2022-01-18 · 9분
This post is over 2 years old. The content may be outdated.
(1) Understanding malware
○ Malware: every malicious program, macro, script, etc. that a creator makes intentionally to harm others — every executable form that runs on a computer
○ Computer virus
▷ Definition: theoretically defined as a combination of instructions that copies itself or a variant of itself into an executable part such as a computer program, macro, or script; in practice, it's trending toward being unified with malicious programs that copy themselves elsewhere without the user's knowledge.
▷ Boot virus: a virus that infects the boot area (floppy disk / hard disk). After infection it's hard to cure in a Windows environment, so cure it after booting into DOS.
▷ Brain virus, Michelangelo virus, Monkey virus, Anti-CMOS virus, WYX virus, etc.
▷ File virus: a virus that generally infects executable program files; in Windows various forms of executable files exist, and it infects various forms of files.
▷ DOS file viruses, Windows file viruses, macro viruses
▷ Boot/file virus: a virus that infects both the boot area and files
▷ A few, such as Natas virus, Half virus, Intruder virus, Tequila virus, etc.
▷ Macro virus: a virus with the ability to copy itself using the macro function supported by an application
○ Trojan horse: backdoors are also a type of trojan; unlike a virus, a trojan horse program has no self-replication ability and is distributed by embedding malicious code inside a utility program, or by disguising itself as a utility program. Once a trojan is installed, depending on a specific environment or condition or the distributor's intent, you can suffer harm such as information leakage or data destruction.
▷ Main functions: remote control, password interception, keyboard-input interception, system file destruction, etc.
▷ NetBus, Back Orifice, etc.
○ Internet worm: a malicious program that copies itself through the network / email, also called an Internet Worm
▷ Propagation methods
▶ Email attachment
▶ Legitimate-looking email attachment
▶ Exploiting network vulnerabilities
▷ Representative types
▶ I-Worm/Happy99, I-Worm/Hybris, I-Worm/Naked, I-Worm/Navidad, I-Worm/ExploreZip, I-Worm/Wininit, etc.
▶ SQL Slammer
○ Mail bomb: a mail bomb is a technique that, to harm the other party, sends thousands or tens of thousands of emails at once to a specific person or system, or continuously sends large-volume emails, eventually causing a failure in that site's computer system.
○ Joke: various programs that don't cause concrete harm like data destruction to the user, but startle users with symptoms similar to a virus
- Delete_Game, Format_Game, Cokegift, Puzzle, etc.
- Hoax/Myth: a kind of spam mail wrongly known as a computer virus. Side effect: lowered security awareness → the boy-who-cried-wolf effect
○ GoodTimes virus, join the crew, Sulfnbk.exe, etc.
○ Malicious script: a malicious program made using scripting features
- Batch files, mIRC script, VBS (Visual Basic Script), JS (JavaScript)
○ Spyware: a legitimate program made/declared to let the SW developer know some of your personal information
(1) Overview of the trojan horse
○ Unlike a virus, a trojan horse program has no self-replication ability and is distributed by embedding malicious code inside a utility program, or by disguising itself as a utility program. Once a trojan is installed, depending on a specific environment or condition or the distributor's intent, you can suffer harm such as information leakage (Backdoor) or data destruction.
○ Trojan horse functions (general functions)
- Remote control: with remote control, a hacker can perform malicious acts through a trojan-infected system. The hacker can completely control everything about the system, including the infected system's files and data.
- Password interception: finding cached passwords existing on a trojan-infected system. It mainly sends the user account and password required when using messengers, websites on the internet, and other applications to the attacker's email address without the user's knowledge.
- Keyboard-input interception: copies the keyboard input the user types on the system into an arbitrary log file, then sends it to a specific email address the hacker set, or sends it in real time.
- System file destruction type: has the function of deleting files or data on the infected system.
○ Trojan horse detection methods
- Detection by an antivirus program
- Examining the registry to check auto-run settings
- Checking whether unused ports are open on the user's computer
- Checking whether programs or files the user didn't install have been installed on the user's computer
(2) Understanding trojan horse S/W by case
○ NetBus
- NetBus features file manager, registry manager, Application Redirect, screen capture, viewing keyboard-input information, etc.
- Function to set a connection password for the server program
- Function to change the server program's port
○ Back Orifice
- Back Orifice is a hacking tool made by the hacking group CDC, with functions like access to all files in the file system, process creation/deletion, system password leakage, keyboard monitoring, sharing designation of network resources, file manipulation, registry manipulation, etc.
- Function to set a connection password for the server program
○ School Bus, etc.
- Functions like password leakage, extracting passwords from the cache area, file management, keyboard-input monitoring, etc.
- Function to set a connection password for the server program
○ ackcmd
- A special remote command prompt for Windows 2000; since it communicates using only TCP ACK segments, in some cases a connection that passes through a firewall is possible.
- That is, it's hard to obtain connection-session info with the netstat -an command.
○ Rootkit
- The purpose of a rootkit is to hide itself and other software from view and avoid the possibility that the user recognizes and removes the attacker's software. A rootkit can hide almost any software, including file servers, keyloggers, botnets, and remailers. Therefore, it's usually undetectable and nearly impossible to remove.
▶ Rootkit functions
- Monitor traffic or keystrokes
- Install a trojan program on the system
- Modify log files
- Hide processes or files
- Set auto-run
- Other
▶ Rootkit types
- For Windows: FU-Rootkit, Hxdef100, NTRootkit, etc.
- For Linux: Suckit, lrk4, lrk5, adore, etc.
▶ Rootkit detection: detect and remove using an antivirus program or a dedicated tool
- Detection by an antivirus program
- General behavior-based rootkit detection software: Rootkit Revealer, etc.
Cracking S/W
(1) Overview of cracking
○ Cracking, compared to hacking, refers to the act of intruding into a system with malicious intent; in another sense it also means converting a shareware program into the full version.
○ As a hacking tool, cracking technology is used as a tool to find a user's ID and password; the attack principle here is the method of continuously substituting IDs and passwords to see whether they are right or wrong.
(2) Understanding cracking S/W by case
○ WWWhack
- A tool that cracks a web server's login ID and password, a connection account's ID and password, FTP's ID and password, and POP's IP and password
○ Golden Eye, Webcrack, etc.
Port scanning S/W
(1) Overview of port scanning
○ Port scanning is the attacker scanning the open ports of the target system, a procedure performed for OS identification, attack-path selection, etc.
- A port number is a method for identifying the specific process to which an internet or other network message should be delivered when it arrives at a server. In TCP and UDP, the port number takes the form of a 16-bit integer placed inside the header added to each message. This port number is continuously passed logically between the client and server transport layers, and physically between the transport layer and internet layer. Port numbers range from 0 to 65535; the port numbers designated for applications (well-known) are 0 to 1023, and other ports are port numbers temporarily assigned at connection time. For example, a request a client makes to an internet server may be a request for a file provided by the host's FTP server. To deliver the user's request to the FTP process inside the remote server, the TCP software layer on the user's computer confirms the port number 21 (the number commonly used in relation to an FTP request) within the 16-bit integer port number added to the request. On the server, the TCP layer will read the port number 21 and deliver the user's request to the FTP program on the server.
- It's the act of finding the ports that are Listening (connectable ports) on the destination system via a port scanner. Attackers check whether the target system is alive (mainly using ping; at the network level they do a ping sweep), search for open ports, then analyze vulnerabilities using a vulnerability scanner (Nessus, Internet Scanner, etc.). After that they attack using the system's vulnerabilities.
- In port scanning, if a 3-way handshake is established for a specific port, you can confirm the port is open.
(2) Understanding port scanning S/W by case
○ NMap
▶ A port scanner using various methods
- TCP connect() scan: scanning using the 3-way handshake. Because it makes a complete TCP connection to check the port's open/close state, it can be easily detected by the system.
- TCP SYN scan: also called a Half-open scan or Stealth scan; without making a complete TCP connection, it sends a SYN packet to the target port — receiving SYN/ACK means open, receiving RST/ACK means closed. Because a SYN scan checks the port's open/close state through a half-open connection, it's a more secretive connection than a TCP connect() scan and isn't logged on the system. Among TCP-based scans, its scan speed is faster than a TCP connect() scan, so it's the most used method.
- TCP FIN, Xmas Tree, NULL scan: these three scan techniques are also called Stealth scans and can be used only against UNIX-family systems. A TCP FIN scan enables the TCP flag FIN to send a packet to the target port; an Xmas Tree scan enables the TCP flags FIN, URG, PUSH to send a packet to the target port. A NULL scan disables all TCP flags to send a packet to the target port. All three scans, if the port is closed, send back an RST packet (RFC 793). If it's open, they ignore the packet.
Original (Korean): tistory — published 2022-01-18, migrated to this blog. This translation was generated with the help of AI.
…