The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / pc / virus / vas043.txt < prev next >

Wrap

Text File | 2003-06-11 | 18.7 KB | 363 lines

╔═════════════════════════════════════════════════════════════════════════════╗ ║ ─────────────────────── ▀▄ █ █▀▀▀█ █▀▀▀▀ ────────────────────────────── ║ ║ ───────────────────────── ▀▄ █ █ █ █▄▄▄▄ ────────────────────────────── ║ ║ ─────────────────────────── ▀▄ █ █▀▀▀█ █ ────────────────────────────── ║ ║ ───────────────────────────── ▀█ █ █ ▄▄▄▄█ ────────────────────────────── ║ ╠═════════════════════════════════════════════════════════════════════════════╣ ║ Vaginal and Anal Secretions Newsletter #0043 ║ ╟─────────────────────────────────────────────────────────────────────────────╢ ║ Date Released : [07/01/92] Author: The Smurfs (PROBE-X) ║ ╟─────────────────────────────────────────────────────────────────────────────╢ ║ Mutation Engine Report ║ ╙─────────────────────────────────────────────────────────────────────────────╜ Hello everyone, following report is provided for your information. More tests are being conducted and results will be posted soon. ----------------------------------------------------------------------- 22 Jun 92 Mutation Engine Report Copyright (c) 1992 by VDS Advanced Research Group All Rights Reserved P.O. Box 9393 Baltimore, MD 21228 (410) 247-7117 prepared by Tarkan Yetiser This report is provided to satisfy the curiosity of the public. We were approached by some third parties to perform an analysis on MtE. We would like to share the results of our analysis with everyone. If you find an error or inaccuracy in this report, please feel free to contact us. All constructive criticism is welcome. TABLE of CONTENTS I. Mutation Engine and Viruses. . . . . . . . . . . . . . . . . . . 1 II. How to Catch Viruses and MtE-based Viruses . . . . . . . . . . 2 III. Mutation Types and Detection Algorithms. . . . . . . . . . . . 3 IV. Live Tests and Results . . . . . . . . . . . . . . . . . . . . 5 A. Comments on Test Results . . . . . . . . . . . . . . . 5 V. A Simple Message . . . . . . . . . . . . . . . . . . . . . . . 6 I. Mutation Engine and Viruses We have analyzed the so-called MtE (Mutation Engine by a "Dark Avenger" from Bulgaria), and sample viruses based on it; namely, Pogue and Dedicated. We have also conducted tests to examine what kind of a potential this miscreant has, and collected empirical data on how popular scanners deal with the MtE. We have also implemented a little program (CatchMTE) that can recognize MtE-based code using an algorithmic technique. The program in executable form is available free of charge as a service to the public. Due to possible misuse, the source code and a more detailed (at the opcode and bit-mask level) analysis with decryptor samples and algorithms necessary to detect MtE will be made available in a limited fashion. Under no circumstances, actual virus samples will be provided; except the missed samples can be sent to known anti-viral product developers who wish to enhance their programs. For those who are not familiar with the MtE, some preliminary info will be presented first: MtE is NOT a virus per se, but an object module that can be linked into a virus to give it polymorphic capabilities. MtE expects to be called as a routine that can encrypt a certain portion of code and can generate a suitable decryption routine. It uses a random number generator to vary each mutation so that it will not be possible to recognize the new variant by using simple scanning techniques. The random number generator is not part of the MtE object module. A sample pseudo-random number generator is included with the archive Dark Avenger distributes. A virus writer could also supply his own random number generator. Though all this may sound ordinary, MtE got so much attention not because it is just another encryptive virus but because it can provide even simple viruses with a feature that makes it difficult to scan for them. MtE is just like a library routine that you link into your virus and call when needed. It is a little over 2K in an object module named MTE.OBJ. A person who calls himself "Dark Avenger" claims to have developed MtE, and distributes it by uploading to BBSes in Bulgaria. The archive contains a fairly detailed documentation on how to use MtE, and even includes a demonstration virus, a non-resident COM infector known as "Dedicated". Shortly after MtE made its appearance, a modified copy of this virus called "Fear" is also seen. Why this person is engaged in such potentially harmful activity, or how he/she gets away with it is not something we know about. Curious individuals who would like to learn more about the history of virus production in Bulgaria and other social as well as technical issues are invited to read an excellent paper written by anti-virus researcher Mr. Vesselin Bontchev of Virus Testing Center, University of Hamburg. The paper is titled "Bulgarian Virus Factory", and it is available via anonymous FTP. It provides insight into some of the cultural aspects of the virus underground in Bulgaria. Mr. Bontchev's contribution to anti-virus research is much appreciated; otherwise, we probably would have never known what goes on inside the Bulgarian virus factories. II. How to Catch Viruses and MtE-based Viruses You disassemble a sample, extract a sequence of bytes that would exist in each infected executable object, put it into a pattern matching engine, and then look for that pattern in executable objects that that virus is known to target. This method proved to be quite useful in fighting many viruses seen in the wild. Assuming a carefully chosen scan string, you can find the virus easily without too many false positives. Not so for polymorphic viruses. These viruses try to defeat common scanning methods. They keep their body encrypted to defy analysis, and encrypt the new copy inserted into an executable object using a different key so that it will "look" as if a different virus infection has occurred. However, even these viruses require a plaintext code that will decrypt the rest of the virus. Scanners can use strings extracted from the plaintext portion of the virus to identify them. It is usually necessary to include wildcard bytes (don't-care bytes) to be able to deal with the varying parts of the decryption routine. Naturally, false alarms are more likely to occur. MtE is more advanced than such viruses seen before. We would like to emphasize that the contents of each mutation and the corresponding decryption routine MtE generates is far too variable to extract a simple (or even wildcard) scan string. It is necessary to analyze the MtE itself as well as many sample mutations. After that, certain characteristics of the code MtE generates can be used as telltale signs to detect its presence. Avoiding false positives while maintaining 100% detection ratio is quite difficult. Armed with an 80x86 instruction set guide (we used Turbo Assembler 3.0 Quick Reference Guide), and a good disassembler (we used Mr. Zandt's DIS86 available via anonymous FTP), and a few known viruses based on MtE (Pogue and Dedicated with payload removed), we analyzed the MtE code, and the mutations generated. Tests were conducted on a 40Mhz 386 with a 100 meg HD and MS-DOS 5.0, and a 4.77Mhz IBM/XT with a 30 meg HD and PC-DOS 3.3 installed. A simple program that generated decoys (small, fully functional programs) was used to create a large number of samples. In the case of Pogue, the virus was allowed to remain resident and infect each decoy program as it is created. Since the Dedicated virus is not resident, it was necessary to create decoys first and then infect them by running the virus (infects in the current directory). After the tests, we archived the samples and stored them on floppy diskettes, and removed them from the hard drives of the test machines. In the Intel 80x86 architecture, it is possible to express a computation in very dissimilar ways. This is possible because certain registers can be substituted in place of another one and still achieve the same result. For example, you can index an array by using SI, DI, BP or BX registers. Or you could XOR a certain value at a given memory location by loading that value in AX, BX, CX or DX first, and performing the XOR on that register, and then putting the result back into memory, etc. Even other possibilities exist. When stepping through elements in an array, you can increment the index register by ADDing to it, INCing it, or ADDing and then SUBtracting from it. It should be clear that such flexibility helps MtE significantly. Of course, variability is something string scanners do not handle too well, since there are many combinations to search for. MtE goes even further than that. The size of the decryption routine is also variable, making it infeasible to assume certain things that would hold for many polymorphic viruses. It also sets up a lengthy sequence of redundant instructions before the decryptor enters the decryption loop. For over 90% of the mutations, MtE generates a convoluted 16-bit XOR-type encryption; however, in many cases it uses indirect ways to apply the XOR mask to a memory value. For example, it computes the mask, and then gets the value to be decrypted into a register, applies the mask and put the result back into that memory location. Besides, memory access is done using many different instructions such as MOV and XCHG. There are also many redundant instructions peppered freely throughout the decryptor. In some cases (5.5%), MtE generates a decryptor with a null effect. The decryptor does not actually decrypt anything, and the virus code is in plaintext. The frequency of such cases seems to depend on the random number generator. It is funny to note that some popular scanners misidentify such extreme cases where the virus is not even encrypted. To handle these mutations, it is sufficient to extract a signature from the MtE itself. It is also possible to extract one from known MtE-based viruses and identify the virus directly. At any rate, a scan string from MtE itself should be used in case a future virus creates a plaintext variant. We must also mention that even these plaintext mutations contained a fully working copy of MtE. They successfully propagated and generated encrypted mutations in future generations. MtE appears to generate correct code in all cases. The deviation between new generations started using plaintext parents and new generations started using encrypted parents was negligible. III. Mutation Types and Detection Algorithms MtE generates 4 "types" of mutations. They are as follows: 1. Double-reference (detectable using Method-1) ( ~ 91.0% ) 2. SUB-NEG (detectable using Method-2) ( ~ 2.0% ) 3. Single-reference (detectable using Method-3) ( ~ 1.5% ) 4. Plaintext or no-reference ( ~ 5.5% ) By implementing three algorithms and one scan string for the plain mutations, it is possible to recognize MtE-based viruses while keeping false positives to an acceptable level. We have one such program that achieved 100% hit rate during our tests. Some others also claim 100% hit rate; and we have tested them as well. A more detailed analysis of mutation types is not made public due to possible misuse of such information. IV. Live Tests and Results Test #1 Base Virus Name: Dedicated SCAN 91 F-PROT 2.04 CatchMTE 1.0 by Name (1) 67 69 60 as MtE (2) 933 931 940 misidentified -0 -0 N/A missed -0 -0 -0 Hit Rate 100% 100% 100% (1) SCAN91 --> [Mut], F-PROT 2.04 --> Dedicated, CatchMTE --> Dedicated (2) SCAN91 --> [DAME], F-PROT 2.04 --> MtE, CatchMTE --> MtE-based Test #2 Base Virus Name: Pogue SCAN 91 F-PROT 2.04 CatchMTE 1.0 by Name (1) 0 0 56 as MtE (2) 935 936 944 misidentified (3) -65 -61 N/A missed -0 -3 -0 Hit Rate 93.5% 93.6% 100% (1) SCAN91 --> N/A, F-PROT 2.04 --> N/A, CatchMTE --> Pogue (2) SCAN91 --> [DAME], F-PROT 2.04 --> MtE, CatchMTE --> MtE-based (3) SCAN91 --> [7S], F-PROT 2.04 --> Gotcha, CatchMTE --> N/A A. Comments on Test Results It seems that both F-PROT 2.04 and SCAN 91 misidentify some Pogue mutations that are in plaintext. F-PROT "quickscan" missed ALL mutations. You are advised to use SECURE scan mode of this product. The extra speed comes with 0% hit rate on MtE-based viruses! F-PROT 2.04 missed three encrypted Pogue mutations. We examined these samples and found them to be of Type-3, and detectable using Method-3. The samples worked as expected. One of those three that were missed was called "suspicious" and guessed to be a variant of the Gotcha virus. We can only speculate that F-PROT lacks Method-3 detection algorithm and uses a heuristic in such cases. Surprisingly, Virx 2.3 missed one of these same mutations. Due to annoying user interface, we were unable to include Virx 2.3 in our full test suite. It should be noted that misidentification of 6% of Pogue mutations is a little alarming. All these misidentified mutations were found to be working and capable of generating new mutations. V. A Simple Message It is dangerous to assume that scanning is adequate since there are some products that can detect MtE-based viruses 100% of the time. We identified at least two ways to make MtE less predictable. Of course, such information will not be disseminated. However, considering the availability of MtE to the hackers all around the world, and the "glory" Dark Avenger will enjoy due to media hype, it's only a matter of time such improvements will be discovered by irresponsible individuals. Besides, this may start a new trend among virus writers to create things like MtE. Keeping up with new virus signatures was hard enough (though manageable), but keeping up with many mutation engines is not going to be trivial. Unfortunately, locking up these "mutant engineers" is not a practical solution, and not even legally possible in many parts of the world. The message is clear. The first line of defense against viruses is NOT using scanners. Although they proved to be very useful, you are highly encouraged to consider other approaches such as integrity checkers as a first line of defense. Even the less sophisticated integrity checkers have a better chance to catch mutating viruses, long before their developers get a chance to analyze the virus samples. The reason is that viruses have a tendency to modify existing code to propagate in most cases. Their spread can be controlled using a non-virus-specific solution that concentrates on the main characteristic of most viruses. Such an approach is not only more cost-effective but also more secure. If your company still relies on a virus scanner to protect its PC- based computing resources against viruses, you are walking on thin ice. - ------------------------------------------------------------- Regards, Tarkan Yetiser VDS Advanced Research Group P.O. Box 9393 (410) 247-7117 Baltimore, MD 21228 e-mail: tyetiser@ssw02.ab.umd.edu --------------------------------------------------------- Response: > It seems that both F-PROT 2.04 and SCAN 91 misidentify some >Pogue mutations that are in plaintext. F-PROT "quickscan" missed >ALL mutations. You are advised to use SECURE scan mode of this >product. The extra speed comes with 0% hit rate on MtE-based >viruses! True, but Keep in mind that Quick scan is a very primitive "single-point" scanner - it is fast, but if a virus cannot be found with a single string, located a fixed offset from the entry point, Quick will not find it. Actually, I will probably drop Quick scan in the near future, as the speed of my secure scan has been steadily improving, and it is now almost as fast as Quick scan on certain machines. >F-PROT 2.04 missed three encrypted Pogue mutations. We >examined these samples and found them to be of Type-3, and >detectable using Method-3. The samples worked as expected. One of >those three that were missed was called "suspicious" and guessed to >be a variant of the Gotcha virus. It did not guess. Pogue IS a variant of Gotcha, just with MtE added. My scanner simply picked up the Gotcha signature, probably that part of the virus was not encrypted. This is also the reason the "non-encrypted" samples are identified as Gotcha-variants. > We can only speculate that F-PROT >lacks Method-3 detection algorithm and uses a heuristic in such >cases. Well, you may speculate, of course, but you are wrong :-) I have what you call a "Method-3", but I guess it is simply not perfect - I would have to look at those three samples, to determine where the flaw is - I simply am not going to disassemble the MtE! - I did spend two days on it, and that is far too much when 3 new viruses arrive every day.... PS: The heuristics are only used if specifically requested, and will never report a particular virus, just the presence of virus-like code... - -frisk ───═════[ VaS DiSTRiBuTioN SiTeS ]═════─── ╔═════════════════════════════════════════════════════════════════════════════╗ ║ BBS Name Number Baud Sysop Title ║ ╟─────────────────────────────────────────────────────────────────────────────╢ ║ LiVe WiRE BBS (313)464-1470 14.4 Studmuffin World HQ ║ ║ PoT BBS (313)462-1906 24oo Phreak_Accident World HQ ║ ║ TcH BBS (713)373-4031 14.4 One Meg Cacher Dist. #1 ║ ║ Floating Pancreas (305)551-0311 14.4 Majestic Cockster Dist. #2 ║ ║ Phantasm III (313)884-2617 14.4 Scavenger Dist. #3 ║ ╚═════════════════════════════════════════════════════════════════════════════╝