3 ms·
Either that or they have specialized web-crawlers that emulate various browsers.
by someguydave 7y ago
Either that or they have specialized web-crawlers that emulate various browsers.
- londons_explore 7y agoEmulating a browser wouldn't be good enough for most exploits. Most stealthy malware immediately deactivates itself if it thinks it is on an emulated or virtualized system.
- someguydave 7y agoMaybe. The article seems to imply that this implant was given to all comers, which may explain how Google found it.
- sangnoir 7y agoIt might be good enough to flag "interesting" websites for further research on native (or emulated native) environments
- Godel_unicode 7y agoFirst, most malware is not that sophisticated. While some does vm detection, most (as is the case here) does not. Second, VM detection is an arms race. See for example the vmcloak project. Third, with the rise of BYOD and VDI, vm detection is less common in sophisticated malware as the target is frequently virtualized. Fourth, vm detection is harder for arm than x86. Fifth, vm detection detection via static analysis is very effective.
- thw0rted 7y agoIf I understood what little I read of the exploit details, it actually loads an opaque payload through WebGL calls, so simply crawling with an iPhone's user-agent wouldn't be enough to notice anything "fishy". The site can just serve the payload to all visitors, then the implant will get installed if the resulting kernel calls are broken as described in the article.