十一届全国政协委员职务和界别情况T。。。

Setiri:AdvancesinTrojanTechnologyRoelofTemminghHaroonMeerBlackHatUSA2002中医免费资料:AdvancesinTrojanTechnologyDemonstrationTakingitfurtherPossiblefixesIntroductionSensePostThespeakersObjectiveofpresentationWhyTrojans?ProfileofTrojanusersRealcriminals……don’twritebufferoverflowsTheweirdnessoftheindustryExamplesBriefHistoryofTrojans&CovertTunnelsTrojansFromQuickThinkingGreeks…toQuickThinkingGeeksTunnelsCovertChannelsTrojans..ValidIP–NoFiltersValidIP–StatelessFiltersPrivateAddresses–StatefulFiltersPrivate+Stateful+IDS+PersonalFirewalls+ContentChecking+…Trojans..(ValidIP–NoFilters)“getreal..”Trojans..(ValidIP–StatelessFilter)DialHomeTrojansRandomPorts/OpenPorts/HighPorts[cDc]ACKTunneling[ArneVidstrom]Trojans..(StatefulFilters)BackOrifice-…toQuickThinkingGeeksTunnelsCovertChannelsTunnels&CovertChannels1985–TSCDefinition”CovertChannels”1996–PhrackMagazine–LOKI1998–R–THC1999-HTTPTUNNEL–GNU2000-FireThru-FirethruConventionalTrojans&howtheyfailStatefulfirewall&IDSDirectmodelDirectmodelwithnetworktricksICMPtunnelingACKtunnelingProperlyconfiguredstatefulfirewallIRCagents+AuthenticationproxyHTTPtunnel++Personalfirewall&AdvancedProxyHTTPtunnelwithAuthentication+++Hybridmodel:“GatSlag”CombinationbetweencovertTunnelandTrojanDefensesmechanismstoday:Packetfilters(stateful)/NATAuthenticationProxiesIntrusiondetectionsystemsPersonalfirewallsContent/protocolcheckingBiometrics/TokenPads/OnetimepasswordsEncryptionAtypicalnetworkHowGatSlagworkedReverseconnectionHTTPcoverttunnelMicrosoftInternetExplorerastransportControlsIEviaOLEEncapsulateinIE,notHTTPReceivecommandsintitleofwebpageReceiveencodeddataasplaintextinbodyofwebpageSenddatawithPOSTrequestSendalivesignalswithGETrequestWhyGatSlagworkedIntegrationofclientwithMSProxyNTLMauthenticationSSLcapableRegistrychangesPersonalfirewallsJustanotherbrowserPlatformindependentIEoneverydesktopSpecifyControllerViapublicwebpage–theMASTERsiteHowGatSlagworkedIICreatesinvisiblebrowserFindcontrolleratMASTERSendrequesttoControllerIfnoController&&retry7,gotoMASTERReceivereplyParsereply:+Uploadfile()+Downloadfile+ExecutecommandLoopWhydefensesfailFirewalls(stateful/NAT)ConfiguredtoallowuserorproxyoutContentlevel&IDSLookslikevalidHTTPrequests&repliesFilesdownloadedastextinwebpagesNodataorportstolockontoSSLprovidesencryptionPersonalfirewallsIEvalidapplicationConfiguredtoallowbrowsingAuthenticationproxiesUsersurfthewebProblemswithGatslagTheController’sIPcanbeobtained!HandlingofmultipleinstancesGUIsupportControllerneededtobeonlineBatchcommandsCommandhistoryMultiplecontrollersUploadfacilitynotefficientPlatformsupportStabilitySessionleveltunnelingSetiri:AdvancesinTrojanTechnologyDesignnotes:WebsitecontainsinstructionsCGIstocreatenewinstructionController’sinterface:–EXEC(DOScommands)–TX(Fileupload)–RX(Filedownload)Directorystructure–eachinstanceTrojan“surfs”towebsite–justanormaluserwouldSetiri:AdvancesinTrojanTechnologyIIAnonymityProblemswithnormalproxiesAlreadyusingaproxyProxylogs“Cleaners”provideanonymity“Inbrowserproxy”–AnonymizerTrojan-Cleaner:SSLCleaner-Controller:SSLChallenges:BrowserhistoryTemporaryfilesDemonstrationTakingitfurtherSessionleveltunnelingFlowcontrolchallengesHowthisisdifferentfromHTTPtunnelingAbrowserisnotasocketNoselectonbrowserTrainmodelTheControllersideCannot“send”BufferingofdataatControllerTheTrojansideMulti-partPOSTsMultipleconnections(HTTP)TruenetworkleveltunnelingSolvingthedilemmaDeliveryWhitelistingUsereducationAV,personalfirewallsShouldyoualloweveryonetosurfthe‘net?ConclusionAwarenessOurmotivation