Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

These are not my lines they are by someone else on the internet. I also want to know is that malware that unique? How will it work in GPU and is there a way to sandbox such application?


1 More than 80% part runs only on GPU.......

so its useless to run that under sandbox

2 Around 90% of the virus is always in GPU memory......

To make the matter worse, you won't be able to debug that piece of does not use CUDA.....

3 The malware mutates in runtime, and that too, on GPU itself......CPU is not involved...

signature matching won't work....

4 The malware does not run as a process......

5 The malware rearranges its pieces in runtime......and becomes a full blown malware from an innocent piece of code.....

6 Different pieces of malware execute at totally different corners of system.......API Interception is not going to help.......not even at kernel level SpyShelter will fail

7 The malware uses MCR techniques......your security suite gonna raise a hell lot of false positives..... "

and how can we access GPU memory?

share|improve this question
An infected video driver? – schroeder Nov 5 '13 at 17:52

Malware can run mostly on GPUs to evade the detection by traditional approaches. One such proof-of-concept is provided in "GPU-assisted Malware". The authors demonstrate how to use General purpose computing on GPUs (GPGPU) to develop a malware which is self-unpacking and with run-time polymorphism.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.