Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/11/2013
05:12 PM
50%
50%

Tech Insight: Viral Arms Race Brings New, Better Evasion

New malware advances focus on evading security researchers and automated analysis sandboxes

Sophisticated threats and APT have become such a focal point of the security industry that we hardly hear about the most common threat facing enterprises -- malware in the form of viruses, botnets, and worms. If you listen to the marketing coming from security vendors, then you might get the impression that these are issues of the past because everyone is scared of targeted attacks. No one, except antivirus vendors, is talking about the thousands of new infections occurring every day across corporate desktops.

The truth is, talking about defending against run-of-the-mill malware isn't sexy and doesn't sell products. Sticking your head in the sand only exacerbates the problem, however, because these threats are not going away, and malware authors are getting better. These authors keep making malware stealthier and finding new ways to profit on old attacks while we're doing our best at defending our networks, yet being told by antivirus vendors that they've got it covered.

Cryptolocker has been the most recent eye-opener that non-targeted malware is still a real problem for many companies. These same companies that thought they had their corporate data protected by keeping their antivirus products up to date are getting hosed by a single user opening up the wrong e-mail attachment. In the case of Cryptolocker, Office documents and other file types on the local hard drive and connected network share are now encrypted using public key cryptography. Unless the ransom is paid using Bitcoin or Money, only the malware author can decrypt the files.

The use of public key crypto is only one of the interesting advances in recent iterations of such malware as Zeus, Andromeda, Vertexnet, and Cidox. Unlike Robert Tappan Morris' Morris Worm from 25 years ago, today's malware isn't part of a failed informal research project. Instead, malware authors are out to make money, and to do that, they must write resilient, stealthy software. Most of the newly observed techniques are focused on more effective persistence mechanisms, evading analysis by security researchers and detection like malware sandboxes such as Anubis and Cuckoo.

The more basic features are simply clever tricks to help malicious PDFs evade detection so they're more likely to end up in users' inboxes where they'll open and infect their computers. HTTP Host header spoofing has helped malicious traffic look legitimate when the HTTP requests are actually part of the Cidox command-and-control framework.

But the advances don't stop there. McAfee has identified several several different pieces of malware that have added new polymorphic capabilities that do more than just modify their binaries a few times a day or each time they're run. The changes include modification of known data and executable procedures, like opcodes, for the prologue and epilogue sequences to evade signature-based detection.

According to a recent report from malware analysis appliance vendor FireEye, more malware samples are including abilities to defeat file-based sandboxes used to analyze and detect malware. In addition to the typical virtual machine-based detection where malware will change its behavior when running in a virtual machine, new variants are monitoring for human interaction before executing their full malicious payload. Two methods outlined in the FireEye paper are watching for user clicks and displaying dialog boxes that require a user to click. Once the malware is satisfied a normal user is executing it, it proceeds to carry out its true purpose.

As we've seen with the average malware infection, protection measures shouldn't stop at just keeping antivirus up to date and ensuring backups are working. Defensive capabilities must be layered so that even if one system gets compromised, it does not impact every other system. Going back to traditional security tenets such as implementing network segmentation and the principal of least privilege, can have a significant impact in limiting the damage that an infected machine can do.

The "Twenty Critical Security Controls for Effective Cyber Defense," published by the SANS Institute, is an excellent framework for building the necessary defenses to protect against malware attacks. In addition to malware protections and data recovery capabilities, the controls promote controlled use of administrative privileges, boundary defense, secure network design, secure endpoint configuration, and much more.

However, one area not covered in detail, but certainly appropriate when discussing the method of propagation for many of today's malware attacks, is user awareness. It is a touchy subject because many security pundits state that any attempts to educate and train users on security is a lost cause. They say the money is best spent elsewhere, but how can that be when desktops and laptops are getting infected even when antivirus, Internet security gateways, and other controls are in place?

User awareness efforts don't need to be expensive and time-consuming in order to be effective. One of the most useful methods is to reinforce common sense computer use, such as not opening attachments from people you weren't expecting to receive attachments from -- such as the more believable phishing messages sourced by the Cutwail botnet that look like legitimate flight and hotel notifications yet contain a malicious attachment.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Major Brazilian Bank Tests Homomorphic Encryption on Financial Data
Kelly Sheridan, Staff Editor, Dark Reading,  1/10/2020
Will This Be the Year of the Branded Cybercriminal?
Raveed Laeb, Product Manager at KELA,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3682
PUBLISHED: 2020-01-17
The docker-kubic package in SUSE CaaS Platform 3.0 before 17.09.1_ce-7.6.1 provided access to an insecure API locally on the Kubernetes master node.
CVE-2019-17361
PUBLISHED: 2020-01-17
In SaltStack Salt through 2019.2.0, the salt-api NEST API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.
CVE-2019-19142
PUBLISHED: 2020-01-17
Intelbras WRN240 devices do not require authentication to replace the firmware via a POST request to the incoming/Firmware.cfg URI.
CVE-2019-19801
PUBLISHED: 2020-01-17
In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an unprivileged but authenticated user is able to perform a backup of the Command Centre databases.
CVE-2019-19802
PUBLISHED: 2020-01-17
In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without p...