For example, if a new rootkit starts spreading and reaches a malware honeypot, any skilled security specialist could get a memory dump of the system, find the malicious code and reverse engineer it, right? So what prevents known malware from being readily neutralized once they are launched?
-
@DKNUCKLES Yes, remember Stuxnet? :) Also small hacker(groups) use it to create botnets easily.– O'NielJul 12, 2016 at 14:23
-
@O'Niel valid point re: Stuxnet, though that was 6 years ago now and it used something like 4(?) 0days. The botnet is interesting though, I've not heard of that - thought they went the way of the dodo bird :)– DKNUCKLESJul 12, 2016 at 14:32
-
4Are you asking how malware protects its intellectual property (what the title sounds like) or how AV systems work on malware (what the question sounds like)?– Neil SmithlineJul 12, 2016 at 15:28
Add a comment
|
2 Answers
I think the easiest way to answer your question is that most malware is coded using Polymorphic Code and the majority of Anti-Virus still uses signature based detection.
The reality is that a good chunk of the population does not keep their software up-to-date which means the original attack vector could potentially be re-exploited with a different payload. A lot of people put a lot of thought and effort into prevention, however not many put it into detection so once a box has been owned there's usually an avenue to re-exploit.
answered Jul 12, 2016 at 14:17
Step 1, malware use code masquerade technique.
Step 2, malware creator will use scan their morphed code through local Antivirus search engine. If detected, they will repeat step 1.
It is a constant arm race.
