Slashdot Mirror
Scanner Identifies Malware Strains, Could Be Future of AV
An anonymous reader writes "When it comes to spotting malware, signature-based detection, heuristics and cloud-based recognition and information sharing used by many antivirus solutions today work well up a certain point, but the polymorphic malware still gives them a run for their money. At the annual AusCert conference held this week in Australia a doctorate candidate from Deakin University in Melbourne has presented the result of his research and work that just might be the solution to this problem. Security researcher Silvio Cesare had noticed that malware code consists of small "structures" that remain the same even after moderate changes to its code. He created Simseer, a free online service that performs automated analysis on submitted malware samples and tells and shows you just how similar they are to other submitted specimens. It scores the similarity between malware (any kind of software, really), and it charts the results and visualizes program relationships as an evolutionary tree."
Not really, heuristic analysis means looking for specific patterns in code or other data. Things like the program setting himself to start at bootup while deleting itself from the initial run location and so on.
What this guys does is divide the code in small pieces and comparing those. The thing is I know for a fact that AVs today already do that so unless he has some really smart way of analyzing those "structures" his research is too late.
Disclaimer: I used to work at an AV company and actually I used to work on the part of the product that does exactly what this guys does.
ics
is to determine how many false positives this thing detects
Tested the Gmer rootkit detector, AV doesn't report it as malicious but heuristics does. And also,
The following cluster is related to your sample. The similarities between your submission and samples in our database are shown below. If one of the listed variants in the cluster is malicious, then it is likely that your submission is malicious also.
Cluster [W32] [Trojan]
Similarity Filename Hash AV Results
0.734592 aedbfccbfbbddcbebbcbcadf ed839568ee1c2906ea0b42612d04f6bd BC.W32.Xpaj
0.718620 deafabbcffdbdcefecffeea 151d4e03f8ffc6adc50facc2e561dab7 BC.W32.Xpaj
0.714916 bcdadffaecdeaefbdbcaccdfed f74f33bcdcff1e97048f2576abb03467 Win.Trojan.Agent-39884
How "likely" ?
You misconstrue the nature of the battle. It is not against malware, anymore than a modern war is againsts guns and bullets. It is against the malware authors. Yes, some variant of "malware" can always be imagined to succeed against any software-level security. But the vast majority of that hypothetical malware is completely irrelevant because no one is ever going to write it. What is missing from consideration is the time and money invested into making the malware work, to how long it is effective, and what the financial payoff will be. The more you increase the burden and reduce the payoff, the more you have shifted the balance toward the good guys. More flexible malware identification mechanisms are big wins not because they are undefeatable but because they make the bad guys work harder. And, as a matter of fact, if you can generalize malicious code based on a few samples, you can effectively have the bad guys working against each other. (Virus 1, using exploit, is successful, second guy notes virus 1's success, analyzes it, produces virus 2 using same exploit, virus 3 also uses same exploit; based on comparison of three viruses, database is able to identify common exploit and innoculate against all subsequent programs which would otherwise rely on said exploit.)
When things get complex, multiply by the complex conjugate.
Except the analogy is crap. If you have found an exploit, that means that the software it is attacking is faulty. The proper solution to that is to fix the broken software, not to add more complexity in the form of AV software that itself is likely to contain additional vulnerabilities. That is particularly true given that there is this apparently little-known result from theoretical computer science called the halting problem that implies that equivalence of programs cannot be decided in the general case - whereas known vulnerabilities in software can actually be fixed, and fixed in a way that is 100% reliable.
This. As soon as any AV product starts to actually work, the writers will change the virus until it doesn't.
AV products are 99% snake oil.
No sig today...
The future is and always has been and always will be white lists.
Nearly all anti virus software works on the premise of the blacklist. That is there is a list of hundreds of thousands of malware and virus code snippets and if the AV sees some it flags it.
The white list works in the opposite direction. All VALID code gets approved. If it isn't on the list then it gets flagged.
Some people will say "but what about my indy software that isn't on the global white lists!? Well, for one thing we'll assume that the process of getting your code on the white list is no big deal. Under that system it is in everyone's interest to get as much approved code on the white lists as possible so as to make the black listing system which is terrible that much less attractive. That said, you can always approve the code yourself. Tell your home AV system that you vouch for that program and move on.
Uninformed users would be encouraged not to EVER do that since they don't know enough to really have a valid opinion. But power users, programmers, and IT experts obviously should be able to tell without a scan.
White lists. Its how the iPhone is effectively protected. Want people to download your product? iTunes has to approve of it. Doubtless itunes gets scammed occasionally but its nothing compared to what would happen if the average user was installing just "anything" on the machine.
White lists are how AV should work. Top to bottom. Forget blacklists. They're bad.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
I don't know why this post would receive a -1. I agree with the poster here.
A: What this researcher is doing is nothing new. He's, once again, taking something old and presenting it as new. AV software has long had methods of detecting similar threats based on a few samples of previously known threats and the algorithms and methods they used are no different than what this person proposes.
B: The best solution to a vulnerability is to patch the vulnerability in the software.
C: People can try to find all sorts of ways to disable the anti-virus. The AV may detect against one method after which someone may find another.
If the AV has to detect a broader range of problems it will either take longer or lead to more false positives (or both). Fixing the vulnerabilities and ensuring an operating system that's much less susceptible to intrusion (without compromising useability) and allowing the AV to only detect the problems that are more difficult to otherwise fix is a better solution than letting the AV do what the operating system should already be doing.
Operating systems have been getting better though. Operating system files are generally digitally signed and my operating system will not allow me to delete or modify operating system files within Windows which, if implemented correctly, can make it more difficult for a virus to embed itself into the operating system.
The biggest problem, really, is user error. and that's something that can be difficult to correct.
1. The iphone thing was just an example of a default white list system. It is a computer. I can literally run windows XP on an android and the iphone is easily as powerful. So its as much a computer as anything.
2. I was not suggesting it be done the same way as the itunes system. I hate itunes too. The point was to control application access through a white list system.
3. Browsers and office suites can do the same thing with the white listing. Certain websites with certain bits of java code would be allowed. Code not approved on sites not approved would not be able to run it. Same thing for some of the hacks involving excel spreed sheets or access databases. Permit the ones known to be good, allow the user to allow ones they know are good, but otherwise deny them code privileges.
Beyond all that, we should have more sandboxing.
The program "sandboxie" is quite popular. Make that a more standard feature of most programs and operating systems so that while code might be allowed to run it isn't actually given control over anything. It THINKS it has control and it can access a facsimile for whatever it wants but actual drivers, system settings, and file system assets remain unchanged.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Even the java exploits out there are generally used to inject native executable code as malware.
I see. If you believe that AV products are useless, what would be your suggestion of a solution to preventing and detecting malware?
No you're not getting it. Currently, any decent malware released right now will not be detected by AV products. AV vendors will get hold of a copy of the malware, tweak their dictionaries, and a subsequent update will detect the malware. Running AV products is a good idea because they will detect malware not too long after the malware is released, but TFA changes nothing about this.