Defending againts malware and stealth techniques

1. Patches: most worms exploit known vulnerabilities
2. Signatures: must be developed automatically to keep up
3. Intrusion and anomaly detection: notice suspicious activity

Antivirus and antimalware

The basic strategy is a signature-based detection: database of byte-level or instruction-level signatures that match known malware.

Other complementary strategies are used:

• Heuristics: check for sign of infection. For example: where code execution starts, heder size, suspicius code section name, patched import address table, ...
• Behavioral detection: detect signs of known malware and common behavors of malwares.

Stealth techniques

General stealth techniques

• Dormant period during which no malicious behavior is exhibited
• Event-triggered payload
• Anti-virtualization techniques: modern malware detect execution environment to complicate analysis
  • virtual machines
  • hardawre supported virtual machines
  • emulators
• Encryption / Packing: encrypt the malicius content using a small routin changing the key at each execution
• Rootkit techniques: after becoming root on a machine, plant a kit to remain root. Your kit could, for example, make files, processes, directories disappear to hide the attacker. Can be:
  • userland (backdoored login, trojanized utilites to hide, ...)
  • kernel-space (SYS_CALL table, interrupt description table, ...)
  • in bios
  • on firmware
  • in virtualization systems

Virus stealth techniques

Virus scanners quicly discover viruses by searching around entry point.

Entry point obfusctaion

• Multicavity viruses
• Hijact control later (after the program is launched), for example overwriting import table addresses or function call instructions

Virus and Worm stealth techniques

• Polymorphism: change layout (shape) with each infection. The same payload is encrypted with different keys.
• Metamorphism: create different versions of code that look different but have the same semantics (do the same thing). Example of ways to do methamorphism are dead code insertions and instruction reorder.

Malware analysis

Is an ex-post workflow after the malware has been identifies:

• reported by someone
• automatically analyzed
• manually analyzed
• antivirus signature developed

Two main type of analysis are carried:

• Static analysis: parse the executable code. Hight code coverage and works in dormant code but suffers from obfuscation.
• Dynamic analysis: Observe the runtime behavior of the executable. Low code coverage and do not work with dormant code but is does not suffer from obfuscation.