Networking Chapter 4 Reinforcementproblem Salamislicing Attack Program Performs Large Number Small Hardly Noticeablemalicious Actions

Unlock access to all the studying documents.

View Full Document

Chapter 4

Reinforcement

Problem R-4.1

In a salami-slicing attack, a program performs a large number of small, hardly noticeable

malicious actions, which add up to a large aggregate malicious action. In a classic example,

a programmer for a bank has 1 cent of the monthly interest calculation on each bank

customer’s account transfered into his account. Thus, if the bank has 1,000,000 customers,

then this programmer would get $10,000 each month from this salami slicing attack. What

type of malware is such a program?

Problem R-4.2

In the Tim Lloyd logic bomb attack on Omega Engineering, what type of vulnerability was

the existence of the user, “12345,” an example of?

Problem R-4.3

Viruses that perform no explicit malicious behaviors are called bacteria or rabbits. Explain

how such seemingly benign viruses can still have negative impacts on computer systems.

Problem R-4.6

Bobby says that a computer virus ate his homework, which was saved as a Word document.

What kind of virus is the most likely culprit?

Problem R-4.7

Dwight has a computer game, StarGazer, which he plays at work. StarGazer has a secret

feature—it pops up an image of a spreadsheet on the screen any time he hits Shift-T on his

keyboard, so that it looks like the user is actually working. Dwight uses this feature any

time his boss walks by while he is playing StarGazer. What is this “feature” of StarGazer

called?

Problem R-4.8

There was an email joke chain letter that called itself the Amish virus. It stated that its

author had no computer available in order to write it; hence, it can’t run as an executable

program or document macro. Instead, it asked the recipient to forward the Amish virus to

several friends and then randomly delete some files on his or her hard drive. Is the Amish

virus a true email virus? Why or why not?

Problem R-4.10

Explain why it is often beneficial for an adware author to include spyware in his adware.

Problem R-4.11

Jack encrypts all his email and insists that everyone who sends him email encrypt it as well.

What kind of spyware attack is Jack trying to avoid?

Problem R-4.12

Pam’s boss, Alan, says that she needs to write her software so that it is protected against

the security risks of today and tomorrow. How is this even possible, given that we don’t

even know what the security risks of tomorrow are?

Problem R-4.13

Eve installed some spyware software on 100 USB ﬂash drives and has designed this software

to autoload from these drives along with some nude photos. She then painted the logo of

a well-known adult magazine on each one and randomly scattered these ﬂash drives in the

parking lots of several of the big defense companies in her town. What type of malware

attack is this and what vulnerability is she trying to exploit in order to get her malware

code past the network firewalls of these companies?

Problem R-4.14

XYZ Company has just designed a new web browser and they are initiating a major market-

ing campaign to get this browser to become the exclusive browser used by everyone on the

Internet. Why would you expect a reduction in Internet security if this marketing campaign

succeeds?

Problem R-4.15

What would be the financial advantage for a malware designer to create lots of different

malicious code instances that all exploit the same vulnerability yet have different malware

signatures?

Creativity

Problem C-4.1

Explain why any computer worm that operates without human intervention is likely to

either be self-defeating or inherently detectable.

Problem C-4.2

Describe a malware attack that causes the victim to receive physical advertisements.

Problem C-4.3

You are given the task of detecting the occurrences of a polymorphic virus that conceals

itself as follows. The body, C, of the virus code is obfuscated by XORing it with a byte

sequence, T, derived from a six-byte secret key, K, that changes from instance to instance

of the virus in a random way. The sequence Tis derived by merely repeating over and over

the given key K. The length of the body of the virus code is a multiple of six—padding is

added otherwise. Thus, the obfuscated body is T⊕C, where T=K||K|| · · · and || denotes

string concatenation. The virus inserts itself to the infected program at an unpredictable

location. @par An infected file contains a loader that reads the key K, unhides the body

Cof the virus code by XORing the obfuscated version with the sequence T(derived from

K), and finally launches C. The loader code, key K, and the obfuscated body are inserted

at random positions of infected programs. At some point of the execution of the infected

program, the loader gets called, which unhides the virus and then executes it. Assume that

you have obtained the body Cof the virus code and a set of programs that are suspected to

be infected. You want to detect the occurrences of this virus among the suspected programs

without having to actually emulate the execution of the programs. Give an algorithm to do

this in polynomial time in the length of the program. Assume that the loader of the virus

is a short piece of code that can be commonly found in legitimate programs. Therefore, it

cannot be used as a signature of our virus. Hence, looking for the loader is not an acceptable

solution. Remember, the loader is in binary, and as such, extracting information from it is

nontrivial, i.e., wrong.

Solution Take the virus code Cand xor repeated copies of it with the body of the

Problem C-4.4

Suppose there is a new computer virus, H1NQ, which is both polymorphic and metamorphic.

Mike has a new malware-detection program, QSniffer, that is 95% accurate at detecting

H1NQ. That is, if a computer is infected with H1NQ, then QSniffer will correctly detect

this fact 95% of the time, and if a computer is not infected, then QSniffer will correctly

detect this fact 95% of the time. It turns out that the H1NQ virus will only infect any

given computer with a probability of 1%. Nevertheless, you are nervous and run QSniffer

on your computer, and it unfortunately says that your computer is infected with H1NQ.

What is the probability that your computer really is infected?

Solution Think of a campus of 2000 computers. By the properties of H1NQ, 20 of these

Problem C-4.5

Like a computer virus, a quine is a computer program that copies itself. But, unlike a

virus, a quine outputs a copy of its source code when it is run, rather than its object code.

Give an example of a quine in Java, C, or some other high-level language.

Problem C-4.6

In accepting the ACM Turing Award, Ken Thompson described a devious Trojan horse

attack on a Unix system, which most people now refer to as Thompson’s rigged compiler.

This attack first changes the binary version of the login program to add a backdoor, say,

to allow a new user, 12345, that has password, 67890, which is never checked against the

password file. Thus, the attacker can always login to this computer using this username

and password. Then the attack changes the binary version of the C compiler, so that it first

checks if it is compiling the source code for the login program, and, if so, it reinserts the

backdoor in the binary version. Thus, a system administrator cannot remove this Trojan

horse simply by recompiling the login program. In fact, the attack goes a step further, so

that the C compiler also checks if it is compiling the source code of the C compiler itself,

and, if so, it inserts the extra code that reinserts the backdoor for when it is compiling the

examines the source code for the login program or the C compiler, they won’t notice that

anything is wrong. Now suppose your Unix system has been compromised in this way

(which you confirm by logging in as 12345). How can you fix it, without using any outside

resources (like a fresh copy of the operating system)?

Solution One solution is to edit the source code for the C compiler, changing variable

names, reordering independent code fragments, and introducing useless code. That is, you

Problem C-4.8

Suppose you want to use an Internet cafe to login to your personal account on a bank web

site, but you suspect that the computers in this cafe are infected with software keyloggers.

Assuming that you can have both a web browser window and a text editing window open

at the same time, describe a scheme that allows you to type in your userID and password

so that a keylogger, used in isolation of any screen captures or mouse event captures, would

not be able to discover your userID and password.

Solution Open both the web browser, pointing to your bank’s login page, and a text

Problem C-4.9

Suppose that a metamorphic virus, DoomShift, is 99% useless bytes and 1% useful bytes.

Unfortunately, DoomShift has infected the login program on your Unix system and increased

its size from 54K bytes to 1,054K bytes; hence, 1,000K bytes of the login program now

consists of the DoomShift virus. Barb has a cleanup program, DoomSweep, that is able

to prune away the useless bytes of the DoomShift virus, so that in any infected file it will

consist of 98% useless bytes and 2% useful bytes. If you apply DoomSweep to the infected

Problem C-4.10

Each time a malware designer, Pierre, sells a product on a chat server in the underground

economy for fraudulent products and services, there is a chance that he will get caught and

be fined by law enforcement officials. Suppose the probability that Pierre will get caught

because of any one sale of malware is p, and this value is known to both Pierre and the law

enforcement officials. What should be the minimum fine for selling a keystroke logger so

that it is not worth the effort for a rational malware designer like Pierre to sell it? What

about the minimum fine for selling a botnet?