Slashdot Mirror
The Malware of the Future May Come Bearing Real Gifts
An anonymous reader writes "Research by Prof. Giovanni Vigna of the University of California leads him to believe that the malware of the future will come in a friendly form, be genuinely useful and may not reveal its intentions for a protracted period of time. Prof. Vigna, speaking at IP Expo in London, outlined a fearful future of 'mimicry' in evolved strains of malware. In the current stage of the war between malware and security researchers, the emphasis is almost entirely on the attempt to convince increasingly intelligent — and increasingly suspicious — malware that it is operating in a bare-metal environment when it is in fact in a sandbox or VM environment. For the malware, the stakes are tremendously high — if it has reached the point of OS-level execution without its hash being indexed and red-flagged by online security databases, it cannot afford to reveal its intentions in a test environment. This article outlines the extraordinary game of cat-and-mouse being played between researchers and hackers, and how future malware exploits are likely to abandon a rush for the buffer overflow in favor of 'the long game' — and to make themselves useful in the process.
It's already here. They're called smartphone apps.
Ever heard of Windows?
xkcd 810.
The article assumes that malware authors are willing to put in the effort required to produce quality useful software, and that the expense of such effort will be paid back through the exploit.
I think this is unlikely. Quality software is not that easy to make.
Research by Prof. Giovanni Vigna of the University of California leads him to believe that the malware of the future will come in a friendly form, be genuinely useful and may not reveal its intentions for a protracted period of time.
Some of it will even turn the American public library system into an infectious host. Adobe Digital Editions 4 scans your hard drive and sends some of the data it finds, in the clear, back to Adobe.
Stop-Prism.org: Opt Out of Surveillance
Adobes already doing this! They're such an awesome company, leading the way into our Brave New World!
Reports your system as a VM to everything
Sigger than your average
I bet that software pirates already have injected malware in many warez, mainly heavy graphics games. Doing so they could discreetly control a lot of powerful machines.
What if I can convince malware that my bare metal is actually a VM? Then will the malware authors work as hard as they can to have their stuff NOT install on my machine?
AMD can't virtual its ass out of a wet paper bag.
There's a gift, which may be ongoing, but it has a nasty payload.
Never had either an STD or computer malware.
Paranoia is your friend, 'cause they ARE out to get you.
The NSA are one of their biggest customers
Is this guy new here or what? Ostensibly useful ("friendly", since TFS apparently wants to anthropomorphize software) programs that carry a nasty payload that doesn't trigger immediately? How's that any different from 20 years ago, when they were called "trojans?"
Wasn't Google set up set up (strike that), transformed to do just this? Along with Facebook and Twitter?
The Malware of the Future May Come Bearing Real Gifts
Malware you can't delete off your machine and that destroys your computer slowly, such as Symantec and MacAfee, have gifted users free trials for years.
There is a site, www.thebuddyforum.com that sells just such a thing. These are the obnoxious bots you see running around your favorite MMORPG, stealing your kills, farming gold, powerleveling, etc. They have to be sandboxed to hide them the anti-cheating tools, and have to run in environments without virus scanners because... they are malware themselves. (In an attempt to sandbox ones of these to get a hash to report to hackshield, my anti-virus software deleted the bot multiple times. Yes I had to ****ing whitelist a piece of malware just to report the malware to the anti-cheating tool company.) It was being triggered by the proactive rules , not actually being flagged as any specific piece of malware (W32:Evo-gen [Susp])
I hate these bots with a passion, and I probably hold the record on the server I play for bot kills. The bot software is written in C#, so you know these aren't hardcore hackers.
Now a bunch of players had their "bots" banned, and others are complaining on the game's forum that they've been hacked... gee ya think?
This is not the only bot software out there, but it is the most known.
Malware authors need only take their existing freeware "products" and put a timer in to delay payload delivery. I can conceive of several ways to do this with only minimal effort.
. . . doesn't mean that they're not out to get you.
Reminds me of the late 90s/early 2000s when millions of accounts for a german online service (T-Online) have been stolen - by 3rd party tool for that service that offered additional services including up/downing your connection (which was essential for those high, minute based rates back then. Butso it had your password, of course)
It was a PITA to convince people to stop using that tool because it was so usefull.
bickerdyke
You mean, like trojans inside apps since the 60s? This is a new low even for slashdot.
To protect yourself from malware, litter your system with artefacts that mimic sandboxes and virtual machines :)
It's called "Microsoft Windows(tm)(R)(c)"
Exceeding the recommended torque is not recommended.
They rape our privacy for their profit. Now they both happen to be extremely useful and this is their real gift. I'm not sure what the point here is, except that there's a fine line between malware and a $100b company.
We had the "useful" malware back in the 90's. It was called Bonzi Buddy.
"Well kids, you tried your best, and you failed. The lesson is, never try." -Homer Simpson
The Malware of the Future May Come Bearing Real Gifs
Any sufficiently modern malware produces it's instant gratification in the form of jpegs. Unisys patented porn is now mostly dead pixels and bears.
Useful malware? http://xkcd.com/810/
Mission fucking accomplished!
Some citations:
Transmission rates based on infected partner's progression stage
Risk based on type of sexual act
It is difficult to get HIV from a woman. Not impossible, but the odds are very low.
Well, not that low, only half the odds, according to study 2.
Now getting HIV from taking it on the butt, it is much more dangerous
Yup. 0.08/0.04 (vaginal) vs 1.4 (annal receptive). About 20x more odds.
And then black woman have a much higher rate of HIV.
Technically, its "women in poorer communities". It happens that in the US black ethnic are often at the bottom of the social scale due to past racial discriminations, etc. but even there they are not alone at the bottom of the scale.
On all this counts, Magic Johnson is not exactly the best example.
He might happen to also be ethnically black, but given his economical situation and popularity, I doubt that he spends his time banging crack-whores. So the fact that HIV is more prevalent among the poorest section of the population has probably rather little impact.
Also, for what I know, he was only interested in women, which lack the proper biological appendage to being a risk for insertive annal (though not properly clean sex-toys might still be a potential danger).
The main reason he caught AIDS are probably due to a high number of partners combined with lack of proper protection.
In fact Magic Johnson helped bring awareness that HIV isn't exclusively targeting drug-addicts and homosexuals.
To transpose that to malware:
the fact that malware are more often found at warez sites ridden with keygen containing hidden malware, and dubious porn site running ads used by hacker to corrupt your system, DOES NOT MEAN that these are the only way a random internet user might get the computer infected by malware.
on the other hand, proper precaution will ALWAYS be a good solution to protect and diminish the risks. (virus scanner, filters, malware blocker, ad-blocker, VMs, etc.)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I know, I'm an AC so what I have to say doesn't count.
But would anyone trust a program that maintains a VPN tunnel to its maker's servers?
Such as Teamviewer.
Oh no. It's a classical trojan because it does not even offer real merits as promised.
It started as one of my typical IT service calls: a Windows Vista laptop was clogged with malware and running slowly. I soon discovered that one of the major culprits was Conduit, a virus that wraps itself kudzu-like around browsers, making every Web page it touches into a hijacked slug. But the customer was running Incredimail, a mail client she loved and had been using for years. Apparently not long ago Conduit bought Incredimail and now requires that a certain amount of their malware be running to keep Incredimail going.
So black hats are going to spend a bunch of resources making something useful that a lot of people are going to want...and then break their system? Reminds me of when they defrosted Dr. Evil and right after he made his demand for ONE MILLION DOLLARS his minions were telling him their legitimate businesses generated $2billion last year.
Decepticons
Its called I-tunes.
My mother had a few of those. Some coupon app on her desktop that was actually advertised by her local news station for getting an aggregated searchable list of coupons available and where to acquire them. It did what it was supposed to. It also downloaded and installed additional applications and hijacked your browser (eg: toolbar search goes to their stuff no matter which option you select, added adverts to websites, and displayed popup ads with fake warnings)
anyone?
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
I think a bunch of these comments are missing the point here. There is a lot of "xyz software has some kinda useful tool, but also packages in a bunch of junk." The bigger threat would be if a useful tool that was running fine and earned your trust suddenly backstabbed you. Think of the old timebomb malwares that triggered at a certain date and time.
Imagine for a minute if every installation of notepad++ suddenly started dumping all pdf and doc files to pastebin. Or exporting database dumps to a CnC server that was spun up 10 minutes before the attack. Or wiped any hard drive it was installed on. How many sensitive systems in your environment would be affected?
If a malicious actor had the patience to wait 3 years for their malware to trigger, would your security testing be able to catch it early?
And I mean my subject literally. This is precisely how we ended up with mitochondria and much of the junk DNA in our genome. Some foreign invader played the long game so well that it just became part of the organism.
It will be interesting to see if we get to a point where the malware is so useful, that instead of cleaning it out we just find a way to keep the good parts.
Granted, that joke was old when I was young, but still . . .
I also just had to remove something like this from a friends PC. This was a Win 7 and what was interesting was that it was installed as a service. Had to disable the service, remove the folder then remove the service. It was quite well hidden and nasty not fun to get rid of.
Back in the late 90's following the idea of real pathogens favoring a long life for their hosts, we talked about how eventually computer viruses would do the same. We joked how they would be built to keep the computer up and running and actually have functions to make it do all the maintenance that normal users never do and that tech support (the jobs we were doing then) would actually advise catching certain viruses to solve hardware issues. This has just about played out. There have long been things like browser bars that while most consider them malware, some users do love them and will insist on installing them if removed because they actually like them. Even in the past, I have seen articles here on /. about how there has been Windows viruses that made the infected computer install needed Microsoft patches to make them safe from competing viruses. As the life of hardware is growing longer, one can expect malware creators to look for the long game and make their programs less conspicuous and perhaps even beneficial for the computer they infect, thus increasing the length that the computer will remain infected before being discarded or rebuilt. Like I said, we've already seen this.
Malware of the future is an institutionnal malware :
https://www.techworm.net/2014/...