Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

If a virus rewrites itself for each infection how would it know if it has infected a file or not? If it keeps infecting the same file soon the whole file structure will be corrupt. For example how does Simile or Sality know if it has infected a file or not?

EDIT: they can't check something simple like "if they append 'kkk' to the end of the file" otherwise AV's would check that and the whole purpose of being polymorphic/metamorphic etc. would be defeated.

share|improve this question
It's signed with the same root key, so it appends, e.g. md5 checksum at the end, which is a random string. Once the signature of the virus is known, it can be defeated, but until then, when you dont extract the private key or salt from the work, you wont be able to detect it. – Andrew Smith Jun 29 '12 at 19:47
1  
Malware writers usually bypass this problem by not caring that the file gets re-infected. They design it in such a way that it either continues to work regardless of infection count, or overwrites the existing infection. – Polynomial Jul 3 '12 at 15:18
An interesting idea is the virus could create a text file storing a list of infected files and if this text file isn't found it would assume it's on a new system and infect everything. – Celeritas Jul 16 '12 at 19:42

3 Answers

up vote 5 down vote accepted

Eric Filiol's paper Metamorphism, Formal Grammars and Undecidable Code Mutation pretty much shows that it can be made impossible for a virus to know if a metamorphosed copy of itself has infected a file. Sic transit gloria anti-virus.

share|improve this answer
The PDF link talks about ALUMINUM PANEL – Tal Aug 13 '12 at 11:23
1  
Theoretically you are correct, but in practice a virus don't need 100% detection of itself. – Tal Aug 14 '12 at 7:16
Changed the link, thanks for letting me know. Yes, maybe less-than-perfect detection works in practice. But the theoretical result shows that sort of thing turns into an "arms race". – Bruce Ediger Aug 14 '12 at 13:25
up vote 4 down vote

'kkk' would be encrypted.

An encrypted virus hides the virus signature (body) by encrypting the virus with a different key from infection to infection thus making it unrecognisable. A problem with encrypting viruses was that the decryption algorithm remains constant. The evil polymorphic virus counters this with a mutation engine that generates randomised decryption routines. The mutation engine and virus body are then both encrypted. (A metamorphic virus rewrites itself completely.)

So if they wanted to mark an infected executable with a string like 'kkk' they could (although there are much better ways).

share|improve this answer
up vote 0 down vote

Malwares do use simple marks.
I’ve seen one modifying file creation time, zeroing out the seconds part as the infection mark.

"...EDIT: they can't check something simple like ... otherwise AV's would check that and the whole purpose of being polymorphic/metamorphic etc. would be defeated."

Antimalware detection algorithm cannot depend on simple malware marks. The false positive implications can cause worldwide havoc.

share|improve this answer
but it could be easier to inoculate a system, in your example all files could have their creation times seconds set to 0s (admittedly in this case your loosing usage of the files created time) – Celeritas Aug 14 '12 at 7:05
I do remember such an approach was used against the first Ping Pong virus. But it only helps to avoid new infections. already infected files are left infected. – Tal Aug 14 '12 at 7:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.