Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/27/2019
02:00 PM
David Strom
David Strom
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Understanding & Defending Against Polymorphic Attacks

Polymorphic malware is far from a new thing. But today, what is good for attackers is also good for defenders. Here's why.

I first wrote about polymorphic malware four years ago. I recall having a hard time getting an editor to approve publication of my piece because he claimed none of his readers would be interested in the concept. Yet in the time since then, polymorphism has gone from virtually unknown to standard practice by malware writers. Indeed, it has become so common that most descriptions of attacks don't even call it out specifically. Webroot in its annual threat assessment from earlier this year reported that almost all malware it has seen had demonstrated polymorphic properties.

The term refers to malware that can adapt to conditions and change its behavior to try to avoid detection. A recent example is the After-Shock-3PC malware which targeted a number of media websites. It frequently switched its active code to spoof online payment systems, in the process trying to appear as if it belonged on the computers that it infected. It was even partially successful.

Polymorphic malware has become popular because criminals can purchase malware construction kits that include this feature, such as the kits that have produced the Cobalt Strike, Fallout, and Orcus malware families. Another reason for the attraction is that polymorphic code is harder for researchers to pick apart and track down its shifting series of operations.

Actually, polymorphic malware is far from a New Thing. The first piece of such malware could be traced to 1990 with Ralf Burger's Chameleon. But what is good for attackers is also good for defenders. Using polymorphic principles to confuse an attacker has become a rich research area, especially for academics. They also call the concept a "moving target defense," and there have been two major two Association of Computing Machinery conferences devoted to the subject: the first one in November 2014 in Arizona and a second one in November 2015 in Denver.

That research has spawned a number of vendors that incorporate polymorphic methods using one (or more) of three major protective tactics to defend your resources:

  • Using network-based actions such as changing IP addresses,
  • Using host-based actions such as changing host names and other identifying characteristics, and
  • Using application-based actions such as recompiling code or changing memory locations of executables.

This last tactic is used by several vendors, including Polyverse and Morphisec. The latter has been a leader in this area and earlier this year closed a $12 million series B funding round. Its software is now installed on over 3 million endpoints. Other startup vendors, such as CyActive, have been absorbed by PayPal, indicating how important this technology is for online-centric businesses that want to shore up their defenses.

Shape Security has a network-based product that is used to block distributed denial-of-service and man-in-the-browser attacks, working with an ordinary network firewall to redirect traffic to critical web resources. There are also numerous other security vendors that claim to block some kinds of polymorphic malware vectors as part of their overall firewall, web app/email security gateways, or intrusion-detection products.

Clearly, its time has come, on both offensive and defensive sides.

What are the main takeaways for security staffs? First, study the concepts behind the moving target defense to see if this can benefit your own operations. Next, consider using one of the defensive vendors mentioned above to protect your most critical online assets. Look at recompiling your custom apps to include polymorphic methods to help stay ahead of attackers. Finally, examine your existing threat detection portfolio and check to see if anything can recognize polymorphic attack scenarios properly. Certainly, the attackers will continue to use these methods to evade detection, so we have to get better at ferreting them out and stopping them.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

David Strom is one of the leading experts on network and Internet technologies and has written and spoken extensively on topics such as cybersecurity, VOIP, convergence, email, cloud computing, network management, Internet applications, wireless and Web services ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...
CVE-2021-26294
PUBLISHED: 2021-03-07
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_...