Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the radar and would typically go unnoticed by IDS/Firewalls. Stuxnet also had a feature that the infected machines contacted and updated other infected machines via RPC in a P2P fashion.

My question here: What additions or changes might be required to have intelligent UTMs/IDSs which can detect such malware which tend to be stealthy and go under the radar?

I am not inviting speculations here, but knowledge-based opinions and some great ideas...

share|improve this question
    
Speaking of honeypots as a means to compliment IDS systems' role, this could be useful: code.google.com/p/ghost-usb-honeypot –  Ion Oct 11 '13 at 10:49
    
@Ion Stuxnet was anyways too smart for honeypots... –  pnp Oct 12 '13 at 9:35
2  
It's funny that you say "like stuxnet". A part of the Stuxnet program was to have spies plug in prepared USB sticks. It's not only a technical problem that needs to be solved in order to prevent Stuxnet 2.0. –  Luc Oct 12 '13 at 13:50
    
@Luc I understand your point. However, I am looking for only technical viewpoints here... –  pnp Oct 14 '13 at 5:09
add comment

3 Answers

I can think of some ways:

  1. Malware connect to C&C server. if you monitor your traffic (as sensitive system should be monitored) - than you find unusual traffic that can be sign (and should be investigated)

  2. If the malware uses USB flash drives to spread itself, and you have different computer platforms in your environment (e,g: windows, mac, linux and BSD systems), than you will see other platforms executables on the flash drives. This way you have a real "sample" of the malware to analyze. (most malware are platform specific), so you can see the malware files if you connect the flash drive to a non-windows machine without the risk of being infected)

  3. Honeypots - You said that stuxnet is too smart to fall in honeypots, but I think that it all about who is smarter - the honeypot or the malware. If you use a common honeypot - the malware will ignore it for sure, but if the honeypot is using new techniques - it will not be detected as one by malwares. keep in mind that some highly sophiticated malware, like Duqu and Flame, do spread only when instructed by C&C servers, that makes them much less vulnerable to finding by honeypots.

After I wrote this, I went to see how Stuxnet was found, Stuxnet itself was detected because of a bug who made BSOF on infected computers (source). Flame was found while researchers were looking for another malware. I couldn't find how Duqu was found.

So we can all be very clever, but what we really need to find such sophisticated viruses is luck...

share|improve this answer
1  
Ummm... disagreed with point 1. Stuxnet was pretty stealthy- the detection systems could never understand its actions as 'unusual'. Plus it upgraded itself in a P2P fashion. Centralized C&C is not present in P2P-based botnets, AFAIK. Rgding point 2- it is more of 'damage control' and analysis after being infected. What about detecting it before? Rgding point 3- you mention that smarter honeypots may help, but you do not mention how to go about having 'new techniques' ... And luck ... c'mon! –  pnp Oct 14 '13 at 5:18
    
1.it all depends - are you "blacklisting" stuff or "whitelisting" stuff, whitelist can see some encrypted packets to an unknown server. 1B. P2P can be suspicious too (depends on the functionality and the structure of your system and your network). 2. To detect before - you have to use behavioral analysis of the files before you run them. won't work for stuxnet. 3. A technique is considered "new" until somebody publishs it on the net or in a book, so... –  Ohad Cohen Oct 14 '13 at 10:23
add comment

Your question can be seen in broader context: How to defend against an APT (advanced persistent threat) style attack (aka targeted attack).

Qucik recap about main characteristics of APT attacks:

Attack vector

As seen so far, most such attacks use one of three attack vectors (with some examples):

  1. spear phising:
  2. infected USB:
  3. strategic web compromises

In practice all of this 3 predominant attack vectors can't be prevented for 100% in any larger company with big enough network and large number of employees. So because prevention eventaully fails we have to build our defense on detection capabilities. But as we all know detecting targeted attacks is hard and such attacks can run unnoticed for years as APT1 Mandinat Report showed us. It is hard mainly because of stealthiness of malware used in these attacks.

Stealthiness

Stealthiness of targeted attacks is based on fact that malware used in executing this kind of attack is custom malware - it hasn't been seen in the wild before by AV software, IDS systems don't have signatures for it, etc.

Defense approaches

Defense concepts against such attacks still emerges and evolves, some notable examples:

Lockheed martin's approach based on Threat Intelligence & Kill Chains (link1 link2)

OR

RSA's and Center for Internet Security's cyber-risk intelligence approach (link1 link2)

share|improve this answer
add comment

It is believed that Stuxnet was created by a major entity (such as government) which means that it was created by experts that knew very well what they were doing and made it extremely hard to detect. In fact they could have worked with different companies which own the knowledge, products, or technologies which they were specifically attacking. With that said I believe the best way to detect this sort of malware is to use a policy based security (i.e. Symantec Critical System protection) which are more pro-active than reactive. With this sort of policy based technology you can limit the system to perform only certain activities that expected from it. For example, the security policy can be set so that it blocks any RPC communication. If RPC communication is occurring it would trigger warning message logs. These warning messages can be correlated using the tool's central reporting console to detect a disparity on what the system is doing and how it is moving away from its normal operation.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.