$kernel.infect(): Creating a cryptovirus for Symfony2 apps
CC Attribution - NonCommercial 2.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Fraile, Raul
$kernel→infect(): Creating a cryptovirus for Symfony2 apps Cryptovirology studies how to use cryptography to design malicious software, given that public-key cryptography can be used to break the symmetry between what an antivirus analyst sees regarding a virus and what the virus writer sees. In this workshop we will create a simple cryptovirus in PHP - for educational purposes - able to infect a Symfony2 app and encrypt data such as database records or user uploaded files using public key cryptography with OpenSSL. To create the virus we will study how Symfony works internally, especially what kernel events are dispatched and how to use them to attach our virus. Several strategies to hide the virus will be discussed. Simple ones like using different encodings and more advanced strategies such as polymorphic code. Finally, we will see how we can defend ourselves from this kind of attacks. ······························ Speaker: Raul Fraile Event: FrOSCon 2014 by the Free and Open Source Software Conference (FrOSCon) e.V.
 Okay, let's start with the talk about creating a crypto virus for Symphony 2 apps. My name is Rolf Reile, I come from Spain. A little bit of me, I am a software developer at CervoGo, a hosting company specialized in PHP hosting, I am a certified engineer, a Symphony certified developer, and I am now studying a master degree in research and computer technologies, and I am focusing on cryptography and data compression, so I thought that would be interesting to apply those things about cryptography to PHP, and especially with Symphony. This is something we will talk about during the talk, we will see the CDPHP, PAPIs, we will see a little bit about them. Even though you don't know Symphony, I will explain just a little bit, so you can follow the talk. It has functions, cryptography, Symphony kernel events, OpenSSL. First, we define what cryptobiology is. Cryptobiology is a computer science field that studies how to use cryptography to design malicious software. It is closely related to ransomware, you get some kind of information, you destroy something, and you ask for money or for information to get the information back, or to get what you deleted back. And also for private information retrieval, from the point of view of Fahaker, it is always important to retrieve some information, but they want to do it safely. So cryptography can help here. And it was a fundamental piece in cryptography. Before that cryptography was used to protect information, to hide what we don't want to share with the rest of the world. Here, applying cryptography to malicious software was a fundamental twist. We divide the talk into main blocks. There will be a quick demo at the end of the talk. First, we see what is public cryptography, which is very important. We see how and why. And then some Symphony internals. It's also important to know how Symphony works internally, so we can attack in some different ways. Some hiding strategies for our virus, and at the end, protection strategies. How can we protect from these kind of attacks? Okay, so we're going to see how we're going to create our own cryptorvirus, for fun, because only for fun. This is only for educational purposes. And I'm warning, this is not a real virus, it's just a proof of concept. Symphony is... I chose Symphony because it's what I know, but these same concepts could be applied to some framework, to PHP, whatever you want, even to plain PHP. And we assume that the virus is already in the target computer. We don't see how to inject that virus in the computer. I'm not a security expert, so this part probably would be done by a security expert. So, a cryptorvirus. How we are going to create it? So the first step is we're going to have the observer. We have Symphony here, an application written in Symphony, and we already have the virus. Then we have another server, which is the server of the hacker. So once the virus is here and it's executed, it connects automatically to the hacker server and asks for a public key. We'll see in a couple of minutes, public key cryptography. But the idea is that we get the public key. The hacker server generates a key pair with a public key, a private key. So it returns a public key and saves the private key. Then the virus already with the public key inside infects the Symphony's application. It could be done in many ways, but we are going to use Symphony kernel events and the Bustra PHP.Cache file. We'll see also how they work. Then once our code is here, we have access to database connection, user blog files, blogs, whatever. So we can use that public key to encrypt that information. Once that information is encrypted... Sorry. Once that information is encrypted using the public key, there's no way to decrypt it without the private key, which is in the hacker server. So we will need to get that private key. Obviously, paying some money. So once we have the private key, we can get back that information. Hacker can use services like Bitcoin to add an extra level of anonymity. That would be a ransomware attack. And we're going to see also the other kind of attack, the private retrieval information. Using the same code, we have here the infected application. Imagine we have a login and password page in Symphony. This is done in a kind of special way. So if we know that we are attacking a Symphony app, we know how to get that information. So once that information is submitted, we can take it here and save it encrypted in a file. So if anyone, the webmaster knows, sees these kind of files, he won't be able to know what is inside because it will be encrypted. Then we will create a backdoor so the hacker server can connect and get the list of users encrypted and using the private key that will be decrypted. We'll see everything in the demo. Now we're going to see the different parts, important parts to know how the virus works. First, public cryptography. Who knows how public cryptography works? Lots of people. Public key and it's also called asymmetric cryptography. Requires two different keys. A public key so we can share that key with anyone and a private key. We'll use, most of the time, we'll use the public key to encrypt information. There are two ways. We'll use the public key to encrypt information and the private key to decrypt it. Public key cryptography is based on one-way functions which are called also trunders. These mathematical functions are really easy to compute in one way and really difficult in the other way. We'll see an example now. This is important because it is believed to be difficult. What does that mean? It means that there is no way to do it fast. It doesn't mean that anyone or any organization can have already a method to do it fast. Some of these one-way functions would be integral factorization which is used by Erase. We're going to use it. This is the local and elliptic codes. If we have Alice and Bob and Alice want to send an image to Bob, Alice has her own private key and her own public key. I'm also Bob, a different private key and a different public key. Alice says to Bob, I want to send that image. Bob says, okay, I give you my public key. Using that public key, you will be able to encrypt it so only me will be able to decrypt it later. We can see this like a box with a padlock. Bob is sending an open box and an open padlock. Alice input enters that image in the box, closes and closes the padlock. So only Bob will be able to open the padlock with the private key. If anyone in the middle gets that information, they just bar-garb it. So this is the factorization problem. For example, if we have P and Q and we want to calculate N, N is a multiplication of P and Q. So even if we use some big numbers for a computer, it's really easy to do it, really fast. In the other way, if we want to know that multiplication, the result, we have the result and we want to know what two numbers were used for the multiplication, we will need to factorize. And factorize is really complex for a computer and for a human. So it is slow. And slow means that there is no known way to do it in polynomial time. We'll use OpenSSL for the sample, which is a general purpose pictorial library. And because we have an extension, PHP OpenSSL, so we can use it from PHP. We'll know what happened with OpenSSL a few months ago. So how can we use OpenSSL from PHP? Imagine we want to create a key pair, a pair of private and public key. We define an array. That is not important now. We say that this is going to be the length of the key and the type. This is RSA. RSA uses the factorization. With that function, we get a key pair. We get that SAP PHP resource. With other function, we extract that private key and then we extract the public key. It is not complex, but it requires a few steps. But if you use this in a function, you want to use a function and get the pair. This is how they look. If you already configure a patch, for example, with HTTPS support, we already know this kind of piece. And then to encrypt that information, we can use this function, which gets the data to the encrypted, the public key, and a reference parameter. So we will get the encrypted information here. Then to the encrypted, using another function, we pass the encrypted information. This will be the variable when we will get the encrypted information and the private key. For our purpose, always encrypt information with the public key and the encrypted data with the private key. Is everything clear with the public key cryptography? Any questions? Yes. So your virus will use the OpenSSL OpenSSL library, so it adds a dependency maybe to the application. The question is that the virus will use OpenSSL, so it is adding a requirement for the virus to run. Yes, it's a requirement. But we could do it from PHP manually, but it won't be safe at all. But for a virus, it will be a good way. So, Symphony, who have used Symphony before? Who haven't used Symphony before? Symphony is a framework for PHP applications. It's quite complex and quite flexible, so you can use the whole framework or you can use only some components. And inside, in every request, there are dispatch a few events. They are called kernel events. So every time a client sends a request, a new object of the request type is created. And then the kernel.request event is dispatched. There can be one listener or lots of listeners listening to this event, so you can use that information for something. Or you can, for example, send a response to that listener and then the execution. Then, when a response object is created, a kernel.response event is dispatched. So we can also use it for whatever. For example, we could use Google Analytics code in that event. It's not the best idea, but we could use it for that. Okay, once the response is sent to the browser, it emits an important event, which is kernel.terminate. We are going to use that event for encrypted information because we are going to encrypt user-uploaded files. So this may take time if there are too many files. So using that event, the client already has the web page. So we can do it later. This is especially useful for, for example, sending emails or post-processing information. Then, in the normal flow, it is kernel.controller event dispatched. And then, in case we don't return a proper response object in the controller, there is a last opportunity to convert that object, for example, a one string into a proper response object. And always, in case there is an exception, an event is dispatched, so we can transfer that exception into a proper response object with extra information, for example. So we will use this event for encrypted information and this event to get the user and password entered by a client. Okay, I will recap kernel request as soon as the request arrived. Kernel controller, once the controller is resolved, kernel view in case the controller doesn't return a response, kernel response, kernel exception and terminate, as I said, for expensive, poor response jobs. And the other part of symphony that you want to, that you need to know is the bootstrap PHP cached file. This is a file created by symphony, it is created by, it's a composer script, okay, but it is used to improve performance. This is just a huge file with lots of classes and interfaces, it's just a copy paste of those files. Why? Performance, okay, instead of loading those files separately, we already have here and we are going to use them for sure, so it's a good idea to have them there. If you download the standard edition of symphony, you will see these two commands. So when we do a composer install or composer update, these commands will be executed and create that bootstrap file. Yes. So bootstrap.cached file is generated by PHP or by the composer called to? Because you talked about the.cached file. Yes, it is generated here, okay, it's the command is configured in composer, but it is a bundle of symphony, so it is created there. So it was just a question which, if the web server has the right permissions to the.cached file, but if the server is probably configured, it's not necessary, right? You can use, okay, the question is if you can use the bootstrap file or not use it. So the question is, if the web server needs right permissions to this.cached file? Yes, it needs. But if they are using symphony, they are probably there, the right permissions. It's not necessary to use it, there are other ways. So we see the third part, hiding the virus. Usually, antivirus software works in two different ways. The first way is through virus definitions. So virus definitions, they are just patterns, so we can look for those patterns in files, okay? It is fast because it is just to compare a few patterns, but it is only useful for non-malware. If there is a new virus, we will have the virus definitions, so we won't be able to get it. So the other strategy is to use heuristic. Heuristic are also patterns, but you look for suspicious patterns. For example, suspicious TCPIP packets, suspicious kernel events. For example, a virus by definition replicates itself. So this is not common for normal software. So this could be a flag, so that could be a virus. Okay, I have to try this, but this works in PHP. So we can do a link of the file, so the current script will be deleted. So this could be a good way to infect the symphony app, and once infected, remove the file. We need to inject some code into Bustrak file, as I said. We can inject it as a normal PHP code, but we can try to make it difficult for a virtual antivirus to detect it. So for example, if we want to inject that code, PHP info, we can use this technique. There are other techniques. So for example, we encode with base 64 five times. Base 64 is lossless, so once decoded, we'll get the same information. So we encode it five times, and then we generate a PHP code able to decode it. So we'll use eval, which is nice for a virus, for real software. And we'll get the string, base 64 decode, five times. Then code the code, we go from here, and then the five parentheses. Then we can use this app to compress it. This app is also lossless. So then we will be able to generate the original information. So we'll get a compressed code. Then using this, we'll be able to execute the code. We'll see an example also with this later. That is nice, but it's just a couple of tricks. So a better idea is use polymorphic code. Polymorphic code uses a polymorphic engine to take code. So we pass some code, and we get different code, but that's exactly the same. So that makes it really difficult for antivirus software to recognize the code as changes every time. So most of the time, you're forcing to that antivirus software to use emulation to execute that code in a simple environment to see what it's doing. For example, if we have these five lines of code, all these lines print the same. In different ways, they print hello world, but they do it in different ways. For example, the first one is easy. This one also. The fourth one uses the CD out to print it, and the fifth one uses character by character. So all of them print hello world, but using different code. So using this, they're making life more difficult for antivirus. More important in PHP, it generates different upcodes. So if you take a look at the generative of codes, they are all different. So it makes it difficult. The goal for a virus would be to create a polymorphic enzyme able to generate different codes in each infection. As you know, this is also really difficult in a computer because it is impossible to generate real random numbers in a computer. If you use run or empty run to do cryptography, don't do it. You can see that there are patterns. Even in empty run, there are also patterns. It is better, but not good enough for cryptography. So it is always recommended to use physical methods for that. For example, random dot org uses atmospheric noise to generate random numbers. We also as humans are not good to generate random numbers. So we're going to do a quick test. During five seconds, we're going to think about one number between one and ten. Start. This is real time. Most of you probably have think of the number seven. Because when a brain tries to generate a good random number, it says one and ten out because it is the first and the last. Second is to come on. And then it looks for five in the middle out. And seven is what we consider the weirdest one. Because it's another number, it's prime number. But an ideal number generator is the frequency that should run. And the last part is about protecting us. So before the infection, we do what we have to do. The user security measures, restricted permissions, as you said, disabled PHP OpenSSL is not going to use it. And something that we can also do is virus and inoculation. So we have a virus always have a method to see if a given file is already infected or not. So if we know how to check how the virus checks if the file is infected, we can inject that information. For example, in a PHP comment or using the hard compiler function and inject that information there. So if we know the virus and we want to avoid that attack, it can be a good strategy, but only for a given virus. And once the app has been infected, we want to check the integrity to know if it's infected or not. So one way to check the integrity of some code or some information is using hash functions. Hash functions, we are used to use it in every day. We use SHA-1, for example, MD5 sometimes. And basically they create fixed-length digest, text-sum, from data or arbitrary length. They must be easy to compute and there must be really, really, really difficult to generate a message with a hash that we want. Really difficult to modify a message without modifying the hash. Really difficult to find two different messages with the same hash. This happens because the number of hash numbers is limited, but it must be really difficult. And the basic idea is this, tiny changes in the source generate big changes in the address. So for example, if we are hashing one gigabyte of information and we change just one bit, if the hash function is good enough, it should generate a new hash number with at least 50% of information change. If you like the hash theory, it's like this, like the butterfly effect. In initial conditions, little changes in initial conditions lead to big changes at the end. So the theory says that the flapping of the wings of a butterfly could cause a trishter in the other part of the world in many years. Like when you go to the past and they say, don't touch anything. The same idea. Why we don't use MD5 anymore? Because it's not collision resistant. The idea is in the build process, when we deploy the project, we can create a hash of the whole project and then check it regularly. For example, using the final component of symphony, we can get all PHP files, for example, and then create a hash of the whole project. So using that number, we can check it in production from time to time and check if anything changes or not. It could be a nice way, but we already have this in PHP, using the path extension. Anyone have used FAL before? Used. No composer? The basic idea is you encapsulate all the projects, even its dependencies, in a single file, in a FAL file. It's equivalent to JavaJal files. The nice thing for this talk is that FAL files can contain a signature, a text of the included files. So we are sorry. Okay, so it can contain a signature of the included files. So we can have what we did before manually, and we can have it automatically. FAL files are divided into four blocks. At first, there's a stack that usually contains some loaded functionality. Basically, some code to be able to map between the included files and that PHP code. It always ends with this function, hard compiler. Who knows what that function does? Two, three, four. That is a real PHP function, and what it says is to the PHP interpreter to stop. Anything that I put after that is not interpreted by PHP. So we can use it, for example, for install script, for example. Then we have a manifest. This is no longer a PHP valid code because we use this function. The manifest basically has the name of the included file names, some checking, the timestamp, size, some binary flags. Then the actual contents will have PHP code, our dependencies. And at the end, a signature. So we can have a signature in MD5, SHA1, 2M56, and 512. So I created a... This is only a missing line. I created a really simple file. So you can see here, we open PHP, we execute map path, so we can map between... We can access the included files and echo hello world. And then hard compiler. This is the stack. Then there's the manifest, which is all of this. This is basically some flags. This is also a manifest. This is the file I included. I included a file called 1.txt. Then the file contents. So the file has some random text inside. And then the signature. This is a SHA1 signature. The signature flag, which indicates the kind of signature we use. And a magic number indicating that there is a signature. So what happens if we are really smart and say, well, we're going to change hello world by hello there. So our virus, for example, would do something like that, change code. If we try to execute that file, we'll get an error. An error that has a broken signature. So automatically PHP is checking that for us. I hope what happens if we are even more smart and we change that little bit that says if there is a signature or not. If we try to execute it again, we can do it. It doesn't have a signature. Is it mandatory for file file to have a signature? No, it is not. But by default, in the PHP.ini file, we have this line. So file files are required to have a signature. So packaging a whole up into a file file could be a good idea to avoid these kind of attacks. And then, yes? If the attacker can write a file file, he also can reach out to lay out the signature and write it too. Yes, that could be even more, more, more smart. I tried to do it. I couldn't. But I need to spend more time on this. So let's see in action. Is there any question? I don't know. I downloaded a symphony project. There are a few demos. And I am using that demo. You have a simple page like this and a simple login for here. Can you see it? At the end? Yes? Okay. Okay. This is the Bustrak file. As you see, it's a huge file containing a copy paste of common symphony classes and interfaces. It uses the special way of using name spaces. And several name spaces in the same file. I'm using this notation. And what we're going to do is inject some code here. So as I said, there is a server, the Hacker server, which will provide the public key. So this is the script. As we do it before, this is the only thing that changes. It generates a shared one of the public key. This is only to have a kind of ID. So if that person pays the money, we can from that key get the private key. We will save the private key here. And try to put contents in. And the response would be an array with the username code containing the ID and the public key. So we are serving the public key and storing the private key. In case it pays, we return the private key. Okay. The symphony project has a known structure. We could use any other framework, but as we know already symphony. And we know that the upload file is here. So we have a Txt file containing Hello World and an image. Imagine that this were uploaded by final users. So we are going to encrypt it. And in case they don't have a backup, they lose that information if they don't pay that. And this is the code of the virus. Okay. No clean code here. Basically, this will be a super polymorphic engine. We are going to create a class because our virus is subject oriented. We are going to create a different class every time. So the name of the class would be V1, V1000, V5000. And we generate the code. Basically, we have an encrypt function. We have a decrypt function. Handle action, which depending on the request, will do anything. Okay. And now the important part will be here. We are getting the contents of the Bustra file. Once we get the contents, we want to inject some code to be in the middle of the file. And we are going to be in the middle of the symphony request. So what we are going to do is to look for this code. This is the code of the event dispatcher. And what we will do is to maintain that code, but in front of this code, inject a call to our virus. A call to the process method of our virus. Which is static. And we will pass the event. So then, depending on the event, for example, the request event, we will do the struct user and password in the response. Just for testing, we will modify the response, adding an extra header containing the symphony, the traffic path. And the kernel terminate will do the encryption. We will read the upload the file folder and encrypt all files. Okay. Let's see in action. This one is commented, so I don't want to lose the virus. Okay. So if we execute the virus, automatically connects to the hardware server, gets the public key. The public key is then injected inside the virus. So if we open the booster file again, we have this code now. This code is only one big line, so it's more difficult to detect. This code is doing all of this. This code contains this class. Class we were generating. And we also changed some function codes. Okay. We look for. We look for this. Okay. For example, here the kernel terminate event, the code, the normal code is here, but now it is injected this code. It's calling. It's calling to the virus, the process method with the type of event and event itself. So if it does it in every request because kernel terminate is executed in every request. So it will refresh this page. Okay. If we see the headers. Here is the extra header we have. And if we see the files, now that they are encrypted now. So if we find this and it's a project, we have a problem. I added this list tree at the beginning, so the file is not encrypted twice. And then to, in case we pay. We can execute. We see now. So what we are doing now is sending the private key to the private. Okay. It is encrypted now. And it is encrypted. We are using the backdoor to do this. So how the backdoor does works. If you see the code, the code is available online so you can take a look later. Here in every request, it gets some action. So in case the action is for that information. So it does the same, but in this case, we have to. Okay. And the last part, that would be the private information retrieval. We have this, a simple login and password. So we say user Frostcon, password 123465. It is not valid, but could be valid. And we can see. In the catch a file and there's a new folder called users. I am saving them there. And there's a file. Okay. We open the file. It's encrypted. So if anyone finds out this file, well, it could be deleted, but they have no way to accuse us for something. Okay. Because they don't know what it is. They know that they are probably using it because I named that way the folder, but I could use any name. Okay. We say Frostcon 2123. Okay. We have two different files. And using the backdoor, we can get the users. It is downloaded the list of users and using the private key to be encrypted. Okay. They are there. Frostcon 2123 and Frostcon 123465. Okay. And that's all. There's the code of the virus. You can take a look and play with it. And simple request to make it even more stronger. Okay. Thank you. Okay. Thank you. Okay. Okay. Yes. That's a way that you need that the client machine allows you to do that. It's a new thing and an extra dependency. And that machine must have appropriate server-random number generator. But yes. Yes. Yes. It's nice to think from the dark side sometimes. You learn a lot. Any other questions? Thank you. Thank you.
 Okay, let's start with the talk about creating a crypto virus for Symphony 2 apps.  My name is Rolf Reile, I come from Spain.  A little bit of me, I am a software developer at CervoGo,  a hosting company specialized in PHP hosting,  I am a certified engineer, a Symphony certified developer,  and I am now studying a master degree in research and computer technologies,  and I am focusing on cryptography and data compression,  so I thought that would be interesting to apply those things about cryptography to PHP,  and especially with Symphony.  This is something we will talk about during the talk,  we will see the CDPHP, PAPIs, we will see a little bit about them.  Even though you don't know Symphony, I will explain just a little bit,  so you can follow the talk.  It has functions, cryptography, Symphony kernel events, OpenSSL.  First, we define what cryptobiology is.  Cryptobiology is a computer science field that studies how to use cryptography  to design malicious software.  It is closely related to ransomware,  you get some kind of information, you destroy something,  and you ask for money or for information to get the information back,  or to get what you deleted back.  And also for private information retrieval,  from the point of view of Fahaker,  it is always important to retrieve some information,  but they want to do it safely.  So cryptography can help here.  And it was a fundamental piece in cryptography.  Before that cryptography was used to protect information,  to hide what we don't want to share with the rest of the world.  Here, applying cryptography to malicious software was a fundamental twist.  We divide the talk into main blocks.  There will be a quick demo at the end of the talk.  First, we see what is public cryptography,  which is very important.  We see how and why.  And then some Symphony internals.  It's also important to know how Symphony works internally,  so we can attack in some different ways.  Some hiding strategies for our virus,  and at the end, protection strategies.  How can we protect from these kind of attacks?  Okay, so we're going to see how we're going to create our own cryptorvirus,  for fun, because only for fun.  This is only for educational purposes.  And I'm warning, this is not a real virus, it's just a proof of concept.  Symphony is...  I chose Symphony because it's what I know,  but these same concepts could be applied to some framework,  to PHP, whatever you want, even to plain PHP.  And we assume that the virus is already in the target computer.  We don't see how to inject that virus in the computer.  I'm not a security expert, so this part probably would be done by a security expert.  So, a cryptorvirus.  How we are going to create it?  So the first step is we're going to have the observer.  We have Symphony here, an application written in Symphony,  and we already have the virus.  Then we have another server, which is the server of the hacker.  So once the virus is here and it's executed,  it connects automatically to the hacker server and asks for a public key.  We'll see in a couple of minutes, public key cryptography.  But the idea is that we get the public key.  The hacker server generates a key pair with a public key, a private key.  So it returns a public key and saves the private key.  Then the virus already with the public key inside infects the Symphony's application.  It could be done in many ways, but we are going to use Symphony kernel events  and the Bustra PHP.Cache file.  We'll see also how they work.  Then once our code is here, we have access to database connection,  user blog files, blogs, whatever.  So we can use that public key to encrypt that information.  Once that information is encrypted...  Sorry.  Once that information is encrypted using the public key,  there's no way to decrypt it without the private key, which is in the hacker server.  So we will need to get that private key.  Obviously, paying some money.  So once we have the private key, we can get back that information.  Hacker can use services like Bitcoin to add an extra level of anonymity.  That would be a ransomware attack.  And we're going to see also the other kind of attack, the private retrieval information.  Using the same code, we have here the infected application.  Imagine we have a login and password page in Symphony.  This is done in a kind of special way.  So if we know that we are attacking a Symphony app, we know how to get that information.  So once that information is submitted, we can take it here and save it encrypted in a file.  So if anyone, the webmaster knows, sees these kind of files,  he won't be able to know what is inside because it will be encrypted.  Then we will create a backdoor so the hacker server can connect  and get the list of users encrypted and using the private key that will be decrypted.  We'll see everything in the demo.  Now we're going to see the different parts, important parts to know how the virus works.  First, public cryptography.  Who knows how public cryptography works?  Lots of people.  Public key and it's also called asymmetric cryptography.  Requires two different keys.  A public key so we can share that key with anyone and a private key.  We'll use, most of the time, we'll use the public key to encrypt information.  There are two ways.  We'll use the public key to encrypt information and the private key to decrypt it.  Public key cryptography is based on one-way functions which are called also trunders.  These mathematical functions are really easy to compute in one way and really difficult in the other way.  We'll see an example now.  This is important because it is believed to be difficult.  What does that mean?  It means that there is no way to do it fast.  It doesn't mean that anyone or any organization can have already a method to do it fast.  Some of these one-way functions would be integral factorization which is used by Erase.  We're going to use it.  This is the local and elliptic codes.  If we have Alice and Bob and Alice want to send an image to Bob, Alice has her own private key and her own public key.  I'm also Bob, a different private key and a different public key.  Alice says to Bob, I want to send that image.  Bob says, okay, I give you my public key.  Using that public key, you will be able to encrypt it so only me will be able to decrypt it later.  We can see this like a box with a padlock.  Bob is sending an open box and an open padlock.  Alice input enters that image in the box, closes and closes the padlock.  So only Bob will be able to open the padlock with the private key.  If anyone in the middle gets that information, they just bar-garb it.  So this is the factorization problem.  For example, if we have P and Q and we want to calculate N, N is a multiplication of P and Q.  So even if we use some big numbers for a computer, it's really easy to do it, really fast.  In the other way, if we want to know that multiplication, the result, we have the result and we want to know what two numbers were used for the multiplication,  we will need to factorize.  And factorize is really complex for a computer and for a human.  So it is slow.  And slow means that there is no known way to do it in polynomial time.  We'll use OpenSSL for the sample, which is a general purpose pictorial library.  And because we have an extension, PHP OpenSSL, so we can use it from PHP.  We'll know what happened with OpenSSL a few months ago.  So how can we use OpenSSL from PHP?  Imagine we want to create a key pair, a pair of private and public key.  We define an array.  That is not important now.  We say that this is going to be the length of the key and the type.  This is RSA.  RSA uses the factorization.  With that function, we get a key pair.  We get that SAP PHP resource.  With other function, we extract that private key and then we extract the public key.  It is not complex, but it requires a few steps.  But if you use this in a function, you want to use a function and get the pair.  This is how they look.  If you already configure a patch, for example, with HTTPS support,  we already know this kind of piece.  And then to encrypt that information, we can use this function,  which gets the data to the encrypted, the public key, and a reference parameter.  So we will get the encrypted information here.  Then to the encrypted, using another function, we pass the encrypted information.  This will be the variable when we will get the encrypted information and the private key.  For our purpose, always encrypt information with the public key and the encrypted data with the private key.  Is everything clear with the public key cryptography?  Any questions?  Yes.  So your virus will use the OpenSSL OpenSSL library, so it adds a dependency maybe to the application.  The question is that the virus will use OpenSSL, so it is adding a requirement for the virus to run.  Yes, it's a requirement.  But we could do it from PHP manually, but it won't be safe at all.  But for a virus, it will be a good way.  So, Symphony, who have used Symphony before?  Who haven't used Symphony before?  Symphony is a framework for PHP applications.  It's quite complex and quite flexible, so you can use the whole framework or you can use only some components.  And inside, in every request, there are dispatch a few events.  They are called kernel events.  So every time a client sends a request, a new object of the request type is created.  And then the kernel.request event is dispatched.  There can be one listener or lots of listeners listening to this event, so you can use that information for something.  Or you can, for example, send a response to that listener and then the execution.  Then, when a response object is created, a kernel.response event is dispatched.  So we can also use it for whatever.  For example, we could use Google Analytics code in that event.  It's not the best idea, but we could use it for that.  Okay, once the response is sent to the browser, it emits an important event, which is kernel.terminate.  We are going to use that event for encrypted information because we are going to encrypt user-uploaded files.  So this may take time if there are too many files.  So using that event, the client already has the web page.  So we can do it later.  This is especially useful for, for example, sending emails or post-processing information.  Then, in the normal flow, it is kernel.controller event dispatched.  And then, in case we don't return a proper response object in the controller,  there is a last opportunity to convert that object, for example,  a one string into a proper response object.  And always, in case there is an exception, an event is dispatched,  so we can transfer that exception into a proper response object with extra information, for example.  So we will use this event for encrypted information and this event to get the user and password entered by a client.  Okay, I will recap kernel request as soon as the request arrived.  Kernel controller, once the controller is resolved, kernel view in case the controller doesn't return a response, kernel response,  kernel exception and terminate, as I said, for expensive, poor response jobs.  And the other part of symphony that you want to, that you need to know is the bootstrap PHP cached file.  This is a file created by symphony, it is created by, it's a composer script, okay,  but it is used to improve performance.  This is just a huge file with lots of classes and interfaces, it's just a copy paste of those files.  Why? Performance, okay, instead of loading those files separately, we already have here and we are going to use them for sure,  so it's a good idea to have them there.  If you download the standard edition of symphony, you will see these two commands.  So when we do a composer install or composer update, these commands will be executed and create that bootstrap file.  Yes.  So bootstrap.cached file is generated by PHP or by the composer called to?  Because you talked about the.cached file.  Yes, it is generated here, okay, it's the command is configured in composer, but it is a bundle of symphony,  so it is created there.  So it was just a question which, if the web server has the right permissions to the.cached file,  but if the server is probably configured, it's not necessary, right?  You can use, okay, the question is if you can use the bootstrap file or not use it.  So the question is, if the web server needs right permissions to this.cached file?  Yes, it needs.  But if they are using symphony, they are probably there, the right permissions.  It's not necessary to use it, there are other ways.  So we see the third part, hiding the virus.  Usually, antivirus software works in two different ways.  The first way is through virus definitions.  So virus definitions, they are just patterns, so we can look for those patterns in files, okay?  It is fast because it is just to compare a few patterns, but it is only useful for non-malware.  If there is a new virus, we will have the virus definitions, so we won't be able to get it.  So the other strategy is to use heuristic.  Heuristic are also patterns, but you look for suspicious patterns.  For example, suspicious TCPIP packets, suspicious kernel events.  For example, a virus by definition replicates itself.  So this is not common for normal software.  So this could be a flag, so that could be a virus.  Okay, I have to try this, but this works in PHP.  So we can do a link of the file, so the current script will be deleted.  So this could be a good way to infect the symphony app, and once infected, remove the file.  We need to inject some code into Bustrak file, as I said.  We can inject it as a normal PHP code, but we can try to make it difficult for a virtual antivirus to detect it.  So for example, if we want to inject that code, PHP info, we can use this technique.  There are other techniques.  So for example, we encode with base 64 five times.  Base 64 is lossless, so once decoded, we'll get the same information.  So we encode it five times, and then we generate a PHP code able to decode it.  So we'll use eval, which is nice for a virus, for real software.  And we'll get the string, base 64 decode, five times.  Then code the code, we go from here, and then the five parentheses.  Then we can use this app to compress it.  This app is also lossless.  So then we will be able to generate the original information.  So we'll get a compressed code.  Then using this, we'll be able to execute the code.  We'll see an example also with this later.  That is nice, but it's just a couple of tricks.  So a better idea is use polymorphic code.  Polymorphic code uses a polymorphic engine to take code.  So we pass some code, and we get different code, but that's exactly the same.  So that makes it really difficult for antivirus software to recognize the code as changes every time.  So most of the time, you're forcing to that antivirus software to use emulation to execute that code in a simple environment to see what it's doing.  For example, if we have these five lines of code, all these lines print the same.  In different ways, they print hello world, but they do it in different ways.  For example, the first one is easy.  This one also.  The fourth one uses the CD out to print it, and the fifth one uses character by character.  So all of them print hello world, but using different code.  So using this, they're making life more difficult for antivirus.  More important in PHP, it generates different upcodes.  So if you take a look at the generative of codes, they are all different.  So it makes it difficult.  The goal for a virus would be to create a polymorphic enzyme able to generate different codes in each infection.  As you know, this is also really difficult in a computer because it is impossible to generate real random numbers in a computer.  If you use run or empty run to do cryptography, don't do it.  You can see that there are patterns.  Even in empty run, there are also patterns.  It is better, but not good enough for cryptography.  So it is always recommended to use physical methods for that.  For example, random dot org uses atmospheric noise to generate random numbers.  We also as humans are not good to generate random numbers.  So we're going to do a quick test.  During five seconds, we're going to think about one number between one and ten.  Start.  This is real time.  Most of you probably have think of the number seven.  Because when a brain tries to generate a good random number, it says one and ten out because it is the first and the last.  Second is to come on.  And then it looks for five in the middle out.  And seven is what we consider the weirdest one.  Because it's another number, it's prime number.  But an ideal number generator is the frequency that should run.  And the last part is about protecting us.  So before the infection, we do what we have to do.  The user security measures, restricted permissions, as you said, disabled PHP OpenSSL is not going to use it.  And something that we can also do is virus and inoculation.  So we have a virus always have a method to see if a given file is already infected or not.  So if we know how to check how the virus checks if the file is infected, we can inject that information.  For example, in a PHP comment or using the hard compiler function and inject that information there.  So if we know the virus and we want to avoid that attack, it can be a good strategy, but only for a given virus.  And once the app has been infected, we want to check the integrity to know if it's infected or not.  So one way to check the integrity of some code or some information is using hash functions.  Hash functions, we are used to use it in every day.  We use SHA-1, for example, MD5 sometimes.  And basically they create fixed-length digest, text-sum, from data or arbitrary length.  They must be easy to compute and there must be really, really, really difficult to generate a message with a hash that we want.  Really difficult to modify a message without modifying the hash.  Really difficult to find two different messages with the same hash.  This happens because the number of hash numbers is limited, but it must be really difficult.  And the basic idea is this, tiny changes in the source generate big changes in the address.  So for example, if we are hashing one gigabyte of information and we change just one bit,  if the hash function is good enough, it should generate a new hash number with at least 50% of information change.  If you like the hash theory, it's like this, like the butterfly effect.  In initial conditions, little changes in initial conditions lead to big changes at the end.  So the theory says that the flapping of the wings of a butterfly could cause a trishter in the other part of the world in many years.  Like when you go to the past and they say, don't touch anything.  The same idea.  Why we don't use MD5 anymore? Because it's not collision resistant.  The idea is in the build process, when we deploy the project, we can create a hash of the whole project and then check it regularly.  For example, using the final component of symphony, we can get all PHP files, for example, and then create a hash of the whole project.  So using that number, we can check it in production from time to time and check if anything changes or not.  It could be a nice way, but we already have this in PHP, using the path extension.  Anyone have used FAL before? Used. No composer?  The basic idea is you encapsulate all the projects, even its dependencies, in a single file, in a FAL file.  It's equivalent to JavaJal files.  The nice thing for this talk is that FAL files can contain a signature, a text of the included files.  So we are sorry.  Okay, so it can contain a signature of the included files.  So we can have what we did before manually, and we can have it automatically.  FAL files are divided into four blocks.  At first, there's a stack that usually contains some loaded functionality.  Basically, some code to be able to map between the included files and that PHP code.  It always ends with this function, hard compiler.  Who knows what that function does?  Two, three, four.  That is a real PHP function, and what it says is to the PHP interpreter to stop.  Anything that I put after that is not interpreted by PHP.  So we can use it, for example, for install script, for example.  Then we have a manifest. This is no longer a PHP valid code because we use this function.  The manifest basically has the name of the included file names, some checking, the timestamp, size, some binary flags.  Then the actual contents will have PHP code, our dependencies.  And at the end, a signature.  So we can have a signature in MD5, SHA1, 2M56, and 512.  So I created a...  This is only a missing line. I created a really simple file.  So you can see here, we open PHP, we execute map path, so we can map between...  We can access the included files and echo hello world.  And then hard compiler.  This is the stack.  Then there's the manifest, which is all of this.  This is basically some flags.  This is also a manifest. This is the file I included.  I included a file called 1.txt.  Then the file contents.  So the file has some random text inside.  And then the signature.  This is a SHA1 signature.  The signature flag, which indicates the kind of signature we use.  And a magic number indicating that there is a signature.  So what happens if we are really smart and say, well, we're going to change hello world by hello there.  So our virus, for example, would do something like that, change code.  If we try to execute that file, we'll get an error.  An error that has a broken signature.  So automatically PHP is checking that for us.  I hope what happens if we are even more smart and we change that little bit  that says if there is a signature or not.  If we try to execute it again, we can do it.  It doesn't have a signature.  Is it mandatory for file file to have a signature?  No, it is not.  But by default, in the PHP.ini file, we have this line.  So file files are required to have a signature.  So packaging a whole up into a file file could be a good idea to avoid these kind of attacks.  And then, yes?  If the attacker can write a file file, he also can reach out to lay out the signature and write it too.  Yes, that could be even more, more, more smart.  I tried to do it.  I couldn't.  But I need to spend more time on this.  So let's see in action.  Is there any question?  I don't know.  I downloaded a symphony project.  There are a few demos.  And I am using that demo.  You have a simple page like this and a simple login for here.  Can you see it?  At the end?  Yes?  Okay.  Okay.  This is the Bustrak file.  As you see, it's a huge file containing a copy paste of common symphony classes and interfaces.  It uses the special way of using name spaces.  And several name spaces in the same file.  I'm using this notation.  And what we're going to do is inject some code here.  So as I said, there is a server, the Hacker server, which will provide the public key.  So this is the script.  As we do it before, this is the only thing that changes.  It generates a shared one of the public key.  This is only to have a kind of ID.  So if that person pays the money, we can from that key get the private key.  We will save the private key here.  And try to put contents in.  And the response would be an array with the username code containing the ID and the public key.  So we are serving the public key and storing the private key.  In case it pays, we return the private key.  Okay.  The symphony project has a known structure.  We could use any other framework, but as we know already symphony.  And we know that the upload file is here.  So we have a Txt file containing Hello World and an image.  Imagine that this were uploaded by final users.  So we are going to encrypt it.  And in case they don't have a backup, they lose that information if they don't pay that.  And this is the code of the virus.  Okay.  No clean code here.  Basically, this will be a super polymorphic engine.  We are going to create a class because our virus is subject oriented.  We are going to create a different class every time.  So the name of the class would be V1, V1000, V5000.  And we generate the code.  Basically, we have an encrypt function.  We have a decrypt function.  Handle action, which depending on the request, will do anything.  Okay.  And now the important part will be here.  We are getting the contents of the Bustra file.  Once we get the contents, we want to inject some code to be in the middle of the file.  And we are going to be in the middle of the symphony request.  So what we are going to do is to look for this code.  This is the code of the event dispatcher.  And what we will do is to maintain that code, but in front of this code, inject a call to our virus.  A call to the process method of our virus.  Which is static.  And we will pass the event.  So then, depending on the event, for example, the request event, we will do the struct user and password in the response.  Just for testing, we will modify the response, adding an extra header containing the symphony, the traffic path.  And the kernel terminate will do the encryption.  We will read the upload the file folder and encrypt all files.  Okay.  Let's see in action.  This one is commented, so I don't want to lose the virus.  Okay.  So if we execute the virus, automatically connects to the hardware server, gets the public key.  The public key is then injected inside the virus.  So if we open the booster file again, we have this code now.  This code is only one big line, so it's more difficult to detect.  This code is doing all of this.  This code contains this class.  Class we were generating.  And we also changed some function codes.  Okay.  We look for.  We look for this.  Okay.  For example, here the kernel terminate event, the code, the normal code is here, but now it is injected this code.  It's calling.  It's calling to the virus, the process method with the type of event and event itself.  So if it does it in every request because kernel terminate is executed in every request.  So it will refresh this page.  Okay.  If we see the headers.  Here is the extra header we have.  And if we see the files, now that they are encrypted now.  So if we find this and it's a project, we have a problem.  I added this list tree at the beginning, so the file is not encrypted twice.  And then to, in case we pay.  We can execute.  We see now.  So what we are doing now is sending the private key to the private.  Okay.  It is encrypted now.  And it is encrypted.  We are using the backdoor to do this.  So how the backdoor does works.  If you see the code, the code is available online so you can take a look later.  Here in every request, it gets some action.  So in case the action is for that information.  So it does the same, but in this case, we have to.  Okay.  And the last part, that would be the private information retrieval.  We have this, a simple login and password.  So we say user Frostcon, password 123465.  It is not valid, but could be valid.  And we can see.  In the catch a file and there's a new folder called users.  I am saving them there.  And there's a file.  Okay.  We open the file.  It's encrypted.  So if anyone finds out this file, well, it could be deleted, but they have no way to accuse us for something.  Okay.  Because they don't know what it is.  They know that they are probably using it because I named that way the folder, but I could use any name.  Okay. We say Frostcon 2123.  Okay. We have two different files.  And using the backdoor, we can get the users.  It is downloaded the list of users and using the private key to be encrypted.  Okay. They are there.  Frostcon 2123 and Frostcon 123465.  Okay. And that's all.  There's the code of the virus.  You can take a look and play with it.  And simple request to make it even more stronger.  Okay. Thank you.  Okay. Thank you.  Okay.  Okay.  Yes. That's a way that you need that the client machine allows you to do that.  It's a new thing and an extra dependency.  And that machine must have appropriate server-random number generator.  But yes.  Yes.  Yes.  It's nice to think from the dark side sometimes.  You learn a lot.  Any other questions?  Thank you.  Thank you.
_kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__0_71.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__72_191.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__192_287.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__288_707.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__708_5195.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__5196_5603.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__5604_6647.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__6648_7319.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__7320_12311.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__12312_12911.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__12912_20111.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__20112_20375.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__20376_21407.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__21408_22583.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__22584_25847.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__25848_26327.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__26328_29891.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__29892_30047.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__30048_30131.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__30132_30323.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__30324_30383.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__30384_31835.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__31836_32063.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__32064_33035.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__33036_33851.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__33852_38639.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__38640_38963.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__38964_40499.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__40500_40703.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__40704_41075.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__41076_41423.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__41424_43115.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__43116_43319.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__43320_43463.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__43464_45275.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__45276_46955.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__46956_47207.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__47208_47795.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__47796_48791.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__48792_49499.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__49500_50099.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__50100_50831.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__50832_51359.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__51360_51899.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__51900_52007.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__52008_57623.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__57624_58175.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__58176_58787.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__58788_59087.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__59088_59519.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__59520_59567.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__59568_59963.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__59964_60551.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__60552_60755.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__60756_61355.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__61356_61415.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__61416_61895.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__61896_62387.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__62388_68687.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__68688_69011.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__69012_69671.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__69672_70163.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__70164_70775.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__70776_70931.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__70932_73427.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__73428_74591.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__74592_74783.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__74784_75059.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__75060_76043.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__76044_76211.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__76212_76919.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__76920_78407.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__78408_79607.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__79608_79667.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__79668_79751.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__79752_79955.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__79956_82031.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__82032_82655.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__82656_82727.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__82728_82811.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__82812_82883.png _kernel_infect____Creating_a_cryptovirus_for_Symfony2_apps__FrOSCon14__82884_82931.png