Slashdot Mirror
Microsoft Builds JavaScript Malware Detection Tool
Trailrunner7 writes "As browser-based exploits and specifically JavaScript malware have shouldered their way to the top of the list of threats, browser vendors have been scrambling to find effective defenses to protect users. Few have been forthcoming, but Microsoft Research has developed a new tool called Zozzle that can be deployed in the browser and can detect JavaScript-based malware on the fly at a very high effectiveness rate. Zozzle is designed to perform static analysis of JavaScript code on a given site and quickly determine whether the code is malicious and includes an exploit. In order to be effective, the tool must be trained to recognize the elements that are common to malicious JavaScript, and the researchers behind it stress that it works best on de-obfuscated code."
Firefox for 4+ years, and never looked back.
Does this malware tool come with its own exploits built in like all the other Microsoft software?
Seven puppies were harmed during the making of this post.
and the researchers behind it stress that it works best on de-obfuscated code.
...because all sites infecting visitor's machines with malware through javascript have js code in clear, reading-friendly syntax.
Does it prevent more real-world attacks than it makes possible?
// MD_Update(&m,buf,j);
if char = g; replace with z; else copy
To do this effectively, wouldn't you need to parse the script into an AST or similar?
What is a malicios Javascript? I assume for them is a Javascript that takes advantage of your browser flaws. Good luck with analizing a language which have eval function.
You should just sand box the Javascript properly instead of adding an extra layer of bloatware.
So instead of using firefox+NoScript, I could switch to IE, and install this tool to block the malware which is specifically de-obfuscated to be blockable?
FTA: "ZOZZLE makes use of a statistical classifier to efficiently identify malicious JavaScript. The classifier needs training data to accurately classify JavaScript source"
It seems that they're using Bayesian (or other) classification techniques like those in spam identification tools. One wonders what percentage of false alarms are going to be set off. When I use NoScript to disable JS for a website, at least I have control over it.
My guess is that this isn't going to be that much more effective than current tools, unless, perhaps, there is some kind of fast data sharing going on between users via a global database used for classification. Frankly, I think it would be more useful to have the tool interact with an existing anti-malware/anti-virus (so it could use its alarms as part of the classification process --- something like, "Hmm, the A/V says something suspicious happened right after executing this JS code, maybe we should flag it").
That's not going to help much on Linux now, since practically no one runs A/V. OTOH, most Linux JS malware would probably infect the browser itself rather than the OS, I suspect.
The app is called Internet Explorer. And it finds ALL the javascript malware!
I think it was in IE7, Microsoft decided to prevent by default the use of "Prompt" in Javascript to help fighting against phishing.
Technically this was probably not a good idea, as programmers with a minimum of skills can emulate the "prompt" behavior via a DIV.
What happened anyway is that many people could not use some pages normally, and were looking at remedies on the Net (like disabling the "feature").
MS should not go against the standards, but cope with them instead, and built a secure approach more smartly.
Let's hope this new tool will not cause more problems than it can solve.
Slashdot, fix the reply notifications... You won't get away with it...
not JavaScript...
Dear Malware Writer, I've just installed this cool MS malware/JS detector but it doesn't work with obfuscated code so, please don't hide your tricky JS code otherwise I won't be able to stop you abusing my computer. thanks, much appreciated. ;-)
It has to be pretty straightforward for Zozzle to catch it.
VirusHereNothingtoSee.Virus(inject, 1);
And why not integrate it with the decent Microsoft Security Essentials?
In order to be effective, the tool must be trained to recognize the elements that are common to malicious JavaScript, and the researchers behind it stress that it works best on de-obfuscated code.
Clearly this will be ineffective or at best effective for a very short time. The Javascript malware I have seen is already quite obfuscated. I'm going to give Microsoft a little credit by presuming that encoded javascript will be decoded prior to analysis.
Web browser security
Sure, there were other reasons, but fundamentally, Javascript has been a big hole in browsers since it was introduced. If you're going to let unknown people run untrusted code on your machine, you need to run it in a sandbox where it can't do any damage. It's possible to write clean, safe, reliable Javascript, but it's also possible to write malicious or broken Javascript, and if you've got Javascript turned on, then you're allowing malware to find whatever holes your browser has.
It helps to run NoScript, and ad-blockers, and Ghostery, but even with that, the amount of ostensibly-non-malicious Javascript and flash out there on pages I want to see is enough that Firefox often tries to burn the entire CPU (and one of the nice things about dual-core machines is that now when that happens, FF is stuck on one core and the rest of my machine is still working fine.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
They released Internet Explorer long ago.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I've been starting to use Chrome for most new work in addition to Firefox. It doesn't do everything, but it doesn't crash or hang as much as FF, and it reloads much much faster than Firefox if I need to kill it or if I need to reboot my laptop. I still keep IE around for sites that need it (and $WORK finally approved IE7 :-).
Firefox still has trouble - even running NoScript and ad blocker and Ghostery, it'll still hang up every couple of days and start burning the entire CPU core, whether that's from Javascript or Flash or just bugs, and sometimes it crashes, especially on AJAX pages, and sometimes it's unresponsive enough that I need to kill it even if it doesn't crash. It's become tolerable now that I've got a dual-core CPU and more than 1.5GB RAM, but it's annoying.
The application that doesn't work well on Chrome is reading news - take a news aggregator site like FARK, open a hundred news articles in tabs, and then start reading them; Chrome often gets stuck and can't handle it.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
No way the malware authors will adjust the malware once this is relased. Also, what's the false-positive rate? After all, an is_malware() that always returns true has a very high effectiveness rate at detecting malware.
So it's come to this point. Microsoft has started sucking its own Slurm.
Insanity: doing the same thing over and over again and expecting different results.
Albert Einstein
I am (finally) forced to use Microsoft Office(tm) -- the one without the menu bar (2007). With Microsoft Windows(tm) (7? not sure). I have to have it plugged into a network in order to use "domain login".
It runs anti-virus software, some kind of remote access software, and Office (because heavily formatted documents from others don't work well with OpenOffice.org). I don't have "administrative access".
Since it's plugged in, I decided to portscan it. 10 open ports (AFAIR). Compare and contrast to 1 open port when I open my (considered non-secure) laptop (22, for ssh).
Yes, SSH has had two exploitable vulnerabilities in the past 15 years. (well... 1, unless you use debian/ubuntu in which case 2). But, client computers really don't need any other incoming ports. I guess it's a good thing my Windows laptop doesn't have port 22 open!
As to JScript? I have been using NoScript. Blanket denial of JScript unless I specifically enable it. We know that pattern-matching heuristics don't work (even though I am forced to put up with it on my MS Office laptop).
Still, I guess that the universal access to computers that has been enabled by Microsoft Windows and cheap Intel hardware has been a net positive to society.
The solution would be to produce two operating environments -- a "starter" and a "normal". We already have this, in the form of Windows vs. Everything Else. But, due to the commercial nature of Windows, there is limited compatibility across the tiers.
Just another "Cubible(sic) Joe" 2 17 3061
I hope whatever it does eventually forces web designers back to mostly static pages.
I hope it stops javascript hyperlinks and forces them back to standard HTML hyperlinks. I hope it blocks all scripting outside of the primary domain, this would force advertisers back to non-scripted ads. I hope it blocks any cross-site CSS accessed via Javascript.
In summary, I hope this tool brings to an end the widespread nuisance use of Javascript. It's reached the point where a menu design loading a new static page to display the next menu option effectively loads faster than all the bloated Javascript code these days.
If web designers want to have all the bells and whistles on their page, do it on the server side and stop using client side resources for what is effectively useless crap. Thank you.
Read it! It's not too hard to understand. There's a link on the cited story.
The selection from the article fails to mention that deobfuscation was a major component of this work. If your exploit runs, whether it's through eval, an iframe, or any other means, Zozzle will see it fully deobfuscated. This is accomplished by hooking the compile function of the JavaScript runtime and performing analysis immediately before compilation.
There is a detailed analysis of false positive and false negative rates in the tech report. By "high effectiveness," the article means "high accuracy." Zozzle correctly classifies over 99% of JavaScript samples in the evaluation set, and has a false positive rate well below 1%.
It would be hard to claim Zozzle is bloatware: the static analysis requires little more time than simply parsing the code. Again, detailed analysis of Zozzle's performance is in the tech report.
The fancy name: I'm glad you think it's "fancy." Zozzle is trained on heap sprays collected by a highly precise runtime detector called Nozzle. Zozzle = zero-day Nozzle. Plus, it's fun to say. As a side note, Zozzle can detect ANY type of JavaScript attack, not just the heap sprays provided as training data. These attacks share many characteristics with other exploits.
Malware writers will adapt: Yes, almost certainly. However, there are some things you can't remove from your code, like calls to the JavaScript runtime functions being exploited. This means a lot of known attacks are off the table and malware writers will need to identify new vulnerabilities to successfully attack Zozzle's users. Even then, these attacks will eventually be picked up by other detection tools, Zozzle will be trained on them, and the malware writers need to start over. This is all assuming these new attacks don't contain patterns Zozzle has already been trained on. Zozzle raises the bar for malware writers, and significantly reduces the effectiveness of copy-pasted attacks (which are the vast majority of attacks on the internet today).
Microsoft has a long proud history of thinking expertise in one thing makes them qualified to try to translate success to another domain. Best thing they could do would be to open source it. I wonder if they plan to use it and publish risk rankings on Bing searches?
If they do not open source it, its doomed to fail.
"Zozzle...has a false-positive rate of less than one percent"
So let's say it's a half percent. I bet most of us look at several dozen web sites a day...so once a week this thing is going to prevent me from visiting a perfectly cromulant website? I don't think that's anything like good enough. Notice that they don't tell us the false-negative rate.
Here is the pseudocode
test
{
if platform (windows)
close browser;
}
Actually, the false positive and negative rates, as well as their relationship with training parameters, are clearly described in the paper. Go read it.
Zozzle is a great first-pass filter for a heavy-weight detection tool. A false positive rate of 1% means that your browser will run some higher-overhead analysis (like Nozzle, which has a 10% performance hit) on one out of every 100 benign pages. Seems reasonable to me.
In practice the false positive rate is significantly less than 1%. With a small training set of 300 malicious samples, Zozzle has a false positive rate of 0.14%. In practice, a much larger training set can be constructed, further reducing the false positive rate.
what good is an antimalware tool if it can't recognize evil code that has been obfuscated? it's not like evil programmers are going to make their programs easy to defeat on purpose.
Remember kids, if you're not paying for the service, YOU ARE THE PRODUCT THAT IS BEING SOLD.
Microsoft's "Malware Dection Tool":
1. Disables system setting regarding Malware ... i.e. allows Malware instalation at the system level.
2. Disables program settingis regarding Malware ... browsers ... outlook (especially ! ) ... Word and Excel.
Looks like M$ is revieving big $$$ from Malware Industries to perputuate Malware !
-- 308
After 15 years of fixes IE is reduced to merely being the number one attack vector.
Goggle - Zozzle
Hummmm.... in wonder if the sales department thought up this brainstorm and wanted to
a) show they have no creativity when it comes to naming things, i mean come on, bing -> seriously????
b) wanted to poke fun at google, who's stocks are still climbing when everyone else's is staing put, and also about 10 times the price of M$ stocks.
c) wanted to appease balmer's rants of "how come we don't have a cool name like they do"
d) all of the above....
Unfortunately, this question no matter which you answer you chose, will always be correct.