Ayush Gandhi and 2 OthersDavid Giffin Zephyros Koyanis+Privacy: Public
Viruses and Antiviruses
Zephyros Koyanis
David Giffin
This project was about creating viruses and antiviruses to investigate and explore data security, shining light on the extreme difficulty in creating an effective antivirus in comparison to the simplicity of malware.
THESIS
Creeper - the first virus
ILOVEYOU - Infected 10% of the internet at the time
AIDS Trojan - First Ransomware
PRECEDENTS
Algorithm
Key: demokey Numkey: 3
Security Analysis
Timeline: This was used around the mid 20th century
But many modern encryptions use this function as a part of a larger algorithm
ENCRYPTION
Not that secure. Because the key repeats and the XOR and shift are the only operations, using a known translation(like a file header) can let people break the encryption. It isn't very easy to do without a significant time investment and computation power however.
Convert file data and text key into binary strings
Compare each bit of data with repeating key bits
Output 1 if bits differ, 0 if they match
Shift the binary by the numkey
Convert back to ASCII text
STATE DIAGRAM
Ransomware
Controlware
STATE DIAGRAM
Antivirus
STATE DIAGRAM
ANTIVIRUS
Scanning of directories and individual files for malicious programs
Analyzation of running processes
Ability to see what files are being run/accessed/edited
Able to monitor network connections(kinda)
YARA matching
Heuristic and behavioral threat detection
Beaconing detection
Process whitelisting
CPU, memory, disk and network usage analysis
FEATURES
CONTROLWARE
Able to click and scroll
Keys work
Encrypted communication
Able to handle multiple clients at once
RANSOMWARE
Has persistance mechanisms that make the program persist through system restarts and closing of the application
Encrypts files with XOR binary shift encryption
FEATURES
PROTOTYPES
PROTOTYPES
PROGRAM DASHBOARD
PROTOTYPES
ACTIVE PROCESS MONITORING
PROTOTYPES
ACTIVE NETWORK MONITORING
PROTOTYPES
THREAT ANALYSIS
PROTOTYPES
PROTOTYPES
DETAILED PROGRAM LOGGING
Get packet sniffing fully working on the antivirus
Make mouse control work on the controlware
Expand the ransomware to have slightly better encryption