Be your savior-the battle for System Security

1. Who is the savior?

I believe that none of my friends who have read the matrix will be unfamiliar with the hero, Neo. The programmer who broke into the virtual world once and again played the "Savior" role, protecting city residents, its image has been deeply rooted in the hearts of the people. After leaving the film, our vast number of computer users will face another real and false digital virtual world-the network. There are also many dangers lurking here, as well as the "hacker empire ", but there is no such person here. We can see that there are only a variety of security vendors and the security tools they provide. In addition, there seems to be no other choice.

As a result, many users regard various security tools as the "savior" in the world. We see a lot of advertisements about security tools, and we purchase popular anti-virus software on the market, when we hear about the weekly "new virus warning", we need to quickly upgrade the virus feature library. We perform a long virus scan on the computer every week ...... Many people do this, and many people have to, because we have handed everything to the anti-virus tool, and we don't need to do anything. We just need to chat online and watch movies without fear, because we have anti-virus tools, which all have a "real-time monitoring" function, it will check the files we just downloaded every moment, and we feel very safe, we think this is the defense in the network.

But is it really so beautiful? I vaguely remember a saying like this: "No matter what you do, you must pay a certain price ", while enjoying the security protection brought about by anti-virus tools, we are also paying the appropriate price. Why? Because the anti-virus tool is a set of programs that start to run at system startup until they are shut down or the user exits, their detection and defense mechanisms cannot be more efficient than those of NEO. For example, anyone who has learned programming knows that the chess program is the most difficult to write perfect, because there is never a fixed pattern for playing chess. We can create many patterns, but the program cannot. It can only determine how each step moves based on a limited judgment mechanism, which is why many chess programs today look like dummies. Some may say that a powerful chess program can write all the methods that you may encounter into it, and this chess program must be invincible. This is feasible, but the cost is that it may take a lifetime for anyone playing chess with it, because the program should "think" all the situations encountered as much as possible before every step of the game, so it will take time to pay, if you want to shorten the time, it is necessary for the program to think about multiple ways at the same time, but at the same time, the cost becomes a huge system resource consumption-can you bear it?

The same defect is occurring on anti-virus software. We know that most anti-virus software uses the "pattern" technology to search for viruses. That is to say, the anti-virus software engine reads a program or file, it matches a specific piece of code in the virus program that has been stored in the database. Once the two are the same, the antivirus software confirms that the file is a virus. With the huge family of viruses, the size of the database has increased to a point that cannot be ignored, and the loading speed has slowed down. In addition, each time a virus pattern is added to the database, the Anti-Virus engine will increase the number of judgment branches, and the corresponding time will be extended. In order to avoid the embarrassment of scanning a file for half an hour, anti-virus software uses various solutions to increase matching speed, but none of these solutions require crazy exploitation of users' system resources. If the configuration of a computer is not very high, when users detect viruses, basically, he is no longer able to do other work normally. Find a TV station and watch the series. This is the price of NEO.

So who is our savior? The answer is-yourself. People who can trust can always be themselves. If they are willing to work hard, everyone can be a Neo. However, this is also a price because it changes the consumption of system resources to the consumption of the brain, write the judgment branch and experience into your mind. In terms of the efficiency of processing the branch, people will always be more flexible than the program. In this way, there will be no vicious circle of dependency, leaving anti-virus software, we must learn to protect ourselves from being hurt by this virtual world. Now, let's be our savior.

　　2. Be your savior

When I was a child, I once saw a story "another aggression", and the Space Invaders defeated by humans gave us a kind of crystal. As long as humans pick it up and think about an item, this item will appear in front of you, so everyone began to immerse themselves in endless enjoyment, and no one went to study scientific and technological defense. After decades, humans began to degrade. At this time, the cosmic invaders visited the earth again. This time they conquered the earth with only one whip, before the last human was evicted into a cage, he turned around and said something vaguely-even his tongue had deteriorated. Maybe he said, "The earth is over."

The above story may be just an illusory fantasy, but similar behavior is happening in the contemporary era. If a user suspects that his computer is infected with a backdoor, his first reaction was probably to turn on the anti-virus tool. In the story, humans rely too much on the magic of Crystal. In reality, we rely too much on anti-virus software for convenience and convenience! Some people may disagree. Since tools can be used to protect computer security conveniently and quickly, why bother me to learn security defense? This way, users do not think of the complexity of the network. The "guests" that can break into the computer are not members on the list of major security tool vendors, some small-scale and undisclosed "Private backdoors" are still circulating in the network (for example, most DDoS backdoors are actually self-written and used ), all competent people can write "Private backdoors" on their own and put them on others' computers in multiple ways. At this time, the limitations of the "virus Database pattern" technology began to be revealed. users infected with "Private backdoors" occasionally noticed computer exceptions, and then they began to check for viruses, as a result, because the backdoor program infiltrated into the system has not been "registered" in the virus feature library, anti-virus software cannot recognize it, after a lot of time is wasted, the user can continue to "enjoy" the feeling of being infiltrated by the "no virus found" message reported by the anti-virus software. Is this ridiculous? We can only be killed by the enemy in front of the one we trust-even this one no longer exists, if the backdoor can kick it out of memory and delete it.

In other words, only people who can trust them are themselves. What's more, this is the network. Therefore, we can no longer hide in the bunker and wait for the savior to destroy all the enemies. We will be our savior!

　　3. Capture "guests" that are not invited"

"600 robots wrap rubber skins and are easy to recognize, but the current 101 robots are made by biochemical technology, with real skin, breathing, bleeding, and even bad breath, just like humans, you can only know that it is not human until it begins to attack."
"What do you do ?"
"We use a dog to identify Terminator ."
-- Terminator

In Terminator, a dog is the only tool that can distinguish between the enemy and the enemy, because it judges each other in a way that is not only eye-oriented, but the eyes can be deceived, but the breath cannot, no matter how vivid a robot is, it cannot have the breath of life, but it can deceive human vision and hearing, which is enough.

The backdoor technology has developed several generations since its birth, and its camouflage technology has become more and more mature. From the initial startup Item combined with the hidden process method to the latest Ring0 driver method, it is increasingly difficult for us to find traces of these "guests". When it begins to destroy it, it is no longer necessary to take remedial measures. Therefore, we need a "dog" that can sniff the backdoor ".

　　1. Preparations

Before doing all the work, you need to have a certain understanding of the system, such as the registry, startup items, services, common programs and process names. This is the most basic requirement for learning to manually detect viruses, in the initial stage, you can refer to some articles that introduce system concepts, such as "system process details" and "WinXP System Service Introduction and Optimization Measures", and take some notes, we strive to keep in mind the usage of some of the most common system programs and related tools over time. If this threshold cannot be reached, we will not be able to talk about the subsequent work.

First, we must understand the three major knowledge points of Windows: Registry, Process, and Privilege ).

"Registry" is a database that appears in Windows 95 and later versions. Before you configure the software and hardware work environment, you must modify a file called "configuration settings" (INI, however, since each device or application has to have its own INI files, the management difficulty is virtually increased. To solve this problem, Microsoft began to unify standards and centralize various information resources for storage, finally, a "Registry" is formed to include application and computer system configuration information ", the Registry is used to manage application and file associations, hardware device descriptions, status attributes, various status information and data, and maintain the normal operation of the entire system.

The Registry uses a structure tree similar to a file directory to describe configuration information. The top five items are called "ROOT_KEY ), the system can recognize that all other data is expanded from them. The five root keys are:

HKEY_CLASSES_ROOT (responsible for various component Registration Categories and file parallel information)
HKEY_CURRENT_USER (Environment Information of the current Login User)
HKEY_LOCAL_MACHINE (Public Environment Information of the entire system)
HKEY_USERS (Environment configuration information of all users)
HKEY_CURRENT_CONFIG (current configuration information)

Registration Information of executable files such as Taobao,. bat,. scr, And. com, so that you can run them first. More information about the registry will be mentioned later. Now let's take a look at what the process is.

"Process" refers to the data information block that the system requests to open to an executable file in the memory during running, by controlling this data block, the system provides data exchange for running programs and determines the survival period of the program. Any program must have at least one process, otherwise it will not be recognized by the system. In one aspect, a process is an executable file that copies itself from the storage medium to an image in the memory. It usually corresponds to a file on the disk, A complete process information includes a lot of data. The "application" tab we see in the process viewing tool contains the process title, the "process" tab contains the process file name, process identifier, and memory usage. Among them, "process file name" and "process identifier" are essential, the process identifier is the unique number specified by the system when it is allocated to the process memory space. The process starts from memory loading to the end.