Walk into a module that will focus on malicious programs.
As we have discovered in the previous module assertion that's the last security boundary that Windows
provides.
Everything that runs slower all processes that you run in the context of a session.
You do it your own risk.
In this module I'd like to take a look at the threats related to the fact that a process might have
unrestricted access to other processes in a session.
If the session is run as an administrator a flushed process may have access to the entire operating
system.
The first category of malicious software I'd like to analyze are Trojan horses.
The term Trojan horse is often mis applied the press and media are the biggest culprits here.
It's often mentioned in the news that a Trojan horse was detected or made it possible for intruders
to attack the system or connect to a victim's computer.
Actually to be precise it's the so-called back door that enables an attacker to obtain access to a targeted
computer the role of a Trojan horse is to conceal itself as another program.
It's a user targeted attack and even if you remember to update your defense mechanisms have a top shelf
anti-virus and the most expensive firewall.
This doesn't matter with trojans.
If you launch a Trojan Horse your operating system will allow it to execute.
It's an example of a social engineering attack.
And since there are automated tools for generating trojans on the Internet this attack ranks among the
most dangerous we'll use here a rather old piece of software created in 2003 or 2004 by Taata a Turk
who went on to sell the tool online.
The tool came in two versions besides a demo a free version.
There was also a commercial version of the tool.
Its creator disappeared from the internet after some time.
The time last blog said that he wished the program had never been developed and that he hoped that it
would only be used for non-malicious purposes.
It's a tie now probably works for a government institution or the institution took care of him in some
other way.
The program shown in this presentation is simple and quite old.
Professional tools for creating Trojan horses offer a much wider variety of features.
And they're even more easy to use.
This is why running an untrusted program is connected with risk
various commercial reports indicate that a large portion perhaps even 50 percent of binary files shared
over peer to peer networks and the like and at least 10 percent of files shared on Web sites are modified
and have trojans or backdoor is added to them.
Let's explore how easily Trojans can be created.
We use beast 2.0 7.
This is a tool dedicated to building Trojan horses that you can find on the Internet Trojan horses can
be back doors at the same time once they're run on a remote computer an attacker can obtain full control
over the computer.
That's why beast is perfect for the presentation.
We'll be able to see step by step how an attack proceeds
modern environments use to generate Trojans are today much richer their payload is usually more complicated
than injecting and inserting a CD drive of a remote machine which is the goal we'll be trying to achieve.
First we need to build a server.
Building a server involves setting up some basic options for a server
since we'll be trying to connect to a remote computer.
It's better to make it connect to us rather than the other way around.
The advantage of reverse connection is that it eliminates one problem we mentioned earlier in the modules
and computer networks receive a firewall and or an intrusion detection system by making a trusted protected
computer connect to us rather than vice versa.
This is a reversal of a TCAP session.
We could also try to hide in a different process.
We'll talk about concealing methods later.
Our process will run directly in the host process.
The program will bind to as you can see we can hide under any process.
We can also create a service that will be run automatically
if a victim terminates a program to which we've added a trojan Trojan will still work submit the IP
address of a computer that's to be connected to by an infected computer in the notifications tab.
This is not the address of our computer.
But for example the address of a computer we broke into yesterday.
You can also request the program to send out an e-mail to a submitted address.
You can also be notified of a new victim through the instant messenger.
We'll use the TCAP protocol instead.
You can specify on the startup tab if your trojan is to survive the terminations of the program to which
it's injected or perhaps survive system restart over the next modules We'll examine mechanisms for automatically
running objects during a system launch.
It'll turn out the registry key and an active controls are a good place for hiding
the threat of detection by an end a virus can be lowered by disabling one of over 300 anti-virus scanners
in a VFW kill tab.
You can even disable them every five seconds just in case a user fights back and tries to run them again
and again since XP firewall was so popular several years ago.
It has its own checkbox.
You can disable it here without having to go through a list of 300 programs.
Another option allows you to enable a key logger a key logger is a program that monitors the sequences
of pressed keys on a remote computer if it's enabled it's enough to wait for a user to log onto a Web
site or run their mailer program to provide a password.
It's not cached of course because the user protects the credentials
the server is built.
Let's now save it.
As you can see below Here's what our Trojan looks like.
It's not highly probable that a user will decide to run it.
If a program that's provided in this manner or found on the Web site is launched by a user there's no
use talking about system security anymore.
Let's try to make the program more slight.
We use binder for this purpose.
We need to select the Trojan and then select some random popular application.
For example the newest version of OpenOffice or a decoder which will convert files from x to y.
We also want our Trojan horse to have an icon from the selected file rather than no icon click on bind
files and save the modified program making it seem like the newest free version of the program
for example exact file free version 3.
X-Sea.
If you take a closer look at it the program is a bit larger than the original software.
I don't think anyone will notice this during the download.
The program was copied to a remote computer for the purpose of this presentation.
Ignore the social engineering aspect for a moment simply assume that somehow we've succeeded in persuading
the user to download and run the program.
Let's see what happens if the victim runs an integrity checker with the injected code
to get a better picture of the attack as it unfolds.
We'll also show you what happens to the attackers computer.
A victim launches the program and will start our server in this way we're controlling two machines Alice
and Cecil.
Are the users logged onto the computers.
Cecil will become the first target will use the go beast button to connect to a selected computer
thinks to be used.
You can now view the directories on the victim's hard disk.
You can download and delete files change file names and run processes.
You have control over the computer.
You can also view the victim's configuration by looking at registry keys.
You can also see the programs launched by the victim.
The list includes our program
will simulate a scenario where the victim has for example opened a web browser using the kill out button.
You can terminate any program running on a remote computer.
Besides these options reast offers many features added for entertainment.
You can't for example hide icons on the victim's desktop or eject and insert CD drives.
If your computer begins to act up after you download and run the newest version of a program icons appear
and disappear the system clock appears and disappears.
Strange process as a runner terminated.
This is not Windows fault.
The cause could be that the program you run contains an injected Trojan horse.
Your system is now controlled by someone else.
If you suspect that a given application can be the source of the problems and terminate it you'll see
that this doesn't bring about any changes.
The Trojan is still running.
And with that we're ending the first presentation on Trojan horses Trojan horse attacks which could
be mounted for example using beast are a result of user's ignorance to tell you the truth.
Ignorance is perhaps the wrong word here.
Many people are perfectly aware of the risks related to running files you come across on the internet
but think that since their computer doesn't contain any sensitive or important data they can take the
risk and download some program from the internet instead of buying it.
If the price is advertizement pop ups and mornings it can be forwarded.
Many people seem to decide that their data can be sacrificed and that it's worth it to take the risk
that their computer can be used for attacking other systems.
Running a program is more important for them approaches common but still is perilous and the stakes
are high.