-8

We are thinking to develop a new Antivirus program. The main concern is to create a virus signature database. I want to ask what is the best possible way to add viruses signature in our database to make it a strong DB. kindly guide us the best possible way.

Note: Its will in MD5

  • Your virus database is going to be in MD5? You mean you want to keep MD5 hashes of viruses? Then the virus writer need only change a single bit in each virus to prevent it from being recognized. – S.L. Barth - Reinstate Monica Feb 8 '16 at 13:27
  • 3
    @EllaBleu Viruses typically change their source code whenever they infect a new host. This would make your database useless as a means of detecting new infections, so your new antivirus program simply wouldn't work. – squeamish ossifrage Feb 8 '16 at 13:36
  • 2
    You're not going to be able to do stream matching a hash database. So your "anti-virus" software will also need a whole load of container format parsers (and it won't be very efficient). Given that there are good, efficient open source and commercial AV tools available, what are you trying to achieve with your proposed products? – symcbean Feb 8 '16 at 13:46
  • 1
    @EllaBleu This is far too broad to answer here, but I've posted an answer which I hope will help you avoid going down this dark path. You need to understand why you shouldn't do this. – Mark Buffalo Feb 8 '16 at 13:55
  • 1
    @EllaBleu No idea, you'll have to decide for yourself... but hashing isn't the appropriate route. It can work against common, static infections... but that's it. You'll have to use a lot of different methods. Can't help you on where to start, as that's beyond the scope of this website. I apologize. – Mark Buffalo Feb 8 '16 at 14:23
5

MD5-based anti-virus just doesn't work

MD5-based anti-malware works decently against static-infections that never change. If it changes even by a little bit, you're screwed. However, MD5 is also vulnerable to collisions, so you're going to have a fair share of false positives.

I wouldn't rely on this method at all. SHA-256 would probably be better for this task. However, that leads to the next problem...


"Viruses" can merge with existing executables

A bigger problem is that viruses can merge themselves onto an existing, non-malicious executable and make it malicious. The author can inject it into various places in the program and make the hash completely different every time.


Changing their source, or even recompiling the virus will defeat you

Not only that, but by changing the code just a little bit, you can completely avoid detection because you'll have a new hash every time. You'll have to add a hash for every possible change to every file, which just isn't practical at all.

Even if you could do this, how would you know that the file was malicious? Did you compare the hash to the one listed on the website? Well, with md5, it's possible to fake it by causing a collision.

If you want to go down the hash route, even if you found a hash algorithm that didn't have any possible collisions, then you would literally need a gigantic white list of valid hashes for all known legitimate programs. And then you would compare them against what they are.

Even if you had a good hashing algorithm, it's just not practical, or even possible.


What is is the best way to create virus signature database?

This is far too broad to answer here.

It's very difficult to create anti-virus software. Even though this post is off-topic, I'm responding in the hopes that you will not go down this dark path, as it'll only offer a false sense of security.

2

Mark Buffalo has already provided an good answer on things to consider. However, I'd like to expand on his answer with few solutions, ofcourse it's extremely broad question so by all means this isn't remotely close to an "best" solution. It's just things to consider.

I'll be making many assumptions based on this question and they will be:

  • The operating system your using is Windows
  • Your system architecture is x86 or x64
  • You've got an good understanding of Windows internals.

"Viruses" can merge with existing executables There are soo many ways on how to do bind executables.

Let's say we have "notepad.exe" as the legit program and "virus.exe" which is the malware. Virus.exe could write itself into the RAT (Resource Address Table) of notepad.exe and replace the OEP (Original Entry Point) with it's custom loader which will execute the malware code then run notepad.exe.

You can defeat this by reading the RAT and doing an .text PE signature.

Code Project - .Text Checksum

Keep in mind this can be defeated by metamorphic and polymorphism which the code is changed on each execution resulting in unique hash for the .text but is much harder to perform. Read through some of z0mbie's code on how it's executed and so on.

z0mbie - Sample malware code etc

You could only defeat this by extreme measures which I'm unaware of been automated, is things which execute in an squence which are malware related. For example, let's pretend DeleteFileW( L"C:\SomeImportantFile.exe" ); so, let's say the code is as follows:

MOV EAX, 0x12345
PUSH EAX
CALL Kernel32.DeleteFileW

Now in terms of efficency it will be slow but you could signature the PUSH EAX, CALL as it will always be same bytes and in your code read what values is held at 0x12345 as this memory address will likely be different.

Changing their source, or even recompiling the virus will defeat you From the above you'll able to get around this.

To cover other points which have not been talked about:

  • Dll injection
  • Code injection
  • SSDT hooking
  • Kernel patching

I do believe this question is more of an question for https://reverseengineering.stackexchange.com/ However, I believe it's too indepth to answer.

  • 2
    Good post. My response was mainly a warning against hashing files and relying on that. Also, I learned some new things here... +1 – Mark Buffalo Feb 8 '16 at 14:46

Not the answer you're looking for? Browse other questions tagged or ask your own question.