Defending againts malware and stealth techniques

1. Patches: most worms exploit known vulnerabilities
2. Signatures: must be developed automatically to keep up
3. Intrusion and anomaly detection: notice suspicious activity

Antivirus and antimalware

The basic strategy is a signature-based detection: database of byte-level or instruction-level signatures that match known malware.

Other complementary strategies are used:

• Heuristics: check for sign of infection. For example: where code execution starts, heder size, suspicius code section name, patched import address table, ...
• Behavioral detection: detect signs of known malware and common behavors of malwares.

Stealth techniques

General stealth techniques

• Dormant period during which no malicious behavior is exhibited
• Event-triggered payload
• Anti-virtualization techniques: modern malware detect execution environment to complicate analysis
  • virtual machines
  • hardawre supported virtual machines
  • emulators
• Encryption / Packing: encrypt the malicius content using a small routin changing the key at each execution
• Rootkit techniques: after becoming root on a machine, plant a kit to remain root. Your kit could, for example, make files, processes, directories disappear to hide the attacker. Can be:
  • userland (backdoored login, trojanized utilites to hide, ...)
  • kernel-space (SYS_CALL table, interrupt description table, ...)
  • in bios
  • on firmware
  • in virtualization systems

Virus stealth techniques

Virus scanners quicly discover viruses by searching around entry point.

Entry point obfusctaion

• Multicavity viruses
• Hijact control later (after the program is launched), for example overwriting import table addresses or function call instructions

Virus and Worm stealth techniques

• Polymorphism: change layout (shape) with each infection. The same payload is encrypted with different keys.
• Metamorphism: create different versions of code that look different but have the same semantics (do the same thing).

Malware analysis

Is an ex-post workflow after the malware has been identifies:

• reported by someone
• automatically analyzed
• manually analyzed
• antivirus signature developed

Two main type of analysis are carried:

• Static analysis: parse the executable code. Hight code coverage and works in dormant code but suffers from obfuscation.
• Dynamic analysis: Observe the runtime behavior of the executable. Low code coverage and do not work with dormant code but is does not suffer from obfuscation.