An empirical study of real-world polymorphic code injection attacks

LEET 2009 - 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2009, Pages

  Polychronakis, Michalis ^a   Anagnostakis, Kostas G ^b   Markatos, Evangelos P ^a  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b INSTITUTE FOR INFOCOMM RESEARCH   (Singapore)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNET; COMPUTER VIRUSES;

CODE INJECTION ATTACKS; EMPIRICAL STUDIES; MALWARE FAMILIES; MALWARE PROPAGATION; NETWORK LEVEL; NETWORK SERVICES; PRODUCTION SYSTEM; REMOTE CODE;

CODES (SYMBOLS);

EID: 85084096732     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (23)

1. The metasploit project. http://www.metasploit.com/.
2. Microsoft Security Bulletin MS08-067 – Critical, Oct. 2008. http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx.
3. Calculating the Size of the Downadup Outbreak, Jan. 2009. http://www.f-secure.com/weblog/archives/00001584.html.
4. P. Bania. TAPiON, 2005. http://pb.specialised.info/all/tapion/.
5. K. Borders, A. Prakash, and M. Zielinski. Spector: Automatically analyzing shell code. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pages 501–514, 2007.
6. J. R. Crandall, Z. Su, S. F. Wu, and F. T. Chong. On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits. In Proceedings of the 12th ACM conference on Computer and communications security (CCS), pages 235–248, 2005.
7. T. Detristan, T. Ulenspiegel, Y. Malcom, and M. Underduk. Polymorphic shellcode engine using spectrum analysis. Phrack, 11(61), Aug. 2003.
8. th USENIX Security Symposium, 2006.
9. J. Goebel, T. Holz, and C. Willems. Measurement and analysis of autonomous spreading malware in a university environment. In Proceedings of the 4th international conference on Detection of Intrusions and Malware, & Vulnerability Assessment (DIMVA), pages 109–128, 2007.
10. K2. ADMmutate, 2001. http://www.ktwo.ca/ ADMmutate- 0.8.4.tar.gz.
11. C. Kruegel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Polymorphic worm detection using structural information of ex-ecutables. In Proceedings of the International Symposium on Recent Advances in Intrusion Detection (RAID), Sept. 2005.
12. J. Ma, J. Dunagan, H. J. Wang, S. Savage, and G. M. Voelker. Finding diversity in remote code injection exploits. In Proceedings of the 6th Internet Measurement Conference (IMC), pages 53–64, 2006.
13. M. Polychronakis, E. P. Markatos, and K. G. Anagnostakis. Network-level polymorphic shellcode detection using emulation. In Proceedings of the Third Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), July 2006.
14. M. Polychronakis, E. P. Markatos, and K. G. Anagnostakis. Emulation-based detection of non-self-contained polymorphic shellcode. In Proceedings of the 10th International Symposium on Recent Advances in Intrusion Detection (RAID), September 2007.
15. N. Provos, P. Mavrommatis, M. A. Rajab, and F. Monrose. All your iFRAMEs point to us. In Proceedings of the 17th USENIX Security Symposium, pages 1–16, 2008.
16. Rix. Writing ia32 alphanumeric shellcodes. Phrack, 11(57), Aug. 2001.
17. Skape. Understanding windows shellcode, 2003. http://www.hick.org/code/skape/papers/ win32- shellcode.pdf.
18. Skape. Implementing a custom x86 encoder. Uninformed, 5, Sept. 2006.
19. Y. Song, M. E. Locasto, A. Stavrou, A. D. Keromytis, and S. J. Stolfo. On the infeasibility of modeling polymorphic shellcode. In Proceedings of the 14th ACM conference on Computer and communications security (CCS), pages 541–551, 2007.
20. P. Ször. The Art of Computer Virus Research and Defense. Addison-Wesley Professional, February 2005.
21. B.-J. Wever. Alpha 2, 2004. http://www.edup.tudelft.nl/∼bjwever/src/alpha2.c.
22. V. Yegneswaran, P. Barford, and J. Ullrich. Internet intrusions: global characteristics and prevalence. In Proceedings of the 2003 ACM SIGMETRICS international conference on Measurement and modeling of computer systems, 2003.
23. Q. Zhang, D. S. Reeves, P. Ning, and S. P. Lyer. Analyzing network traffic to detect self-decrypting exploit code. In Proceedings of the 2nd ACM Symposium on Information, Computer and Communications Security (ASIACCS), pages 4–12, 2007.