This is a presentation based on the paper "HTTP Header Heuristics for Malware Detection", by Tobias Lewis. The paper is in the SANS Institute InfoSec Reading Room.
http://www.sans.org/reading-room/whitepapers/detection/http-header-heuristics-malware-detection-34460
HTTP Header Heuristicsfor Malware DetectionSANS Institute InfoSec Reading Room Author: Tobias Lewis link to paper !Presented by: Clay Wells (Sr. Systems Programmer) Department of Biostatistics & Epidemiology University of Pennsylvania
View Slide
HTTP Header Heuristics for Malware DetectionOverviewIntroductionAnalysis of HTTP heuristics Recommendations Conclusion Resources
HTTP Header Heuristics for Malware DetectionIntroductionMethods for malware detection - Signature based “known knowns” - Heuristics, rules and patterns “unknown”
HTTP Header Heuristics for Malware DetectionIntroductionBasic assumptions !- Malware will “phone-home” (C&C) - Malware masquerades as legitimate web traffic - Uses Hypertext Transfer Protocol, HTTP
HTTP Header Heuristics for Malware DetectionIntroductionHTTP !- Application layer protocol (client-server) - Transfers information using headers !“allows the client to pass additional information aboutthe request, and about the client itself, to the server”!- RFC2616!
HTTP Header Heuristics for Malware DetectionIntroductionHTTP request-header fields !- User-Agent: - Host: *required - Referer:
HTTP Header Heuristics for Malware DetectionIntroductionUser-Agent !"User-Agent" ":" 1*( product | comment )!!User-Agent: CERN-LineMode/2.15 libwww/2.17b3!
HTTP Header Heuristics for Malware DetectionIntroductionHost !Host = "Host" ":" host [ ":" port ]!!Host: www.w3.org!
HTTP Header Heuristics for Malware DetectionIntroductionReferer !Referer = "Referer" ":" ( absoluteURI | relativeURI )!!https://encrypted.google.com/#q=w3c
HTTP Header Heuristics for Malware DetectionOverviewIntroduction Analysis of HTTP heuristicsRecommendations Conclusion Resources
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsGeneral heuristics !- User-Agents - Typographic errors - URL complexity !Using p0f for generic malware detection !- Introduction - Demonstration - Deployment options - Considerations
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsUser-Agents !Proxy log example !!!
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsUser-Agents !- fairly static, but.. - a large number exist with BYOD, etc - works best when fine-tuned
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsUser-Agents, SNORT based signatures !- doesn’t present User-Agent of a possible standard build - doesn’t contain the correct OS
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsTypographic errors !- Explicitly hardcoded header fields MEDIANA PROTUX QUARIAN
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsTypographic errors, MEDIANA !Surplus white space (ACSII 0x20)
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsTypographic errors, MEDIANA !SNORT rule
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsTypographic errors, PROTUX !Surplus white space in URL
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsTypographic errors, QUARIAN !Other incorrect header fields
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity !- Some complexity will exist (valid Referer) - Servers shouldn’t rely on > 255 characters
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity, IXESHE !Absent Referer field
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity, TAIDOOR !Absent Referer field
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity, MONGALL !More extreme example
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity, NETTRAVELER !More extreme example
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristics
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity !Long & complex URLs do exist in legitimate traffic !- Microsoft-CryptoAPI service - Banner ads
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity !- Fine tune for your environment - Use with other heuristics
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsURL complexity !Snort rule using “urilen”
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsp0f: Introduction !- Passive fingerprinting tool - Assuming malware uses TCP library of the host OS - Uses structure of OSI model !TTL, Window Size, Sequence numbers !References a fingerprint library
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsp0f: Demonstration !- Generated traffic using wget and Firefox (header plug-in) - Conducted from a Windows 7 machine - Used a fixed User-Agent claiming to be IE6 on XP - Captured data using Fakenet
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicswget
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsFirefox modified
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsNETTRAVELER
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsLegitimate traffic
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsp0f: Deployment options !- gateway devices - part of a larger suite of network monitoring tools (using API)
HTTP Header Heuristics for Malware DetectionAnalysis of HTTP heuristicsp0f: Considerations !- Examines at the application and transport layers - Struggles to reliably detect the host OS - Relies on the spoof-ability of the malware author - Identifies malicious behavior fairly well - No tool or tool set will ever be 100% accurate!
HTTP Header Heuristics for Malware DetectionOverviewIntroduction Analysis of HTTP heuristics RecommendationsConclusion Resources
HTTP Header Heuristics for Malware DetectionRecommendations- Baseline your network - Lower the noise floor where possible - Heuristics work best when fine-tuned to the environment - Don’t rely on a single method for detection
HTTP Header Heuristics for Malware DetectionOverviewIntroduction Analysis of HTTP heuristics Recommendations ConclusionResources
HTTP Header Heuristics for Malware DetectionConclusion- Heuristics can be a useful tool in your arsenal - Compliments signature based IDS or host based
HTTP Header Heuristics for Malware DetectionResourcesLink to paper RFC2616, HTTP/1.1 http://practicalmalwareanalysis.com/fakenet/ p0f www.snort.org
HTTP Header Heuristics for Malware Detection2014-02-06: User-Agent strings!!Fedora release 19!-----------------!!Firefox: "Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0"!!Chrome: "Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"!!Seamonkey: "Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0 SeaMonkey/2.23"!!Midori: "Mozilla/5.0 (X11; Linux) AppleWebKit/537.32 (KHTML, like Gecko) Chrome/18.0.1025.133 Safari/537.32 Midori/0.5"!!!OS X 10.9.1!-----------!!Firefox: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0"!!Chrome: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107Safari/537.36"!!Safari: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_1) AppleWebKit/537.73.11 (KHTML, like Gecko) Version/7.0.1Safari/537.73.11"!!!Windows XP!----------!!Firefox: "Mozilla/5.0 (Windows NT 5.1; rv:23.0) Gecko/20100101 Firefox/23.0"!!IE: "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.1; .NET CLR3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E)"!!Chrome: "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36"!!Safari: "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2"
HTTP Header Heuristics for Malware DetectionThank You!everyone !www.sans.org !
clayball
oracle4engineer
lemiorhan
achamixx
okamototakuyasr2
leveragestech
i35_267
shkitayama
baseballyama
andpad
sansantech
holman
addyosmani
lara
mongodb
danielanewman
mojombo
bkeepers
brad_frost
jcasabona
sachag