6 ms·

I'm surprised that no one has fingerprinted the patterns that these apps take to encrypt the files, then created an antivirus definition for them. Surely they c

by mrmondo 12y ago

I'm surprised that no one has fingerprinted the patterns that these apps take to encrypt the files, then created an antivirus definition for them. Surely they can't be that polymorphic that no one can catch them?

mdisraeli 12y ago
Polymorphism typically referred to worms and viruses that changed their own code base as they spread. Most infections, however, happen from phishing emails either with attachments or linking to the payload. Changing the files produced so as to no longer be caught by antivirus signatures is trivial, and you can even create a unique variant for each phish. Many legitimate programs will seem to act similarly - opening files and overwriting contents with something else. ID3 tag writers for MP3s, file type converters, batch image processing, etc. This means you can't match easily against the types of actions being taken. Let's imagine, however, that the antivirus was still able to detect that something odd was happening. If it prompts the user, they will inevitably click 'yes run this file', because that's what they have always done. If it quarantines the file... well, you just add another few lines to the phishing email saying that the attachment is perfectly safe ("scanned by symantec" apparently...) and to go ahead and bring it back out from quarantine
fencepost 12y ago
HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) includes a variation of this - it's not looking for fingerprints, it's monitoring for process behavior characteristic of individually encrypting bunches of files.
acdha 12y ago
The problem is that the signature-based antivirus model assumes 1980s-speed networking where an attacker releases a single program which has months or years to spread around the world. In the Internet era, the attacker receives the same AV updates when you do and can tweak an executable until it's no longer detected locally before immediately deploying it. This approach can even be automated both to permute the executable until it passes and to stop spreading it after it starts being flagged.

by mrmondo 12y ago

mdisraeli 12y ago

Polymorphism typically referred to worms and viruses that changed their own code base as they spread. Most infections, however, happen from phishing emails either with attachments or linking to the payload. Changing the files produced so as to no longer be caught by antivirus signatures is trivial, and you can even create a unique variant for each phish. Many legitimate programs will seem to act similarly - opening files and overwriting contents with something else. ID3 tag writers for MP3s, file type converters, batch image processing, etc. This means you can't match easily against the types of actions being taken. Let's imagine, however, that the antivirus was still able to detect that something odd was happening. If it prompts the user, they will inevitably click 'yes run this file', because that's what they have always done. If it quarantines the file... well, you just add another few lines to the phishing email saying that the attachment is perfectly safe ("scanned by symantec" apparently...) and to go ahead and bring it back out from quarantine

fencepost 12y ago

HitmanPro.Alert (http://www.surfright.nl/en/alert http://www.surfright.nl/en/alert) includes a variation of this - it's not looking for fingerprints, it's monitoring for process behavior characteristic of individually encrypting bunches of files.

acdha 12y ago

The problem is that the signature-based antivirus model assumes 1980s-speed networking where an attacker releases a single program which has months or years to spread around the world. In the Internet era, the attacker receives the same AV updates when you do and can tweak an executable until it's no longer detected locally before immediately deploying it. This approach can even be automated both to permute the executable until it passes and to stop spreading it after it starts being flagged.