Slashdot Mirror
The Rise of Polymorphic Malware
twoheadedboy writes "The level of aggressive, polymorphic malware intercepted by Symantec doubled in July, when compared to figures from six months ago. This kind of malware has been typically found inside an executable within an attached ZIP file disguised as a PDF file, and is pretty darn good at getting around traditional anti-virus products. 'There are powerful Darwinian forces acting on the development of malware by criminals,' said Martin Lee, senior software engineer at Symantec. 'Those who look to innovate and improve their malware tend to infect more computers and acquire the resources to reinvest in further development and innovation.'"
Virus writers discover OOP??
so college drop outs have finally found a way to pay off all that school debt?
It still blows my mind that people open attachments from individuals they do not know. Despite years of computer virus education and the general public becoming "aware" of tainted files and links, people still do it. They'll put "the club" on their car parked at a Walmart in the middle of no where, but open up random attachments and video links to spiders under the skin from people they don't know. Amazing.
"powerful Darwinian forces" is an interesting way to describe the process by which the designers of these viruses are using progressively more intelligent designs.
Hooray! Another vendor advertisement disguised as a /. article.
But nobody uses Macs or Linux, so it's not worth bothering writing malware for those platforms ...
Polymorphic Shellcode Engine Using Spectrum Analysis
http://www.phrack.org/issues.html?issue=61&id=9
Release date : 13/08/2003
Naturally I'm paranoid about what AVG and Comodo have not detected since then. NOD32 didn't say anything either about my normal use, but I'm actually glad the technique is becoming a threat that AV suppliers must address.
All rites reversed 2010
Polymorphic and metamorphic malware has been around for years. They're probably seeing a rise in detections simply because of the popularity of a certain malware generation tool or something. You can read about polymorphic and metamorphic malware in a book written by a guy from Symantec that was published in 2005: http://www.amazon.com/Art-Computer-Virus-Research-Defense/dp/0321304543
I was only 28,931 registrations away from having a 6-digit UID
In the middle 90's I ordered a book called "The Giant Black Book of Computer Viruses". Loved it. Still have it. Signed by the author even. Some good info in the book about polymorphic and genetic viruses.
Future devices that are not in a "walled garden" ecosystem will have to provide users with an easy, virus-immune way to roll back to a previous state then automatically "roll forward" with scrutiny on every "going forward" change.
To make this work, OS and machine vendors will need to give their customers a way to "clean boot" into a read-only-boot-media recovery environment, a way to store changes, and a way to store one or more "roll-back-to" points in a form that viruses cannot write to.
Nothing here is really new - rollback and recovery have been around for decades. Making it easy for Joe User to do is the hard part.
Oh, and this still won't completely solve the problem - a few viruses WILL find a way to tamper with data that's supposedly "read only," but if 99% of today's malware infections that can't be easily treated today can be treated with "roll back and attempt recovery of safe changes since last commit date" then there will be a lot fewer "wipe the drive and reinstall" scenarios.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Polymorphic Software
Prerequisite: Industrial Base, Information Networks
Technology: Advanced Subatomic Theory, Optical Computers, Adaptive Doctrine
Special Ability: Heavy Artillery
Improves Probe Team success rate.
Track and Level: Discover 2
"Technological advance is an inherently iterative process. One does not simply take sand from the beach and produce a Dataprobe. We use crude tools to fashion better tools, and then our better tools to fashion more precise tools, and so on. Each minor refinement is a step in the process, and all of the steps must be taken."
-- Chairman Sheng-ji Yang,
"Looking God in the Eye"
You can lead a horse to water, but you can't make it dissolve.
A lot of people just innately trust anything on the PC. Not just their address book, but anything they find. What we need to do is, yes, build a culture of suspicion into this - Why is this thing you want available? Why is someone sending you this offer? Why are you receiving an attachment from this person? If you can't figure it out, then you need to either realize you're taking a risk and search for more info/evalute if it's worth it (What we do, particularly if we're searching for pirated software or the like where there IS a risk), or just back away and don't do it.
What most people do is find out by clicking - the equivalent of taste-testing stuff off the New York Sidewalk. Maybe if someone started a seminar where attendees who blindly open attachments are forced into such unsavory blind taste tests, we'd see a little improvement. Even the BEST viruses I've seen as far as making a 'believable' e-mail, are obvious to me. Even if it came from my brother I wouldn't click on 'em. Because I have some healthy mistrust and suspicion of the internet.
I think a lot of our problems come from these 3rd party packages that have grown WAY too complex and provide too many vulnerabilities. Why, for example, should the PDF format permit -anything executable or coded-, whether it's JavaScript or ZIP files? It's time in my view for the developer and system integrator community to simplify; let's get back to the idea of tools and programs that have well-defined scope and do a few things well, rather than turning into Yet Another Vendor Platform that can be used to distribute viruses/trojans/malware/crapware/etc.
AdBlock implemented default in browsers? Oh my an outcry there'd be
Then let's backpedal a bit. I'd recommend implementing content-type blocking (e.g. Flashblock) by default in browsers. That'd keep the user safe from untrusted rich media in an exploitable non-free player, and the circumvention (advertise using a medium other than Flash) wouldn't be much of a burden for advertisers.
Whale is more than 20 years old now, and it was polymorphic. An issue of 40hex from 1993 provides source for a polymorphic engine. This isn't a new development, the technique was "mastered" 20 years ago :P
Maybe they've seen a recent spike in it, but... who cares? Well, unless it means they'll put a little more thought into AV than signature-based bullshit. "heuristics"-based detection that isn't a complete joke, for a start.
Malware spreaders using people's address books
If malware can sniff the passphrase to read an address book, it can sniff the passphrase to sign mail.
I'd like to see the OS, especially one like Android in the hands of unsupported, naive, and promiscuous users, require permissions for InterProcess Communication the it does for files. And for DB access. All strongly typed. Those kinds of familiar patterns in combination, upon every access between processes on objects. Mediated by an OS capable of supporting the user and using a support Internet to warn others when threats (or patterns that represent threats) appear to correlate to risky objects of the same kind.
The OS and Internet should act as an integrated immune system bathing our objects, not just a special case intervention when opening the first file from an email. Dedicate one or two cores of these multicore CPUs (and prefilter at servers for smaller/mobile devices). Attacks are now the norm, not the exception. The network and OS infrastructure design should recognize the new reality.
--
make install -not war
Several reasons why Antivirus is a fail:
1) 0-day. Your AV will never pick it up
2) polymorphism - if the virus sig changes, you're hosed
3) People think: "Since I have AV, I can't get infected"
4) People think: "AV didn't find anything wrong, so I must be clean"
5) When AV doesn't work, people assume it's broken
Antivirus has evolved into a "solution" when it's clearly not capable. How many infected windows installs have you found where Norton took a head-shot, or some kind of AV *was* installed at one time but got smoked?
What's needed: OSs need to plug their holes. Browsers could be fixed so it doesn't hand off malicious content to system executables. The OS itself should be trimmed down so not everyone is running SMB/RPC (or other commonly exploited services) by default. Executables which handle web contect could be sandboxed and run by a lower privilege user (this can be done in Unix, so why not windows?). Why do these things not happen?
AV is great when it works but it's proving not to be enough.
Join the Slashcott! Feb 10 thru Feb 17!
There have been polymorphic viruses since the dawn of time. I even wrote one in 2004. Why is this news?
I rarely respond to comments. Also, don't ask for clarifications: a brain and Google are faster, believe me!
Malware authors are combining ever more powerful buzzwords to create frightening malicious software packages that could, in theory, cause system slowdowns and system crashes more severe than those caused by Symantec software. Symantec researchers anticipate seeing examples of this malware "in the wild", rather than only on their testing lab dev boxes, at any moment.
This malware uses code so sophisticated and complex, and yet somehow so compact, that it cannot currently be detected, even as it hides in PDFs and ZIP files -- file types familiar to most people who sign purchase orders.
Fortunately, Symantec is almost ready to release its new software to fight this menace, available for $69.99/year; estimated release date is when "polymorphic malware" peaks on Google Trends.
What I gather from the Christian Bible is that humans were designed by God (created in his image) but has had malware implanted by a hacker named Satan. God's son had to die to pay the ransom for the self-destruct code for Satan's malware, and this code will be applied after the tribulation.
One has to wonder, as viruses get more sophisticated and are able to obfuscate their own signatures, what methods are going to be utilized in the future to detect them... because I can't see it.
For some reason, this is reminding me of the Turing Halting Problem.
And even trying to practice safe web surfing habits isn't always effective. I have seen a virus get onto a work computer that was behind the company's firewall, where the user did not install any software at all, used mozilla for 100% of his browsing, and did not download or install any plugins or extensions. However it got on there, it happened without any user-intervention whatsoever.
The virus was easy enough to remove as another user of course... but my point is that even what should be "safe" web practices doesn't always work.
File under 'M' for 'Manic ranting'
[grammar_nazi_mode=ON]
This may win me the pedant of the year award, but the summary says "The level ... doubled in July, when compared to figures from six months ago." This is incorrect and doesn't even make sense. Reading the original article reveals the truth. The level doubled in the six months leading up to July. I suppose it's theoretically possible that the level stayed perfectly flat for 5 months, then suddenly doubled, but I think the article would have mentioned that.
[grammar_nazi_mode=OFF]
And the 1260 virus.
The 'methods' of encryption have changed (once was ZIP, now ZIP AND PDF, requiring a PDF reader in addition to ZIP libraries), but the concept isn't new, and I;m surprised has not been in continuous use since then.
And this passes as either new or unusual for /.? Doubling the deteciton volume for a month? July? And July isn't even over yet?
So was it the word 'darwinian' that justified this as interesting?
feh.
deleting the extra space after periods so i can stay relevant, yeah.
There are problems with AV software, not the least of which is that it's a system resource-hog, usually far worse than the malicious code it's supposed to defend against.
I've been ok for a few years now running Windows XP without any full-time anti-virus software, but I'd hesitate to recommend that for non-technical users. Of course, most of the time I run Linux, and I only boot Windows when I have to...
Some time ago, I was doing experiments where I wanted a Windows desktop to automatically send experiment results back to the server. Using sftp wasn't very attractive due to the need for passwords or usernames, so sending an E-mail seemed the best way to go. But the problem was the anti-virus/anti-spam software which didn't like unknown applications sending E-mail. Problem was solved by renaming the application "agent.exe". Problem solved.
Follow the money. Who stands to profit from a market of security vulnerabilities? I can tell you, Symantec sure isn't hurting for cash right now.
I've been wondering about this for 13 years now (when I started learning z80 and 68k assembly) if antivirus software was smart enough to analyze for things like:
jmp lbl_1 .ds 50 /* declare 50 bytes of storage */
lbl_1:
And those 50 bytes are filled in with random patterns. But this article makes it sound like there are multiple jumps that are being generated which I've also considered. Or dummy for loops.
I'm surprised virus writers are only starting to do this. Any assembly coder worth his salt should be smart enough to think of this.
http://en.wikipedia.org/wiki/Jury_nullification
1) you forgot that root/administrator is for installing software and not a user.
2) a system user should not exist. All software needs to run as the user who initiated it (sandbox).
What's needed: OSs need to plug their holes.
Problem is, the biggest hole sits in front of the computer and can't be plugged (no pun intended).
MS-DOS had polymorphic viruses in the early '90s.
Hail Eris, full of mischief...
E pluribus sanguinem
3) People think ... ...
4) People think
0) People didn't think.
Oh wait, this is redundant to one of the existing replies. Sorry for wasting your time guys.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The first polymorphic file-infecting virus that saw wide dispersion was DAV (Dark Avenger), back in 1991. It was detected just fine.
Not all virus detection is performed via signature-checking. In the case of Dark Avenger, McAfee used curve-fitting. A histogram of the frequency of various byte values in specific locations within an executable file was generated, and a frequency-distribution curve generated from that. This curve was compared to the curves of legitimate executables and to what the DAV virus tended to create as it altered the files it infected. How well the curves matched, and where any anomalies in otherwise-perfectly-matching curves were, became the basis of determining confidence that there was a"hit". This technique proved to be extremely accurate, moreso than string-matching. While false-negative (failed detection) and false-positive rates were never perfect, they were in the "many 9's" of accuracy. In many cases, this heuristic was more accurate against DAV than string-matching was against other non-polymorphic viruses
Point 1 is incorrect. Heuristics will often pick up a 0-day virus, as will behavior-based (anomaly detection) systems. String-based virus detection is only a part of modern antivirus products.
Point 2 is incorrect, and has been for 20 years. Polymorphism is no more a perfect virus cloaking mechanism than antivirus software is perfect malware defense.
Points 3 and 4... no antivirus software will ever stop infection if the user explicitly grants permission for something to run. There is no functional difference between malware and legitimate software; everything that malware does (from a functional perspective) is something that some piece of legitimate software or another can do. Malware is defined by deception, not function. Antivirus software does not detect deception, nor should it be expected to.
Point 5... yeah. People expect magic bullets. People demand perfection for free. People can go fuck themselves and their slimy little tort lawyers.
And... stack-based exploits are not viruses. Antivirus software is not intended to defend against such attacks.
But yes, all applications should run in their own sandboxes, memory-wise, file-system-wise, privilege-wise. This isn't a perfect defense either, as the software which attempts to enforce the sandbox is itself subject to attack. And there are many components of a system which are user-installed but are not sandboxed (device drivers, maintenance utilities). As long as operating systems and applications are architected as they are, there will be vulnerabilities which are deception-based. The only defenses there are education and reputation.
Everybody gets what the majority deserves.
I get real tired of this one. This naive geek idea that OSes can be made perfect and somehow immune to viruses. News flash: They can't, at least not if you wish to keep the ability to run arbitrary code. The only way to make an OS safe against viruses is the Apple "walled garden" idea where only authorized apps run. Even then, you could potentially sneak something by the authority that says if apps are ok. However so long as you can run arbitrary code, you can run evil code. There is no evil bit, the computer will execute anything it is given.
Please remember when talking about malware as opposed to worms you are talking about stuff that comes in to the computer through user action. It is bundled with an application, or is an app all by itself. The user downloads and runs it. There is no patching against that.
Also you have the silly idea of "if something isn't 100% effective it shouldn't be used." Bullshit. Look at security in the real world some day, where there is no such thing, ever, as perfect security. You get used to the concept that everything is fallible and you need defense in depth. Virus scanners help provide that defense in depth. They scan incoming things for known threats (by the way good ones are updated more than once a day). It is not your only line of defense, but one of them.
Run a virus scanner, and run as a deprivledged user, and patch your OS, and make sure to get software from trusted sources, and monitor your system, and so on. Don't have a defense, have layers. Only then do you have a real security solution.
PS, web executables can be sandboxed on Windows, IE does this, other browsers just don't care to use the interface to do so.
even then they can still F* user data and maybe even infect data files.
A very good article about ... nothing.
Ah, sorry, Symantec is good for you! how could I have missed that?
There are two things from AV which are useful:
First, is catching non zero days. A machine gets infected at an AV lab, someone finds the culprit, and pushes out an infected signature library. This at least forces malware to have to be polymorphic or at least change with each push out.
Second is a host intrusion protection system. A HIPS is a good thing to have to catch unknown things. For example, if a game started wanting to read and erase everything in the home directory, or Excel wanted to make low level hard disk writes to the MBR. Heuristics are a very useful tool, especially when combined with whitelists.
However, against 0-days, which most drive-bys tend to be, I have found blocking ads far more effective than any AV program out there. Because ads are an ecosystem that allows for content without having to do microtransactions, in return, I try to donate something or purchase a subscription at the sites I go to. This way, the provider gets cash even though I don't see their ads, and I keep my security.
How many infected windows installs have you found where Norton took a head-shot, or some kind of AV *was* installed at one time but got smoked?
Normally it is because the AV subscription hasn't been paid up. I don't think I have seen an infection on a computer with a working anti-virus.
Then again if you are basing this on Norton, well yea then All AV's are crap if you only judge it by Norton, they may have name recognition, but that is about all.
Don't know something? Look it up. Still don't know? Then ask.
Then these must affect OS X.....
I suppose we should be thankful he didn't go for something like:
These Darwinian forces are causing an acceleration of Moore's Law in the prevalence of super-intelligent malware.
sigh.
If you're wondering what they're talking about you should watch this video. http://www.youtube.com/watch?v=54XYqsf4JEY
For a demo, see the 38:00 mark. The windows "calc.exe" is modified to simultaneously a valid windows exe, a valid zip archive, and a valid PDF. The same file can appear benign to anti-virus tools even though there is malware contained in the file when interpreted in certain ways.
-molo
Using your sig line to advertise for friends is lame.
that would hurt the economy, stupid! lol
Symantec and the AV industry is actually fueled by fear. Every real threat costs them money. Those are jobs that need actual work to overcome. Or at least enough to placate their customers. False threats, scaremongering, and the general fear of malware is what makes money in the AV industry.
Best clean-up I ever did was a Norton install done by my father-in-law's 'computer guy', complete with trojan masquerading as a key generator.
So long, and thanks for all the Phish
You hit the nail almost on the head. I work in IT, and I see a lot of dumb stuff happen because people trust their computers to magically keep them safe.
AV software usually has features that plug some of the holes - like blocking IRC communication, or preventing execution of attachments, or things in temp folders, or things on network shares. You have to configure it right. That's not a skill most users are going to have, unfortunately. The overhead of doing all this can be pretty intense sometimes, too, which makes people say "forget it, I'll take my chances so I can get more work done."
There's also something to be said about configuring your OS right. Most people are totally unaware of group policy (on Windows) and wouldn't know what most of those settings do. But if you set it up right, it prevents a large amount of malware from working, straight up. The same goes for updates. People get really lazy with those - Conficker spread more AFTER the update that closed the hole was released. It's still out there, too.
Things happen because people happen. It's not really doable to educate everyone, since we all know we'll take shortcuts when we see them.
You wonder why these things aren't optimized for security by default, but I think the answer is that they set them to something that strikes a balance between compatibility with the most software, and the current security environment upon release. Maybe it would be a lot better if Microsoft were to update group policy to meet the current trends via Windows Update... I'd almost support silent updates, if it wouldn't cause such a backlash.
I guess that's why infosec staff is so useful, right?
A bait car with cameras, remote control, and remote locking? Where can I get me one?
Between the spam and viruses, perhaps the time has come for some sort of digital postage? Its been discussed and shot down before but its reached a point where the ongoing costs of fighting spam, viruses and malware are outpacing previously proposed pricing for emails. It just seems ridiculous that I end up spending so much time and effort with my clients just trying to keep up with idiots who want to fuck up peoples computers and dealing with the ignorant (who admittedly shouldn't have to know all about that kind of crap) who find new ways to get infected on a seemingly weekly basis. Its not my favorite idea but what else can be done?
you can uninstall it, delete it, manually remove it from the registry, use specialized tools, and even beg for the authors to provide help , but BAM there is a fucking windows installer asking you to insert the disk every time you fart
I assume you don't lock your doors or windows when you go out then? Afterall if somebody wants to burgle your house they'll just smash a window or break down the door anyway, so there's no point locking everything.
I've seen plenty of infected Windows machines (XP, Vista and Win7) running AV with current subscriptions. Granted, they often haven't installed patches or they're doing file sharing and running IE but AV doesn't make you immune. Ironically, most of the infected machines are running McAfee or AVG/Avast. Occasionally we see a machine with an updated version of N360 or IS2011 or the like but thats rare. I've honestly NEVER seen one with Avira or MSE come in
1) thats why you wait for a week or two while someone else trains the AV.
2) some things stay the same, it still has to infect to be a virus.
The real solution is to start sentencing these malware writers to a life as a pc tech for a poorly funded state agency without possibility of vacation.
Since you're in the middle of nowhere, the cost of losing your car is ever so much greater. Therefore, it makes sense to protect your car. Cost/benefit.
You can lead a horse to water, but you can't make it dissolve.
There was a guy in one place where I worked who would constantly click on shit he shouldn't have, and so a lot of time was spent helping him out. He got infected by one trojan that had a chopped-up payload, so when you got rid of the main program it would just piece it together from bits scattered over the drive, registry entries, etc. on reboot.
Someone in the office probably gave it to him. It was insidious.
This is why you don't open or look at non-plain text documents unless you're absolutely sure you know what you're doing. Especially if that document comes from someone over the internet. This isn't just with PDF files, but any kind of file/document that allows embedded scripting. This basic security flaw has been known about for ages (20+ years and little has actually been done to stop the problem), and yet people still continue to ignore these very obvious red flags.
I mostly agree, with a few remarks however:
OR, as I call it, "layered security". I, & others I know that do the guides I have written since 1997 online (& before that) for Windows do well using it (I haven't had a "malware-in-general" infestation since 1996 in fact because of it):
"You get used to the concept that everything is fallible and you need defense in depth. Virus scanners help provide that defense in depth. They scan incoming things for known threats (by the way good ones are updated more than once a day). It is not your only line of defense, but one of them." - by Sycraft-fu (314770) on Tuesday July 26, @02:24PM (#36886646)
Correct, & they all "compliment one another" + tend to make up for each others' "shortcomings"... because "layered-security/defense-in-depth" IS really the best thing we have going... IF you take the time to implement it.
On Windows NT-based systems of "more modern varieties" (ala 2000/XP/Server 2003/VISTA/7/Server 2008), that takes about 1-2 hours of your time, albeit gaining you YEARS of uptime into the distance as your "ROI" for effort expended...
This takes time, but it's well worth doing if you value a stable long-term setup of a computers.
This means:
---
1.) OS & app patching conscientiously
2.) Updating antispyware/antivirus
3.) ONLY using java/javascript ONLY WHERE IT'S ABSOLUTELY NEEDED ONLINE (think ecommerce sites), as well as the same for frames/iframes/plugins to browsers
4.) Email in TEXT ONLY
5.) Securing rights to filesystems ACL/MAC-wise
6.) Securing group & local system security policies (which are NOT setup as strong as possible by default mind you in shipping OEM init. default setups by the makers of them)
7.) Disabling unneeded potentially "dangerous" services that establish "listeners" on the internet (thus, possible "handles" to grab for illegal ingress)
8.) The use of custom HOSTS files (for both speed & security, more on that below)
9.) Using filtering DNSBL utilizing DNS servers to compliment them (more on that below with examples of DNS servers that do that)
10.) Firewall rules tables (both in routers &/or software firewalls in combination), if not also the "poor man's firewall" of IP filtering @ both the TCP/UDP portions of the IP stack.
... and more...
All of those measure work on a very, Very, VERY SIMPLE PRINCIPLE TOO:
"You can't get burned if you don't go into the malware-in-general kitchen", or better yet "If you don't get in bed with the devil, you can't F**** & get impregnated by he" either...
That, along with educating users is the most important part!
(This last one, it is the most important part imo, so they understand as best they can in laymen's terms when possible, on HOW/WHY/WHEN/WHERE malware-in-general works on them to steal their information or money, or to enslave their systems for nefarious purposes, etc./et al!).
---
To "immunize" a Windows system thus, I effectively use the principles in "layered security" possibles!
I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:
http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text
& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.
That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online:
http://w
This kind of malware has been typically found inside an executable within an attached ZIP file disguised as a PDF file.
Is the zip-file attached to an email?
How the heck can a zip-file be disguised a pdf-file?
Why does it open as zip-file if it is marked as a pdf-file?
Why does an exe-file run if a zip-file is opened?
Is this some kind of microsofty-windowsy-thing, because I know of no OS or email-application where the above could happen and I have used a lot of both (but I have very little recent experience in using Windows (except w95))?
What user does the login validation process run as, then?
Either way, I'm thinking he needs some time in a SDLC class
Free will is an important part of the experiment. Is the SDLC teacher going to encourage God to leave out free will next time?
Finally, some malware writers with class.....
Many of the malware packages which are out in the wild, successfully infecting people, are kit-based. If someone uses a virus construction kit, it's pretty easy to detect anything created by that kit. The reason that these script-kiddie packages work is that people don't patch and don't keep their AV software, if they have any, current. Given the large number of people who fall into that category, polymorphism is irrelevant, and if you can fool (or numb) someone into clicking Yes on Grant Admin Privileges, nothing in the world is going to save that person.
So, unless a malware author is good (most aren't), or is targeting a specific organization, they just don't care whether AV catches their package, because they won't be coming into AV often enough to matter.
Contrary to what a sensationalist press corps would have you believe, there aren't that many people capable of writing original, robust viruses or exploit packages. The ones who do tend to be on the payroll of large organized crime groups, and don't release their code to other would-be botnet herders. When something new and effective does come out (which isn't all that often), it will spread quickly, but it's just the one package.
Having seen first-hand from my time working at McAfee and a not-named-here IDS company, I can say with certainty that the overwhelming majority of infections use a small handful of vulnerabilities which have been known for a while (count the number of variants of MS-06-040 sometime) and simply aren't being patched. Headline-grabbing new hotness is always interesting, but people who don't patch their systems will be equally vulnerable to legacy exploits (so the new exploit is irrelevant), and people who DO patch their systems will quickly become protected as the AV vendors and OS vendors provide a solution once the exploit gets noticed.
Note also that application-based exploits (browsers, Flash, Adobe Reader, etc.) are becoming the dominant means of exploit. OS vulnerabilities are still out there, and in large numbers, but it's the applications that will get you... particularly for targeted attacks. You can tailor an exploit-document to look tempting to your target, and even folks who patch their OS (or let it autopatch) don't always stay on top of application patches. Sure, you patch your browser, but how often do you patch your office suite? How do you know you need to?
As for polymorphism... yes, it's the decryptors (even the obfuscated ones) which are detectable. Have been since 1991. And as I said, it's not signatures that give them away.
I have "just tried it". Got the paychecks to prove it.
Everybody gets what the majority deserves.
So, by way of experiment, we're going to put two naïve naked people, wired for curiosity, into a lush garden, tell them to eat anything except for one thing, and when they (predictably) eat the verboten thing, jump out from behind a bush and yell "gotcha!". Then let them be cursed with painful childbirth and early death. And not just them, the perpetrators . . . but also the countless generations of progeny they've been ordered to put forth (miraculously, since they have only themselves as a breeding population . . . oh, except for those unexplained people in Nodland to the East) until the experimenter gets tired of it all and wipes the program . . .
This sounds less like an experiment, and more like a soap opera written by the Marquis de Sade and directed by Alan Funt.
As for what an SDLC instructor would tell 'god'? Probably, "Do module testing instead of trying to debug the whole system."
Raoul Mitgong: Unhelpful.
So, by way of experiment, we're going to put two naïve naked people, wired for curiosity, into a lush garden, tell them to eat anything except for one thing, and when they (predictably) eat the verboten thing, jump out from behind a bush and yell "gotcha!".
That was God saying "Have it your way." The goal of this experiment is to prove that Satan's idea for how to manage creation is unworkable. Sometimes you have to break a few eggs to make an omelet.
miraculously, since they have only themselves as a breeding population
Before the population bottleneck caused by the great flood of 1656 A.M., inbreeding depression wasn't a problem.
As for what an SDLC instructor would tell 'god'? Probably, "Do module testing instead of trying to debug the whole system."
This is a module test. I believe tests of other modules are happening on other class M planets in this galaxy. The coming system of things is even grander.
And... stack-based exploits are not viruses. Antivirus software is not intended to defend against such attacks.
Then antivirus software is pretty pointless today, isn't it? Because botware using exploits seems a lot more prevalent these days than old-school "infect every .COM file on my 5.25" floppy disk" viruses.
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
And, in the case of the OS &/or drivers? Also memory/process accessability...
That being the OS + drivers having said access, to Ring 3/RPL 3/Usermode code!
Yes - & this is WHY a driver-driven rootkit is SO dangerous:
It can even bypass object-oriented code protections too (that's right, because drivers have access to ALL MEMORY in usermode, or else you couldn't for instance, use your keyboard even).
E.G.-> A former professor of mine in academia years ago, was telling us all about how "good oop is" for memory protection, & he was "ex-Navy" (which matters here) - I pointed out that Naval subs were infiltrated by driver-driven malware, & for THAT VERY REASON (to bypass ADA &/or C++ oop design memory protective schemes)... he had to admit I was "spot on/top marks" on that in fact, though I suspect he was "loathe to admit it"...
However - There ARE experimental OS' out there, like MS' "singularity" iirc, that implement the other "rings of access" & .NET runtime driven protection, but as long as things run from Ring 0/RPL 0/kernel-mode privelege even THAT is useless for the MOST part, because OS & drivers can "peer into" anything, & why tools like ProcessExplorer can even be deceived by such machinations, via API call intercepts & redirections!
(Now, as far as Ring 0/RPL 0/Kernel mode level of privelege? Well, iirc, ONLY the "debug" privelege is higher)
Thus - You have what you complain of, & also what I noted in drivers being used maliciously (only thing more "dangerous" would be firmware implemented malware, & that's been coming out for years too)...
APK
P.S.=> I did my 1st presentation on computer security back as far as 1984 in collegiate academia, & the conclusion of myself & my group? Well, simple:
"What one man can secure & lock down, another man will unlock & unsecure, eventually..."
It's a "cat-N-mouse"/"Cops-N-Robbers" game, & always has been + will be... this, is life!
... apk