NIST SP800-83：全面指南：防范与处理恶意软件事件

需积分: 5 81 浏览量更新于2024-07-16 收藏 2.9MB PDF 举报

NIST SP800-83，由美国国土安全部赞助，是关于恶意软件（malware）威胁管理和应对的一份指南。这份特别出版物旨在帮助组织理解不同类型的恶意软件所带来的风险，并提供实用的策略来预防和有效地处理这些安全事件。它涵盖了以下几个关键知识点： 1. 背景与威胁概述：文档首先阐述了恶意软件的基本概念，包括病毒、蠕虫、特洛伊木马、间谍软件等主要类别，使读者对潜在威胁有全面的认识。 2. 预防措施：针对各类恶意软件，指南提供了具体的预防措施，如更新操作系统和应用程序补丁、实施强密码策略、使用防病毒和反恶意软件软件、网络访问控制和防火墙设置等，以降低感染风险。 3. 教育和意识：强调员工的安全培训和意识提升，因为人为因素往往是恶意软件传播的一个重要环节。通过提高用户识别和抵御恶意软件的能力，可以减少内部攻击的可能性。 4. 响应计划：指南还详细阐述了如何制定和执行应急响应计划，包括发现和确认恶意软件事件、隔离受影响系统、取证分析、恢复数据和系统、以及通知相关人员和监管机构等步骤。 5. 指导原则与最佳实践：NIST推荐了一套标准化的操作流程和风险管理框架，确保组织在处理恶意软件事件时遵循一致且有效的方法。 6. 角色与责任：明确了在预防和应对过程中各层级人员的职责，包括管理层、安全团队和技术支持人员的角色定义，以确保协同工作和责任分明。 7. 技术与法律合规：讨论了涉及的数据保护法规，如美国的《电子通信隐私法》(ECPA)和《计算机欺诈和滥用法》(CFAA)，以及如何在符合法律要求的同时进行安全操作。 8. 持续改进：指南鼓励组织定期评估和更新其恶意软件防御措施，以便适应不断演变的威胁环境。 NIST SP800-83是一份实用的参考文献，为信息安全专业人员提供了关于恶意软件管理的深入洞察，对于企业、政府机构和组织来说，它是提升网络安全态势、防范和减轻恶意软件影响的重要工具。

GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING

program, it propagates to infect other programs on the system, as well as other systems that use a

shared infected program. Jerusalem and Cascade are two of the best known file infector viruses.

 Boot Sector. A boot sector virus infects the master boot record (MBR) of a hard drive or the

boot sector of a hard drive or removable media, such as floppy diskettes. The boot sector is an

area at the beginning of a drive or disk where information about the drive or disk structure is

stored. Boot sectors contain boot programs that are run at host startup to boot the OS. The MBR

of a hard drive is a unique location on the disk where a computer’s basic input/output system

(BIOS) can locate and load the boot program. Removable media, such as floppy disks, need not

be bootable to infect the system; if an infected disk is in the drive when the computer boots, the

virus could be executed. Boot sector viruses are easily concealed, have a high rate of success,

and can harm a computer to the point of making it completely inoperable. Symptoms of boot

sector virus infection on a computer include an error message during booting or the inability to

boot. Form, Michelangelo, and Stoned are examples of boot sector viruses.

 Multipartite. A multipartite virus uses multiple infection methods, typically infecting both files

and boot sectors. Accordingly, multipartite viruses combine the characteristics of file infector

and boot sector viruses. Examples of multipartite viruses include Flip and Invader.

In addition to infecting files, compiled viruses can reside in the memory of infected systems so that each

time a new program is executed, the virus infects the program. Among compiled viruses, boot sector

viruses are the most likely to be memory resident. Viruses that are memory resident stay in memory for

an extended period of time and therefore are likely to infect more files and to interfere more frequently

with normal system operations than non-memory-resident viruses.

2.1.2

Interpreted Viruses

Unlike compiled viruses, which can be executed by an OS, interpreted viruses are composed of source

code that can be executed only by a particular application or service. Interpreted viruses have become

very common because they are much easier to write and modify than other types of viruses. A relatively

unskilled attacker can acquire an interpreted virus, review and modify its source code, and distribute it to

others. There are often dozens of variants of a single interpreted virus, most with only trivial changes

from the original. The two major types of interpreted viruses are macro viruses and scripting viruses.

Macro viruses are the most prevalent and successful type of virus. These viruses attach themselves to

application documents, such as word processing files and spreadsheets, and use the application’s macro

programming language to execute and propagate. Macro viruses use the macro programming capabilities

that many popular software packages, such as Microsoft Office, use to automate complex or repetitive

tasks. These viruses tend to spread quickly because users frequently share documents from applications

with macro capabilities. In addition, when a macro virus infection occurs, the virus infects the template

that the program uses to create and open files. Once a template is infected, every document that is created

or opened with that template is also infected. The Concept, Marker, and Melissa viruses are well-known

examples of macro viruses.

Scripting viruses are very similar to macro viruses. The primary difference is that a macro virus is written

in a language understood by a particular application, such as a word processor, whereas a scripting virus

is written in a language understood by a service run by the OS. For example, the Windows Scripting Host

For more information on these examples, as well as the other examples cited throughout this section, visit the virus

information Web sites listed in the Technical Resource Sites section of Appendix F. The compiled virus examples listed in

this section are mostly from the early 1990’s, when they were the most common form of malware.

2-2

GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING

feature on some Microsoft Windows systems can execute scripts written in VBScript. Examples of well-

known scripting viruses are First and Love Stages.

2.1.3

Virus Obfuscation Techniques

Most viruses are created using one or more obfuscation techniques—ways of constructing a virus that

make it more difficult to detect. If a virus is hard to detect, it is likely to spread more widely. The

following are commonly used obfuscation techniques:

 Self-Encryption and Self-Decryption. Some viruses can encrypt and decrypt their virus code

bodies, concealing them from direct examination. Viruses that employ encryption might use

multiple layers of encryption or random cryptographic keys, which make each instance of the

virus appear to be different, even though the underlying code is the same.

 Polymorphism. Polymorphism is a particularly robust form of self-encryption. A polymorphic

virus generally makes several changes to the default encryption settings, as well as altering the

decryption code. In a polymorphic virus, the content of the underlying virus code body does not

change; encryption alters its appearance only.

 Metamorphism. The idea behind metamorphism is to alter the content of the virus itself, rather

than hiding the content with encryption. The virus can be altered in several ways—for example,

by adding unneeded code sequences to the source code or changing the sequence of pieces of the

source code. The altered code is then recompiled to create a virus executable that looks

fundamentally different from the original.

 Stealth. A stealth virus uses various techniques to conceal the characteristics of an infection. For

example, many stealth viruses interfere with OS file listings so that the reported file sizes reflect

the original values and do not include the size of the virus added to each infected file.

 Armoring. The intent of armoring is to write a virus so that it attempts to prevent antivirus

software or human experts from analyzing the virus’s functions through disassembly, traces, and

other means.

 Tunneling. A virus that employs tunneling inserts itself into a low level of the OS so that it can

intercept low-level OS calls. By placing itself below the antivirus software, the virus attempts to

manipulate the OS to prevent detection by antivirus software.

Antivirus software vendors design their products to attempt to compensate for the use of any combination

of obfuscation techniques. Older obfuscation techniques, including self-encryption, polymorphism, and

stealth, are generally handled effectively by antivirus software. However, newer, more complex

obfuscation techniques, such as metamorphism, are still emerging and can be considerably more difficult

for antivirus software to overcome.

2.2 Worms

Worms are self-replicating programs that are completely self-contained, meaning that they do not require

a host program to infect a victim. Worms also are self-propagating; unlike viruses, they can create fully

functional copies and execute themselves without user intervention. This has made worms increasingly

popular with attackers, because a worm has the potential to infect many more systems in a short period of

time than a virus can. Worms take advantage of known vulnerabilities and configuration weaknesses,

For a more comprehensive list of virus obfuscation techniques, consult The Art of Computer Virus Research and Defense by

Peter Szor (Addison-Wesley, 2005).

2-3

GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING

such as unsecured Windows shares. Although some worms are intended mainly to waste system and

network resources, many worms damage systems by installing backdoors (discussed in Section 2.7.1),

perform distributed denial of service (DDoS) attacks against other hosts, or perform other malicious acts.

The two primary categories of worms are network service worms and mass mailing worms.

Network service worms spread by exploiting a vulnerability in a network service associated with an OS or

an application. Once a worm infects a system, it typically uses that system to scan for other systems

running the targeted service and then attempts to infect those systems as well. Because they act

completely without human intervention, network service worms can typically propagate more quickly

than other forms of malware. The rapid spread of worms and the intensive scanning they often perform to

identify new targets often overwhelm networks and security systems (e.g., network intrusion detection

sensors), as well as infected systems. Examples of network service worms are Sasser and Witty.

Mass mailing worms are similar to e-mail–borne viruses, with the primary difference being that mass

mailing worms are self-contained instead of infecting an existing file as e-mail–borne viruses do. Once a

mass mailing worm has infected a system, it typically searches the system for e-mail addresses and then

sends copies of itself to those addresses, using either the system’s e-mail client or a self-contained mailer

built into the worm itself. A mass mailing worm typically sends a single copy of itself to multiple

recipients at once. Besides overwhelming e-mail servers and networks with massive volumes of e-mails,

mass mailing worms often cause serious performance issues for infected systems. Examples of mass

mailing worms are Beagle, Mydoom, and Netsky.

2.3 Trojan Horses

Named after the wooden horse from Greek mythology, Trojan horses are non-replicating programs that

appear to be benign but actually have a hidden malicious purpose.

Some Trojan horses are intended to

replace existing files, such as system and application executables, with malicious versions; others add

another application to systems instead of overwriting existing files. Trojan horses tend to conform to any

of the following three models:

 Continuing to perform the function of the original program and also performing separate,

unrelated malicious activity (e.g., a game that also collects application passwords)

 Continuing to perform the function of the original program but modifying the function to perform

malicious activity (e.g., a Trojan horse version of a login program that collects passwords) or to

disguise other malicious activity (e.g., a Trojan horse version of a process-listing program that

does not display other malicious processes)

 Performing a malicious function that completely replaces the function of the original program

(e.g., a file that claims to be a game but actually just deletes all system files when it is run).

Trojan horses can be difficult to detect. Because many are specifically designed to conceal their presence

on systems and perform the original program’s function properly, users and system administrators may

not notice them. Many newer Trojan horses also make use of some of the same obfuscation techniques

that viruses use to avoid detection.

The use of Trojan horses to distribute spyware programs has become increasingly common. Spyware is

often bundled with software, such as certain peer-to-peer file sharing client programs; when the user

installs the supposedly benign software, it then covertly installs spyware programs. Trojan horses also

often deliver other types of attacker tools onto systems, which can provide unauthorized access to or

Trojan horses are sometimes referred to as Trojans.

2-4

GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING

usage of infected systems. These tools may be bundled with the Trojan horse or downloaded by the

Trojan horse after it is placed onto a system and run. Section 2.7 describes several types of malicious

tools that are commonly delivered by means of Trojan horses.

Trojan horses can cause serious technical issues on systems. For example, a Trojan horse that replaces

legitimate system executables may cause certain functionality to be performed incorrectly or lost

altogether. Spyware-related Trojan horses have been particularly disruptive to many systems because

they are often intentionally invasive, making many modifications to systems and deploying themselves so

that their removal causes serious disruption to the system, in some cases to the point where the system can

no longer function. Trojan horses and the tools they install can also be resource-intensive, causing

noticeable performance degradation on infected systems. Some well-known Trojan horses are SubSeven,

Back Orifice, and Optix Pro.

2.4 Malicious Mobile Code

Mobile code is software that is transmitted from a remote system to be executed on a local system,

typically without the user’s explicit instruction.

It has become a popular way of writing programs that

can be used by many different operating systems and applications, such as Web browsers and e-mail

clients. Although mobile code is typically benign, attackers have learned that malicious mobile code can

be an effective way of attacking systems, as well as a good mechanism for transmitting viruses, worms,

and Trojan horses to users’ workstations. Malicious mobile code differs significantly from viruses and

worms in that it does not infect files or attempt to propagate itself. Instead of exploiting particular

vulnerabilities, it often affects systems by taking advantage of the default privileges granted to mobile

code. Popular languages for malicious mobile code include Java, ActiveX, JavaScript, and VBScript.

One of the best-known examples of malicious mobile code is Nimda, which used JavaScript. Section 2.5

contains additional information on Nimda.

2.5 Blended Attacks

A blended attack is an instance of malware that uses multiple infection or transmission methods. The

well-known Nimda “worm” is actually an example of a blended attack.

It used four distribution

methods:

 E-mail. When a user on a vulnerable host opened an infected e-mail attachment, Nimda

exploited a vulnerability in the Web browser used to display HTML-based e-mail. After

infecting the host, Nimda then looked for e-mail addresses on the host and then sent copies of

itself to those addresses.

 Windows Shares. Nimda scanned hosts for unsecured Windows file shares; it then used

NetBIOS as a transport mechanism to infect files on that host. If a user ran an infected file, this

would activate Nimda on that host.

 Web Servers. Nimda scanned Web servers, looking for known vulnerabilities in Microsoft

Internet Information Services (IIS). If it found a vulnerable server, it attempted to transfer a copy

of itself to the server and to infect the server and its files.

For more information on mobile code, read NIST Special Publication (SP) 800-28, Guidelines on Active Content and Mobile

Code, available from the Computer Security Resource Center (CSRC) Web site at http://csrc.nist.gov/publications/nistpubs/

More information on Nimda is available from CERT®/CC Advisory CA-2001-26 Nimda Worm, available at

http://www.cert.org/advisories/CA-2001-26.html

2-5

GUIDE TO MALWARE INCIDENT PREVENTION AND HANDLING

 Web Clients. If a vulnerable Web client visited a Web server that had been infected by Nimda,

the client’s workstation would become infected.

In addition to using the methods described above, blended attacks can spread through such services as

instant messaging and peer-to-peer file sharing. Many instances of blended attacks, like Nimda, are

incorrectly referred to as worms because they have some worm characteristics. In fact, Nimda has

characteristics of viruses, worms, and malicious mobile code. Another example of a blended attack is

Bugbear, which acted as both a mass mailing worm and a network service worm. Because blended

attacks are more complex than single-method malware, they are considerably harder to create.

Blended attacks do not have to use multiple methods simultaneously to spread; they can also perform

multiple infections in sequence. This is becoming more popular, primarily as a way of delivering and

installing Trojan horses on systems. For example, a virus, a worm, or malicious mobile code that

successfully enters a system can install and run a copy of a Trojan horse. The Trojan horse can then

perform additional malicious acts, such as installing spyware on the system.

2.6 Tracking Cookies

A cookie is a small data file that holds information about the use of a particular Web site.

Session

cookies are temporary cookies that are valid only for a single Web site session. Persistent cookies are

stored on a computer indefinitely so that the site can identify the user during subsequent visits. The

intended use of a persistent cookie is to record user preferences for a single Web site so that the site can

automatically customize its appearance or behavior for the user’s future visits. In this way, persistent

cookies can help Web sites serve their users more effectively.

Unfortunately, persistent cookies also can be misused as spyware to track a user’s Web browsing

activities for questionable reasons without the user’s knowledge or consent. For example, a marketing

firm could place advertisements on many Web sites and use a single cookie on a user’s machine to track

the user’s activity on all of those Web sites, creating a detailed profile of the user’s behavior. Cookies

used in this way are known as tracking cookies. Information collected by tracking cookies is often sold to

other parties and used to target advertisements and other directed content at the user. Most spyware

detection and removal utilities specifically look for tracking cookies on systems.

Another way to capture and deliver a user’s private information is through the use of Web bugs. A Web

bug is a tiny graphic on a Web site that is referenced within the Hypertext Markup Language (HTML)

content of a Web page or e-mail. The graphic has no purpose other than to collect information about the

user viewing the HTML content. Web bugs are usually invisible to users because they typically consist of

only 1 pixel. Like tracking cookies, Web bugs are often used by marketing firms. They can collect

information such as the user’s Internet Protocol (IP) address and Web browser type and can also access a

tracking cookie. These actions enable Web bugs to be used as spyware to create personal profiles of

individual users.

2.7 Attacker Tools

As part of a malware infection or other system compromise, various types of attacker tools might be

delivered to a system. These tools, which are forms of malware, allow attackers to have unauthorized

access to or use of infected systems and their data, or to launch additional attacks. When transferred by

other malware, attacker tools can be delivered as part of the malware itself, (e.g., in a Trojan horse) or

delivered after an infection occurs. For example, a worm-infected system might be directed by the worm

Cookies often store data in plaintext, which could allow an unauthorized party that accesses a cookie to use or alter the data

stored in it. Some Web sites create encrypted cookies, which protect the data from unauthorized access.

2-6

剩余100页未读，继续阅读

艾米的爸爸

粉丝: 789
资源: 314

NIST SP800-83：全面指南：防范与处理恶意软件事件

NIST SP800-133：加密密钥生成建议

NIST SP800-94：入侵检测与预防系统指南

NIST SP800-126: SCAP 1.0技术规范

NIST SP800-83r1.pdf

NIST SP800-38C.pdf

NIST SP800-121.pdf

NIST SP800-25.pdf

NIST SP800-69.pdf

NIST SP800-29.pdf

NIST SP800-84.pdf

最新资源