1 1 00:00:00,270 --> 00:00:01,530 Consumption. 2 2 00:00:01,530 --> 00:00:02,700 In the last lesson, 3 3 00:00:02,700 --> 00:00:05,760 we looked at how you can do a basic memory analysis 4 4 00:00:05,760 --> 00:00:08,850 to look at different processes and the memory usage. 5 5 00:00:08,850 --> 00:00:10,620 Now, this is actually a big task, 6 6 00:00:10,620 --> 00:00:12,630 especially if you're trying to do it in real time 7 7 00:00:12,630 --> 00:00:16,140 looking for signs of malicious code or malicious behavior, 8 8 00:00:16,140 --> 00:00:18,870 so you need to be able to find different ways to identify 9 9 00:00:18,870 --> 00:00:20,700 where you should focus your efforts. 10 10 00:00:20,700 --> 00:00:23,250 And one of those is by looking at consumption. 11 11 00:00:23,250 --> 00:00:25,440 Resource consumption is a key indicator 12 12 00:00:25,440 --> 00:00:26,820 of malicious activity, 13 13 00:00:26,820 --> 00:00:28,620 but you have to be careful here 14 14 00:00:28,620 --> 00:00:31,020 because just because something is using a lot of resources 15 15 00:00:31,020 --> 00:00:32,520 doesn't make it malicious. 16 16 00:00:32,520 --> 00:00:33,353 A lot of times, 17 17 00:00:33,353 --> 00:00:35,760 this will occur with legitimate software too. 18 18 00:00:35,760 --> 00:00:37,650 As I'm recording this video right now, 19 19 00:00:37,650 --> 00:00:41,340 my video recording software is using up a lot of resources. 20 20 00:00:41,340 --> 00:00:43,980 It's being very heavy on the processor and the memory. 21 21 00:00:43,980 --> 00:00:45,060 But it's not malicious. 22 22 00:00:45,060 --> 00:00:46,560 It's doing what I told it to do. 23 23 00:00:46,560 --> 00:00:47,940 So you have to keep that in mind 24 24 00:00:47,940 --> 00:00:49,830 as you're looking for legitimate activity 25 25 00:00:49,830 --> 00:00:51,660 versus malicious activity. 26 26 00:00:51,660 --> 00:00:53,190 Now, some of the things you can look at 27 27 00:00:53,190 --> 00:00:54,252 when you're measuring resources 28 28 00:00:54,252 --> 00:00:56,730 are things like your processor usage. 29 29 00:00:56,730 --> 00:00:59,520 Now, your process usage is the percentage of CPU time 30 30 00:00:59,520 --> 00:01:02,010 utilized on a per-process level. 31 31 00:01:02,010 --> 00:01:03,060 Now, in addition to this, 32 32 00:01:03,060 --> 00:01:05,010 you might look at your memory consumption. 33 33 00:01:05,010 --> 00:01:06,780 This is the amount of memory that's utilized 34 34 00:01:06,780 --> 00:01:08,730 on a per-process level. 35 35 00:01:08,730 --> 00:01:11,100 Again, we don't want to look at just an application, 36 36 00:01:11,100 --> 00:01:12,810 but on a single process 37 37 00:01:12,810 --> 00:01:13,995 because this allows us to identify 38 38 00:01:13,995 --> 00:01:16,710 if a single process has become victim 39 39 00:01:16,710 --> 00:01:19,110 of some kind of malicious activity. 40 40 00:01:19,110 --> 00:01:20,400 Now, to understand this, 41 41 00:01:20,400 --> 00:01:22,230 you have to first look at your baseline 42 42 00:01:22,230 --> 00:01:23,430 or your normal usage, 43 43 00:01:23,430 --> 00:01:24,900 just like we talked about before. 44 44 00:01:24,900 --> 00:01:27,660 If you understand what normal looks like for a process, 45 45 00:01:27,660 --> 00:01:30,240 then you can compare it against what you're observing now. 46 46 00:01:30,240 --> 00:01:31,170 And based on that, 47 47 00:01:31,170 --> 00:01:33,630 that would help you determine if it's suspicious. 48 48 00:01:33,630 --> 00:01:37,260 For example, right now my process that's recording this 49 49 00:01:37,260 --> 00:01:40,020 is using about 50% of a processor. 50 50 00:01:40,020 --> 00:01:42,510 Now, is that normal or is that suspicious? 51 51 00:01:42,510 --> 00:01:44,850 Well, I know that normally when I record a video 52 52 00:01:44,850 --> 00:01:46,560 it uses about 50%. 53 53 00:01:46,560 --> 00:01:49,650 If that jumped up to 75, that would be suspicious. 54 54 00:01:49,650 --> 00:01:51,150 So an understanding what normal is 55 55 00:01:51,150 --> 00:01:52,650 and what deviates from baseline 56 56 00:01:52,650 --> 00:01:54,660 really does help you identify what's suspicious 57 57 00:01:54,660 --> 00:01:56,310 and should be looked at further. 58 58 00:01:56,310 --> 00:01:59,018 Now, on a Windows system, you can look at this information 59 59 00:01:59,018 --> 00:02:01,560 by going into your Task Manager. 60 60 00:02:01,560 --> 00:02:02,490 Here on the screen, 61 61 00:02:02,490 --> 00:02:04,770 you can see all the different apps that are running, 62 62 00:02:04,770 --> 00:02:06,270 the amount of CPU being used, 63 63 00:02:06,270 --> 00:02:07,830 and the memory being used, 64 64 00:02:07,830 --> 00:02:11,010 and that way you can identify what is normal and what isn't. 65 65 00:02:11,010 --> 00:02:12,630 If you click on one of those columns, 66 66 00:02:12,630 --> 00:02:14,250 right now we are sorting it by name, 67 67 00:02:14,250 --> 00:02:15,960 but we could click on CPU or memory 68 68 00:02:15,960 --> 00:02:18,630 and see which ones are the biggest offenders. 69 69 00:02:18,630 --> 00:02:21,000 As I look down the column for memory right now, 70 70 00:02:21,000 --> 00:02:23,820 I see one of the biggest offenders is actually Vivaldi, 71 71 00:02:23,820 --> 00:02:25,440 which is a 32 bit program, 72 72 00:02:25,440 --> 00:02:27,990 and it has six processes running underneath it. 73 73 00:02:27,990 --> 00:02:29,910 Now, as I look at it as a per-process level, 74 74 00:02:29,910 --> 00:02:32,280 I see the first one is 1.3 megabytes, 75 75 00:02:32,280 --> 00:02:34,200 the second one is 15.2 megabytes, 76 76 00:02:34,200 --> 00:02:37,350 and the third one is 155.6 megabytes. 77 77 00:02:37,350 --> 00:02:40,230 So if I was looking at one that might be suspicious, 78 78 00:02:40,230 --> 00:02:42,300 the first one I would look at is that third one, 79 79 00:02:42,300 --> 00:02:44,610 that 155.6 megabytes, 80 80 00:02:44,610 --> 00:02:47,700 because it is so much larger than the other two processes. 81 81 00:02:47,700 --> 00:02:50,010 Now, does that mean automatically it's malicious? 82 82 00:02:50,010 --> 00:02:51,570 No, of course not, 83 83 00:02:51,570 --> 00:02:53,940 but it is the one that I would look at first. 84 84 00:02:53,940 --> 00:02:56,400 So while it's really easy to use Task Manager 85 85 00:02:56,400 --> 00:02:57,660 inside of Windows, 86 86 00:02:57,660 --> 00:03:00,390 we have to have tools that we can use for Linux servers too 87 87 00:03:00,390 --> 00:03:02,700 because you will do some instant responses there. 88 88 00:03:02,700 --> 00:03:05,010 Now, there are two main tools that we're going to use for that. 89 89 00:03:05,010 --> 00:03:07,200 The first one is known as free. 90 90 00:03:07,200 --> 00:03:09,180 Free is a command that outputs a summary 91 91 00:03:09,180 --> 00:03:11,430 of the available used and freely available memory 92 92 00:03:11,430 --> 00:03:12,480 on a computer. 93 93 00:03:12,480 --> 00:03:14,400 Essentially, how much memory do you have 94 94 00:03:14,400 --> 00:03:15,960 and how much is available? 95 95 00:03:15,960 --> 00:03:17,130 To run the command free, 96 96 00:03:17,130 --> 00:03:18,900 just type in free and hit Enter, 97 97 00:03:18,900 --> 00:03:20,910 and you'll get a screen that looks like this. 98 98 00:03:20,910 --> 00:03:22,349 Here, you can see the amount of total memory 99 99 00:03:22,349 --> 00:03:24,060 and the amount that's used 100 100 00:03:24,060 --> 00:03:27,390 both for the physical memory and the swap file. 101 101 00:03:27,390 --> 00:03:30,420 Now, in addition to this, you can use the top command. 102 102 00:03:30,420 --> 00:03:33,420 The top command works a lot like Task Manager. 103 103 00:03:33,420 --> 00:03:35,700 Top is a command that creates a scrollable table 104 104 00:03:35,700 --> 00:03:37,050 of every running process 105 105 00:03:37,050 --> 00:03:38,121 and is constantly refreshed 106 106 00:03:38,121 --> 00:03:41,040 so that you could see the most up-to-date statistics. 107 107 00:03:41,040 --> 00:03:42,240 I really like the top command 108 108 00:03:42,240 --> 00:03:45,000 because it's a really easy way to look at everything. 109 109 00:03:45,000 --> 00:03:46,500 So as I look at the top command, 110 110 00:03:46,500 --> 00:03:48,540 up at the top I get a lot of the same information 111 111 00:03:48,540 --> 00:03:49,830 that I had from free. 112 112 00:03:49,830 --> 00:03:52,530 I have the amount of memory, the total and the free memory. 113 113 00:03:52,530 --> 00:03:54,870 I see how much was used and how much is in buffer. 114 114 00:03:54,870 --> 00:03:56,100 If I go down to the bottom, 115 115 00:03:56,100 --> 00:03:59,163 I can see this list of processes listed by PID. 116 116 00:04:00,000 --> 00:04:01,710 Now, as I'm looking at it from PID, 117 117 00:04:01,710 --> 00:04:03,030 I get that for the first column, 118 118 00:04:03,030 --> 00:04:05,280 I then see the user that launched it. 119 119 00:04:05,280 --> 00:04:07,530 For PID 1, which is our system daemon, 120 120 00:04:07,530 --> 00:04:10,200 we have the root, which is the one who launched that. 121 121 00:04:10,200 --> 00:04:11,520 As you go across to the right, 122 122 00:04:11,520 --> 00:04:13,680 you'll see columns for the CPU percentage 123 123 00:04:13,680 --> 00:04:15,000 and the memory percentage 124 124 00:04:15,000 --> 00:04:16,710 and the time it's been online, 125 125 00:04:16,710 --> 00:04:19,110 and then what command was being used. 126 126 00:04:19,110 --> 00:04:21,180 All of these are commands that are used, 127 127 00:04:21,180 --> 00:04:22,920 and a lot of them look just like we had 128 128 00:04:22,920 --> 00:04:25,770 inside the Task Manager inside of Windows. 129 129 00:04:25,770 --> 00:04:27,000 Now, in addition to top, 130 130 00:04:27,000 --> 00:04:29,724 there's actually a newer version known as htop. 131 131 00:04:29,724 --> 00:04:32,280 Now, the htop utility is going to provide 132 132 00:04:32,280 --> 00:04:34,620 similar functionality plus mouse support, 133 133 00:04:34,620 --> 00:04:37,410 and it contains a more easy to read output 134 134 00:04:37,410 --> 00:04:39,990 when it's run in the default configuration. 135 135 00:04:39,990 --> 00:04:41,130 So if I look at this, 136 136 00:04:41,130 --> 00:04:42,660 you get something that looks like this. 137 137 00:04:42,660 --> 00:04:43,980 First of all, you'll notice 138 138 00:04:43,980 --> 00:04:45,960 there is more of a graphical display to this 139 139 00:04:45,960 --> 00:04:48,510 with some coloring instead of just being black and white. 140 140 00:04:48,510 --> 00:04:49,980 Additionally, I have this little graph 141 141 00:04:49,980 --> 00:04:53,310 in the top left corner showing memory and CPU usage. 142 142 00:04:53,310 --> 00:04:54,570 Also, on the right side, 143 143 00:04:54,570 --> 00:04:57,030 I could see the average load and the amount of uptime 144 144 00:04:57,030 --> 00:04:59,850 and how many tasks we have total and how many are running. 145 145 00:04:59,850 --> 00:05:03,570 Here, we can also see our PID on the left, we get our user, 146 146 00:05:03,570 --> 00:05:06,540 and as we move to the right, we see our CPU and our memory. 147 147 00:05:06,540 --> 00:05:08,040 This one has actually been sorted 148 148 00:05:08,040 --> 00:05:10,140 with the highest memory on top, 149 149 00:05:10,140 --> 00:05:12,270 which in this case is actually htop. 150 150 00:05:12,270 --> 00:05:13,740 Now, the nice thing about htop 151 151 00:05:13,740 --> 00:05:16,080 is it's very easy to sort by different columns. 152 152 00:05:16,080 --> 00:05:19,440 You'll notice here we have F6 which is the sort by function. 153 153 00:05:19,440 --> 00:05:20,490 As we hit F6, 154 154 00:05:20,490 --> 00:05:24,690 we can choose whether we want to sort by PID, CPU, or memory. 155 155 00:05:24,690 --> 00:05:26,580 For instance, if I wanted to see which process 156 156 00:05:26,580 --> 00:05:28,080 is using the most memory, 157 157 00:05:28,080 --> 00:05:30,120 I can do that by sorting by memory. 158 158 00:05:30,120 --> 00:05:31,050 And if I did that, 159 159 00:05:31,050 --> 00:05:32,730 right now I'm just looking down the column, 160 160 00:05:32,730 --> 00:05:34,170 I can see that bash, 161 161 00:05:34,170 --> 00:05:37,410 the last process there on the list at 3645, 162 162 00:05:37,410 --> 00:05:38,460 would be the highest 163 163 00:05:38,460 --> 00:05:41,910 because it's using 2.3% of the total memory. 164 164 00:05:41,910 --> 00:05:43,971 Now, why is looking at memory important? 165 165 00:05:43,971 --> 00:05:47,520 Well, because it could indicate that you have memory issues, 166 166 00:05:47,520 --> 00:05:50,370 whether these are memory leaks or memory overflows. 167 167 00:05:50,370 --> 00:05:51,900 When we deal with a memory overflow, 168 168 00:05:51,900 --> 00:05:53,910 this is a means of exploiting a vulnerability 169 169 00:05:53,910 --> 00:05:56,910 inside an application to execute arbitrary code 170 170 00:05:56,910 --> 00:05:58,200 or to crash the process, 171 171 00:05:58,200 --> 00:05:59,549 or an ongoing memory leak 172 172 00:05:59,549 --> 00:06:02,340 will be used to crash the entire system. 173 173 00:06:02,340 --> 00:06:05,400 Now, if you suspect you may have a memory overflow issue, 174 174 00:06:05,400 --> 00:06:07,200 what can you do to test that? 175 175 00:06:07,200 --> 00:06:09,750 Well, you can take the code for that program 176 176 00:06:09,750 --> 00:06:12,930 and run it inside a sandbox debugging environment. 177 177 00:06:12,930 --> 00:06:14,640 This will allow you to find the process 178 178 00:06:14,640 --> 00:06:17,550 that might be exploiting a buffer overflow condition. 179 179 00:06:17,550 --> 00:06:20,610 By doing this, you can end up figuring is that code good 180 180 00:06:20,610 --> 00:06:22,186 or is that code malicious? 181 181 00:06:22,186 --> 00:06:24,360 Now, by putting it in the sandbox, 182 182 00:06:24,360 --> 00:06:26,040 you can start observing its behavior 183 183 00:06:26,040 --> 00:06:27,990 and trying to identify a signature. 184 184 00:06:27,990 --> 00:06:29,490 Once you find a signature, 185 185 00:06:29,490 --> 00:06:31,050 you as an analyst can now identify 186 186 00:06:31,050 --> 00:06:32,970 any of these buffer overflow attacks 187 187 00:06:32,970 --> 00:06:36,450 by the signature created by that particular exploit code. 188 188 00:06:36,450 --> 00:06:38,310 Now, what do I mean by a signature? 189 189 00:06:38,310 --> 00:06:41,670 Well, this is a way of doing business for that exploit code. 190 190 00:06:41,670 --> 00:06:42,720 One of the most common things 191 191 00:06:42,720 --> 00:06:44,130 that we see with buffer overflows 192 192 00:06:44,130 --> 00:06:46,620 is they use what's called a NOP sled. 193 193 00:06:46,620 --> 00:06:48,780 Now, a NOP sled works like this. 194 194 00:06:48,780 --> 00:06:51,630 Here is a graphical depiction of my memory. 195 195 00:06:51,630 --> 00:06:53,400 Up to the top, I have the shell code, 196 196 00:06:53,400 --> 00:06:54,780 and as I go down the stack, 197 197 00:06:54,780 --> 00:06:57,270 you'll see things called NOP or NOP. 198 198 00:06:57,270 --> 00:06:58,950 NOP is essentially a command 199 199 00:06:58,950 --> 00:07:01,470 that tells the computer to do nothing, 200 200 00:07:01,470 --> 00:07:03,330 just move to the next memory location 201 201 00:07:03,330 --> 00:07:04,890 and keep executing the program. 202 202 00:07:04,890 --> 00:07:06,900 Essentially, it's like blank space. 203 203 00:07:06,900 --> 00:07:09,660 So for example, if I started out on the first green NOP, 204 204 00:07:09,660 --> 00:07:10,493 I'm going to execute NOP, 205 205 00:07:10,493 --> 00:07:12,870 which says do nothing, move to the next spot. 206 206 00:07:12,870 --> 00:07:14,220 That moves me to the next NOP, 207 207 00:07:14,220 --> 00:07:15,870 do nothing, move to the next spot. 208 208 00:07:15,870 --> 00:07:17,250 That says relative jump, 209 209 00:07:17,250 --> 00:07:19,050 which means I'm going to take that 210 210 00:07:19,050 --> 00:07:21,750 and jump down to the next link that I was supposed to go to, 211 211 00:07:21,750 --> 00:07:23,790 which in this case is another NOP. 212 212 00:07:23,790 --> 00:07:24,810 Once I reach that NOP, 213 213 00:07:24,810 --> 00:07:26,790 I'm going to go through all four of those NOPs. 214 214 00:07:26,790 --> 00:07:28,350 This would be called a NOP sled 215 215 00:07:28,350 --> 00:07:30,143 because I'm essentially skiing across, 216 216 00:07:30,143 --> 00:07:33,420 going down the hill of those four NOPs. 217 217 00:07:33,420 --> 00:07:35,790 As I keep doing that, I go through all of them, 218 218 00:07:35,790 --> 00:07:37,530 and I get down to the final line, 219 219 00:07:37,530 --> 00:07:40,620 which is NOP, NOP, and then relative jump. 220 220 00:07:40,620 --> 00:07:41,970 Once I get to that relative jump, 221 221 00:07:41,970 --> 00:07:43,830 I'm going to jump up to where I'm told, 222 222 00:07:43,830 --> 00:07:45,930 which in this case is the shell code. 223 223 00:07:45,930 --> 00:07:47,880 That shell code has my exploit, 224 224 00:07:47,880 --> 00:07:50,400 which means I now can run the exploit. 225 225 00:07:50,400 --> 00:07:53,160 This is essentially how a buffer overflow attack works. 226 226 00:07:53,160 --> 00:07:55,080 We try to overflow the buffer, 227 227 00:07:55,080 --> 00:07:56,490 write in a bunch of these NOPs, 228 228 00:07:56,490 --> 00:07:58,560 and then a relative jump into a location 229 229 00:07:58,560 --> 00:08:00,420 that we know our shell code is. 230 230 00:08:00,420 --> 00:08:01,380 And by doing this, 231 231 00:08:01,380 --> 00:08:03,210 we can randomly guess whenever a program 232 232 00:08:03,210 --> 00:08:04,150 tries to execute something, 233 233 00:08:04,150 --> 00:08:05,983 it might land on one of these NOPs, 234 234 00:08:05,983 --> 00:08:08,106 slide down into a relative jump, 235 235 00:08:08,106 --> 00:08:10,800 and then push us up to the shell code. 236 236 00:08:10,800 --> 00:08:14,070 So why would an attacker try to do a memory overflow 237 237 00:08:14,070 --> 00:08:15,420 or a memory consumption 238 238 00:08:15,420 --> 00:08:18,390 or a memory leak or a processor consumption? 239 239 00:08:18,390 --> 00:08:21,060 Well, they do this to create a denial of service condition. 240 240 00:08:21,060 --> 00:08:23,580 Now, I know we've mentioned denial of services before, 241 241 00:08:23,580 --> 00:08:24,840 but again, as a review, 242 242 00:08:24,840 --> 00:08:26,790 I want you to remember that a denial of service 243 243 00:08:26,790 --> 00:08:29,730 is an attack meant to shut down a machine or a network 244 244 00:08:29,730 --> 00:08:32,820 that makes it inaccessible for its intended purpose. 245 245 00:08:32,820 --> 00:08:35,370 So if I start using a computer 246 246 00:08:35,370 --> 00:08:37,350 and I start taking up a lot of its resources, 247 247 00:08:37,350 --> 00:08:39,067 that can make it so it doesn't have resources 248 248 00:08:39,067 --> 00:08:40,920 for other things it needs to do. 249 249 00:08:40,920 --> 00:08:42,870 This is a denial of service condition. 250 250 00:08:42,870 --> 00:08:45,270 So one type of denial of service attack method 251 251 00:08:45,270 --> 00:08:48,450 is to cause an application to overrun its memory buffer 252 252 00:08:48,450 --> 00:08:50,490 to trigger an execution failure. 253 253 00:08:50,490 --> 00:08:53,910 This can lead to a program crash or even a system crash. 254 254 00:08:53,910 --> 00:08:54,870 And if that happens, 255 255 00:08:54,870 --> 00:08:57,570 you have now conducted a denial of service against it.