Defending against cybercrime: advances in the detection of malicious servers and the analysis of client-side vulnerabilities

Esta tesis se centra en el análisis de dos aspectos complementarios de la ciberdelincuencia (es decir, el crimen perpetrado a través de la red para ganar dinero). Estos dos aspectos son las máquinas infectadas utilizadas para obtener beneficios económicos de la delincuencia a través de diferentes acciones (como por ejemplo, clickfraud, DDoS, correo no deseado) y la infraestructura de servidores utilizados para gestionar estas máquinas (por ejemplo, C & C, servidores explotadores, servidores de monetización, redirectores). En la primera parte se investiga la exposición a las amenazas de los ordenadores victimas. Para realizar este análisis hemos utilizado los metadatos contenidos en WINE-BR conjunto de datos de Symantec. Este conjunto de datos contiene metadatos de instalación de ficheros ejecutables (por ejemplo, hash del fichero, su editor, fecha de instalación, nombre del fichero, la versión del fichero) proveniente de 8,4 millones de usuarios de Windows. Hemos asociado estos metadatos con las vulnerabilidades en el National Vulnerability Database (NVD) y en el Opens Sourced Vulnerability Database (OSVDB) con el fin de realizar un seguimiento de la decadencia de la vulnerabilidad en el tiempo y observar la rapidez de los usuarios a remiendar sus sistemas y, por tanto, su exposición a posibles ataques. Hemos identificado 3 factores que pueden influir en la actividad de parches de ordenadores victimas: código compartido, el tipo de usuario, exploits. Presentamos 2 nuevos ataques contra el código compartido y un análisis de cómo el conocimiento usuarios y la disponibilidad de exploit influyen en la actividad de aplicación de parches. Para las 80 vulnerabilidades en nuestra base de datos que afectan código compartido entre dos aplicaciones, el tiempo entre el parche libera en las diferentes aplicaciones es hasta 118 das (con una mediana de 11 das) En la segunda parte se proponen nuevas técnicas de sondeo activos para detectar y analizar las infraestructuras de servidores maliciosos. Aprovechamos técnicas de sondaje activo, para detectar servidores maliciosos en el internet. Empezamos con el análisis y la detección de operaciones de servidores explotadores. Como una operación identificamos los servidores que son controlados por las mismas personas y, posiblemente, participan en la misma campaña de infección. Hemos analizado un total de 500 servidores explotadores durante un período de 1 año, donde 2/3 de las operaciones tenían un único servidor y 1/2 por varios servidores. Hemos desarrollado la técnica para detectar servidores explotadores a diferentes tipologías de servidores, (por ejemplo, C & C, servidores de monetización, redirectores) y hemos logrado escala de Internet de sondeo para las distintas categorías de servidores maliciosos. Estas nuevas técnicas se han incorporado en una nueva herramienta llamada CyberProbe. Para detectar estos servidores hemos desarrollado una novedosa técnica llamada Adversarial Fingerprint Generation, que es una metodología para generar un modelo único de solicitud-respuesta para identificar la familia de servidores (es decir, el tipo y la operación que el servidor apartenece). A partir de una fichero de malware y un servidor activo de una determinada familia, CyberProbe puede generar un fingerprint válido para detectar todos los servidores vivos de esa familia. Hemos realizado 11 exploraciones en todo el Internet detectando 151 servidores maliciosos, de estos 151 servidores 75% son desconocidos a bases de datos publicas de servidores maliciosos. Otra cuestión que se plantea mientras se hace la detección de servidores maliciosos es que algunos de estos servidores podrán estar ocultos detrás de un proxy inverso silente. Para identificar la prevalencia de esta configuración de red y mejorar el capacidades de CyberProbe hemos desarrollado RevProbe una nueva herramienta a través del aprovechamiento de leakages en la configuración de la Web proxies inversa puede detectar proxies inversos. RevProbe identifica que el 16% de direcciones IP maliciosas activas analizadas corresponden a proxies inversos, que el 92% de ellos son silenciosos en comparación con 55% para los proxies inversos benignos, y que son utilizado principalmente para equilibrio de carga a través de múltiples servidores. ABSTRACT In this dissertation we investigate two fundamental aspects of cybercrime: the infection of machines used to monetize the crime and the malicious server infrastructures that are used to manage the infected machines. In the first part of this dissertation, we analyze how fast software vendors apply patches to secure client applications, identifying shared code as an important factor in patch deployment. Shared code is code present in multiple programs. When a vulnerability affects shared code the usual linear vulnerability life cycle is not anymore effective to describe how the patch deployment takes place. In this work we show which are the consequences of shared code vulnerabilities and we demonstrate two novel attacks that can be used to exploit this condition. In the second part of this dissertation we analyze malicious server infrastructures, our contributions are: a technique to cluster exploit server operations, a tool named CyberProbe to perform large scale detection of different malicious servers categories, and RevProbe a tool that detects silent reverse proxies. We start by identifying exploit server operations, that are, exploit servers managed by the same people. We investigate a total of 500 exploit servers over a period of more 13 months. We have collected malware from these servers and all the metadata related to the communication with the servers. Thanks to this metadata we have extracted different features to group together servers managed by the same entity (i.e., exploit server operation), we have discovered that 2/3 of the operations have a single server while 1/3 have multiple servers. Next, we present CyberProbe a tool that detects different malicious server types through a novel technique called adversarial fingerprint generation (AFG). The idea behind CyberProbe’s AFG is to run some piece of malware and observe its network communication towards malicious servers. Then it replays this communication to the malicious server and outputs a fingerprint (i.e. a port selection function, a probe generation function and a signature generation function). Once the fingerprint is generated CyberProbe scans the Internet with the fingerprint and finds all the servers of a given family. We have performed a total of 11 Internet wide scans finding 151 new servers starting with 15 seed servers. This gives to CyberProbe a 10 times amplification factor. Moreover we have compared CyberProbe with existing blacklists on the internet finding that only 40% of the server detected by CyberProbe were listed. To enhance the capabilities of CyberProbe we have developed RevProbe, a reverse proxy detection tool that can be integrated with CyberProbe to allow precise detection of silent reverse proxies used to hide malicious servers. RevProbe leverages leakage based detection techniques to detect if a malicious server is hidden behind a silent reverse proxy and the infrastructure of servers behind it. At the core of RevProbe is the analysis of differences in the traffic by interacting with a remote server.

A single-headed dimer of Escherichia coli ribosomal protein L7/L12 supports protein synthesis

During protein synthesis, the two elongation factors Tu and G alternately bind to the 50S ribosomal subunit at a site of which the protein L7/L12 is an essential component. L7/L12 is present in each 50S subunit in four copies organized as two dimers. Each dimer consists of distinct domains: a single N-terminal (“tail”) domain that is responsible for both dimerization and binding to the ribosome via interaction with the protein L10 and two independent globular C-terminal domains (“heads”) that are required for binding of elongation factors to ribosomes. The two heads are connected by flexible hinge sequences to the N-terminal domain. Important questions concerning the mechanism by which L7/L12 interacts with elongation factors are posed by us in response to the presence of two dimers, two heads per dimer, and their dynamic, mobile properties. In an attempt to answer these questions, we constructed a single-headed dimer of L7/L12 by using recombinant DNA techniques and chemical cross-linking. This chimeric molecule was added to inactive core particles lacking wild-type L7/L12 and shown to restore activity to a level approaching that of wild-type two-headed L7/L12.

The role of enzyme distortion in the single displacement mechanism of family 19 chitinases

By using molecular dynamics simulations, we have examined the binding of a hexaNAG substrate and two potential hydrolysis intermediates (an oxazoline ion and an oxocarbenium ion) to a family 19 barley chitinase. We find the hexaNAG substrate binds with all sugars in a chair conformation, unlike the family 18 chitinase which causes substrate distortion. Glu 67 is in a position to protonate the anomeric oxygen linking sugar residues D and E whereas Asn 199 serves to hydrogen bond with the C2′ N-acetyl group of sugar D, thus preventing the formation of an oxazoline ion intermediate. In addition, Glu 89 is part of a flexible loop region allowing a conformational change to occur within the active site to bring the oxocarbenium ion intermediate and Glu 89 closer by 4–5 Å. A hydrolysis product with inversion of the anomeric configuration occurs because of nucleophilic attack by a water molecule that is coordinated by Glu 89 and Ser 120. Issues important for the design of inhibitors specific to family 19 chitinases over family 18 chitinases also are discussed.

Comparison of fusion phage libraries displaying VH or single-chain Fv antibody fragments derived from the antibody repertoire of a vaccinated melanoma patient as a source of melanoma-specific targeting molecules

A single-chain Fv (scFv) fusion phage library derived from random combinations of VH and VL (variable heavy and light chains) domains in the antibody repertoire of a vaccinated melanoma patient was previously used to isolate clones that bind specifically to melanoma cells. An unexpected finding was that one of the clones encoded a truncated scFv molecule with most of the VL domain deleted, indicating that a VH domain alone can exhibit tumor-specific binding. In this report a VH fusion phage library containing VH domains unassociated with VL domains was compared with a scFv fusion phage library as a source of melanoma-specific clones; both libraries contained the same VH domains from the vaccinated melanoma patient. The results demonstrate that the clones can be isolated from both libraries, and that both libraries should be used to optimize the chance of isolating clones binding to different epitopes. Although this strategy has been tested only for melanoma, it is also applicable to other cancers. Because of their small size, human origin and specificity for cell surface tumor antigens, the VH and scFv molecules have significant advantages as tumor-targeting molecules for diagnostic and therapeutic procedures and can also serve as probes for identifying the cognate tumor antigens.

Fluorescence and photobleaching dynamics of single light-harvesting complexes

Single light-harvesting complexes LH-2 from Rhodopseudomonas acidophila were immobilized on various charged surfaces under physiological conditions. Polarized light experiments showed that the complexes were situated on the surface as nearly upright cylinders. Their fluorescence lifetimes and photobleaching properties were obtained by using a confocal fluorescence microscope with picosecond time resolution. Initially all molecules fluoresced with a lifetime of 1 ± 0.2 ns, similar to the bulk value. The photobleaching of one bacteriochlorophyll molecule from the 18-member assembly caused the fluorescence to switch off completely, because of trapping of the mobile excitations by energy transfer. This process was linear in light intensity. On continued irradiation the fluorescence often reappeared, but all molecules did not show the same behavior. Some LH-2 complexes displayed a variation of their quantum yields that was attributed to photoinduced confinement of the excited states and thereby a diminution of the superradiance. Others showed much shorter lifetimes caused by excitation energy traps that are only ≈3% efficient. On repeated excitation some molecules entered a noisy state where the fluorescence switched on and off with a correlation time of ≈0.1 s. About 490 molecules were examined.

Conformational fluctuations in single DNA molecules

Measurement of fluorescent lifetimes of dye-tagged DNA molecules reveal the existence of different conformations. Conformational fluctuations observed by fluorescence correlation spectroscopy give rise to a relaxation behavior that is described by “stretched” exponentials and indicates the presence of a distribution of transition rates between two conformations. Whether this is an inhomogeneous distribution, where each molecule contributes with its own reaction rate to the overall distribution, or a homogeneous distribution, where the reaction rate of each molecule is time-dependent, is not yet known. We used a tetramethylrhodamine-linked 217-bp DNA oligonucleotide as a probe for conformational fluctuations. Fluorescence fluctuations from single DNA molecules attached to a streptavidin-coated surface directly show the transitions between two conformational states. The conformational fluctuations typical for single molecules are similar to those seen in single ion channels in cell membranes.

Interleukin 12 and B7-1 costimulatory molecule expressed by an adenovirus vector act synergistically to facilitate tumor regression

Stimulation of antitumor immune mechanisms is the primary goal of cancer immunotherapy, and accumulating evidence suggests that effective alteration of the host–tumor relationship involves immunomodulating cytokines and also the presence of costimulatory molecules. To examine the antitumor effect of direct in vivo gene transfer of murine interleukin 12 (IL-12) and B7-1 into tumors, we developed an adenovirus (Ad) vector, AdIL12–B7-1, that encodes the two IL-12 subunits in early region 1 (E1) and the B7-1 gene in E3 under control of the murine cytomegalovirus promoter. This vector expressed high levels of IL-12 and B7-1 in infected murine and human cell lines and in primary murine tumor cells. In mice bearing tumors derived from a transgenic mouse mammary adenocarcinoma, a single intratumoral injection with a low dose (2.5 × 107 pfu/mouse) of AdIL12–B7-1 mediated complete regression in 70% of treated animals. By contrast, administration of a similar dose of recombinant virus encoding IL-12 or B7-1 alone resulted in only a delay in tumor growth. Interestingly, coinjection of two different viruses expressing either IL-12 or B7-1 induced complete tumor regression in only 30% of animals treated at this dose. Significantly, cured animals remained tumor free after rechallenge with fresh tumor cells, suggesting that protective immunity had been induced by treatment with AdIL12–B7-1. These results support the use of Ad vectors as a highly efficient delivery system for synergistically acting molecules and show that the combination of IL-12 and B7-1 within a single Ad vector might be a promising approach for in vivo cancer therapy.

Detection of targeted GFP-Hox gene fusions during mouse embryogenesis

The ability to use a vital cell marker to study mouse embryogenesis will open new avenues of experimental research. Recently, the use of transgenic mice, containing multiple copies of the jellyfish gene encoding the green fluorescent protein (GFP), has begun to realize this potential. Here, we show that the fluorescent signals produced by single-copy, targeted GFP in-frame fusions with two different murine Hox genes, Hoxa1 and Hoxc13, are readily detectable by using confocal microscopy. Since Hoxa1 is expressed early and Hoxc13 is expressed late in mouse embryogenesis, this study shows that single-copy GFP gene fusions can be used through most of mouse embryogenesis. Previously, targeted lacZ gene fusions have been very useful for analyzing mouse mutants. Use of GFP gene fusions extends the benefits of targeted lacZ gene fusions by providing the additional utility of a vital marker. Our analysis of the Hoxc13GFPneo embryos reveals GFP expression in each of the sites expected from analysis of Hoxc13lacZneo embryos. Similarly, Hoxa1GFPneo expression was detected in all of the sites predicted from RNA in situ analysis. GFP expression in the foregut pocket of Hoxa1GFPneo embryos suggests a role for Hoxa1 in foregut-mediated differentiation of the cardiogenic mesoderm.

A single amino acid substitution converts a carboxylesterase to an organophosphorus hydrolase and confers insecticide resistance on a blowfly

Resistance to organophosphorus (OP) insecticides is associated with decreased carboxylesterase activity in several insect species. It has been proposed that the resistance may be the result of a mutation in a carboxylesterase that simultaneously reduces its carboxylesterase activity and confers an OP hydrolase activity (the “mutant ali-esterase hypothesis”). In the sheep blowfly, Lucilia cuprina, the association is due to a change in a specific esterase isozyme, E3, which, in resistant flies, has a null phenotype on gels stained using standard carboxylesterase substrates. Here we show that an OP-resistant allele of the gene that encodes E3 differs at five amino acid replacement sites from a previously described OP-susceptible allele. Knowledge of the structure of a related enzyme (acetylcholinesterase) suggests that one of these substitutions (Gly137 → Asp) lies within the active site of the enzyme. The occurrence of this substitution is completely correlated with resistance across 15 isogenic strains. In vitro expression of two natural and two synthetic chimeric alleles shows that the Asp137 substitution alone is responsible for both the loss of E3’s carboxylesterase activity and the acquisition of a novel OP hydrolase activity. Modeling of Asp137 in the homologous position in acetylcholinesterase suggests that Asp137 may act as a base to orientate a water molecule in the appropriate position for hydrolysis of the phosphorylated enzyme intermediate.

Detection of HIV-1 RNA by nucleic acid sequence-based amplification combined with fluorescence correlation spectroscopy

Nucleic acid sequence-based amplification (NASBA) has proved to be an ultrasensitive method for HIV-1 diagnosis in plasma even in the primary HIV infection stage. This technique was combined with fluorescence correlation spectroscopy (FCS) which enables online detection of the HIV-1 RNA molecules amplified by NASBA. A fluorescently labeled DNA probe at nanomolar concentration was introduced into the NASBA reaction mixture and hybridizing to a distinct sequence of the amplified RNA molecule. The specific hybridization and extension of this probe during amplification reaction, resulting in an increase of its diffusion time, was monitored online by FCS. As a consequence, after having reached a critical concentration of 0.1–1 nM (threshold for unaided FCS detection), the number of amplified RNA molecules in the further course of reaction could be determined. Evaluation of the hybridization/extension kinetics allowed an estimation of the initial HIV-1 RNA concentration that was present at the beginning of amplification. The value of initial HIV-1 RNA number enables discrimination between positive and false-positive samples (caused for instance by carryover contamination)—this possibility of discrimination is an essential necessity for all diagnostic methods using amplification systems (PCR as well as NASBA). Quantitation of HIV-1 RNA in plasma by combination of NASBA with FCS may also be useful in assessing the efficacy of anti-HIV agents, especially in the early infection stage when standard ELISA antibody tests often display negative results.

Molecular basis for the recognition of two structurally different major histocompatibility complex/peptide complexes by a single T-cell receptor

2C is a typical alloreactive cytotoxic T lymphocyte clone that recognizes two different ligands. These ligands are adducts of the allo-major histocompatibility complex (MHC) molecule H-2Ld and an endogenous octapeptide, and of the self-MHC molecule H-2Kb and another peptide. MHC-binding and T-cell assays with synthetic peptides in combination with molecular modeling studies were employed to analyze the structural basis for this crossreactivity. The molecular surfaces of the two complexes differ greatly in densities and distributions of positive and negative charges. However, modifications of the peptides that increase similarity decrease the capacities of the resulting MHC peptide complexes to induce T-cell responses. Moreover, the roles of the peptides in ligand recognition are different for self- and allo-MHC-restricted T-cell responses. The self-MHC-restricted T-cell responses were finely tuned to recognition of the peptide. The allo-MHC-restricted responses, on the other hand, largely ignore modifications of the peptide. The results strongly suggest that adaptation of the T-cell receptor to the different ligand structures, rather than molecular mimicry by the ligands, is the basis for the crossreactivity of 2C. This conclusion has important implications for T-cell immunology and for the understanding of immunological disorders.

In silico detection of control signals: mRNA 3′-end-processing sequences in diverse species

We have investigated mRNA 3′-end-processing signals in each of six eukaryotic species (yeast, rice, arabidopsis, fruitfly, mouse, and human) through the analysis of more than 20,000 3′-expressed sequence tags. The use and conservation of the canonical AAUAAA element vary widely among the six species and are especially weak in plants and yeast. Even in the animal species, the AAUAAA signal does not appear to be as universal as indicated by previous studies. The abundance of single-base variants of AAUAAA correlates with their measured processing efficiencies. As found previously, the plant polyadenylation signals are more similar to those of yeast than to those of animals, with both common content and arrangement of the signal elements. In all species examined, the complete polyadenylation signal appears to consist of an aggregate of multiple elements. In light of these and previous results, we present a broadened concept of 3′-end-processing signals in which no single exact sequence element is universally required for processing. Rather, the total efficiency is a function of all elements and, importantly, an inefficient word in one element can be compensated for by strong words in other elements. These complex patterns indicate that effective tools to identify 3′-end-processing signals will require more than consensus sequence identification.

Chemical synthesis of the precursor molecule of the Aequorea green fluorescent protein, subsequent folding, and development of fluorescence

The present paper describes the total chemical synthesis of the precursor molecule of the Aequorea green fluorescent protein (GFP). The molecule is made up of 238 amino acid residues in a single polypeptide chain and is nonfluorescent. To carry out the synthesis, a procedure, first described in 1981 for the synthesis of complex peptides, was used. The procedure is based on performing segment condensation reactions in solution while providing maximum protection to the segment. The effectiveness of the procedure has been demonstrated by the synthesis of various biologically active peptides and small proteins, such as human angiogenin, a 123-residue protein analogue of ribonuclease A, human midkine, a 121-residue protein, and pleiotrophin, a 136-residue protein analogue of midkine. The GFP precursor molecule was synthesized from 26 fully protected segments in solution, and the final 238-residue peptide was treated with anhydrous hydrogen fluoride to obtain the precursor molecule of GFP containing two Cys(acetamidomethyl) residues. After removal of the acetamidomethyl groups, the product was dissolved in 0.1 M Tris⋅HCl buffer (pH 8.0) in the presence of DTT. After several hours at room temperature, the solution began to emit a green fluorescence (λmax = 509 nm) under near-UV light. Both fluorescence excitation and fluorescence emission spectra were measured and were found to have the same shape and maxima as those reported for native GFP. The present results demonstrate the utility of the segment condensation procedure in synthesizing large protein molecules such as GFP. The result also provides evidence that the formation of the chromophore in GFP is not dependent on any external cofactor.

Detection of a Yb3+ binding site in regenerated bacteriorhodopsin that is coordinated with the protein and phospholipid head groups

Near infrared Yb3+ vibronic sideband spectroscopy was used to characterize specific lanthanide binding sites in bacteriorhodopsin (bR) and retinal free bacteriorhodopsin (bO). The VSB spectra for deionized bO regenerated with a ratio of 1:1 and 2:1 ion to bO are identical. Application of a two-dimensional anti-correlation technique suggests that only a single Yb3+ site is observed. The Yb3+ binding site in bO is observed to consist of PO2− groups and carboxylic acid groups, both of which are bound in a bidentate manner. An additional contribution most likely arising from a phenolic group is also observed. This implies that the ligands for the observed single binding site are the lipid head groups and amino acid residues. The vibronic sidebands of Yb3+ in deionized bR regenerated at a ratio of 2:1 ion to bR are essentially identical to those in bO. The other high-affinity binding site is thus either not evident or its fluorescence is quenched. A discussion is given on the difference in binding of Ca2+ (or Mg2+) and lanthanides in phospholipid membrane proteins.

Multiplex detection of four pathogenic retroviruses using molecular beacons

We describe a multiplex nucleic acid assay that identifies and determines the abundance of four different pathogenic retroviruses (HIV-1, HIV-2, and human T-lymphotrophic virus types I and II). Retroviral DNA sequences are amplified in a single, sealed tube by simultaneous PCR assays, and the resulting amplicons are detected in real time by the hybridization of four differently colored, amplicon-specific molecular beacons. The color of the fluorescence generated in the course of amplification identifies which retroviruses are present, and the number of thermal cycles required for the intensity of each color to rise significantly above background provides an accurate measure of the number of copies of each retroviral sequence that were present originally in the sample. Fewer than 10 retroviral genomes can be detected. Moreover, 10 copies of a rare retrovirus can be detected in the presence of 100,000 copies of an abundant retrovirus. Ninety-six samples can be analyzed in 3 hr on a single plate, and the use of a closed-tube format eliminates crossover contamination. Utilizing previously well characterized clinical samples, we demonstrate that each of the pathogenic retroviruses can be identified correctly and no false positives occur. This assay enables the rapid and reliable screening of donated blood and transplantable tissues.