Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/27/2019
02:00 PM
David Strom
David Strom
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Understanding & Defending Against Polymorphic Attacks

Polymorphic malware is far from a new thing. But today, what is good for attackers is also good for defenders. Here's why.

I first wrote about polymorphic malware four years ago. I recall having a hard time getting an editor to approve publication of my piece because he claimed none of his readers would be interested in the concept. Yet in the time since then, polymorphism has gone from virtually unknown to standard practice by malware writers. Indeed, it has become so common that most descriptions of attacks don't even call it out specifically. Webroot in its annual threat assessment from earlier this year reported that almost all malware it has seen had demonstrated polymorphic properties.

The term refers to malware that can adapt to conditions and change its behavior to try to avoid detection. A recent example is the After-Shock-3PC malware which targeted a number of media websites. It frequently switched its active code to spoof online payment systems, in the process trying to appear as if it belonged on the computers that it infected. It was even partially successful.

Polymorphic malware has become popular because criminals can purchase malware construction kits that include this feature, such as the kits that have produced the Cobalt Strike, Fallout, and Orcus malware families. Another reason for the attraction is that polymorphic code is harder for researchers to pick apart and track down its shifting series of operations.

Actually, polymorphic malware is far from a New Thing. The first piece of such malware could be traced to 1990 with Ralf Burger's Chameleon. But what is good for attackers is also good for defenders. Using polymorphic principles to confuse an attacker has become a rich research area, especially for academics. They also call the concept a "moving target defense," and there have been two major two Association of Computing Machinery conferences devoted to the subject: the first one in November 2014 in Arizona and a second one in November 2015 in Denver.

That research has spawned a number of vendors that incorporate polymorphic methods using one (or more) of three major protective tactics to defend your resources:

  • Using network-based actions such as changing IP addresses,
  • Using host-based actions such as changing host names and other identifying characteristics, and
  • Using application-based actions such as recompiling code or changing memory locations of executables.

This last tactic is used by several vendors, including Polyverse and Morphisec. The latter has been a leader in this area and earlier this year closed a $12 million series B funding round. Its software is now installed on over 3 million endpoints. Other startup vendors, such as CyActive, have been absorbed by PayPal, indicating how important this technology is for online-centric businesses that want to shore up their defenses.

Shape Security has a network-based product that is used to block distributed denial-of-service and man-in-the-browser attacks, working with an ordinary network firewall to redirect traffic to critical web resources. There are also numerous other security vendors that claim to block some kinds of polymorphic malware vectors as part of their overall firewall, web app/email security gateways, or intrusion-detection products.

Clearly, its time has come, on both offensive and defensive sides.

What are the main takeaways for security staffs? First, study the concepts behind the moving target defense to see if this can benefit your own operations. Next, consider using one of the defensive vendors mentioned above to protect your most critical online assets. Look at recompiling your custom apps to include polymorphic methods to help stay ahead of attackers. Finally, examine your existing threat detection portfolio and check to see if anything can recognize polymorphic attack scenarios properly. Certainly, the attackers will continue to use these methods to evade detection, so we have to get better at ferreting them out and stopping them.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

David Strom is one of the leading experts on network and Internet technologies and has written and spoken extensively on topics such as cybersecurity, VOIP, convergence, email, cloud computing, network management, Internet applications, wireless and Web services ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: He still insists that security by obscurity is the way to go.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9681
PUBLISHED: 2019-09-17
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-HDBW4X2X,IPC-HDW5X2X...
CVE-2019-9009
PUBLISHED: 2019-09-17
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
CVE-2018-20336
PUBLISHED: 2019-09-17
An issue was discovered in Asuswrt-Merlin 384.6. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP, which may lead to an information leak.
CVE-2019-12755
PUBLISHED: 2019-09-17
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
CVE-2019-14826
PUBLISHED: 2019-09-17
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.