Old Malware Tricks Still Defeat Most AV Scanners

SkiifGeek writes "A year ago Didier Stevens discovered that padding IE malware with 0x00 bytes would happily slip past most of the scanners in use at VirusTotal.com. Revisiting his earlier discovery, Didier found that detection on his initial samples had improved, but not by much. For all the talk of AV companies moving away from signature based detection to heuristics, it is painfully obvious that not many of the tested engines can successfully handle such a simple and well known obfuscation method and the best of those that can detect the obfuscation can only detect it as a generic malware type. At least the scanning engines that can detect the presence of malware with the obfuscation aren't trying to claim each differential as a new variant."

What they lied about using heuristics? NEVER!

[topham]

Considering the arguments I got in between the word 'Signatures' and 'Heuristics' when it came to anti-virus I'm not surprised.
They think heuristics are BLAH.*BLAH instead of BLAH...BLAH.

And even then, they don't get it right.

Re:uh oh

[noundi]

Your post gave me a thought. How come no AV markets their software using relativity? I mean what use does the average user have for a software that detects a decade old piece of malicous code, that most likely doesn't even work anymore? Perhaps it's time that they market their software with fixes for current problems, not brag about their huge bank of outdated viruses. That creates nothing but a bloated AV, which in the end will most likely hog your system more than it should.

Applied AI

[khellendros1984]

It seems like this is exactly the sort of place where AI could be useful...disassemble some binary data, figure out what it does, and use *that* as a sort of signature. The behavior of the program is the thing that causes a problem, anyhow.

Re:Credit Card Companies

[peragrin]

while you are correct, the problem lies with the OS that needs the most AV support. Windows itself acts like a virus to change memory locations when certian apps are run. Thisis to ensure compatibility. With Vista msft has been trying to change such behaviour, but it took 6years for msft to notice the problem and at least until win7 until things start working better. Linux and OSX don't suffer from such things as badly as they depracrate old buggy features ona regular basis.

(Stupid) Useful Malaware Tricks?

[kyashan]

..a bit OT, but sometimes I wonder when will be the year of malaware on Linux or OS X.

Ugh! Scanners!

[flajann]

One thing I absolutely despise with the AV scanners is just that -- the scanning, that eats up performance both disk-wise and cpu-wise, and always seem to run at the wrong times -- when I am using the machine!

This scanning aspect grows even more germane as we ascend into the commonality of terabyte drives.

We need better approaches to checking files for infections or payloads -- like checking them thoroughly once and then checking any newly created or altered ones at the time of alteration. But even there you take a performance hit, and I know most AV systems already does this to some extent (but will rescan all the drives periodically).

Ah, gotta love Windows. I much prefer to have a clean system and avoid any operations that might introduce a payload -- like running IE, for example.

Google's attempts to flag questionable sites is half-baked, and depends on GoogleBots catching the vulnerabilities before your browser does. And for the poor site owner that's been compromised, Google fails to provide enough details for the site owner to eliminate the potential problems.

Well, I don't use Windows as my primary platform for a number of reasons, virus vulnerabilities being one of them. Not to say Linux doesn't have its share, but they are far less common and if you keep up with the latest upgrades, you'll do OK for the most part.

I think we need to go in a direction of relying on hypervisor-wrapped OSes that can do selective rollbacks to the points before infection. This way, you eliminate the need for scanning everything all the time and better yet, you might put some of the malware protection in the hypervisor itself, at a level the guest OS or the malware could never detect nor evade.

Just a thought for free for some enterprising individual to go make $$$$ from!

Re:Padding with 0x00 bytes?

[rebootconrad]

You know, posting it to virus total just runs it through a static file scanner. Most IE exploits are caught when they attempt to install - you can obfuscate the static code, but you can't obfuscate the call to the system API. VirusTotal is a useful resource, but it doesn't really show anything when it comes to live threats.

Didn't Consumer Reports say this years ago?

[tkrotchko]

A few years back, Consumer Reports took some malware and made some trivial changes and almost all the AV vendors failed that simple test.

If you recall the AV vendors criticized Consumer Reports because they claimed it was the equivalent of producing new malware and that it was irresponsible.

Bottom line... this pretty much proves that AV has little or no value. You use it because everybody tells you that you have to use it, not because it provides any sort of comprehensive security (it doesn't even come close).

Re:Credit Card Companies

[Ranzear]

I so much more enjoy Antivir's almost purely-background scanning. Every detection I get on a machine I install it on is upon is upon access, and it's even capable of detecting within compressed file formats as soon as you open them. Theres no need for a piece-by-piece thorough scan of every piece of code and every file on the harddrive, and thats even becoming prohibitive anymore. Its no longer a matter of looking at what a file is or contains, but at what it -does-. A process that reads memory from other processes, opens a high port number, and attempts to send out packets should raise immediate red-flags, yet could contain enough junk between the functional bits to disguise itself as a 3D-rendering program. My favorite notion about Norton's product is that its very, VERY secure - particularly because it eliminates the user being able to perform almost any task on the machine. Its almost the predecessor of UAC, and falls into a category I dub 'Security through Dysfunction'. Stopping to check every process running on a machine is about as effective as stopping every vehicle at the border and asking if they have bombs or weapons or... okay bad analogy.

Re:Credit Card Companies

[nabsltd]

The thing about anti-virus software is that is stupidly tries not to be intrusive. AV software could be pretty much 100% effective with a few tiny changes, but those changes will make it more visible and annoying.

1. At install, the AV software adds a "run at reboot" entry that runs in the PE boot time, before most (but not all) other processes get a chance to run and does a full system scan at that point. You don't get to continue the install until you agree to this reboot.
2. After the scan, the AV software (still in the PE environment) picks a few select directories (like "C:\Windows" and "C:\Program Files") and creates checksums of all files in those directories (or subdirectories).
3. When the re-boot finishes and the install completes, the user is given the option to add other directories to the "safe" list, and file checksums in those directories are computed.
4. After this, the AV software will not allow a file on disk to be run as an executable unless it is in one of the "safe" directories and the checksum exists and has not changed.
5. Any other attempt to execute a file results in a full scan of the file using the virus signatures, and the user is then given a warning about running non-trusted executable and analysis of the scan.
6. The AV software will provide a way to manually update the "safe" directories, so that after you install software you can run it, but there should be no way to automate it.
7. As an option, the AV software blocks write access to every executable file in the "safe" directories.

This won't protect against scripting language malware and exploits of ActiveX (or other in-process DLL code), but it will tend to stop what they can do in the long run. Exploit code can create an executable in some directory, but it won't be able to be run without a warning, even if that code contains no known virus.

Re:Padding with 0x00 bytes?

[mrops]

Man, Let me tell you, Viruses have evolved. Really evolved. I don't run a anti-virus at home, don't like them.

In a moment of weekness I started watching a downloaded version of stargate, missed it on friday :( the WMV movie asked for a "codec" to be installed, guess what... (I know I should have know better)

Its been 4 weeks and I am still struggling with this virus. Most virus scanners detect this beast, however in my last 4 weeks, none can properly clean it. This has become somewhat of a challenge.

I have discovered so far, that
- it is installed as windows driver,
- this driver gets notified at winlogon
- the driver creates a exe
- the exe executes and stays in memory
- the virus driver file then mutates and goes elsewhere, again to come back at the next logon, this mutation is what virus scanners can't work with.
- Spreads via Windows networking to other computers on the network, this however only if the other computers have any shared writable folders.

Yesterday, I discovered, the crappy thing downloads and installs stuff off the internet.

Fortunately I have all data backed up.

I can re-install my XP anytime, but this has become too challanging to let go.

Here is a kicker, I tried infecting a qemu emulated XP VM, guess what, there is a newer version of the virus, somewhat different than 4 weeks ago. The new codec that downloaded wasn't the same that got downloaded to my machine.

So it seems these virus/trojan developers are well funded and doing this as a day job. Hoping this trojan shares some mp3s so RIAA can go after them, they seem to be more effective than FBI in tracking this kind of a thing.

Here to some good news, my dad's Vista PC is immune to this virus, so Microsoft may have done something right, or maybe the virus/trojan developers are not targeting Vista.

Antivirus/Antispyware 2009

[Danzigism]

Working in a repair shop, the most common infection I've seen in the past couple months has been the rogue antivirus/antispyware products. They usually pose as "Antivirus 2009" or "XP Antivirus 2009". They use extremely generic names. Its funny because every customer that has one of these infections, is usually running Norton, Mcafee, Trend Micro, AVG, or any of them. Not ONE of them from 2008 has been able to rid the rogue product. It's funny too because all you have to do is remove a couple lines in HiJackThis and remove the Program Files folder. Although it has made our repair shop a good amount of money, it is annoying having to tell customers why their AV software can't remove such a silly thing. I've been a strong supporter of Panda Antivirus for many years, and I've always thought all the others are extremely bloated. ESPECIALLY NORTON.. HOWEVER, Norton 2009 has literally done a 180 with its performance. It removed XP Antivirus in no time. It barely uses 1% of your CPU when it is idle, and it updates literally every few minutes. I've been extremely impressed with their latest release and would recommend the noobs out there to try a 15 day free trial. But of course, ultimately running any AV software is a joke if you know how to use your computer correctly and don't download goat pr0n and warez. but fyi, if you would of asked me a month ago about Norton, I would of told you it is ridiculous and extremely bloated crap software, just like the rest.

Re:Ugh! Scanners!

[flajann]

What I don't understand is how I run NO A/V software (no, really) - I just run Sygate, a software firewall - and I have not gotten any trojans or viruses in the last... 10 years? Yeah I guess I could have one and not know about it, but I doubt it, disk activity and network activity seems normal (except when Skype decides to route a call thru me, why can't people get their own IPv6 IPs damnit??), and I occasionally run a virus/rootkit scanner over my machine and they come up clean.

A/V is probably unnecessary, if you have a reasonably knowledge of how to use a computer. Yeah most don't, but you're posting Slashdot so you probably do. Why do you use one at all?

One reason: Kids.

One kid uses Linux as much as he uses Windows, and understands how to avoid malware. Alas, he has a lot of friends over that have not learned these important lessons.

Not to mention my other -- younger -- kid, who insists of downloading malware from Disney and other sites that *insists* on using IE to run at all.

Re: of course

[Keeper Of Keys]

I am a web developer, quite proficient in javascript, and agree with the GP. No site should *require* js for navigation. There are established ways to mark up your menus, no matter how complex they may be, so that they may be navigated with js turned off while perhaps having enhanced usability or attractiveness for those who allow it to run. This is absolutely essential in the modern web: your most important visitor, the googlebot, doesn't run javascript - and obviously you want it to be able to follow links on your site.