1

Newer malware might not be detected, but if files are older, is it more likely they are clean when scanned with anti-malware scanners that have newer updates?

For example files that are few months old and files that are several years old?

How likely is that some old malware might still lurk in them and even newer updated scanners won't detect anything?

  • 1
    of course. scanners only find things they know about, and the longer something has been in the wild, the more likely the scanner knows about it. I've not heard of scanners forgetting, though they may stop checking for say, win98 exploits on a win10 box... – dandavis Jan 19 '17 at 18:51
  • @dandavis Basically not checking things that can't be harmful in new systems anyways? – Haccckkku Jan 19 '17 at 18:56
  • even if something thought to be outmoded "re-emerges", presumably the next scanner update will patch it, so the claim "older data + newer scanner = safer" still holds. That said, i've not heard of any malware resurrections. – dandavis Jan 19 '17 at 19:00
1

Antivirus vendors and administrators tend to disable scanning routines and pattern detection for older malware generations. They usually do this for performance reasons. The legitimization is, that old malware might be eliminated anyway in the meanwhile because there were so many detection mechanisms established for so long which would make it impossible for an ancient malware to survive. I did an analysis of the default protection filters of HP TippingPoint and revealed the same in the IDS/IPS sector.

The problem is, that the reasoning is wrong. Older malware might have survived because everyone thought it is extinct. There is a similar problem when it comes to vaccination.

Besides that it might be possible that an attacker/malware manipulated the timestamps of a file. Without integrity checking you can't tell if this really is the file that you expect it to be since an earlier point in time.

-1

A fundamental theorem of theoretical computer science goes like this: Let π be a non-trivial predicate of programs. Then for every algorithm A that, given a program's description P as input outputs π(P), there are inputs for which A cannot terminate in finite time.

A trivial property is one that is either true or false for all programs. Since some programs are malware and some are not, whether a given program is malware is a non-trivial predicate. Given that, no perfect malware analysis tool can exist from a theoretical point of view. In practice, this meas that there inevitably will be an arms race between authors of malware and malware detection tools. Give any one party additional time to advance in an arms race while its competitor is forced to stand still and it will eventually gain a strategical advantage.

I think that this also is the unwritten premises of your question. And I cannot doubt it. However, nobody in their right mind will tell you any specific numbers how “likely” it is that a file analyzed by any given tool does not contain malware.

Since a general approach to malware analysis is theoretically impossible, practical tools use a mix of different heuristics. One technique is to use a database of known exploit patterns. Obviously, such a database can only contain patterns that were known at the time. Consequently, a newer analysis tool will profit from patterns detected in the time between the malware and the tool were released. Of course, nobody can know how many patterns have not been discovered yet. So the best we can say is that tools likely won't become worse as time progresses. This is not too strong a statement.

In rare cases, authors of analysis tools might remove patterns from their libraries because they are causing too many false positives, are too inefficient or the exploit is believed to be obsolete. The time a user is willing to invest into running an analysis is limited and tool makers have to spend that budget wisely. On the other hand, computers tend to become faster over time so more complex analyses become feasible.

Besides looking for known patterns, analysis tools can also look for more general suspicious signs. These analyses might also find malware that was not specifically known to the tool maker beforehand. It is to be expected that – as time and technology advances – these heuristics become better and will find more malware. It seems unlikely to me that a vendor removes a working analysis from their tool but of course, regressions do happen in practice. Malware analysis tools are just software like any other and the people writing it do make mistakes.

Perhaps the strongest advantage you have against old files is that the vulnerability they were exploiting might have been fixed in the mean time. Of course, you can only harvest this benefit if you're using the files in an environment that has received updates in the mean time. It is likely that some vulnerabilities that were exploited by malware at one point in time have since been fixed. Of course others might have been introduced but it is very unlikely that a file contains a working exploit for a future vulnerability. Usually, malware authors approach their targets with a lot of intimate knowledge and you cannot know something that doesn't exist yet. Be aware that not all malware works by exploiting vulnerabilities, though.

An unconventional but not entirely implausible exception to the “analysis tools become better as time progresses” rule happens of course if tool makers deliberately cripple their products. They might do so because of government pressure or other questionable reasons. Given that most malware analysis tools are proprietary software, few people actually know what they really do. And those who do know more likely than not won't tell you.

What you can always do is analyzing a file with multiple analysis tools (old and new) and thus enhance your chances that some of them will find something. Be warned, though, that analysis tools may also contain bugs and malware that specifically attacks the analyzer is not unheard of.

Above all the theoretical considerations, there is always the practical question what you actually consider to be malware. If a web browser sends logs of your activity to advertising companies, I would certainly call it malware and refuse to use it. Other people might not. In the end, no tool will be able to make that personal decision for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.