Vulnerabilities / Threats
2/26/2013
10:40 PM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Lastline Report Finds Evasive Threats On The Rise

“The Security Threat of Evasive Malware” details how malware authors are exploiting the limited visibility of sandboxes

SANTA BARBARA, Calif.--(BUSINESS WIRE)--Lastline, Inc., a new provider of active malware defense solutions for businesses, has released a new report, "The Security Threat of Evasive Malware," that looks at how malware authors are able to exploit the limited visibility of automated malware analysis systems (sandboxes) and ensure that targeted attacks and zero day exploits remain successful. The report concludes that the use of stalling codes is resulting in a growing trend of evasive threats.

"Malware authors have been using evasive techniques for years, and those techniques are becoming more and more complex," said Chris Kruegel, Chief Scientist at Lastline. "It's a game of cat and mouse as once a solution to an evasive threat is discovered, the malware authors go back to the drawing board and find another way to avoid detection."

The report highlights two techniques currently used by malware authors: Environmental Checks and Stalling Code. While environmental checks have been well documented, stalling code is the latest technique being utilized to spread malware. It delays the execution of a malicious code inside a sandbox and instead performs a computation that appears legitimate. Once the sandbox has timed out, the evasive malware is free to execute. The report finds that stalling codes are particularly troublesome because they "can no longer be handled by traditional sandboxes (even if the trick is known)."

"Current sandboxes have a lack of visibility into the execution of a malware program," said Giovanni Vigna, CTO of Lastline. "To detect this new breed of evasive threats, a sandbox needs to have visibility and must be able to do this stealthily. Otherwise, as we have seen in stalling code, the malware will react accordingly and remain undetectable."

Lastline offers a solution in the form of a system emulator, which allows the company to "gain the advantages of a virtual execution environment, while retaining the "ability to see every instruction." According to the report, this type of solution is "crucial to be able to automatically handle environmental checks as well as stalling code."

For a full copy of "The Security Threat of Evasive Malware" and to learn more about Lastline, please visit: www.lastline.com

Lastline Social Media:

Twitter: www.twitter.com/lastlineinc

Facebook: www.facebook.com/lastlineinc

Blog: www.lastline.com/blog

About Lastline:

Lastline protects networks against target attacks, APT's, and zero-day targeted attacks across all threat vectors. Lastline's malware defense solution performs high-resolution analysis of incoming threats and outgoing network traffic, and combines this with active discovery of the threat landscape (the malscape.) The result is actionable threat intelligence that enables effective remediation.

- See more at: http://www.rsaconference.com/events/2013/usa/for-media/sponsor-news.htm#sthash.oeGUI2Uz.dpuf

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web