Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/27/2019
02:00 PM
David Strom
David Strom
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Understanding & Defending Against Polymorphic Attacks

Polymorphic malware is far from a new thing. But today, what is good for attackers is also good for defenders. Here's why.

I first wrote about polymorphic malware four years ago. I recall having a hard time getting an editor to approve publication of my piece because he claimed none of his readers would be interested in the concept. Yet in the time since then, polymorphism has gone from virtually unknown to standard practice by malware writers. Indeed, it has become so common that most descriptions of attacks don't even call it out specifically. Webroot in its annual threat assessment from earlier this year reported that almost all malware it has seen had demonstrated polymorphic properties.

The term refers to malware that can adapt to conditions and change its behavior to try to avoid detection. A recent example is the After-Shock-3PC malware which targeted a number of media websites. It frequently switched its active code to spoof online payment systems, in the process trying to appear as if it belonged on the computers that it infected. It was even partially successful.

Polymorphic malware has become popular because criminals can purchase malware construction kits that include this feature, such as the kits that have produced the Cobalt Strike, Fallout, and Orcus malware families. Another reason for the attraction is that polymorphic code is harder for researchers to pick apart and track down its shifting series of operations.

Actually, polymorphic malware is far from a New Thing. The first piece of such malware could be traced to 1990 with Ralf Burger's Chameleon. But what is good for attackers is also good for defenders. Using polymorphic principles to confuse an attacker has become a rich research area, especially for academics. They also call the concept a "moving target defense," and there have been two major two Association of Computing Machinery conferences devoted to the subject: the first one in November 2014 in Arizona and a second one in November 2015 in Denver.

That research has spawned a number of vendors that incorporate polymorphic methods using one (or more) of three major protective tactics to defend your resources:

  • Using network-based actions such as changing IP addresses,
  • Using host-based actions such as changing host names and other identifying characteristics, and
  • Using application-based actions such as recompiling code or changing memory locations of executables.

This last tactic is used by several vendors, including Polyverse and Morphisec. The latter has been a leader in this area and earlier this year closed a $12 million series B funding round. Its software is now installed on over 3 million endpoints. Other startup vendors, such as CyActive, have been absorbed by PayPal, indicating how important this technology is for online-centric businesses that want to shore up their defenses.

Shape Security has a network-based product that is used to block distributed denial-of-service and man-in-the-browser attacks, working with an ordinary network firewall to redirect traffic to critical web resources. There are also numerous other security vendors that claim to block some kinds of polymorphic malware vectors as part of their overall firewall, web app/email security gateways, or intrusion-detection products.

Clearly, its time has come, on both offensive and defensive sides.

What are the main takeaways for security staffs? First, study the concepts behind the moving target defense to see if this can benefit your own operations. Next, consider using one of the defensive vendors mentioned above to protect your most critical online assets. Look at recompiling your custom apps to include polymorphic methods to help stay ahead of attackers. Finally, examine your existing threat detection portfolio and check to see if anything can recognize polymorphic attack scenarios properly. Certainly, the attackers will continue to use these methods to evade detection, so we have to get better at ferreting them out and stopping them.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

David Strom is one of the leading experts on network and Internet technologies and has written and spoken extensively on topics such as cybersecurity, VOIP, convergence, email, cloud computing, network management, Internet applications, wireless and Web services ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16994
PUBLISHED: 2020-02-18
An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices. Incorrect handling of a request with non-standard symbols allows remote attackers to initiate a complete lock up of the bus coupler. Authentication of the request is no...
CVE-2020-7796
PUBLISHED: 2020-02-18
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
CVE-2020-8633
PUBLISHED: 2020-02-18
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
CVE-2020-9268
PUBLISHED: 2020-02-18
SoPlanning 1.45 is vulnerable to SQL Injection in the OrderBy clause, as demonstrated by the projets.php?order=nom_createur&by= substring.
CVE-2020-9269
PUBLISHED: 2020-02-18
SOPlanning 1.45 is vulnerable to authenticated SQL Injection that leads to command execution via the users parameter, as demonstrated by export_ical.php.