第十七章 虬龙星.ppt

Case Study: Stuxnet Contains both user-mode and kernel-mode rootkits Valid digital certificates stolen from Veri-Sign used to avoid driver detection Web sites in Denmark and Malasia served as command-and-control centers Utilized 4 zero-day Windows vulnerabilities Infects project files for Siemens WinCC/PCS 7 SCADA controlers subverts key communications dll to avoid detection Case Study: Stuxnet Stuxnet is VERY sophisticated indicates multi-level, evolving attack strategy believed to have been developed as a targeted cyber-warfare weapon has raised awareness among cyber-security commands similar attacks could target power grids, communications, oil refineries, shipyards, etc. (see movie ‘Eagle Eye’ for hypothetical potential) * Chao-Hsien Chu College of Information Sciennces and Technology The Pennsylvania State University University Park, PA 16802 chu@ Modified by Santoro Malicious Code: Viruses and Worms Learning by Doing Theory ? Practice 苍穹龙骑 Malicious Code Taxonomy Viruses – replicating malicious code Worms – self-replicating malicious code Mailing worms Random scanning worms Logic Bombs – programmed malfunctions (similar to easter eggs) Trojan Horses – malicious program that masquerades as legitimate Backdoors Password stealers Exploit code: Autorooters White hat penetration tools Downloaders – loads other malicious code on a machine Malicious Code Taxonomy Dialers – generate money for attackers by having users unknowingly dial premium rate numbers Code generator kits (e.g. Virus Creation Lab) Spammer programs Flooders – DDOS tools, BotNets Keyloggers Rootkits – special tool set installed after an attacker has gained control of a system; modifies logs, installs backdoors, etc. Other: Hoax messages Adware Spyware Phishing attacks Malicious Code Example “Most people I think don’t even know what a rootkit is so why should they care about it?” Thomas Hesse, Sony BMG In 2005, Sony BMG released music CDs containing extended copy protection (XCP) so