Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/18/2011
11:48 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google Report: How Web Attackers Evade Malware Detection

Data gathered from Google's Safe Browsing API service reveals drive-by infections most common, with 'IP cloaking' on the rise

Attackers increasingly are engaging in "IP cloaking" to infect Web visitors, where they bypass malware detection systems by serving them clean pages while they drop malware on visitors to the site, according to a new report by Google's security team.

"Over the years, we have seen more malicious sites engaging in IP cloaking. To bypass the cloaking defense, we run our scanners in different ways to mimic regular user traffic," said Lucas Ballard and Niels Provos of the Google Security Team, in a blog post yesterday.

Google's research is based on more than four years of data gathered from its Safe Browsing API service. Google's Safe Browsing API is an online database that contains known malware-rigged Web pages and phishing sites. Chrome, as well as Mozilla's Firefox and Apple's Safari browsers, use the database, as well.

The search engine giant's analysis of the malware-evasion methods used by the bad guys is based on 160 million Web pages hosted on some 8 million sites.

As of summer 2010, 160,000 or so websites were employing cloaking domains, according to Google's report, which covers five years of data. This technique peaked two years ago, when there were some 200,000 websites with IP cloaking, up from more than 50,000 earlier that year. "That peak coincides with a large-scale attack, where thousands of sites were infected to redirect to gumblar.cn, which actively cloaked our scanners," Google says in its report. "Although the increase in the graph is partly due to improved detection of cloaking domains in our system, we believe that it is representative of the general state of cloaking."

Attackers are also using social engineering and drive-by downloads, according to Google. Socially engineered Web attacks try to lure a user into following a link or downloading software. Malware from websites is one of the three main threat vectors for browsers; phishing attacks and exploits are the other two. A recent test by NSS Labs showed that Internet Explorer 9 was best at catching socially engineered malware attacks.

But Google says while social engineering is on the rise as a vector for Web malware, only 2 percent of all websites that distribute malware actually use that vector. The malware often comes in the form of fake antivirus or a browser plug-in, for example.

"Social engineering has increased in frequency significantly and is still rising. However, it’s important to keep this growth in perspective," the Google report says.

Drive-by downloads remain one of the more popular vectors for malware: This is where attackers exploit a bug in a browser or browser plug-in to infect the victim. "Our analysis of which vulnerabilities are actively being exploited over time shows that adversaries quickly switch to new and more reliable exploits to help avoid detection," Google says in its report. "Most vulnerabilities are exploited only for a short period of time until new vulnerabilities become available. A prominent exception is the MDAC vulnerability which is present in most exploit kits."

And JavaScript obfuscation is being used to bypass browser emulators and AV engines.

Google found that the bad guys are constantly retooling their efforts in order to evade the more common detection methods of virtual machine honeypots, browser emulation honeypots, domain reputation, and antivirus engines. "Our experiments corroborate our hypothesis that malware authors continue to pursue delivery mechanisms that can confuse different malware detection systems," the report says.

The full report is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/10/2020
Zscaler to Buy Cloudneeti
Dark Reading Staff 4/9/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Yes, I do have virus protection on my system, now what?
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11669
PUBLISHED: 2020-04-10
An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR, aka CID-53a712bae5dd.
CVE-2020-1801
PUBLISHED: 2020-04-10
There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro vers...
CVE-2020-3952
PUBLISHED: 2020-04-10
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
CVE-2020-4362
PUBLISHED: 2020-04-10
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. IBM X-Force ID: 178929.
CVE-2020-1802
PUBLISHED: 2020-04-10
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product version...