evolution trend before their actual occurrence, and ultimately to suggest the development of proactive anti-botnet techniques. [ABSTRACT FROM AUTHOR]

In the modern society the majority of information is stored and preserved on the digitalized storage medium. By the way, it is difficult to recognize that there are any adding, deleting, or changing of the records in the digitalized storage medium. In this paper, we suggest an evidence detection technique of malicious executable file installation on computer system using visualization of similarity between machine language sequences. Also suggested method can not only detect original malwares but also mutants of them. Besides, our method can help to reassemble the data blocks containing the fragments of the malicious file back into their proper sequences for securing legal evidences. [ABSTRACT FROM AUTHOR]

Critical Infrastructures are nowadays exposed to new kind of threats. The cause of such threats is related to the large number of new vulnerabilities and architectural weaknesses introduced by the extensive use of ICT and Network technologies into such complex critical systems. Of particular interest are the set of vulnerabilities related to the class of communication protocols normally known as ˵SCADA″ protocols, under which fall all the communication protocols used to remotely control the RTU devices of an industrial system. In this paper we present a proof of concept of the potential effects of a set of computer malware specifically designed and created in order to impact, by taking advantage of some vulnerabilities of the ModBUS protocol, on a typical Supervisory Control and Data Acquisition system. [ABSTRACT FROM AUTHOR]

In 2005, Sony-BMG used a rootkit to conceal the digital right management software, which is aptly installed in consumers΄ computers to prevent unauthorized copying. As a result, it lets the installed rootkit computers provide malware with excellent shelters to be capable of escaping anti-virus detection easily. We can observe that more and more malware writers are taking advantage of rootkits to shield their illegal activities. In this paper, we develop a new Windows driver-hidden rootkit with five tricks based on Direct Kernel Object Manipulation (DKOM), and have verified that it can successfully avoid well-known rootkit detectors. Our research goal is to find out the weaknesses of current detectors, and expect detector developers pay much attention to them and upgrade their products in order to identify the proposed new rookit. We affirm our efforts will be useful for stimulating detector developers to improve the current techniques of detecting Windows Driver-Hidden Rootkits. [ABSTRACT FROM AUTHOR]

The Asprox infection weaves a complex chain of dependencies involving bots that perform SQL injections on vulnerable web servers, and visitors whose machines get compromised simply by visiting infected websites. Using real-world data sets, we study Asprox bots, infected web servers, and the malicious infrastructure behind Asprox propagation. We find that the malware-propagation infrastructure in Asprox is aggressively provisioned to resist take-down efforts. This, combined with the easy availability of vulnerable user machines and web servers whose administrators are probably constrained in time and resources necessary to fix the problem, indicates that cleaning up Asprox infections is not going to be easy. [ABSTRACT FROM AUTHOR]

Malware detectors are applications that attempt to identify and block malicious programs. Unfortunately, malware detectors might not always be able to preemptively block a malicious program from infecting the system (e.g., when the signatures database is not promptly updated). In these situations, the only way to eradicate the infection without having to reinstall the entire system is to rely on the remediation capabilities of the detectors. Therefore, it is essential to evaluate the efficacy and accuracy of anti-malware software in such situations. This paper presents a testing methodology to assess the quality (completeness) of the remediation procedures used by malware detectors to revert the effect of an infection from a compromised system. To evaluate the efficacy of our testing methodology, we developed a prototype and used it to test six of the top-rated commercial malware detectors currently available on the market. The results of our evaluation witness that in many situations the tested malware detectors fail to completely remove the effects of an infection. [ABSTRACT FROM AUTHOR]

Distributed systems are widely deployed in industries where high computational capability and low cost are required. Distributed software architecture is very important in the distributed system. However, since most distributed systems are designed based on a network structure, distributed software is very vulnerable to malware attacks. Due to the popularity of distributed system, it is vital to study the effects of malware attack on distributed systems. In this paper, we studied the malware attack behaviors by a Markov process model. The states of the object homogeneous distributed system can be derived by analyzing the Markov model, with which the service reliability and service availability can be further obtained. An illustrative demonstration is also presented. [ABSTRACT FROM AUTHOR]

Malicious web sites perform drive-by download attacks to infect their visitors with malware. Current protection approaches rely on black- or white-listing techniques that are difficult to keep up-to-date. As todays drive-by attacks already employ encryption to evade network level detection we propose a series of techniques that can be implemented in web browsers to protect the user from such threats. In addition, we discuss challenges and open problems that these mechanisms face in order to be effective and efficient. [ABSTRACT FROM AUTHOR]

Most behavioral detectors of malware remain specific to a given language and platform, mostly executables for Windows. The objective of this paper is to define a generic approach for behavioral detection based on two layers respectively responsible for abstraction and detection. The abstraction layer is specific to a platform and a language. It interprets the collected instructions, API calls and arguments and classifies these operations, as well as the objects involved, according to their purpose in the malware lifecycle. The detection layer remains generic and interoperable with different abstraction components. It relies on parallel automata parsing attribute-grammars where semantic rules are used for object typing (object classification) and object binding (data-flow). Theoretical results are first given with respect to the grammatical constraints weighting on the signature construction as well as to the resulting complexity of the detection. For experimentation purposes, two abstraction components have then been developed: one processing system call traces and the other processing the VBScript interpreted language. Experimentations have provided promising detection rates, in particular for scripts (89%), with almost no false positives. In the case of process traces, the detection rate remains significant (51%) but could be increased by sophisticated collection tools. [ABSTRACT FROM AUTHOR]

We address the semantic gap problem in behavioral monitoring by using hierarchical behavior graphs to infer high-level behaviors from myriad low-level events. Our experimental system traces the execution of a process, performing data-flow analysis to identify meaningful actions such as ˵proxying″, ˵keystroke logging″, ˵data leaking″, and ˵downloading and executing a program″ from complex combinations of rudimentary system calls. To preemptively address evasive malware behavior, our specifications are carefully crafted to detect alternative sequences of events that achieve the same high-level goal. We tested eleven benign programs, variants from seven malicious bot families, four trojans, and three mass-mailing worms and found that we were able to thoroughly identify high-level behaviors across this diverse code base. Moreover, we effectively distinguished malicious execution of high-level behaviors from benign by identifying remotely-initiated actions. [ABSTRACT FROM AUTHOR]

Malware is at the root of a large number of information security breaches. Despite widespread effort devoted to combating malware, current techniques have proven to be insufficient in stemming the incessant growth in malware attacks. In this paper, we describe a tool that exploits a combination of virtualized (isolated) execution environments and dynamic binary instrumentation (DBI) to detect malicious software and prevent its execution. We define two isolated environments: (i) a Testing environment, wherein an untrusted program is traced during execution using DBI and subjected to rigorous checks against extensive security policies that express behavioral patterns of malicious software, and (ii) a Real environment, wherein a program is subjected to run-time monitoring using a behavioral model (in place of the security policies), along with a continuous learning process, in order to prevent non-permissible behavior. We have evaluated the proposed methodology on both Linux and Windows XP operating systems, using several virus benchmarks as well as obfuscated versions thereof. Experiments demonstrate that our approach achieves almost complete coverage for original and obfuscated viruses. Average execution times go up to 28.57X and 1.23X in the Testing and Real environments, respectively. The high overhead imposed in the Testing environment does not create a severe impediment since it occurs only once and is transparent to the user. Users are only affected by the overhead imposed in the Real environment. We believe that our approach has the potential to improve on the state-of-the-art in malware detection, offering improved accuracy with low performance penalty. [ABSTRACT FROM AUTHOR]

To date, much work has been focused on localization in wireless sensor networks and lots of algorithms have been proposed. Most of these algorithms use the reference points to aid the location estimation of unknown nodes. References such as beacon nodes are those whose positions are previously configured or can be acquired via location sensing device, such as GPS. However, most of the previous localization algorithms assume all nodes of the network are cooperative to perform localization. If malicious beacons appear in a wireless sensor networks, none of these algorithms works well. In this paper, we focus on the malicious beacon detection for node localization and propose a simple scheme to approximately detect the malicious beacons and revoke them when localizing. Our scheme uses RSSI measurement information to compute the different RSS values of beacons and exclude the malicious ones. Simulation shows our scheme can effectively differentiate the malicious beacons and get a location accuracy very close to non-malicious beacon environment. [ABSTRACT FROM AUTHOR]

Anti-Malware Engineering Workshop 2009 provided a common dataset for all the authors there. In order to understand research-promotion effects in the network-security community, we evaluate the dataset through observations and a questionnaire. [ABSTRACT FROM AUTHOR]

A definition of the term "worm" is presented. A form of malware, it refers to the malicious software applications that are designed to spread via computer networks. Worms, once installed on a computer, spontaneously generate additional electronic mail messages containing copies of the worm. In addition, they may open TCP ports to create network security holes or other applications.

A definition of the computer security term "zoo" is presented. It refers to a collection of viruses and worms that exist only in virus and anti-virus laboratories. These are used to proactively study how malware programs are written and distributed.

A definition of the term "Virus" is presented. It refers to a self-replicating part of computer software, which is usually malicious logic, that propagates by infecting another program. Based on the entry, a computer virus could not work by itself, meaning it needs its host program be run to make the virus active.

A definition of the term "Trojan" is presented. It refers to a form of malware that often can do considerable damage to a system or network.

An encyclopedia entry for "Signature Detection" in information security is presented. It is a technique frequently used in the Intrusion Detection System and other anti-malware systems like anti-virus and anti-spyware. Under the technique, the network or system information is scanned against known attack or malware signature database.

An encyclopedia entry for "Script Vulnerability" is presented. Script vulnerabilities refer to problems associated with malicious codes like Trojans, backdoors and logical bombs. Scripts downloaded from the Internet are susceptible to such problems.

A definition of the term "Program Infector" is presented. It refers to a piece of malware that attaches itself to existing program files.

A definition of the term "Malware" used in relation to computer security is presented. It is a generic term for different kinds of malicious code, such as spyware, computer virus, trojan horse and others.

A definition of the term "Malicious Code" is presented. It refers to software, such as Trojan horse or spyware, that appears to perform a useful or desirable function, but actually gains unauthorized access to system resources or tricks a user into executing other malicious logic.

A definition of the term "knark," in relation to computer security, is presented. It refers to a rootkit that targets the Linux operating system.

A definition of the term "Hijackware" is presented. It is also known as browser hijacker. It refers to a type of malware program that alters a computer's browser settings so that the user is redirected to Web sites that he had no intention of visiting. A lot of browser hijackers alter default home pages and search pages to those of their customers, who pay for that service because of the traffic it generates.

An encyclopedia entry for the "European Institute of Computer Anti-Virus Research" is presented. It refers to an organization founded in 1990 whose mission is to enhance antivirus research and improve development of antivirus software. The organization's research covers malicious software and other computer viruses. It is well known for its Eicar test file.

An encyclopedia entry for browser hijacker is presented. It is a type of malware program that alters one's browser settings so that the user is redirected to Web sites that an individual had no intention of visiting. According to the article, most browser hijackers alter default home pages and search pages to those of their customers who pay for that service because of the traffic it generates.

A definition of the term "Boot Record Infector" is presented. It refers to a piece of malware that inserts malicious code into the boot sector of a disk.

A definition of the term "Behavior Blocking Software" is presented. It is also known as sandboxing and it refers to a type of software that detects and prevents suspicious behavior from being executed on a system. This software also monitors the actions of malicious software and stops it before it delete files and settings.

A definition of the term "Arbitrary Code Execution Attack" is presented. It refers to a type of attack that enables an intruder to run arbitrary code on the target machine.

A definition of the term "Anti-Adware" is presented. It refers to a software that identifies and removes adware, spyware, keyloggers, trojans and other malicious codes. A number of adware programs are undetectable to anti-virus software, prompting computer users to install anti-adware along with anti-virus software.

A definition of the term "Amplification Attack" is presented. It refers to any type of attack that magnifies the effect of a single attacking host.