COMPUTER VIRUSES: FROM THEORY TO APPLICATIONS
CONTENTS PART I - GENESIS AND THEORY OF COMPUTER VIRUSES INTRODUCTION THE FORMALIZATION FOUNDATIONS 2 1 INTRODUCTION 2 2 TURING MACHINES 2 2 1 TURING MACHINES AND RECURSIVE FUNCTIONS 2 2 2 UNIVERSAL TURING MACHINE 2 2 3 THE HALTING PROBLEM AND DECIDABILITY 2 2 4 RECURSIVE FUNCTIONS AND VIRUSES 2 3 SELF-REPRODUCING AUTOMATA 2 3 1 THE MATHEMATICAL MODEL OF VON NEUMANN AUTOMATA 2 3 2 VON NEUMANN’S SELF-REPRODUCING AUTOMATON 2 3 3 THE LANGTON’S SELF-REPRODUCING LOOP EXERCISES STUDY PROJECTS STUDY OF THE HERMAN’S THEOREM CODD AUTOMATA IMPLEMENTATION F COHEN AND L ADLEMAN’S FORMALIZATION 3 1 INTRODUCTION 3 2 FRED COHEN’S FORMALIZATION 3 2 1 BASIC CONCEPTS AND NOTATIONS 3 2 2 FORMAL DE?NITION OF VIRUSES 3 2 3 STUDY AND BASIC PROPERTIES OF VIRAL SETS 3 2 4 COMPUTABILITY ASPECTS OF VIRUSES AND VIRAL DETECTION 3 2 5 PREVENTION AND PROTECTION MODELS 3 2 6 EXPERIMENTS WITH COMPUTER VIRUSES AND RESULTS 3 3 LEONARD ADLEMAN’S FORMALIZATION 3 3 1 NOTATION AND BASIC DE?NITIONS 3 3 2 TYPES OF VIRUSES AND MALWARE 3 3 3 THE COMPLEXITY OF VIRAL DETECTION 3 3 4 STUDYING THE ISOLATION MODEL 3 4 CONCLUSION IMPLEMENTATION OF THE THEOREM 8 MACHINE IMPLEMENTATION OF MACHINE DESCRIBED IN THEOREM 11 TAXONOMY, TECHNIQUES AND TOOLS 4 1 INTRODUCTION 4 2 GENERAL ASPECTS OF COMPUTER INFECTION PROGRAMS 4 2 1 DE?NITIONS AND BASIC CONCEPTS 4 2 2 ACTION CHART OF VIRUSES OR WORMS 4 2 3 VIRUSES OR WORMS LIFE CYCLE 4 2 4 ANALOGY BETWEEN BIOLOGICAL AND COMPUTER VIRUSES 4 2 5 NUMERICAL DATA AND INDICES 4 2 6 DESIGNING MALWARE 4 3 NON SELF-REPRODUCING MALWARE (EPEIAN) 4 3 1 LOGIC BOMBS 4 3 2 TROJAN HORSE AND LURE PROGRAMS 4 4 HOW DO VIRUSES OPERATE? 4 4 1 OVERWRITING VIRUSES 4 4 2 ADDING VIRAL CODE: APPENDERS AND PREPENDERS 4 4 3 CODE INTERLACING INFECTION OR HOLE CAVITY INFECTION 4 4 4 COMPANION VIRUSES 4 4 5 SOURCE CODE VIRUSES 4 4 6 ANTI-ANTIVIRAL TECHNIQUES 4 5 VIRUS AND WORMS CLASSI?CATION 4 5 1 VIRUSES NOMENCLATURE 4 5 2 WORMS NOMENCLATURE 4 6 TOOLS IN COMPUTER VIROLOGY FIGHTING AGAINST VIRUSES 5 1 INTRODUCTION 5 2 PROTECTING AGAINST VIRAL INFECTIONS 5 2 1 ANTIVIRAL TECHNIQUES 5 2 2 ASSESSING OF THE COST OF VIRAL ATTACKS 5 2 3 COMPUTER “HYGIENE RULES” 5 2 4 WHAT TO DO IN CASE OF A MALWARE ATTACK 5 2 5 CONCLUSION 5 3 LEGAL ASPECTS INHERENT TO COMPUTER VIROLOGY 5 3 1 THE CURRENT SITUATION 5 3 2 EVOLUTION OF THE LEGAL FRAMEWORK : THE LAW DEALING WITH E-ECONOMY SECOND PART - COMPUTER VIRUSES BY PROGRAMMING COMPUTER VIRUSES IN INTERPRETED PROGRAMMING LANGUAGE 7 1 INTRODUCTION 7 2 DESIGN OF A SHELL BASH VIRUS UNDER LINUX 7 2 1 FIGHTING OVERINFECTION 7 2 2 ANTI-ANTIVIRAL FIGHTING: POLYMORPHISM 7 2 3 INCREASING THE VBASH INFECTIVE POWER 7 2 4 INCLUDING A PAYLOAD 7 3 SOME REAL-WORLD EXAMPLES 7 3 1 THE UNIX OWR VIRUS 7 3 2 THE UNIX HEAD VIRUS 7 3 3 THE UNIX COCO VIRUS 7 3 4 THE UNIX BASH VIRUS 7 4 CONCLUSION A PERL ENCRYPTED VIRUS DISINFECTION SCRIPTS COMPANION VIRUSES 8 1 INTRODUCTION 8 2 THE VCOMP EX COMPANION VIRUS 8 2 1 ANALYSIS OF THE VCOMP EX VIRUS 8 2 2 WEAKNESSES AND FLAWS OF THE VCOMP EX VIRUS 8 3 OPTIMIZED AND STEALTH VERSIONS OF THE VCOMP EX VIRUS 8 3 1 THE VCOMP EX V1 VARIANT 8 3 2 THE VCOMP EX V2 VARIANT 8 3 3 CONCLUSION 8 4 THE VCOMP EX V3 COMPANION VIRUS 8 5 A HYBRID COMPANION VIRUS: THE UNIX SATYR VIRUS CASE 8 5 1 GENERAL DESCRIPTION OF THE UNIX SATYR VIRUS 8 5 2 DETAILED ANALYSIS OF THE UNIX SATYR SOURCE CODE 8 6 CONCLUSION BYPASSING INTEGRITY CHECKING BYPASSING OF THE RPM SIGNATURE CHECKING PASSWORD WIRETAPPING WORMS 9 1 INTRODUCTION 9 2 THE INTERNET WORM 9 2 1 THE ACTION OF THE INTERNET WORM 9 2 2 HOW THE INTERNET WORM OPERATED 9 2 3 DEALING WITH THE CRISIS 9 3 IIS WORM CODE ANALYSIS 9 3 1 BU?ER OVER?OWS 9 3 2 IIS VULNERABILITY AND BU?ER OVER?OW 9 3 3 DETAILED ANALYSIS OF THE SOURCE CODE 9 3 4 CONCLUSION 9 4 XANAX WORM CODE SOURCE ANALYSIS 9 4 1 MAIN SPREADING MECHANISMS: INFECTING E-MAILS 9 4 2 EXECUTABLE FILES INFECTION 9 4 3 SPREADING VIA THE IRC CHANNELS 9 4 4 FINAL ACTION OF THE WORM 9 4 5 THE VARIOUS PROCEDURES OF THE WORM 9 4 6 CONCLUSION 9 5 ANALYSIS OF THE UNIX LOVELETTER WORM 9 5 1 VARIABLES AND PROCEDURES 9 5 2 HOW THE WORM OPERATES 9 6 CONCLUSION APACHE WORM CODE ANALYSIS RAMEN WORM CODE ANALYSIS THIRD PART - COMPUTER VIRUSES AND APPLICATIONS 10 INTRODUCTION 11 COMPUTER VIRUSES AND APPLICATIONS 11 1 INTRODUCTION 11 2 THE STATE OF THE ART 11 2 1 THE XEROX WORM 11 2 2 THE KOH VIRUS 11 2 3 MILITARY APPLICATIONS 11 3 FIGHTING AGAINST CRIME 11 4 ENVIRONMENTAL CRYPTOGRAPHIC KEY GENERATION 11 5 CONCLUSION 12 BIOS VIRUSES 12 1 INTRODUCTION 12 2 BIOS STRUCTURE AND WORKING 12 2 1 DISASSEMBLY AND ANALYSIS OF THE BIOS CODE 12 2 2 DETAILED ANALYSIS OF THE BIOS CODE 12 3 VBIOS VIRUS DESCRIPTION 12 3 1 VIRAL BOOT SECTOR CONCEPT 12 4 INSTALLATION OF VBIOS 12 5 FUTURE PROSPECTS AND CONCLUSION 13 APPLIED CRYPTANALYSIS OF CIPHER SYSTEMS 13 1 INTRODUCTION 13 2 GENERAL DESCRIPTION OF BOTH THE VIRUS AND THE ATTACK 13 2 1 THE VIRUS V1: THE FIRST INFECTION LEVEL 13 2 2 THE VIRUS V2: THE SECOND INFECTION LEVEL 13 2 3 THE VIRUS V2: THE APPLIED CRYPTANALYSIS STEP 13 3 DETAILED ANALYSIS OF THE YMUN20 VIRUS 13 3 1 THE ATTACK CONTEXT 13 3 2 THE YMUN20-V1 VIRUS 13 3 3 THE YMUN20-V2 VIRUS 13 4 CONCLUSION STUDY PROJECT IMPLEMENTING THE YMUN20 VIRUS CONCLUSION 14 CONCLUSION 385WARNING ABOUT THE CDROM REFERENCES SKETCH OF A TURING MACHINE VON NEUMANN’S NEIGHBORHOOD VON NEUMANN’S SELF-REPRODUCING AUTOMATA DIAGRAM LUDWIG’S SELF-REPRODUCING AUTOMATON FORMAL DE?NITION OF A VIRAL SET GRAPHICAL ILLUSTRATION OF THE VIRUS FORMAL DE?NITION FLOW MODEL WITH A THRESHOLD OF 1 ?N AND ?N CLASSES AND THEIR RESPECTIVE HIERARCHY TAXONOMY OF MALWARE DISTRIBUTION OF MALWARE (JANUARY 2002) ACTION MECHANISMS OF A TROJAN HORSE OVERWRITING MODE OF INFECTION ADDING VIRAL CODE: THE APPENDER CASE STRUCTURE OF A PE EXECUTABLE FILE INFECTION BY CODE INTERLACING (PE ?LE) COMPANION VIRUS INFECTION MODE SOURCE CODE INFECTION 4 10 NUMBER OF MACRO-VIRUS ALERTS (SOURCE: FRENCH CIVIL SERVICE) 4 11 NUMBER OF SERVERS INFECTED BY THE CODERED WORM AS A TIME FUNCTION (SOURCE [111]) 4 12 NUMBER OF HOSTS INFECTED BY THE CODRED WORM PER MINUTE (SOURCE [111]) 4 13 DISTRIBUTION OF THE SERVERS INFECTED BY THE SAPPHIRE/SLAMMER WORM (H + 30 MINUTES) THE DIAMETER OF EACH BLUE CIRCLE IS RELATIVE TO THE LOGARITHM OF THE NUMBER OF LOCALLY INFECTED SERVERS (SOURCE: [112]) 4 14 EVOLUTION OF THE W32/BUGBEAR-A WORM ATTACK (OCT 2002 - SOURCE J -L CASEY) 4 15 EVOLUTION DOF THE W32/NETSKY-P AND W32/NETSKY-P WORMS ATTACKS (JULY - AUGUST 2004) VBASHP INFECTION VCOMP EX VIRUS INFECTION PRINCIPLE ORGANIZATION OF THE EXAMPLE1 PROGRAM STACK IIS WORM OVER?OW CODE STRUCTURE IIS WORM CODE ORGANIZATION XANAX WORM PAYLAOD 13 1 FUNCTIONAL FLOWCHART OF YMUN-V1 VIRUS 13 2 FUNCTIONAL FLOWCHART OF YMUN-V2 VIRUS (INFECTION STEP) 13 3 FUNCTIONAL FLOWCHART OF YMUN-V2 VIRUS (PAYLOAD) 13 4 INFECTION WITH YMUN20-V1 VIRUS 13 5 YMUN20-V1 VIRUS ACTION 13 6 FUNCTIONAL FLOWCHART OF THE YMUN20-V2 VIRUS AN SIMPLE EXAMPLE OF VIRAL CODE TURING MACHINE COMPUTING THE SUM OF TWO INTEGERS TRANSITION FUNCTION TABLE FOR LANGTON’S SELF-REPRODUCING LOOP INITIAL STATE OF LANGTON’S SELF-REPRODUCING LOOP BYL’S AUTOMATA INITIAL STATES BYL1 TRANSITION FUNCTION TABLE BYLE2 TRANSITION FUNCTION TABLE ANALOGY BETWEEN BIOLOGICAL VIRUSES AND COMPUTER VIRUSES PORTS AND PROTOCOLS USED BY THE MOST FAMOUS TROJAN HORSES FORMATS THAT MAY CONTAIN DOCUMENTS VIRUSES DISTRIBUTION OF MAIN MACRO-VIRUSES TYPES SOURCE CODE OF THE VBASH VIRUS VBASHP VIRUS : RESTORING FUNCTION VBASHP OVERINFECTION MANAGEMENT (MVB ?RST PART) VBASHP VIRUS: INFECTION (MVB END) THE UNIX OWR VIRUS SOURCE CODE THE UNIX HEAD VIRUS THE UNIX COCO VIRUS THE UNIX BASH (BEGINNING) THE UNIX BASH (END) FILE TYPE AND FILE PERMISSION FLAGS IN OCTAL POSSIBLE VALUES FOR THE FLAG ARGUMENT OF THE FTW FUNCTION 11 1 BLING AGENT FOR DATA SEARCH 12 1 MBR LAYOUT AND STRUCTURE 12 2 PARTITION ENTRY STRUCTURE AND LAYOUT (PART OF MBR) 12 3 OS BOOT SECTOR STRUCTURE AND LAYOUT