The Experts below are selected from a list of 141 Experts worldwide ranked by ideXlab platform
Julian Rrushi - One of the best experts on this subject based on the ideXlab platform.
-
On Second-Order Detection of Webcam Spyware
2020 3rd International Conference on Information and Computer Technologies (ICICT), 2020Co-Authors: Haissam Badih, Benjamin Bond, Julian RrushiAbstract:Second-order detection of malware is frequently more effective than traditional malware detection in that it operates on the basis of a heavily influenced malware behavior. In this paper, we advance second-order detection of webcam spyware through an approach that aims at reaching their behavior at a greater than before depth. We propose decoy user space activity, along with a case study of it, namely a decoy security protocol, to involve malware in a series of interactions that lead them towards accessing a decoy I/O device, i.e. a decoy webcam in this case. In practical terms, decoy user space activity is delivered by a coherent ensemble of decoy I/O devices and decoy processes. This work makes decoy user space activity and decoy I/O indistinguishable from their real counterparts, and therefore increases uncertainty in malware operations on a Compromised Machine to benefit their detection.
-
ICICT - On Second-Order Detection of Webcam Spyware
2020 3rd International Conference on Information and Computer Technologies (ICICT), 2020Co-Authors: Haissam Badih, Benjamin Bond, Julian RrushiAbstract:Second-order detection of malware is frequently more effective than traditional malware detection in that it operates on the basis of a heavily influenced malware behavior. In this paper, we advance second-order detection of webcam spyware through an approach that aims at reaching their behavior at a greater than before depth. We propose decoy user space activity, along with a case study of it, namely a decoy security protocol, to involve malware in a series of interactions that lead them towards accessing a decoy I/O device, i.e. a decoy webcam in this case. In practical terms, decoy user space activity is delivered by a coherent ensemble of decoy I/O devices and decoy processes. This work makes decoy user space activity and decoy I/O indistinguishable from their real counterparts, and therefore increases uncertainty in malware operations on a Compromised Machine to benefit their detection.
-
Machine Learning and Recognition of User Tasks for Malware Detection
2019 First IEEE International Conference on Trust Privacy and Security in Intelligent Systems and Applications (TPS-ISA), 2019Co-Authors: Yasamin Alagrash, Nithasha Mohan, Sandhya Rani Gollapalli, Julian RrushiAbstract:Malware often act on a Compromised Machine with the identifier of a legitimate user. We analyzed numerous malware and user tasks, and found subtle differences between how the two operate on a Machine. We have developed a Machine learning approach that characterizes user tasks through their resource utilization. We have found that many routine user tasks retain their resource utilization patterns, despite the occurrence of new dynamics each time a user carries out those tasks. On the other hand, upon landing on a target Machine, malware perform a substantial amount of work to explore the Machine and discover resources that are of interest to threat actors. Our approach collects live performance counter data from the operating system kernel, and subsequently pre-processes and analyzes those data to learn and then recognize the resource utilization of a task. We develop decoy process mechanisms that camouflage performance counter data to prevent malware from learning the resource utilization of a user task. We tested our approach against both legitimate users in real-world work settings and malware samples, and discuss our findings in the paper.
-
On Sustaining Prolonged Interaction with Attackers
2017 IEEE 15th Intl Conf on Dependable Autonomic and Secure Computing 15th Intl Conf on Pervasive Intelligence and Computing 3rd Intl Conf on Big Data, 2017Co-Authors: Roberto M. Vergaray, Julian RrushiAbstract:Webcams are commonly used by advanced malware to spy on computer users. Victims are silently filmed without their knowledge for extended periods of time. Recent attack trends show that webcam video covertly recorded by malware is used beyond the boundaries of the cyber domain, and thus is combined with human factors. The Delilah malware, for example, lurks on a Compromised Machine while using the webcam to capture details about family, work, social connections, and any other element involved in the life of a target user. The attackers then blackmail the target user with the goal of turning him/her into an insider threat to his/her employer. The attackers ask the victim to give them industrial secrets in return for not disclosing video that is highly sensitive to him/her. In this paper we discuss an approach that enables the defender to sustain prolonged interaction with attackers for defensive and forensics purposes. The approach uses a decoy webcam on Machines in production. It relies on a decoy video traffic injector module, as well as on the learning of the operational dynamics of real webcams. A webcam shadowing mechanism alternates between the real webcam and the decoy webcam. That mechanism causes malware to target the decoy webcam, but still enables the user to only see and hence use the real webcam. The approach can feed decoy webcam traffic into the data stream that malware intercept and send to attackers. The decoy webcam is robust to probes, and is able to coexist with production functions.
-
DNIC Architectural Developments for 0-Knowledge Detection of OPC Malware
IEEE Transactions on Dependable and Secure Computing, 1Co-Authors: Julian RrushiAbstract:We present an anti-malware solution that is able to reliably detect Object Linking and Embedding for Process Control (OPC) malware on Machines in production. Detection is attained on the very first encounter with OPC malware and hence without any prior knowledge of their code and data. We architected the integration of a decoy network interface controller (DNIC) with a layer of kernel code that emulates a target OPC Machine. A DNIC displays a (nonexistent) network, which the Compromised Machine appears to be connected to. OPC emulation displays a valid (but nonexistent) target OPC Machine, which appears to be reachable from the Compromised Machine over the (nonexistent) network. Our code intercepts OPC malware during their search for target Machines over the network. Its overall architecture is crafted to validate infection by leveraging OPC protocol mechanics. The same principles of operation are used to recognize goodware that access a DNIC by accident. Safe co-existence with production functions and real I/O devices is ensured by a monitor filter driver, which removes all decoy data bound for the monitor. We tested our DNIC architectural developments against numerous OPC malware samples involved in the Dragonfly cyber espionage campaign, and discuss the findings in the paper.
Kirill Levchenko - One of the best experts on this subject based on the ideXlab platform.
-
IEEE Symposium on Security and Privacy - To Catch a Ratter: Monitoring the Behavior of Amateur DarkComet RAT Operators in the Wild
2017 IEEE Symposium on Security and Privacy (SP), 2017Co-Authors: Brown Farinholt, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Stevens Le Blond, Damon Mccoy, Kirill LevchenkoAbstract:Remote Access Trojans (RATs) give remote attackers interactive control over a Compromised Machine. Unlike large-scale malware such as botnets, a RAT is controlled individually by a human operator interacting with the Compromised Machine remotely. The versatility of RATs makes them attractive to actors of all levels of sophistication: they've been used for espionage, information theft, voyeurism and extortion. Despite their increasing use, there are still major gaps in our understanding of RATs and their operators, including motives, intentions, procedures, and weak points where defenses might be most effective. In this work we study the use of DarkComet, a popular commercial RAT. We collected 19,109 samples of DarkComet malware found in the wild, and in the course of two, several-week-long experiments, ran as many samples as possible in our honeypot environment. By monitoring a sample's behavior in our system, we are able to reconstruct the sequence of operator actions, giving us a unique view into operator behavior. We report on the results of 2,747 interactive sessions captured in the course of the experiment. During these sessions operators frequently attempted to interact with victims via remote desktop, to capture video, audio, and keystrokes, and to exfiltrate files and credentials. To our knowledge, we are the first large-scale systematic study of RAT use.
-
To Catch a Ratter: Monitoring the Behavior of Amateur DarkComet RAT Operators in the Wild
2017 IEEE Symposium on Security and Privacy (SP), 2017Co-Authors: Brown Farinholt, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Stevens Le Blond, Damon Mccoy, Kirill LevchenkoAbstract:Remote Access Trojans (RATs) give remote attackers interactive control over a Compromised Machine. Unlike large-scale malware such as botnets, a RAT is controlled individually by a human operator interacting with the Compromised Machine remotely. The versatility of RATs makes them attractive to actors of all levels of sophistication: they've been used for espionage, information theft, voyeurism and extortion. Despite their increasing use, there are still major gaps in our understanding of RATs and their operators, including motives, intentions, procedures, and weak points where defenses might be most effective. In this work we study the use of DarkComet, a popular commercial RAT. We collected 19,109 samples of DarkComet malware found in the wild, and in the course of two, several-week-long experiments, ran as many samples as possible in our honeypot environment. By monitoring a sample's behavior in our system, we are able to reconstruct the sequence of operator actions, giving us a unique view into operator behavior. We report on the results of 2,747 interactive sessions captured in the course of the experiment. During these sessions operators frequently attempted to interact with victims via remote desktop, to capture video, audio, and keystrokes, and to exfiltrate files and credentials. To our knowledge, we are the first large-scale systematic study of RAT use.
Giovanni Vigna - One of the best experts on this subject based on the ideXlab platform.
-
detecting kernel level rootkits through binary analysis
Annual Computer Security Applications Conference, 2004Co-Authors: Christopher Kruegel, William Robertson, Giovanni VignaAbstract:A rootkit is a collection of tools used by intruders to keep the legitimate users and administrators of a Compromised Machine unaware of their presence. Originally, root-kits mainly included modified versions of system auditing programs (e.g., ps or netstat on a Unix system). However, for operating systems that support loadable kernel modules (e.g., Linux and Solaris), a new type of rootkit has recently emerged. These rootkits are implemented as kernel modules, and they do not require modification of user-space binaries to conceal malicious activity. Instead, these rootkits operate within the kernel, modifying critical data structures such as the system call table or the list of currently-loaded kernel modules. This paper presents a technique that exploits binary analysis to ascertain, at load time, if a module's behavior resembles the behavior of a rootkit. Through this method, it is possible to provide additional protection against this type of malicious modification of the kernel. Our technique relies on an abstract model of module behavior that is not affected by small changes in the binary image of the module. Therefore, the technique is resistant to attempts to conceal the malicious nature of a kernel module.
Pan Li - One of the best experts on this subject based on the ideXlab platform.
-
GLOBECOM - Energy-Based Detection of Defect Injection Attacks in IoT-Enabled Manufacturing
2018 IEEE Global Communications Conference (GLOBECOM), 2018Co-Authors: Sergio A.salinas Monroy, Ming Li, Pan LiAbstract:Manufacturing systems are rapidly adopting the Internet of Things (IoT) to improve their efficiency and productivity. The IoT equips manufacturing systems with sensing, computing and communications capabilities, which enable real-time monitoring and control of increasingly complex and geographically distributed factory floors. However, the increased used of computer networks in IoT-enabled manufacturing introduces cyber-vulnerabilities that can be exploited by sophisticated adversaries to sabotage manufacturing operations. A particularly serious cyberattack against manufacturing systems is the defect injection (DI) attack. In a DI attack, a Compromised Machine fabricates objects with deformed geometry, weak material composition, abnormal dimensions, etc., which pose a great risk to safety-critical applications. In this paper, we develop a method to identify Compromised Machines that launch DI attacks against smart manufacturing systems. Specifically, we first propose a DI attack localization (DIAL) algorithm that uses Machines' energy consumption and voltage measurements to identify Compromised Machines in the system. Our proposed approach only requires modest hardware resources and can be used in large-scale systems. We implement our DIAL algorithm on a real-world advanced manufacturing testbed, and observe that it can successfully locate the Compromised Machines with a high detection rate.
-
Energy-Based Detection of Defect Injection Attacks in IoT-Enabled Manufacturing
2018 IEEE Global Communications Conference GLOBECOM 2018 - Proceedings, 2018Co-Authors: Sergio A.salinas Monroy, Ming Li, Pan LiAbstract:Manufacturing systems are rapidly adopting the Internet of Things (IoT) to improve their efficiency and productivity. The IoT equips manufacturing systems with sensing, computing and communications capabilities, which enable real-time monitoring and control of increasingly complex and geographically distributed factory floors. However, the increased used of computer networks in IoT-enabled manufacturing introduces cyber-vulnerabilities that can be exploited by sophisticated adversaries to sabotage manufacturing operations. A particularly serious cyberattack against manufacturing systems is the defect injection (DI) attack. In a DI attack, a Compromised Machine fabricates objects with deformed geometry, weak material composition, abnormal dimensions, etc., which pose a great risk to safety-critical applications. In this paper, we develop a method to identify Compromised Machines that launch DI attacks against smart manufacturing systems. Specifically, we first propose a DI attack localization (DIAL) algorithm that uses Machines' energy consumption and voltage measurements to identify Compromised Machines in the system. Our proposed approach only requires modest hardware resources and can be used in large-scale systems. We implement our DIAL algorithm on a real-world advanced manufacturing testbed, and observe that it can successfully locate the Compromised Machines with a high detection rate. © 2018 IEEE.
Brown Farinholt - One of the best experts on this subject based on the ideXlab platform.
-
IEEE Symposium on Security and Privacy - To Catch a Ratter: Monitoring the Behavior of Amateur DarkComet RAT Operators in the Wild
2017 IEEE Symposium on Security and Privacy (SP), 2017Co-Authors: Brown Farinholt, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Stevens Le Blond, Damon Mccoy, Kirill LevchenkoAbstract:Remote Access Trojans (RATs) give remote attackers interactive control over a Compromised Machine. Unlike large-scale malware such as botnets, a RAT is controlled individually by a human operator interacting with the Compromised Machine remotely. The versatility of RATs makes them attractive to actors of all levels of sophistication: they've been used for espionage, information theft, voyeurism and extortion. Despite their increasing use, there are still major gaps in our understanding of RATs and their operators, including motives, intentions, procedures, and weak points where defenses might be most effective. In this work we study the use of DarkComet, a popular commercial RAT. We collected 19,109 samples of DarkComet malware found in the wild, and in the course of two, several-week-long experiments, ran as many samples as possible in our honeypot environment. By monitoring a sample's behavior in our system, we are able to reconstruct the sequence of operator actions, giving us a unique view into operator behavior. We report on the results of 2,747 interactive sessions captured in the course of the experiment. During these sessions operators frequently attempted to interact with victims via remote desktop, to capture video, audio, and keystrokes, and to exfiltrate files and credentials. To our knowledge, we are the first large-scale systematic study of RAT use.
-
To Catch a Ratter: Monitoring the Behavior of Amateur DarkComet RAT Operators in the Wild
2017 IEEE Symposium on Security and Privacy (SP), 2017Co-Authors: Brown Farinholt, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Stevens Le Blond, Damon Mccoy, Kirill LevchenkoAbstract:Remote Access Trojans (RATs) give remote attackers interactive control over a Compromised Machine. Unlike large-scale malware such as botnets, a RAT is controlled individually by a human operator interacting with the Compromised Machine remotely. The versatility of RATs makes them attractive to actors of all levels of sophistication: they've been used for espionage, information theft, voyeurism and extortion. Despite their increasing use, there are still major gaps in our understanding of RATs and their operators, including motives, intentions, procedures, and weak points where defenses might be most effective. In this work we study the use of DarkComet, a popular commercial RAT. We collected 19,109 samples of DarkComet malware found in the wild, and in the course of two, several-week-long experiments, ran as many samples as possible in our honeypot environment. By monitoring a sample's behavior in our system, we are able to reconstruct the sequence of operator actions, giving us a unique view into operator behavior. We report on the results of 2,747 interactive sessions captured in the course of the experiment. During these sessions operators frequently attempted to interact with victims via remote desktop, to capture video, audio, and keystrokes, and to exfiltrate files and credentials. To our knowledge, we are the first large-scale systematic study of RAT use.