IoT VILLAGE - Worms that fight back: Nematodes as an antidote for IoT malware
Wixey, Matt
Nematodes, often called “anti-worms” or “beneficial worms”, are a controversial topic. They involve exploiting the same vulnerabilities used by malicious worms, but, rather than installing malware or being used to form a botnet, nematodes attempt to disinfect and patch the vulnerable host. In some variants, nematodes also try to perform some kind of beneficial action, such as compressing files, or reporting illegal content to law enforcement. Despite being brought up a few times in previous talks and papers, nematodes remain largely on the fringes of the security community’s consciousness. Perhaps part of the reason for this is the demise of traditional network worms – after all, it’s not 2004 any more – and perhaps, for good reason, most people think the idea usually doesn’t work in practice, or has significant legal implications. However, there has recently been a trend of wormable vulnerabilities which utilise rather different mediums – such as WiFi (Broadpwn), Bluetooth (BlueBorne), light (smart lightbulbs), RFID tags, and more - and, of course, a huge number of wormable vulnerabilities in a wide range of IoT devices. The rise of these, and the fact that IoT security issues are not easily resolvable with patching, antivirus solutions, and other security mechanisms, may make it worth re-opening the nematode debate. In this talk, I’ll consider whether it actually is worth doing so, given that we could be on the threshold of an era involving new and devastating types of worms. Along the way, I’ll cover the history of nematodes and take a journey back in time with some 'digital paleovirology', starting with the murky history of Creeper, Reaper and PERVADE in the 1970s, then moving on to Brain and Denzuko in 1986; ADM and Max Vision in 1998; PolyPedo in 2001; the ‘worm wars’ of 2003-2004; and right up to the present day battles between IoT botnets such as Mirai with IoT nematodes such as Hajime and Brickerbot. I’ll also cover the legal and ethical issues posed by nematodes; the challenges and benefits they can bring; and will present some demos of custom nematodes. These include custom-developed worms and corresponding nematodes for both a recent web application vulnerability and an IoT device, and an improved and updated alternative to the PolyPedo worm. I'll also discuss 'Antidote', an in-progress and experimental modular framework for deploying and configuring anti-worms based on recent exploits and attack techniques. Finally, I'll outline some ideas for future research in this area.
 Okay, hi everyone. Thank you very much for coming. So, um, this is worms that fight back. Uh, Nemo Toads is an antidote for IoT malware. Um, so worth pointing out that what I'm going to talk to you about today is presented for educational purposes only. Uh, also worth pointing out that this isn't a brand new concept. This is building on work that's been done previously. Uh, as you guys will see by the, the references and the, the kind of case studies that I'm going to talk about. So my name is Matt Wixie. Uh, I lead research for PWC UK cybersecurity business unit. Uh, also work on its ethical hacking team. Uh, I'm a part-time PhD student at UCL and my previous role was, uh, working in law enforcement, uh, in the UK, uh, leading a technical R&D team. So, I want to talk about, uh, Nemo Toads or anti worms because I think it's a really interesting and, and really underexpored concept. So it's kind of been talked about a little bit before. Um, and it actually goes back, right back to the 1970s when, uh, malware kind of first started to, uh, to be experimented with and played with. Uh, I have a kind of general interest in repurposing bad stuff, uh, for good purposes. Um, and as far as I know, this kind of concept hasn't really been applied to IoT, um, in any kind of security research sense anyway. So I'm going to cover, uh, what a Nemo Toad is, what an anti worm is. Uh, I'm going to go through, uh, history of Nemo Toads in the wild. Uh, I'm going to cover why, um, those attempts didn't really kind of take off. Um, and kind of previous attempts to produce Nemo Toad frameworks, uh, as a kind of commercial offering or service offering. I'm then going to talk about something called Neo Toads which, uh, is a term I've come up with just to describe new kinds of worms using, uh, new replication vectors and whether that makes it worth reopening the debate and whether anti worms are something that could be used. Uh, I've got some demos for you as well. So I'm going to demo some Nemo Toads that I've developed. Uh, I'm then going to talk about something called the Antidote Framework which is something experimental that we're working on at PwC and then finally I'm going to wrap up. So what is a Nemo Toad? Um, so in biology, uh, a Nemo Toad is kind of a generic term for a, uh, a worm or a kind of parasite that attacks other parasites. That's kind of how it's commonly understood. In security, it's an anti worm. So it's a, um, a tool which exploits the same vulnerabilities that malicious worms exploit. It replicates, uh, in the same ways that malicious worms do. Um, but it's designed to disinfect systems, patch systems, kick malicious worms off of infected hosts. Um, and there are three different kinds based on the case studies that are out there. There are, uh, true Nemo Toads. So these are designed to, um, to exploit, uh, systems which have certain vulnerabilities and then automatically like download and install a patch and kick malicious worms off of that host. Uh, there are malicious Nemo Toads. So these are, uh, Nemo Toads which, um, are in themselves malicious but are trying to kick other malicious worms off of infected hosts to kind of boost their own infection rate, um, to kind of kill off the competition if you like. And then finally there are, uh, Moral Nemo Toads and I use the word Moral in inverted comments. So these are, uh, Nemo Toads which in the eyes of the author or the developer perform some kind of beneficial action. Um, they don't necessarily exploit a specific vulnerability but they do something, um, that the, the author believes is, uh, is morally good. So if we walk through the history of Nemo Toads, uh, the first known one and it's kind of apocryphal, um, is Creeper versus Reaper. Uh, has anyone heard of the Creeper virus? A couple of people? So Creeper was, uh, an experiment basically. Uh, it infected, uh, uh, 10x operating systems and it was, um, arguably the first kind of self replicating, spreading piece of malware. Uh, it didn't really do anything. It transferred itself over to different systems rather than replicating and it just printed out a bit of text on the terminal that you can see there. Uh, I'm the Creeper. Catch me if you can. And, uh, Reaper, uh, the rumor has it anyway, is a tool that was developed to try and catch up with the, the Creeper virus. Um, and then kind of kick it off the system. Uh, anyone heard of Animal and the Pervade routine? A couple of people. So Animal, um, was a, uh, a game developed by a guy called John Walker in 1975. It was like a, a kind of guessing game. So it would ask you to think of an animal and then try and guess what it was. Uh, and Pervade was a subroutine in Animal that was designed to spread the game. So it would copy over to shared disks and shared drives. Um, so that it would kind of spread as far as possible. Uh, and Hunter, uh, again, Apocryphal was a tool that allegedly, uh, was designed to track down copies of Animal, uh, and delete them from systems. Uh, there's Brain, um, so you'll be familiar with Brain. Uh, I would imagine so Brain, uh, pretty old virus infected the boot sector of floppy disks, uh, renamed it. And you can see from this screenshot that the authors, uh, ensured that their name and address and telephone number were actually included in this. Um, so there's a, a kind of couple of interpretations of that. One is that it's just kind of a more innocent time in writing viruses and malware and that kind of thing. Uh, the other arguably is that the Brain virus was developed as a kind of warning to software pirates. Um, and the names and addresses and telephone number in there were added so that, um, if people were infected they would have some kind of recourse and they could get themselves patched. Uh, the Denzuko virus was a, uh, a nematode that deliberately targeted, uh, Brain infected, uh, disks. So it would just replace, um, what was on the boot sector, it retitled it. Then there's Co, uh, named after the chemical formula for, uh, potassium hydroxide. So Co, um, would encrypt your disk. Um, but it would, uh, beforehand ask for permission and it would ask you to supply the password. It's kind of a very benign form of ransomware, if you like. So this is a good example of a kind of moral nematode. Uh, the reason it was doing this was to try and, um, protect your system from being attacked and having your data stolen. On a kind of similar note, this Cruncher, uh, from 92, 93, so Cruncher, uh, would compress files, um, on your system, uh, ostensibly to, to save you space. Uh, who's heard of Max Vision or Max Butler? Yeah, quite a few people. So, um, Max Vision, Max Butler was a, uh, penetration tester and security researcher. He ran a website called white hats.com. He also ran something called a RACNIDS, uh, which was a kind of database of attack signatures. And, uh, in 1998, uh, a group called ADM released a worm that exploited a vulnerability in DNS bind software. And, uh, Max Vision, whilst, uh, on the one hand kind of writing public blog articles about that worm, on the other hand, developed a nematode that he released into the wild. So that nematode would exploit the bind vulnerability. Uh, it would then attempt to download and install a patch for it. Um, and I believe it would try and kick off the, the malicious worm if it was on the system as well. Uh, unfortunately, uh, Max left a backdoor on the systems that were patched by that nematode so that he could access them whenever he wanted. Um, and his nematode caused a lot of disruption in military networks that his nematode ended up infecting. Um, if you haven't heard of him before and you're interested, uh, Kevin Polson wrote a great book on him and his story called Kingpin, um, which describes how he went from, uh, kind of a white hat researcher to running, uh, massive carding forum. Um, so it's worth a read if you can, uh, get hold of a copy. Uh, Polypedo is a really interesting one. So this is a good example of a moral nematode. Um, it's pretty basic. So it was from 2001, it was written in VBS. And, uh, what Polypedo did was it would scan your hard drive, uh, for images and it would look at the file names of all those images and it would compare those file names using regular expressions to a hard coded list of file names which were associated with child abuse. And if it found any of those images on your hard drive, it would send an email to various law enforcement agencies and charities and other organizations, uh, attaching the images, uh, and kind of reporting it. So raising all sorts of, uh, really interesting legal and ethical questions about whether or not that's justified. Uh, Blaster versus Welchia, um, so talking about kind of more recent ones here, so the Blaster worm obviously, um, infected, um, uh, uh, exploited vulnerability in DCOMRPC. Uh, Welchia was released about a week later, um, and it would, uh, download and install a patch, it would check the registry to see if the patch had been installed, if not it would download and install it. It would try and, um, delete Blaster from infected hosts and ended up causing all sorts of problems with network bandwidth and denial of service and that kind of thing. Uh, anyone read Stealing the Network? Yeah, a couple of people. So, really great book, uh, really great kind of collection of stories, there's a whole series of them. Um, they're kind of like connected short stories written by hackers about hacking. Uh, some of the, the technology they speak about, a little bit dated now, but they're really good stories. Uh, and this particular one, the worm turns from 2003, uh, describes the situation, uh, very similar to the Blaster and, and Welchia, uh, case study. Um, so definitely worth a read if you can get hold of that. And then the, uh, worm was, uh, worm wars from 2004. So Netsch guy, Bagel, Mydoom, uh, all of which were at one point trying to kick each other off of infected hosts. Um, and the authors were kind of trading insults in the source code of, uh, various versions of these worms as well. So good examples of, um, of malicious nematodes. And then, uh, even more recently, Mirai versus Hajime. So, uh, you'll be familiar with Mirai. Uh, Hajime, um, was, uh, or is an IoT nematode that exploits some of the same vulnerabilities that Mirai does in terms of, uh, default passwords and things like that. Um, includes this message on infected hosts to let people know, um, that it's infected it. And then I think most interestingly, the one that kind of I find most interesting is this one. So this is, um, Brickabot versus Mirai, RIPA and, and various others. So in, um, December last year, there was a, uh, a post on pace bin and ghost bin and a few other places by someone calling themselves Janitor. And they claimed to be the author of the Brickabot worm. Um, so Brickabot, um, would permanently disable machines infected by corrupting the firmware or overwriting the firmware with a bad image. Um, and Janitor claims that, uh, they did that in order to prevent those devices subsequently being misused by Mirai and RIPA and participating in, uh, DDoS attacks. So that again raises all sorts of really interesting legal and ethical questions about whether it's preferable for devices to be bricked or preferable to let them remain vulnerable and then have them be used in massive DDoS attacks which end up potentially taking out parts of internet infrastructure. So, um, the kind of heyday of worms I guess was probably, um, the mid 2000s. You obviously had Conficker a few years later which is, um, you know, probably the, the, the biggest one. Um, but in recent times, uh, traditional kind of network worms have decreased quite a lot. So you still get the occasional one, one across a good example, but generally things like exploit mitigations and better antivirus and security solutions, uh, better patching, management and incident response, uh, generally just better security. It's meant that those kind of big, uh, network based traditional worms have fallen off to a great extent. So there were some previous attempts to try and formalize a kind of nematode framework and make it something that could be used by the security community as something that could be used by organizations to try and protect themselves from, uh, from worms. So the first one, uh, that I'm aware of is a guy called Dr. Cyrus Pakari, um, who gave a talk, uh, Defcon 9, uh, back in 2001. And he was coming from the perspective of, um, of immunology and virology and applying that to computer security. So his concept was that it might be possible to create a kind of intent attenuated or weakened virus, release that in the wild in order to boost the immunity of antivirus systems and security solutions. So, uh, an interesting concept, um, it pretty much remained a concept. It was, uh, just a kind of thought experiment really. Um, then Dave Artel, uh, from immunity sec, uh, presented a talk in 2005, um, where he proposed, uh, a framework which would automatically generate nematodes based on exploits. So the idea was that you would feed in a recent exploit into his framework and it would then generate a nematode automatically, uh, which you could then deploy. Uh, unfortunately, I've only been able to find the slides of that talk. I haven't been able to find any, um, any source code or demos. Uh, if anyone knows of where I can find any, uh, that would be great. Um, and then around the same kind of time, HP, um, started something called active counter measures, uh, which is not a lot of detail available about it, um, but it was essentially kind of using exploits to protect systems. And then in a similar vein, uh, Fijitsu was approached, uh, maybe contracted by the Japanese government in 2012 to do a similar kind of thing. So the, um, all of those proposed frameworks, uh, suggested a number of benefits. So, uh, to, to using nematodes on the corporate system. So as well as being able to kind of rapidly assess, uh, an entire network for vulnerabilities and if they'd already been affected by worms to disinfect them and patch them. Uh, some people also suggested that nematodes could be used for things like distributed searching, uh, for self-discovering networks. So discovering things like shadow IT or hosts which weren't kind of 100% up. Um, and even potentially vulnerability scanning. So consistent vulnerability scanning where every host is a scanner. Uh, the counter arguments for that, uh, are many, really. Um, so firstly there's the Galathe. So just releasing a nematode into the wild in the majority of countries, uh, is going to be illegal because you're still accessing and modifying someone else's system without authorization. Um, there's also an ethics question to it as well, whether it's right to do that, whether it's right for someone to kind of take on that role of, uh, deciding that they're going to sort out your security for you. Uh, there's also a trust model. So evidence from the, the max vision case study where, uh, despite developing a, a kind of beneficial nematode, he also put a back door in it as well. So what makes us, um, able to trust nematode developers any more than, than a worm developer? Uh, obvious issues with denial of service and bandwidth as well. So, because nematodes, uh, will be like worms consistently scanning for new hosts to attack, uh, and will be replicating, uh, that can potentially cause issues, uh, with that as well. Uh, hard to target and control. So even if you are only launching a nematode on an internal network, uh, maybe a fairly small network, if that somehow gets onto a removable device, uh, and that's then plugged into another machine, then that can spread that way potentially. Uh, and lastly, just that worms are difficult to do, uh, difficult to do well anyway. So it's hard to write, uh, an effective and efficient worm which isn't going to crash the host that it infects, it's not going to generate, uh, too much network traffic. So of those frameworks, none of them kind of really went anywhere. Um, none of them kind of really addressed that, that fear factor. Um, and combined with the demise of those traditional big network worms, it pretty much meant that the concepts, uh, died to death really. Now, uh, nematodes, uh, or kind of new generations of worms possibly, um, could make it worthwhile reopening this debate. So if you look at some recent and some not so recent vulnerabilities and, and exploits, um, so taking it from the left, you have the Phillips Hue light bulb. So a black hat talk a couple of years ago described creating a worm using the Phillips Hue light bulb which could spread across and into our city. Um, you've then got Broadpwn, um, looking at vulnerabilities in Broadcom, uh, Wi-Fi chipsets. Um, going back a few years, um, malware in RFID tags and readers, um, that could spread from the tag to the reader and then from the reader to every tag that, that touched the reader. Um, so the proof of concept for that one was SQL injection, fairly easy to do. Uh, BlueBorn, vulnerabilities in implementations of Bluetooth. Uh, the Arduino YUN, so that was a, a paper from a couple of years ago about a wormable vulnerability in that particular Arduino board. And then, at the bottom, various IoT devices. Now, um, these specific devices aren't necessarily vulnerable to, um, to attacks, it's just a kind of illustration of the types of devices. Um, so particularly interesting there, you've got an IP camera, um, and I'll talk about that a bit later on. So, um, given that there are potentially, uh, a new generation of worms on the horizon that use different methods for propagation where traditional vulnerability, vulnerability management doesn't necessarily apply, um, and applying patches can be very difficult. You might be talking about having to have physical access to the device, uh, getting firmware updates over the air, um, potentially time consuming to do that as well. If you have a big network of IoT devices, um, many exploit mitigation mechanisms might not be possible depending on what kind of system it is. You've also got, um, uh, a proliferation now of IoT devices in corporate environments. So, uh, there was a good talk yesterday about, um, smart speakers, um, by Steven Hill about how, um, many organizations now just have sonar speakers in their office. Um, and also as well, if you work in security and you want to demonstrate to a client or you want to demonstrate to supervisors or whatever how, uh, damaging worms can be, nematodes are a really good way to do that, um, potentially. Okay, so I'm gonna run through some demos. Um, so the first one is an example of a true nematode. Um, so this is a fairly recent exploit, uh, it was March this year. Um, it's a command injection vulnerability in a web application called clip bucket. Um, so I wrote a worm in Python, um, that worm, uh, exploits the vulnerability. It downloads and runs a copy of itself, uh, it puts a web shell on the infected machine just to demonstrate that it can, and then it starts to scan for new targets. Uh, the nematode, uh, obviously exploits the same vulnerability. Um, it searches for both the malicious worm and for the PHP back door, deletes both of them. Um, it takes the, uh, PHP file that contains the vulnerability and renames it, and then creates, um, a new version of that PHP file, which just warns the user that they have a vulnerability and they need to update, and then it will scan and replicate. So I have, um, four virtual machines here, um, that all have clip bucket running as a web application. Uh, and you can, this is just to just kind of show at the moment that there's nothing, um, on the system. This is kind of a fresh install of that, um, that web app. Okay, I'll skip forward a little bit. Uh, okay, so this is the, uh, malicious worm being run. So it's running in, uh, just a small subnet, um, finds four vulnerable web applications, exploits them, reports back to a dashboard. So it just tells us that they've been infected. If you then look at the, uh, individual machines, that's the malicious worm that's now been replicated and you can see there's a shell.php file on there as well. Um, so the shell.php is just a one line, uh, PHP back door that's been put on there. So it's just demonstrating that this has happened on, um, on all four of the machines. This is the back door. That's what it looks like. Uh, so very simple example. And then just to demonstrate that that does work. Okay, so you can execute commands with the web show, which is great. So all those machines have now been, uh, infected. And then this is running the NemoTode. So this is doing exactly the same thing. It's based on the malicious worm, um, checking the same subnet, again reporting back to the dashboard. Uh, and it should tell us that they've all been, uh, now disinfected. And then if we have a look at the individual machines, you can see it's renamed the vulnerable file, which is file underscore uploader.php. Uh, it's put a back, um, dot b a k file, uh, renamed it to that. And this is the, the new version of file underscore uploader dot php, which just tells the user that they need to update and it gives them a vulnerability reference. Uh, the NemoTode also removes the, um, the shell dot php, so it removes the back door so that now can't be used. Uh, and it's done that for uh, all four machines. So in terms of practically applying that, how you would do that, um, one option could be that you, um, you have a feed, a vulnerability feed, something like exploit DB, uh, something like that. And you assess for new vulnerabilities whether or not they are wormable. And if they are, or you start to hear that a worm exists in the wild, uh, exploiting that vulnerability, then you can launch a, uh, a NemoTode on your network that checks for it, that removes malicious worms if they're found, uh, and tries to perform some kind of patch. So you would do this, um, you could either do this with an official patch if one has been released or you can do a kind of temporary work around. Okay, um, second demo is an IOT NemoTode. Um, so this is an IP camera, um, manufactured, um, under various brand names. There are two vulnerabilities in it, um, that which can be chained together, um, to make it wormable. So the first is a pre-authentication credential disclosure. Um, so you get the username and password to access the camera. And then the second is authenticated command injection. So the vendors of this camera, uh, have tried to address these and some other vulnerabilities. So it used to be that you could just telnet into these cameras with no username, no password and get a root prompt. They've now disabled telnet, um, by default so you, you don't have telnet access. Um, users are encouraged to change the default username and password. Uh, it also randomizes the HTTP port, uh, for the, the web server of the camera. Um, which is a kind of, I guess, security through obscurity, uh, more than anything else. Um, but the underlying vulnerabilities are still there. So, uh, the worm can retrieve credentials, uh, from the web server, use those to execute commands as an authenticated user. Um, you can then just re-enable telnet and still get a root prompt. So, uh, I was feeling pretty, uh, masochistic, I guess. So I tried to write this worm in bash. Um, turns out bash wasn't installed on the camera, uh, after many hours. So it turned out to be an SH worm instead. Um, so what the worm does, it retrieves a.ini file which contains credentials, extracts them, uses those for command injection, and then replicates. So, um, so that the demo didn't take hours to show you, I've put the cameras on sequential IP addresses, uh, with a static HTTP port. Um, to show, so what the worm will do is it will enable telnet again, uh, with a root prompt. It will also spin the camera around so there's a kind of visual indication that's been infected. Um, and then the nematode will run and it will stop the camera from spinning. Um, and then disable telnet again. So at the moment you can see that you can't telnet into any of these cameras. So I'm now running the malicious worm, um, which is going to infect, uh, these three cameras here. So you can see it starts them spinning. Uh, you can see on the screen that you've got username and password as well and that we're replicating onto the web server. Okay, and then you can see there, uh, that we can now telnet in, uh, and get a root prompt on those cameras. Oops, uh, sorry. Okay, so at this point the nematode has been launched and you can see it's going to stop those cameras from spinning. Um, it's then going to clear up the malicious worm and it is also going to disable telnet access. So, uh, I will now not be able to telnet into these cameras anymore. And then the last demo, uh, is the one that I think is the most interesting. So, um, I wanted to try and create just for purely educational, experimental purposes, uh, an improved version of that polypedo worm. So definitely not advocating that anyone do this in the wild or actually put this stuff out there. Um, but I thought there were kind of several problems with polypedo that could be improved on. So it wasn't efficient. It spread by mailing lists, um, and it determined what was suspicious content by the file name of the image, uh, which isn't particularly, uh, robust. So when you're talking about kind of comparing images, obviously cryptographic hashes are the most, uh, common way to do that. Um, so something like MD5 for instance, there are kind of floors associated with using that. Um, probably the, the biggest flaw is that if very, very slight edits are made to images, it results in a completely different cryptographic hash. So the solution, uh, is something called perceptual hashing. Has anyone heard of perceptual hashing before? Yeah, a couple of people. So perceptual hashing is, uh, a measure of the similarity of two images. Um, you can, there are various ways to do it. Reversed image searching would tend to use some kind of perceptual hashing algorithm. Uh, mine's not as near as complicated as that. Um, but it is, uh, fairly robust in the demos that I'm going to show you. So, um, essentially what it does is, um, and it's based on some previous work in this area, uh, is it will break an image down into 8x8 pixels. Um, it will then retrieve the pixel values, calculate an average pixel value, and then for every pixel, uh, if the pixel is above the average, it will assign a 1 to a string, and if it's below it will assign a 0. So you end up with a 64 bit string of 1s and 0s, which is a, a representation of how each pixel differs from the average, whether it's higher or lower. So you can then just compare that string. So just do simple, uh, string matching. Um, and for what is like a really primitive algorithm, uh, really, is pretty tolerant to things like resizing, so to thumbnails of images, to, um, minor edits in the images, and to, like, sequential frames or different frames from, uh, from the same video. So the, uh, example nematode I created, what it does is it scans a folder, uh, for images. Um, it will generate perceptual hashes, so those 64 bit strings of those images, and it will compare them to a hard coded list of, uh, hashes for suspicious images. And if it's above 90%, it will send an email and attach those images. Uh, replication is over USB, um, so it will check for attached removable media, and, uh, it uses a technique that's been seen in the wild before for, uh, I think it was KJ worm, NJ rat, that kind of family. So it will replicate itself as a hidden file, uh, create a visible shortcut with a notepad icon, and then the target of that shortcut is a hidden file. So the example is that I'm going to use for this demo, uh, this one, so you have an image of a plane that's just been resized, it's been cut down. You have an image where there's been a very slight modification, and then you have, uh, two stills from the same video at different points. So obviously visually similar, but different images. Okay, so this is the inbox, the notifications that I come into, it's empty at the moment. Um, there's a USB drive attached to this laptop that is also, um, empty at the moment. So this is the, um, the folder of original images and the, the corresponding perceptual hash values. And then this is the folder, uh, that the nematode is going to check, uh, for suspicious images. So when the nematode is run, uh, you'll be able to see that it, it starts to find some matches, it indicates what might be a match, says that it's sending us an email, um, and at the end it replicates itself. So the plane, uh, which was the resized was a 95% possible match, the, uh, slight modification 98%, and the video still is 93%. So we go and check the inbox now, we can see that it sent us an email, it said I've infected this machine, um, I found this image which matches this reference image. Here's the similarity score, uh, let me know if I got it right. Uh, and it's done that for all three of those, uh, results. And then, uh, the nematode is also replicated over to the USB drive. Uh, so if we have a look at that. So there's now a shortcut file in there which just says my notes and the target for that is a hidden XE, uh, which is the nematode which is also on there. Um, so if we, uh, refresh the, uh, the, the file listing, uh, for the drive, you can then see that the hidden executable. So there are some refinements that, that could, uh, in theory be made to that to kind of make it a bit more robust so you could have like a depth count of infections so that you only infect so many, uh, machines after initial infection. You could also, uh, have alternative replication methods as well. Okay, so the last thing I wanted to talk to you about was antidote. Um, so antidote, uh, is something that we're working on at PWC. We're in the very, very early stages of doing it. The goal, uh, the, the kind of, um, the idea is to create a modular, free open source framework for people to, uh, develop and use IoT nematodes, nematodes in general, but with a focus on IoT, uh, on their own networks. So, um, the, the dream is to have this as a kind of nematode version of Metasploit. Um, so you can, um, overcome a lot of those, uh, early, um, criticisms of nematodes and nematode frameworks by, um, customizing the exact payloads that are used, uh, deciding whether or not you want it to replicate and how much, uh, whether you want a delay between scans and exploitation, whether you want host to reboot once they've been, um, fixed and scanned and whether you want patches to be applied. Um, so it is very much in the early stages. Um, I'll just show you kind of a video so you've got an idea of what it might look like. So this is a kind of proof of concept. Um, but it would be great to get your thoughts on this and your feedback and if you want to get involved in, uh, the development or you've got any thoughts, uh, it'd be great to hear from you. Uh, I'll put my contact details up at the, the end of the talk. Um, so, uh, this is kind of a, just a demo version that just shows, um, the kind of features that it might have. So, it's kind of a console based framework. You can load in various modules according to whether they're web apps or whether they're IP cameras or, uh, whatever it is. And obviously there would be more kind of IoT devices in those categories. Uh, you can then load a module in. Uh, you can see some info about it. So, whether or not it supports things like disinfection, patching, replication, um, what data was released, obviously what version of software it affects and targets. Um, and then in order to do some kind of damage control so it doesn't, um, leak out into the wild, you can set a starting IP address, uh, an end IP address, uh, how many IP addresses each worm should scan, uh, whether or not you want to use disinfection, patching, replication, uh, you can have a time delay in between exploitation attack attempts, um, so that you know, you can kind of avoid bandwidth and denial of service problems. Uh, you can have a kill switch as well. Um, and you can finally have the nematode, uh, if you want, delete itself after it's, um, done its job. And then it's, it will support, um, log files as well. So, writing logs of what it's done. So, if you do want to get involved in that, um, let me know. Um, I'll just say again, we are at the very early stages but it'd be great to have this as a kind of community project. We want as many people to get involved, um, as we can. Uh, my Twitter handle's there. Um, so to sum up, um, nematodes are a novel idea. I think they still are a really novel idea. Um, ultimately not successful when they were kind of first discussed and first deployed. And because of that demise of the big traditional network worms, they weren't really, um, uh, applicable. But I think with the onset of, um, worms that use different methods to propagate, replicate and exploit, there's potentially, uh, an argument to say that nematodes could be useful in the future. Um, there are obviously still concerns that would affect it. Um, but I think, um, that it's potentially an area of promise. Um, anti dot is our very kind of experimental approach to doing that. Uh, and if nothing else, hopefully it will stimulate some debate and get people talking. Um, so, uh, there's lots of references here if you want some, uh, some reading, uh, about the case studies that I talked about, uh, various other bits and pieces. Um, Twitter handle's there again, email address if you want to email me. Um, yeah, that's it. Thank you very much.
 Okay, hi everyone. Thank you very much for coming. So, um, this is worms that fight back. Uh,  Nemo Toads is an antidote for IoT malware. Um, so worth pointing out that what I'm going to  talk to you about today is presented for educational purposes only. Uh, also worth  pointing out that this isn't a brand new concept. This is building on work that's been done  previously. Uh, as you guys will see by the, the references and the, the kind of case studies  that I'm going to talk about. So my name is Matt Wixie. Uh, I lead research for PWC UK  cybersecurity business unit. Uh, also work on its ethical hacking team. Uh, I'm a part-time  PhD student at UCL and my previous role was, uh, working in law enforcement, uh, in the UK,  uh, leading a technical R&D team. So, I want to talk about, uh, Nemo Toads or anti worms  because I think it's a really interesting and, and really underexpored concept. So it's  kind of been talked about a little bit before. Um, and it actually goes back, right back to  the 1970s when, uh, malware kind of first started to, uh, to be experimented with and  played with. Uh, I have a kind of general interest in repurposing bad stuff, uh, for good  purposes. Um, and as far as I know, this kind of concept hasn't really been applied to IoT, um,  in any kind of security research sense anyway. So I'm going to cover, uh, what a Nemo Toad  is, what an anti worm is. Uh, I'm going to go through, uh, history of Nemo Toads in the  wild. Uh, I'm going to cover why, um, those attempts didn't really kind of take off. Um, and  kind of previous attempts to produce Nemo Toad frameworks, uh, as a kind of commercial  offering or service offering. I'm then going to talk about something called Neo Toads which, uh,  is a term I've come up with just to describe new kinds of worms using, uh, new replication  vectors and whether that makes it worth reopening the debate and whether anti worms are  something that could be used. Uh, I've got some demos for you as well. So I'm going to  demo some Nemo Toads that I've developed. Uh, I'm then going to talk about something  called the Antidote Framework which is something experimental that we're working on at  PwC and then finally I'm going to wrap up. So what is a Nemo Toad? Um, so in biology, uh,  a Nemo Toad is kind of a generic term for a, uh, a worm or a kind of parasite that attacks  other parasites. That's kind of how it's commonly understood. In security, it's an anti  worm. So it's a, um, a tool which exploits the same vulnerabilities that malicious worms  exploit. It replicates, uh, in the same ways that malicious worms do. Um, but it's designed to  disinfect systems, patch systems, kick malicious worms off of infected hosts. Um, and there  are three different kinds based on the case studies that are out there. There are, uh,  true Nemo Toads. So these are designed to, um, to exploit, uh, systems which have certain  vulnerabilities and then automatically like download and install a patch and kick malicious  worms off of that host. Uh, there are malicious Nemo Toads. So these are, uh, Nemo Toads  which, um, are in themselves malicious but are trying to kick other malicious worms off  of infected hosts to kind of boost their own infection rate, um, to kind of kill off the  competition if you like. And then finally there are, uh, Moral Nemo Toads and I use the word  Moral in inverted comments. So these are, uh, Nemo Toads which in the eyes of the author or  the developer perform some kind of beneficial action. Um, they don't necessarily exploit a  specific vulnerability but they do something, um, that the, the author believes is, uh, is  morally good. So if we walk through the history of Nemo Toads, uh, the first known one and it's  kind of apocryphal, um, is Creeper versus Reaper. Uh, has anyone heard of the Creeper  virus? A couple of people? So Creeper was, uh, an experiment basically. Uh, it infected, uh,  uh, 10x operating systems and it was, um, arguably the first kind of self replicating, spreading  piece of malware. Uh, it didn't really do anything. It transferred itself over to different  systems rather than replicating and it just printed out a bit of text on the terminal that  you can see there. Uh, I'm the Creeper. Catch me if you can. And, uh, Reaper, uh, the rumor has  it anyway, is a tool that was developed to try and catch up with the, the Creeper virus. Um,  and then kind of kick it off the system. Uh, anyone heard of Animal and the Pervade routine?  A couple of people. So Animal, um, was a, uh, a game developed by a guy called John Walker  in 1975. It was like a, a kind of guessing game. So it would ask you to think of an animal  and then try and guess what it was. Uh, and Pervade was a subroutine in Animal that was  designed to spread the game. So it would copy over to shared disks and shared drives. Um, so  that it would kind of spread as far as possible. Uh, and Hunter, uh, again, Apocryphal was a tool  that allegedly, uh, was designed to track down copies of Animal, uh, and delete them from  systems. Uh, there's Brain, um, so you'll be familiar with Brain. Uh, I would imagine so Brain, uh,  pretty old virus infected the boot sector of floppy disks, uh, renamed it. And you can see  from this screenshot that the authors, uh, ensured that their name and address and telephone  number were actually included in this. Um, so there's a, a kind of couple of interpretations  of that. One is that it's just kind of a more innocent time in writing viruses and malware  and that kind of thing. Uh, the other arguably is that the Brain virus was developed as a kind  of warning to software pirates. Um, and the names and addresses and telephone number in  there were added so that, um, if people were infected they would have some kind of recourse  and they could get themselves patched. Uh, the Denzuko virus was a, uh, a nematode that  deliberately targeted, uh, Brain infected, uh, disks. So it would just replace, um, what was  on the boot sector, it retitled it. Then there's Co, uh, named after the chemical formula for, uh,  potassium hydroxide. So Co, um, would encrypt your disk. Um, but it would, uh, beforehand ask  for permission and it would ask you to supply the password. It's kind of a very benign form of  ransomware, if you like. So this is a good example of a kind of moral nematode. Uh, the reason it  was doing this was to try and, um, protect your system from being attacked and having your  data stolen. On a kind of similar note, this Cruncher, uh, from 92, 93, so Cruncher, uh, would  compress files, um, on your system, uh, ostensibly to, to save you space. Uh, who's heard of Max  Vision or Max Butler? Yeah, quite a few people. So, um, Max Vision, Max Butler was a, uh,  penetration tester and security researcher. He ran a website called white hats.com. He also  ran something called a RACNIDS, uh, which was a kind of database of attack signatures. And, uh,  in 1998, uh, a group called ADM released a worm that exploited a vulnerability in DNS  bind software. And, uh, Max Vision, whilst, uh, on the one hand kind of writing public  blog articles about that worm, on the other hand, developed a nematode that he released into  the wild. So that nematode would exploit the bind vulnerability. Uh, it would then attempt to  download and install a patch for it. Um, and I believe it would try and kick off the, the  malicious worm if it was on the system as well. Uh, unfortunately, uh, Max left a backdoor on  the systems that were patched by that nematode so that he could access them whenever he  wanted. Um, and his nematode caused a lot of disruption in military networks that his  nematode ended up infecting. Um, if you haven't heard of him before and you're interested,  uh, Kevin Polson wrote a great book on him and his story called Kingpin, um, which describes  how he went from, uh, kind of a white hat researcher to running, uh, massive carding  forum. Um, so it's worth a read if you can, uh, get hold of a copy. Uh, Polypedo is a really  interesting one. So this is a good example of a moral nematode. Um, it's pretty basic. So it  was from 2001, it was written in VBS. And, uh, what Polypedo did was it would scan your  hard drive, uh, for images and it would look at the file names of all those images and it  would compare those file names using regular expressions to a hard coded list of file names  which were associated with child abuse. And if it found any of those images on your  hard drive, it would send an email to various law enforcement agencies and charities and  other organizations, uh, attaching the images, uh, and kind of reporting it. So raising all  sorts of, uh, really interesting legal and ethical questions about whether or not that's  justified. Uh, Blaster versus Welchia, um, so talking about kind of more recent ones here,  so the Blaster worm obviously, um, infected, um, uh, uh, exploited vulnerability in DCOMRPC. Uh,  Welchia was released about a week later, um, and it would, uh, download and install a  patch, it would check the registry to see if the patch had been installed, if not it  would download and install it. It would try and, um, delete Blaster from infected hosts and  ended up causing all sorts of problems with network bandwidth and denial of service and  that kind of thing. Uh, anyone read Stealing the Network? Yeah, a couple of people. So,  really great book, uh, really great kind of collection of stories, there's a whole series  of them. Um, they're kind of like connected short stories written by hackers about hacking.  Uh, some of the, the technology they speak about, a little bit dated now, but they're  really good stories. Uh, and this particular one, the worm turns from 2003, uh, describes  the situation, uh, very similar to the Blaster and, and Welchia, uh, case study. Um, so  definitely worth a read if you can get hold of that. And then the, uh, worm was, uh,  worm wars from 2004. So Netsch guy, Bagel, Mydoom, uh, all of which were at one point  trying to kick each other off of infected hosts. Um, and the authors were kind of trading  insults in the source code of, uh, various versions of these worms as well. So good  examples of, um, of malicious nematodes. And then, uh, even more recently, Mirai versus  Hajime. So, uh, you'll be familiar with Mirai. Uh, Hajime, um, was, uh, or is an IoT nematode  that exploits some of the same vulnerabilities that Mirai does in terms of, uh, default  passwords and things like that. Um, includes this message on infected hosts to let people  know, um, that it's infected it. And then I think most interestingly, the one that kind  of I find most interesting is this one. So this is, um, Brickabot versus Mirai, RIPA and, and  various others. So in, um, December last year, there was a, uh, a post on pace bin and ghost  bin and a few other places by someone calling themselves Janitor. And they claimed to be the  author of the Brickabot worm. Um, so Brickabot, um, would permanently disable machines  infected by corrupting the firmware or overwriting the firmware with a bad image. Um, and  Janitor claims that, uh, they did that in order to prevent those devices subsequently  being misused by Mirai and RIPA and participating in, uh, DDoS attacks. So that again raises all  sorts of really interesting legal and ethical questions about whether it's preferable for  devices to be bricked or preferable to let them remain vulnerable and then have them be used  in massive DDoS attacks which end up potentially taking out parts of internet infrastructure.  So, um, the kind of heyday of worms I guess was probably, um, the mid 2000s. You obviously had  Conficker a few years later which is, um, you know, probably the, the, the biggest one. Um,  but in recent times, uh, traditional kind of network worms have decreased quite a lot. So  you still get the occasional one, one across a good example, but generally things like  exploit mitigations and better antivirus and security solutions, uh, better patching,  management and incident response, uh, generally just better security. It's meant that those  kind of big, uh, network based traditional worms have fallen off to a great extent. So  there were some previous attempts to try and formalize a kind of nematode framework and  make it something that could be used by the security community as something that could be  used by organizations to try and protect themselves from, uh, from worms. So the first  one, uh, that I'm aware of is a guy called Dr. Cyrus Pakari, um, who gave a talk, uh,  Defcon 9, uh, back in 2001. And he was coming from the perspective of, um, of immunology  and virology and applying that to computer security. So his concept was that it might be  possible to create a kind of intent attenuated or weakened virus, release that in the wild in  order to boost the immunity of antivirus systems and security solutions. So, uh, an  interesting concept, um, it pretty much remained a concept. It was, uh, just a kind of thought  experiment really. Um, then Dave Artel, uh, from immunity sec, uh, presented a talk in  2005, um, where he proposed, uh, a framework which would automatically generate nematodes  based on exploits. So the idea was that you would feed in a recent exploit into his  framework and it would then generate a nematode automatically, uh, which you could then deploy.  Uh, unfortunately, I've only been able to find the slides of that talk. I haven't been able to  find any, um, any source code or demos. Uh, if anyone knows of where I can find any, uh, that  would be great. Um, and then around the same kind of time, HP, um, started something called  active counter measures, uh, which is not a lot of detail available about it, um, but it was  essentially kind of using exploits to protect systems. And then in a similar vein, uh, Fijitsu  was approached, uh, maybe contracted by the Japanese government in 2012 to do a similar  kind of thing. So the, um, all of those proposed frameworks, uh, suggested a number of benefits.  So, uh, to, to using nematodes on the corporate system. So as well as being able to kind of  rapidly assess, uh, an entire network for vulnerabilities and if they'd already been  affected by worms to disinfect them and patch them. Uh, some people also suggested that  nematodes could be used for things like distributed searching, uh, for self-discovering  networks. So discovering things like shadow IT or hosts which weren't kind of 100% up. Um,  and even potentially vulnerability scanning. So consistent vulnerability scanning where  every host is a scanner. Uh, the counter arguments for that, uh, are many, really. Um, so  firstly there's the Galathe. So just releasing a nematode into the wild in the majority of  countries, uh, is going to be illegal because you're still accessing and modifying someone  else's system without authorization. Um, there's also an ethics question to it as well,  whether it's right to do that, whether it's right for someone to kind of take on that  role of, uh, deciding that they're going to sort out your security for you. Uh, there's  also a trust model. So evidence from the, the max vision case study where, uh, despite  developing a, a kind of beneficial nematode, he also put a back door in it as well. So  what makes us, um, able to trust nematode developers any more than, than a worm developer?  Uh, obvious issues with denial of service and bandwidth as well. So, because nematodes, uh,  will be like worms consistently scanning for new hosts to attack, uh, and will be replicating,  uh, that can potentially cause issues, uh, with that as well. Uh, hard to target and  control. So even if you are only launching a nematode on an internal network, uh, maybe a  fairly small network, if that somehow gets onto a removable device, uh, and that's then  plugged into another machine, then that can spread that way potentially. Uh, and lastly,  just that worms are difficult to do, uh, difficult to do well anyway. So it's hard to  write, uh, an effective and efficient worm which isn't going to crash the host that it  infects, it's not going to generate, uh, too much network traffic. So of those frameworks,  none of them kind of really went anywhere. Um, none of them kind of really addressed that,  that fear factor. Um, and combined with the demise of those traditional big network worms,  it pretty much meant that the concepts, uh, died to death really. Now, uh, nematodes, uh,  or kind of new generations of worms possibly, um, could make it worthwhile reopening this  debate. So if you look at some recent and some not so recent vulnerabilities and, and  exploits, um, so taking it from the left, you have the Phillips Hue light bulb. So a  black hat talk a couple of years ago described creating a worm using the Phillips Hue light  bulb which could spread across and into our city. Um, you've then got Broadpwn, um, looking  at vulnerabilities in Broadcom, uh, Wi-Fi chipsets. Um, going back a few years, um, malware  in RFID tags and readers, um, that could spread from the tag to the reader and then from  the reader to every tag that, that touched the reader. Um, so the proof of concept for  that one was SQL injection, fairly easy to do. Uh, BlueBorn, vulnerabilities in  implementations of Bluetooth. Uh, the Arduino YUN, so that was a, a paper from a couple  of years ago about a wormable vulnerability in that particular Arduino board. And then,  at the bottom, various IoT devices. Now, um, these specific devices aren't necessarily  vulnerable to, um, to attacks, it's just a kind of illustration of the types of devices.  Um, so particularly interesting there, you've got an IP camera, um, and I'll talk about  that a bit later on. So, um, given that there are potentially, uh, a new generation of worms  on the horizon that use different methods for propagation where traditional vulnerability,  vulnerability management doesn't necessarily apply, um, and applying patches can be very  difficult. You might be talking about having to have physical access to the device, uh,  getting firmware updates over the air, um, potentially time consuming to do that as well.  If you have a big network of IoT devices, um, many exploit mitigation mechanisms might  not be possible depending on what kind of system it is. You've also got, um, uh, a proliferation  now of IoT devices in corporate environments. So, uh, there was a good talk yesterday about,  um, smart speakers, um, by Steven Hill about how, um, many organizations now just have  sonar speakers in their office. Um, and also as well, if you work in security and you want  to demonstrate to a client or you want to demonstrate to supervisors or whatever how, uh,  damaging worms can be, nematodes are a really good way to do that, um, potentially. Okay, so  I'm gonna run through some demos. Um, so the first one is an example of a true nematode.  Um, so this is a fairly recent exploit, uh, it was March this year. Um, it's a command  injection vulnerability in a web application called clip bucket. Um, so I wrote a worm in  Python, um, that worm, uh, exploits the vulnerability. It downloads and runs a copy of  itself, uh, it puts a web shell on the infected machine just to demonstrate that it can, and  then it starts to scan for new targets. Uh, the nematode, uh, obviously exploits the same  vulnerability. Um, it searches for both the malicious worm and for the PHP back door, deletes  both of them. Um, it takes the, uh, PHP file that contains the vulnerability and renames it, and  then creates, um, a new version of that PHP file, which just warns the user that they have a  vulnerability and they need to update, and then it will scan and replicate. So I have, um, four  virtual machines here, um, that all have clip bucket running as a web application. Uh, and you  can, this is just to just kind of show at the moment that there's nothing, um, on the system.  This is kind of a fresh install of that, um, that web app. Okay, I'll skip forward a little  bit. Uh, okay, so this is the, uh, malicious worm being run. So it's running in, uh, just a  small subnet, um, finds four vulnerable web applications, exploits them, reports back to a  dashboard. So it just tells us that they've been infected. If you then look at the, uh, individual  machines, that's the malicious worm that's now been replicated and you can see there's a  shell.php file on there as well. Um, so the shell.php is just a one line, uh, PHP back door that's  been put on there. So it's just demonstrating that this has happened on, um, on all four of the  machines. This is the back door. That's what it looks like. Uh, so very simple example. And  then just to demonstrate that that does work. Okay, so you can execute commands with the  web show, which is great. So all those machines have now been, uh, infected. And then this is  running the NemoTode. So this is doing exactly the same thing. It's based on the malicious  worm, um, checking the same subnet, again reporting back to the dashboard. Uh, and it  should tell us that they've all been, uh, now disinfected. And then if we have a look at the  individual machines, you can see it's renamed the vulnerable file, which is file underscore  uploader.php. Uh, it's put a back, um, dot b a k file, uh, renamed it to that. And this is the, the  new version of file underscore uploader dot php, which just tells the user that they need to  update and it gives them a vulnerability reference. Uh, the NemoTode also removes the, um, the  shell dot php, so it removes the back door so that now can't be used. Uh, and it's done that for  uh, all four machines. So in terms of practically applying that, how you would do that, um, one  option could be that you, um, you have a feed, a vulnerability feed, something like exploit  DB, uh, something like that. And you assess for new vulnerabilities whether or not they are  wormable. And if they are, or you start to hear that a worm exists in the wild, uh, exploiting  that vulnerability, then you can launch a, uh, a NemoTode on your network that checks for it,  that removes malicious worms if they're found, uh, and tries to perform some kind of patch. So  you would do this, um, you could either do this with an official patch if one has been released  or you can do a kind of temporary work around. Okay, um, second demo is an IOT NemoTode. Um,  so this is an IP camera, um, manufactured, um, under various brand names. There are two  vulnerabilities in it, um, that which can be chained together, um, to make it wormable. So  the first is a pre-authentication credential disclosure. Um, so you get the username and  password to access the camera. And then the second is authenticated command injection. So  the vendors of this camera, uh, have tried to address these and some other vulnerabilities. So  it used to be that you could just telnet into these cameras with no username, no password and  get a root prompt. They've now disabled telnet, um, by default so you, you don't have telnet  access. Um, users are encouraged to change the default username and password. Uh, it also  randomizes the HTTP port, uh, for the, the web server of the camera. Um, which is a kind of, I  guess, security through obscurity, uh, more than anything else. Um, but the underlying  vulnerabilities are still there. So, uh, the worm can retrieve credentials, uh, from the web  server, use those to execute commands as an authenticated user. Um, you can then just  re-enable telnet and still get a root prompt. So, uh, I was feeling pretty, uh, masochistic, I guess.  So I tried to write this worm in bash. Um, turns out bash wasn't installed on the camera, uh,  after many hours. So it turned out to be an SH worm instead. Um, so what the worm does, it  retrieves a.ini file which contains credentials, extracts them, uses those for command  injection, and then replicates. So, um, so that the demo didn't take hours to show you, I've  put the cameras on sequential IP addresses, uh, with a static HTTP port. Um, to show, so what  the worm will do is it will enable telnet again, uh, with a root prompt. It will also spin the  camera around so there's a kind of visual indication that's been infected. Um, and then  the nematode will run and it will stop the camera from spinning. Um, and then disable telnet  again. So at the moment you can see that you can't telnet into any of these cameras. So I'm  now running the malicious worm, um, which is going to infect, uh, these three cameras  here. So you can see it starts them spinning. Uh, you can see on the screen that you've got  username and password as well and that we're replicating onto the web server. Okay, and  then you can see there, uh, that we can now telnet in, uh, and get a root prompt on those  cameras. Oops, uh, sorry. Okay, so at this point the nematode has been launched and you can see it's  going to stop those cameras from spinning. Um, it's then going to clear up the malicious  worm and it is also going to disable telnet access. So, uh, I will now not be able to telnet  into these cameras anymore. And then the last demo, uh, is the one that I think is the most  interesting. So, um, I wanted to try and create just for purely educational, experimental  purposes, uh, an improved version of that polypedo worm. So definitely not advocating that  anyone do this in the wild or actually put this stuff out there. Um, but I thought there  were kind of several problems with polypedo that could be improved on. So it wasn't  efficient. It spread by mailing lists, um, and it determined what was suspicious content by  the file name of the image, uh, which isn't particularly, uh, robust. So when you're  talking about kind of comparing images, obviously cryptographic hashes are the most, uh,  common way to do that. Um, so something like MD5 for instance, there are kind of floors  associated with using that. Um, probably the, the biggest flaw is that if very, very slight  edits are made to images, it results in a completely different cryptographic hash. So  the solution, uh, is something called perceptual hashing. Has anyone heard of perceptual  hashing before? Yeah, a couple of people. So perceptual hashing is, uh, a measure of the  similarity of two images. Um, you can, there are various ways to do it. Reversed image  searching would tend to use some kind of perceptual hashing algorithm. Uh, mine's not  as near as complicated as that. Um, but it is, uh, fairly robust in the demos that I'm  going to show you. So, um, essentially what it does is, um, and it's based on some previous  work in this area, uh, is it will break an image down into 8x8 pixels. Um, it will then  retrieve the pixel values, calculate an average pixel value, and then for every pixel, uh, if  the pixel is above the average, it will assign a 1 to a string, and if it's below it will  assign a 0. So you end up with a 64 bit string of 1s and 0s, which is a, a representation of  how each pixel differs from the average, whether it's higher or lower. So you can then  just compare that string. So just do simple, uh, string matching. Um, and for what is like a  really primitive algorithm, uh, really, is pretty tolerant to things like resizing, so to  thumbnails of images, to, um, minor edits in the images, and to, like, sequential frames or  different frames from, uh, from the same video. So the, uh, example nematode I created, what it  does is it scans a folder, uh, for images. Um, it will generate perceptual hashes, so those  64 bit strings of those images, and it will compare them to a hard coded list of, uh, hashes  for suspicious images. And if it's above 90%, it will send an email and attach those  images. Uh, replication is over USB, um, so it will check for attached removable media, and, uh, it  uses a technique that's been seen in the wild before for, uh, I think it was KJ worm, NJ rat,  that kind of family. So it will replicate itself as a hidden file, uh, create a visible  shortcut with a notepad icon, and then the target of that shortcut is a hidden file. So the  example is that I'm going to use for this demo, uh, this one, so you have an image of a plane  that's just been resized, it's been cut down. You have an image where there's been a very  slight modification, and then you have, uh, two stills from the same video at different  points. So obviously visually similar, but different images. Okay, so this is the inbox,  the notifications that I come into, it's empty at the moment. Um, there's a USB drive attached to  this laptop that is also, um, empty at the moment. So this is the, um, the folder of original  images and the, the corresponding perceptual hash values.  And then this is the folder, uh, that the nematode is going to check, uh, for suspicious  images. So when the nematode is run, uh, you'll be able to see that it, it starts to find some  matches, it indicates what might be a match, says that it's sending us an email, um, and at  the end it replicates itself. So the plane, uh, which was the resized was a 95% possible  match, the, uh, slight modification 98%, and the video still is 93%. So we go and check the  inbox now, we can see that it sent us an email, it said I've infected this machine, um, I found  this image which matches this reference image. Here's the similarity score, uh, let me know if  I got it right. Uh, and it's done that for all three of those, uh, results. And then, uh, the  nematode is also replicated over to the USB drive. Uh, so if we have a look at that. So there's  now a shortcut file in there which just says my notes and the target for that is a hidden  XE, uh, which is the nematode which is also on there. Um, so if we, uh, refresh the, uh, the, the  file listing, uh, for the drive, you can then see that the hidden executable. So there are some  refinements that, that could, uh, in theory be made to that to kind of make it a bit more  robust so you could have like a depth count of infections so that you only infect so many,  uh, machines after initial infection. You could also, uh, have alternative replication  methods as well. Okay, so the last thing I wanted to talk to you about was antidote. Um,  so antidote, uh, is something that we're working on at PWC. We're in the very, very early  stages of doing it. The goal, uh, the, the kind of, um, the idea is to create a modular,  free open source framework for people to, uh, develop and use IoT nematodes, nematodes in  general, but with a focus on IoT, uh, on their own networks. So, um, the, the dream is to  have this as a kind of nematode version of Metasploit. Um, so you can, um, overcome a lot  of those, uh, early, um, criticisms of nematodes and nematode frameworks by, um,  customizing the exact payloads that are used, uh, deciding whether or not you want it to  replicate and how much, uh, whether you want a delay between scans and exploitation, whether  you want host to reboot once they've been, um, fixed and scanned and whether you want  patches to be applied. Um, so it is very much in the early stages. Um, I'll just show you  kind of a video so you've got an idea of what it might look like. So this is a kind of  proof of concept. Um, but it would be great to get your thoughts on this and your  feedback and if you want to get involved in, uh, the development or you've got any  thoughts, uh, it'd be great to hear from you. Uh, I'll put my contact details up at the,  the end of the talk. Um, so, uh, this is kind of a, just a demo version that just shows, um,  the kind of features that it might have. So, it's kind of a console based framework. You  can load in various modules according to whether they're web apps or whether they're IP  cameras or, uh, whatever it is. And obviously there would be more kind of IoT devices in  those categories. Uh, you can then load a module in. Uh, you can see some info about it. So,  whether or not it supports things like disinfection, patching, replication, um, what  data was released, obviously what version of software it affects and targets. Um, and then  in order to do some kind of damage control so it doesn't, um, leak out into the wild, you  can set a starting IP address, uh, an end IP address, uh, how many IP addresses each worm  should scan, uh, whether or not you want to use disinfection, patching, replication, uh, you  can have a time delay in between exploitation attack attempts, um, so that you know, you can  kind of avoid bandwidth and denial of service problems. Uh, you can have a kill switch as  well. Um, and you can finally have the nematode, uh, if you want, delete itself after it's, um,  done its job. And then it's, it will support, um, log files as well. So, writing logs of what  it's done. So, if you do want to get involved in that, um, let me know. Um, I'll just say again,  we are at the very early stages but it'd be great to have this as a kind of community  project. We want as many people to get involved, um, as we can. Uh, my Twitter handle's there.  Um, so to sum up, um, nematodes are a novel idea. I think they still are a really novel  idea. Um, ultimately not successful when they were kind of first discussed and first  deployed. And because of that demise of the big traditional network worms, they weren't  really, um, uh, applicable. But I think with the onset of, um, worms that use different  methods to propagate, replicate and exploit, there's potentially, uh, an argument to say  that nematodes could be useful in the future. Um, there are obviously still concerns that  would affect it. Um, but I think, um, that it's potentially an area of promise. Um, anti  dot is our very kind of experimental approach to doing that. Uh, and if nothing else, hopefully  it will stimulate some debate and get people talking. Um, so, uh, there's lots of references  here if you want some, uh, some reading, uh, about the case studies that I talked about,  uh, various other bits and pieces. Um, Twitter handle's there again, email address if you  want to email me. Um, yeah, that's it. Thank you very much.
DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_0_2087.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_2088_3323.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_3324_3383.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_3384_5615.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_5616_6887.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_6888_7931.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_7932_9347.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_9348_12419.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_12420_14483.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_14484_15863.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_15864_18179.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_18180_18263.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_18264_19139.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_19140_19475.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_19476_22883.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_22884_25619.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_25620_25883.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_25884_27611.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_27612_31691.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_31692_32435.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_32436_32963.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_32964_33071.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_33072_34967.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_34968_35075.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_35076_35171.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_35172_35279.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_35280_35351.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_35352_38051.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_38052_39299.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_39300_40043.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_40044_40451.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_40452_41375.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_41376_45731.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_45732_46115.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_46116_46331.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_46332_49067.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_49068_49715.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_49716_54563.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_54564_55307.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_55308_55727.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_55728_55895.png DEF_CON_26_IoT_VILLAGE_-_Matt_Wixey_-_Worms_that_fight_back_Nematodes_as_an_antidote_fo_55896_56223.png
Okay, hi everyone. Thank you very much for coming. So, um, this is worms that fight back. Uh, Nemo Toads is an antidote for IoT malware. Um, so worth pointing out that what I'm going to talk to you about today is presented for educational purposes only. Uh, also worth pointing out that this isn't a brand new concept. This is building on work that's been done previously. Uh, as you guys will see by the, the references and the, the kind of case studies that I'm going to talk about. So my name is Matt Wixie. Uh, I lead research for PWC UK cybersecurity business unit. Uh, also work on its ethical hacking team. Uh, I'm a part-time PhD student at UCL and my previous role was, uh, working in law enforcement, uh, in the UK, uh, leading a technical R&D team. So, I want to talk about, uh, Nemo Toads or anti worms because I think it's a really interesting and, and really underexpored concept. So it's kind of been talked about a little bit before. Um, and it actually goes back, right back to the 1970s when, uh, malware kind of first started to, uh, to be experimented with and played with. Uh, I have a kind of general interest in repurposing bad stuff, uh, for good purposes. Um, and as far as I know, this kind of concept hasn't really been applied to IoT, um, in any kind of security research sense anyway. So I'm going to cover, uh, what a Nemo Toad is, what an anti worm is. Uh, I'm going to go through, uh, history of Nemo Toads in the wild. Uh, I'm going to cover why, um, those attempts didn't really kind of take off. Um, and kind of previous attempts to produce Nemo Toad frameworks, uh, as a kind of commercial offering or service offering. I'm then going to talk about something called Neo Toads which, uh, is a term I've come up with just to describe new kinds of worms using, uh, new replication vectors and whether that makes it worth reopening the debate and whether anti worms are something that could be used. Uh, I've got some demos for you as well. So I'm going to demo some Nemo Toads that I've developed. Uh, I'm then going to talk about something called the Antidote Framework which is something experimental that we're working on at PwC and then finally I'm going to wrap up. So what is a Nemo Toad? Um, so in biology, uh, a Nemo Toad is kind of a generic term for a, uh, a worm or a kind of parasite that attacks other parasites. That's kind of how it's commonly understood. In security, it's an anti worm. So it's a, um, a tool which exploits the same vulnerabilities that malicious worms exploit. It replicates, uh, in the same ways that malicious worms do. Um, but it's designed to disinfect systems, patch systems, kick malicious worms off of infected hosts. Um, and there are three different kinds based on the case studies that are out there. There are, uh, true Nemo Toads. So these are designed to, um, to exploit, uh, systems which have certain vulnerabilities and then automatically like download and install a patch and kick malicious worms off of that host. Uh, there are malicious Nemo Toads. So these are, uh, Nemo Toads which, um, are in themselves malicious but are trying to kick other malicious worms off of infected hosts to kind of boost their own infection rate, um, to kind of kill off the competition if you like. And then finally there are, uh, Moral Nemo Toads and I use the word Moral in inverted comments. So these are, uh, Nemo Toads which in the eyes of the author or the developer perform some kind of beneficial action. Um, they don't necessarily exploit a specific vulnerability but they do something, um, that the, the author believes is, uh, is morally good. So if we walk through the history of Nemo Toads, uh, the first known one and it's kind of apocryphal, um, is Creeper versus Reaper. Uh, has anyone heard of the Creeper virus? A couple of people? So Creeper was, uh, an experiment basically. Uh, it infected, uh, uh, 10x operating systems and it was, um, arguably the first kind of self replicating, spreading piece of malware. Uh, it didn't really do anything. It transferred itself over to different systems rather than replicating and it just printed out a bit of text on the terminal that you can see there. Uh, I'm the Creeper. Catch me if you can. And, uh, Reaper, uh, the rumor has it anyway, is a tool that was developed to try and catch up with the, the Creeper virus. Um, and then kind of kick it off the system. Uh, anyone heard of Animal and the Pervade routine? A couple of people. So Animal, um, was a, uh, a game developed by a guy called John Walker in 1975. It was like a, a kind of guessing game. So it would ask you to think of an animal and then try and guess what it was. Uh, and Pervade was a subroutine in Animal that was designed to spread the game. So it would copy over to shared disks and shared drives. Um, so that it would kind of spread as far as possible. Uh, and Hunter, uh, again, Apocryphal was a tool that allegedly, uh, was designed to track down copies of Animal, uh, and delete them from systems. Uh, there's Brain, um, so you'll be familiar with Brain. Uh, I would imagine so Brain, uh, pretty old virus infected the boot sector of floppy disks, uh, renamed it. And you can see from this screenshot that the authors, uh, ensured that their name and address and telephone number were actually included in this. Um, so there's a, a kind of couple of interpretations of that. One is that it's just kind of a more innocent time in writing viruses and malware and that kind of thing. Uh, the other arguably is that the Brain virus was developed as a kind of warning to software pirates. Um, and the names and addresses and telephone number in there were added so that, um, if people were infected they would have some kind of recourse and they could get themselves patched. Uh, the Denzuko virus was a, uh, a nematode that deliberately targeted, uh, Brain infected, uh, disks. So it would just replace, um, what was on the boot sector, it retitled it. Then there's Co, uh, named after the chemical formula for, uh, potassium hydroxide. So Co, um, would encrypt your disk. Um, but it would, uh, beforehand ask for permission and it would ask you to supply the password. It's kind of a very benign form of ransomware, if you like. So this is a good example of a kind of moral nematode. Uh, the reason it was doing this was to try and, um, protect your system from being attacked and having your data stolen. On a kind of similar note, this Cruncher, uh, from 92, 93, so Cruncher, uh, would compress files, um, on your system, uh, ostensibly to, to save you space. Uh, who's heard of Max Vision or Max Butler? Yeah, quite a few people. So, um, Max Vision, Max Butler was a, uh, penetration tester and security researcher. He ran a website called white hats.com. He also ran something called a RACNIDS, uh, which was a kind of database of attack signatures. And, uh, in 1998, uh, a group called ADM released a worm that exploited a vulnerability in DNS bind software. And, uh, Max Vision, whilst, uh, on the one hand kind of writing public blog articles about that worm, on the other hand, developed a nematode that he released into the wild. So that nematode would exploit the bind vulnerability. Uh, it would then attempt to download and install a patch for it. Um, and I believe it would try and kick off the, the malicious worm if it was on the system as well. Uh, unfortunately, uh, Max left a backdoor on the systems that were patched by that nematode so that he could access them whenever he wanted. Um, and his nematode caused a lot of disruption in military networks that his nematode ended up infecting. Um, if you haven't heard of him before and you're interested, uh, Kevin Polson wrote a great book on him and his story called Kingpin, um, which describes how he went from, uh, kind of a white hat researcher to running, uh, massive carding forum. Um, so it's worth a read if you can, uh, get hold of a copy. Uh, Polypedo is a really interesting one. So this is a good example of a moral nematode. Um, it's pretty basic. So it was from 2001, it was written in VBS. And, uh, what Polypedo did was it would scan your hard drive, uh, for images and it would look at the file names of all those images and it would compare those file names using regular expressions to a hard coded list of file names which were associated with child abuse. And if it found any of those images on your hard drive, it would send an email to various law enforcement agencies and charities and other organizations, uh, attaching the images, uh, and kind of reporting it. So raising all sorts of, uh, really interesting legal and ethical questions about whether or not that's justified. Uh, Blaster versus Welchia, um, so talking about kind of more recent ones here, so the Blaster worm obviously, um, infected, um, uh, uh, exploited vulnerability in DCOMRPC. Uh, Welchia was released about a week later, um, and it would, uh, download and install a patch, it would check the registry to see if the patch had been installed, if not it would download and install it. It would try and, um, delete Blaster from infected hosts and ended up causing all sorts of problems with network bandwidth and denial of service and that kind of thing. Uh, anyone read Stealing the Network? Yeah, a couple of people. So, really great book, uh, really great kind of collection of stories, there's a whole series of them. Um, they're kind of like connected short stories written by hackers about hacking. Uh, some of the, the technology they speak about, a little bit dated now, but they're really good stories. Uh, and this particular one, the worm turns from 2003, uh, describes the situation, uh, very similar to the Blaster and, and Welchia, uh, case study. Um, so definitely worth a read if you can get hold of that. And then the, uh, worm was, uh, worm wars from 2004. So Netsch guy, Bagel, Mydoom, uh, all of which were at one point trying to kick each other off of infected hosts. Um, and the authors were kind of trading insults in the source code of, uh, various versions of these worms as well. So good examples of, um, of malicious nematodes. And then, uh, even more recently, Mirai versus Hajime. So, uh, you'll be familiar with Mirai. Uh, Hajime, um, was, uh, or is an IoT nematode that exploits some of the same vulnerabilities that Mirai does in terms of, uh, default passwords and things like that. Um, includes this message on infected hosts to let people know, um, that it's infected it. And then I think most interestingly, the one that kind of I find most interesting is this one. So this is, um, Brickabot versus Mirai, RIPA and, and various others. So in, um, December last year, there was a, uh, a post on pace bin and ghost bin and a few other places by someone calling themselves Janitor. And they claimed to be the author of the Brickabot worm. Um, so Brickabot, um, would permanently disable machines infected by corrupting the firmware or overwriting the firmware with a bad image. Um, and Janitor claims that, uh, they did that in order to prevent those devices subsequently being misused by Mirai and RIPA and participating in, uh, DDoS attacks. So that again raises all sorts of really interesting legal and ethical questions about whether it's preferable for devices to be bricked or preferable to let them remain vulnerable and then have them be used in massive DDoS attacks which end up potentially taking out parts of internet infrastructure. So, um, the kind of heyday of worms I guess was probably, um, the mid 2000s. You obviously had Conficker a few years later which is, um, you know, probably the, the, the biggest one. Um, but in recent times, uh, traditional kind of network worms have decreased quite a lot. So you still get the occasional one, one across a good example, but generally things like exploit mitigations and better antivirus and security solutions, uh, better patching, management and incident response, uh, generally just better security. It's meant that those kind of big, uh, network based traditional worms have fallen off to a great extent. So there were some previous attempts to try and formalize a kind of nematode framework and make it something that could be used by the security community as something that could be used by organizations to try and protect themselves from, uh, from worms. So the first one, uh, that I'm aware of is a guy called Dr. Cyrus Pakari, um, who gave a talk, uh, Defcon 9, uh, back in 2001. And he was coming from the perspective of, um, of immunology and virology and applying that to computer security. So his concept was that it might be possible to create a kind of intent attenuated or weakened virus, release that in the wild in order to boost the immunity of antivirus systems and security solutions. So, uh, an interesting concept, um, it pretty much remained a concept. It was, uh, just a kind of thought experiment really. Um, then Dave Artel, uh, from immunity sec, uh, presented a talk in 2005, um, where he proposed, uh, a framework which would automatically generate nematodes based on exploits. So the idea was that you would feed in a recent exploit into his framework and it would then generate a nematode automatically, uh, which you could then deploy. Uh, unfortunately, I've only been able to find the slides of that talk. I haven't been able to find any, um, any source code or demos. Uh, if anyone knows of where I can find any, uh, that would be great. Um, and then around the same kind of time, HP, um, started something called active counter measures, uh, which is not a lot of detail available about it, um, but it was essentially kind of using exploits to protect systems. And then in a similar vein, uh, Fijitsu was approached, uh, maybe contracted by the Japanese government in 2012 to do a similar kind of thing. So the, um, all of those proposed frameworks, uh, suggested a number of benefits. So, uh, to, to using nematodes on the corporate system. So as well as being able to kind of rapidly assess, uh, an entire network for vulnerabilities and if they'd already been affected by worms to disinfect them and patch them. Uh, some people also suggested that nematodes could be used for things like distributed searching, uh, for self-discovering networks. So discovering things like shadow IT or hosts which weren't kind of 100% up. Um, and even potentially vulnerability scanning. So consistent vulnerability scanning where every host is a scanner. Uh, the counter arguments for that, uh, are many, really. Um, so firstly there's the Galathe. So just releasing a nematode into the wild in the majority of countries, uh, is going to be illegal because you're still accessing and modifying someone else's system without authorization. Um, there's also an ethics question to it as well, whether it's right to do that, whether it's right for someone to kind of take on that role of, uh, deciding that they're going to sort out your security for you. Uh, there's also a trust model. So evidence from the, the max vision case study where, uh, despite developing a, a kind of beneficial nematode, he also put a back door in it as well. So what makes us, um, able to trust nematode developers any more than, than a worm developer? Uh, obvious issues with denial of service and bandwidth as well. So, because nematodes, uh, will be like worms consistently scanning for new hosts to attack, uh, and will be replicating, uh, that can potentially cause issues, uh, with that as well. Uh, hard to target and control. So even if you are only launching a nematode on an internal network, uh, maybe a fairly small network, if that somehow gets onto a removable device, uh, and that's then plugged into another machine, then that can spread that way potentially. Uh, and lastly, just that worms are difficult to do, uh, difficult to do well anyway. So it's hard to write, uh, an effective and efficient worm which isn't going to crash the host that it infects, it's not going to generate, uh, too much network traffic. So of those frameworks, none of them kind of really went anywhere. Um, none of them kind of really addressed that, that fear factor. Um, and combined with the demise of those traditional big network worms, it pretty much meant that the concepts, uh, died to death really. Now, uh, nematodes, uh, or kind of new generations of worms possibly, um, could make it worthwhile reopening this debate. So if you look at some recent and some not so recent vulnerabilities and, and exploits, um, so taking it from the left, you have the Phillips Hue light bulb. So a black hat talk a couple of years ago described creating a worm using the Phillips Hue light bulb which could spread across and into our city. Um, you've then got Broadpwn, um, looking at vulnerabilities in Broadcom, uh, Wi-Fi chipsets. Um, going back a few years, um, malware in RFID tags and readers, um, that could spread from the tag to the reader and then from the reader to every tag that, that touched the reader. Um, so the proof of concept for that one was SQL injection, fairly easy to do. Uh, BlueBorn, vulnerabilities in implementations of Bluetooth. Uh, the Arduino YUN, so that was a, a paper from a couple of years ago about a wormable vulnerability in that particular Arduino board. And then, at the bottom, various IoT devices. Now, um, these specific devices aren't necessarily vulnerable to, um, to attacks, it's just a kind of illustration of the types of devices. Um, so particularly interesting there, you've got an IP camera, um, and I'll talk about that a bit later on. So, um, given that there are potentially, uh, a new generation of worms on the horizon that use different methods for propagation where traditional vulnerability, vulnerability management doesn't necessarily apply, um, and applying patches can be very difficult. You might be talking about having to have physical access to the device, uh, getting firmware updates over the air, um, potentially time consuming to do that as well. If you have a big network of IoT devices, um, many exploit mitigation mechanisms might not be possible depending on what kind of system it is. You've also got, um, uh, a proliferation now of IoT devices in corporate environments. So, uh, there was a good talk yesterday about, um, smart speakers, um, by Steven Hill about how, um, many organizations now just have sonar speakers in their office. Um, and also as well, if you work in security and you want to demonstrate to a client or you want to demonstrate to supervisors or whatever how, uh, damaging worms can be, nematodes are a really good way to do that, um, potentially. Okay, so I'm gonna run through some demos. Um, so the first one is an example of a true nematode. Um, so this is a fairly recent exploit, uh, it was March this year. Um, it's a command injection vulnerability in a web application called clip bucket. Um, so I wrote a worm in Python, um, that worm, uh, exploits the vulnerability. It downloads and runs a copy of itself, uh, it puts a web shell on the infected machine just to demonstrate that it can, and then it starts to scan for new targets. Uh, the nematode, uh, obviously exploits the same vulnerability. Um, it searches for both the malicious worm and for the PHP back door, deletes both of them. Um, it takes the, uh, PHP file that contains the vulnerability and renames it, and then creates, um, a new version of that PHP file, which just warns the user that they have a vulnerability and they need to update, and then it will scan and replicate. So I have, um, four virtual machines here, um, that all have clip bucket running as a web application. Uh, and you can, this is just to just kind of show at the moment that there's nothing, um, on the system. This is kind of a fresh install of that, um, that web app. Okay, I'll skip forward a little bit. Uh, okay, so this is the, uh, malicious worm being run. So it's running in, uh, just a small subnet, um, finds four vulnerable web applications, exploits them, reports back to a dashboard. So it just tells us that they've been infected. If you then look at the, uh, individual machines, that's the malicious worm that's now been replicated and you can see there's a shell.php file on there as well. Um, so the shell.php is just a one line, uh, PHP back door that's been put on there. So it's just demonstrating that this has happened on, um, on all four of the machines. This is the back door. That's what it looks like. Uh, so very simple example. And then just to demonstrate that that does work. Okay, so you can execute commands with the web show, which is great. So all those machines have now been, uh, infected. And then this is running the NemoTode. So this is doing exactly the same thing. It's based on the malicious worm, um, checking the same subnet, again reporting back to the dashboard. Uh, and it should tell us that they've all been, uh, now disinfected. And then if we have a look at the individual machines, you can see it's renamed the vulnerable file, which is file underscore uploader.php. Uh, it's put a back, um, dot b a k file, uh, renamed it to that. And this is the, the new version of file underscore uploader dot php, which just tells the user that they need to update and it gives them a vulnerability reference. Uh, the NemoTode also removes the, um, the shell dot php, so it removes the back door so that now can't be used. Uh, and it's done that for uh, all four machines. So in terms of practically applying that, how you would do that, um, one option could be that you, um, you have a feed, a vulnerability feed, something like exploit DB, uh, something like that. And you assess for new vulnerabilities whether or not they are wormable. And if they are, or you start to hear that a worm exists in the wild, uh, exploiting that vulnerability, then you can launch a, uh, a NemoTode on your network that checks for it, that removes malicious worms if they're found, uh, and tries to perform some kind of patch. So you would do this, um, you could either do this with an official patch if one has been released or you can do a kind of temporary work around. Okay, um, second demo is an IOT NemoTode. Um, so this is an IP camera, um, manufactured, um, under various brand names. There are two vulnerabilities in it, um, that which can be chained together, um, to make it wormable. So the first is a pre-authentication credential disclosure. Um, so you get the username and password to access the camera. And then the second is authenticated command injection. So the vendors of this camera, uh, have tried to address these and some other vulnerabilities. So it used to be that you could just telnet into these cameras with no username, no password and get a root prompt. They've now disabled telnet, um, by default so you, you don't have telnet access. Um, users are encouraged to change the default username and password. Uh, it also randomizes the HTTP port, uh, for the, the web server of the camera. Um, which is a kind of, I guess, security through obscurity, uh, more than anything else. Um, but the underlying vulnerabilities are still there. So, uh, the worm can retrieve credentials, uh, from the web server, use those to execute commands as an authenticated user. Um, you can then just re-enable telnet and still get a root prompt. So, uh, I was feeling pretty, uh, masochistic, I guess. So I tried to write this worm in bash. Um, turns out bash wasn't installed on the camera, uh, after many hours. So it turned out to be an SH worm instead. Um, so what the worm does, it retrieves a.ini file which contains credentials, extracts them, uses those for command injection, and then replicates. So, um, so that the demo didn't take hours to show you, I've put the cameras on sequential IP addresses, uh, with a static HTTP port. Um, to show, so what the worm will do is it will enable telnet again, uh, with a root prompt. It will also spin the camera around so there's a kind of visual indication that's been infected. Um, and then the nematode will run and it will stop the camera from spinning. Um, and then disable telnet again. So at the moment you can see that you can't telnet into any of these cameras. So I'm now running the malicious worm, um, which is going to infect, uh, these three cameras here. So you can see it starts them spinning. Uh, you can see on the screen that you've got username and password as well and that we're replicating onto the web server. Okay, and then you can see there, uh, that we can now telnet in, uh, and get a root prompt on those cameras. Oops, uh, sorry. Okay, so at this point the nematode has been launched and you can see it's going to stop those cameras from spinning. Um, it's then going to clear up the malicious worm and it is also going to disable telnet access. So, uh, I will now not be able to telnet into these cameras anymore. And then the last demo, uh, is the one that I think is the most interesting. So, um, I wanted to try and create just for purely educational, experimental purposes, uh, an improved version of that polypedo worm. So definitely not advocating that anyone do this in the wild or actually put this stuff out there. Um, but I thought there were kind of several problems with polypedo that could be improved on. So it wasn't efficient. It spread by mailing lists, um, and it determined what was suspicious content by the file name of the image, uh, which isn't particularly, uh, robust. So when you're talking about kind of comparing images, obviously cryptographic hashes are the most, uh, common way to do that. Um, so something like MD5 for instance, there are kind of floors associated with using that. Um, probably the, the biggest flaw is that if very, very slight edits are made to images, it results in a completely different cryptographic hash. So the solution, uh, is something called perceptual hashing. Has anyone heard of perceptual hashing before? Yeah, a couple of people. So perceptual hashing is, uh, a measure of the similarity of two images. Um, you can, there are various ways to do it. Reversed image searching would tend to use some kind of perceptual hashing algorithm. Uh, mine's not as near as complicated as that. Um, but it is, uh, fairly robust in the demos that I'm going to show you. So, um, essentially what it does is, um, and it's based on some previous work in this area, uh, is it will break an image down into 8x8 pixels. Um, it will then retrieve the pixel values, calculate an average pixel value, and then for every pixel, uh, if the pixel is above the average, it will assign a 1 to a string, and if it's below it will assign a 0. So you end up with a 64 bit string of 1s and 0s, which is a, a representation of how each pixel differs from the average, whether it's higher or lower. So you can then just compare that string. So just do simple, uh, string matching. Um, and for what is like a really primitive algorithm, uh, really, is pretty tolerant to things like resizing, so to thumbnails of images, to, um, minor edits in the images, and to, like, sequential frames or different frames from, uh, from the same video. So the, uh, example nematode I created, what it does is it scans a folder, uh, for images. Um, it will generate perceptual hashes, so those 64 bit strings of those images, and it will compare them to a hard coded list of, uh, hashes for suspicious images. And if it's above 90%, it will send an email and attach those images. Uh, replication is over USB, um, so it will check for attached removable media, and, uh, it uses a technique that's been seen in the wild before for, uh, I think it was KJ worm, NJ rat, that kind of family. So it will replicate itself as a hidden file, uh, create a visible shortcut with a notepad icon, and then the target of that shortcut is a hidden file. So the example is that I'm going to use for this demo, uh, this one, so you have an image of a plane that's just been resized, it's been cut down. You have an image where there's been a very slight modification, and then you have, uh, two stills from the same video at different points. So obviously visually similar, but different images. Okay, so this is the inbox, the notifications that I come into, it's empty at the moment. Um, there's a USB drive attached to this laptop that is also, um, empty at the moment. So this is the, um, the folder of original images and the, the corresponding perceptual hash values. And then this is the folder, uh, that the nematode is going to check, uh, for suspicious images. So when the nematode is run, uh, you'll be able to see that it, it starts to find some matches, it indicates what might be a match, says that it's sending us an email, um, and at the end it replicates itself. So the plane, uh, which was the resized was a 95% possible match, the, uh, slight modification 98%, and the video still is 93%. So we go and check the inbox now, we can see that it sent us an email, it said I've infected this machine, um, I found this image which matches this reference image. Here's the similarity score, uh, let me know if I got it right. Uh, and it's done that for all three of those, uh, results. And then, uh, the nematode is also replicated over to the USB drive. Uh, so if we have a look at that. So there's now a shortcut file in there which just says my notes and the target for that is a hidden XE, uh, which is the nematode which is also on there. Um, so if we, uh, refresh the, uh, the, the file listing, uh, for the drive, you can then see that the hidden executable. So there are some refinements that, that could, uh, in theory be made to that to kind of make it a bit more robust so you could have like a depth count of infections so that you only infect so many, uh, machines after initial infection. You could also, uh, have alternative replication methods as well. Okay, so the last thing I wanted to talk to you about was antidote. Um, so antidote, uh, is something that we're working on at PWC. We're in the very, very early stages of doing it. The goal, uh, the, the kind of, um, the idea is to create a modular, free open source framework for people to, uh, develop and use IoT nematodes, nematodes in general, but with a focus on IoT, uh, on their own networks. So, um, the, the dream is to have this as a kind of nematode version of Metasploit. Um, so you can, um, overcome a lot of those, uh, early, um, criticisms of nematodes and nematode frameworks by, um, customizing the exact payloads that are used, uh, deciding whether or not you want it to replicate and how much, uh, whether you want a delay between scans and exploitation, whether you want host to reboot once they've been, um, fixed and scanned and whether you want patches to be applied. Um, so it is very much in the early stages. Um, I'll just show you kind of a video so you've got an idea of what it might look like. So this is a kind of proof of concept. Um, but it would be great to get your thoughts on this and your feedback and if you want to get involved in, uh, the development or you've got any thoughts, uh, it'd be great to hear from you. Uh, I'll put my contact details up at the, the end of the talk. Um, so, uh, this is kind of a, just a demo version that just shows, um, the kind of features that it might have. So, it's kind of a console based framework. You can load in various modules according to whether they're web apps or whether they're IP cameras or, uh, whatever it is. And obviously there would be more kind of IoT devices in those categories. Uh, you can then load a module in. Uh, you can see some info about it. So, whether or not it supports things like disinfection, patching, replication, um, what data was released, obviously what version of software it affects and targets. Um, and then in order to do some kind of damage control so it doesn't, um, leak out into the wild, you can set a starting IP address, uh, an end IP address, uh, how many IP addresses each worm should scan, uh, whether or not you want to use disinfection, patching, replication, uh, you can have a time delay in between exploitation attack attempts, um, so that you know, you can kind of avoid bandwidth and denial of service problems. Uh, you can have a kill switch as well. Um, and you can finally have the nematode, uh, if you want, delete itself after it's, um, done its job. And then it's, it will support, um, log files as well. So, writing logs of what it's done. So, if you do want to get involved in that, um, let me know. Um, I'll just say again, we are at the very early stages but it'd be great to have this as a kind of community project. We want as many people to get involved, um, as we can. Uh, my Twitter handle's there. Um, so to sum up, um, nematodes are a novel idea. I think they still are a really novel idea. Um, ultimately not successful when they were kind of first discussed and first deployed. And because of that demise of the big traditional network worms, they weren't really, um, uh, applicable. But I think with the onset of, um, worms that use different methods to propagate, replicate and exploit, there's potentially, uh, an argument to say that nematodes could be useful in the future. Um, there are obviously still concerns that would affect it. Um, but I think, um, that it's potentially an area of promise. Um, anti dot is our very kind of experimental approach to doing that. Uh, and if nothing else, hopefully it will stimulate some debate and get people talking. Um, so, uh, there's lots of references here if you want some, uh, some reading, uh, about the case studies that I talked about, uh, various other bits and pieces. Um, Twitter handle's there again, email address if you want to email me. Um, yeah, that's it. Thank you very much.
working in law enforcement, uh, in the UK, uh, about a little bit before. Um, and it actually goes back, right back to the 1970s when, uh, and whether that makes it worth reopening the debate and whether anti worms are something that could be used. Uh, I've got some demos for you as something called the Antidote Framework which is patch and kick malicious worms off of that host. the developer perform some kind of beneficial good. So if we walk through the history of Nemo apocryphal, um, is Creeper versus Reaper. Uh, has itself over to different systems rather than reason it was doing this was to try and, um, quite a few people. So, um, Max Vision, Max signatures. And, uh, in 1998, uh, a group called attempt to download and install a patch for it. reporting it. So raising all sorts of, uh, really the patch had been installed, if not it would that. And then the, uh, worm was, uh, worm wars And then, uh, even more recently, Mirai versus Uh, Hajime, um, was, uh, or is an IoT nematode that exploits some of the same vulnerabilities that it's infected it. And then I think most legal and ethical questions about whether it's preferable to let them remain vulnerable and then biggest one. Um, but in recent times, uh, security solutions, uh, better patching, nematode framework and make it something that could be used by the security community as Defcon 9, uh, back in 2001. And he was coming nematodes based on exploits. So the idea was that frameworks, uh, suggested a number of benefits. affected by worms to disinfect them and patch attack, uh, and will be replicating, uh, that can Um, and combined with the demise of those at vulnerabilities in Broadcom, uh, Wi-Fi in RFID tags and readers, um, that could spread just a kind of illustration of the types of that a bit later on. So, um, given that there are potentially, uh, a new generation of worms on the was a good talk yesterday about, um, smart nematodes are a really good way to do that, um, vulnerability. Um, it searches for both the bucket running as a web application. Uh, and you Uh, okay, so this is the, uh, malicious worm exploiting that vulnerability, then you can have tried to address these and some other experimental purposes, uh, an improved version of previous work in this area, uh, is it will break original images and the, the corresponding uh, the nematode is also replicated over to the those, uh, early, um, criticisms of nematodes and obviously there would be more kind of IoT devices traditional network worms, they weren't really,