Evasive Malware via Identifier Implanting

(2018) Evasive Malware via Identifier Implanting.

Preview	Text implants-dimva2018.pdf Download (476kB) | Preview
	Other (Plain Text Bibliography) bibliography.txt - Bibliography Download (12kB)

Abstract

To cope with the increasing number of malware attacks that organizations face, anti-malware appliances and sandboxes have become an integral security defense. In particular, appliances have become the de facto standard in the fight against targeted attacks. Yet recent incidents have demonstrated that malware can effectively detect and thus evade sandboxes, resulting in an ongoing arms race between sandbox developers and malware authors. We show how attackers can escape this arms race with what we call customized malware, i.e., malware that only exposes its malicious behavior on a targeted system. We present a web-based reconnaissance strategy, where an actor leaves marks on the target system such that the customized malware can recognize this particular system in a later stage, and only then exposes its malicious behavior. We propose to implant identifiers into the target system, such as unique entries in the browser history, cache, cookies, or the DNS stub resolver cache. We then prototype a customized malware that searches for these implants on the executing environment and denies execution if implants do not exist as expected. This way, sandboxes can be evaded without the need to detect artifacts that witness the existence of sandboxes or a real system environment. Our results show that this prototype remains undetected on commercial malware security appliances, while only exposing its real behavior on the targeted system. To defend against this novel attack, we discuss countermeasures and a responsible disclosure process to allow appliances vendors to prepare for such attacks.

Item Type:	Conference or Workshop Item (A Paper) (Paper)
Divisions:	Christian Rossow (System Security Group, SysSec)
Conference:	DIMVA GI International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Depositing User:	Johannes Krupp
Date Deposited:	01 Jul 2019 10:04
Last Modified:	15 Oct 2022 12:11
Primary Research Area:	NRA3: Threat Detection and Defenses
URI:	https://publications.cispa.saarland/id/eprint/2949

Actions

Actions (login required)

View Item