바이러스, 웜, 트로이 목마

소프트웨어를 악성으로 만드는 요소

바이러스: 감염 및 자기 복제

# Virus detection evasion techniques:
# Polymorphic:  changes code signature each replication
# Metamorphic:  rewrites itself entirely each time (harder to detect)
# Stealth:      intercepts OS calls to hide infected files
# Encrypted:    body encrypted, only decryptor visible to scanner

# File infector: appends or prepends code to executable
# Macro virus:   lives in Office document; runs via VBA macros
# Boot sector:   infects MBR/VBR; loads before OS; bypasses AV

웜: 호스트 없이 자기 전파

# Worm propagation methods:
# Network vulnerability: EternalBlue (SMBv1 RCE) - WannaCry, NotPetya
# Credential brute-force: weak/default passwords (Mirai)
# Email: attaches to outgoing email (ILOVEYOU worm)
# IM/Social: spreads via messaging platforms
# File shares: copies to network drives

# WannaCry timeline:
# 1. Exploits EternalBlue (SMBv1 CVE-2017-0144)
# 2. Installs DoublePulsar backdoor
# 3. Deploys ransomware payload
# 4. Scans for more SMBv1 hosts -> repeat

트로이 목마: 위장된 악성 코드

# Trojan examples and categories:
# Backdoor Trojan: opens listening port for remote control
# RAT (Remote Access Trojan): full remote control, keylog, screenshot
#   Examples: DarkComet, NetBus, Sub7, njRAT, AsyncRAT
# Downloader Trojan: downloads and installs additional malware
#   Examples: Emotet (banking -> loader), TrickBot
# Banking Trojan: intercepts online banking sessions
#   Examples: Zeus, Dridex, Ursnif
# Fake AV: pretends to be antivirus, demands payment to 'clean'

바이러스, 웜 및 트로이 목마 비교

# Classification comparison:
# Characteristic      Virus    Worm    Trojan
# Requires host file    YES      NO      NO
# Self-replicates       YES      YES     NO
# Requires user action  YES      NO      YES (install)
# Network spread        SLOW     FAST    NO (user-driven)
# Typical goal          Damage   Spread  Persistence/backdoor

봇넷 및 명령 및 제어(C2)

# C2 detection indicators:
# Beaconing: regular outbound connections at fixed intervals
# Unusual DNS: long subdomains, high query volume, new domains
# HTTPS to non-CDN IPs: encrypted C2 often uses bulletproof hosting
# Non-standard port HTTPS: HTTPS on port 8443, 4443, etc.
# Large outbound data: data exfiltration spike

# Block C2 at network level:
# DNS sinkhole + proxy with URL categorization
# Threat intelligence feeds for known C2 domains/IPs

바이러스 서명 탐지와 행위 기반 탐지

# Detection method comparison:
# Signature-based:
#   + Fast, low false-positive rate for known malware
#   - Fails on new, polymorphic, encrypted malware

# Heuristic:
#   + Catches variants of known families
#   - Higher false-positive rate

# Behavioral (EDR):
#   + Catches zero-day and fileless malware
#   - Requires tuning to reduce alert fatigue

# Sandbox:
#   + Definitive judgment by observing actual execution
#   - Sophisticated malware detects sandbox and stays dormant

다중 감염형 및 매크로 바이러스

# Macro virus defense - Group Policy:
# Office 365/2016+: Trust Center -> Macro Settings
# 'Disable all macros except digitally signed macros'
# Or: 'Disable all macros with notification'
#
# Advanced: Attack Surface Reduction (ASR) rules in Defender:
# 'Block all Office applications from creating child processes'
# 'Block Office applications from creating executable content'
# 'Block execution of potentially obfuscated scripts'

전파 방지 전략

# Disable SMBv1 (prevent WannaCry-style worm propagation):
# PowerShell:
Set-SmbServerConfiguration -EnableSMB1Protocol $false
# Or Group Policy:
# Computer Config -> Admin Templates -> Network -> Lanman Server
# 'Enable insecure guest logons' = Disabled

# Verify SMBv1 is disabled:
Get-SmbServerConfiguration | Select EnableSMB1Protocol

드라이브 바이 다운로드 및 워터링 홀 공격

# Drive-by download defense:
# 1. Keep browser, OS, and plugins fully patched
# 2. Disable Flash, Java, and legacy plugins entirely
# 3. Use web proxy with URL filtering
# 4. Enable click-to-play for remaining plugins
# 5. Use browser content security policies (CSP header)
# 6. Consider browser isolation (remote browser in cloud sandbox)
#    -> no local code execution even if site is malicious

악성 코드 사고 대응

# Malware containment (immediate isolation):
# Network level: firewall rule to block host traffic
iptables -I INPUT 1 -s 192.168.1.50 -j DROP
iptables -I OUTPUT 1 -d 192.168.1.50 -j DROP

# Host level: disable network adapter (prevents spread)
ip link set eth0 down

# Memory image before remediation:
winpmem_mini_x64.exe memory.dmp
# Disk image:
dcfldd if=/dev/sda of=/forensics/sda.img hash=sha256

빠른 확인

과정 요약