Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware:
- Signature-based detection
- Heuristic analysis
- Sandboxing (for the files that go through the filtering of 1. and 2.)
At first it seemed to me like a great idea, especially the sandboxing smart features that may be able to detect delayed execution, virtual machine countermeasures, encryption and more.
Then a way to bypass those detection techniques came through my mind, so I tested it and it works against every antivirus I tried and probably on any one relying on those techniques:
What if the malicious code is encrypted in an innocent looking file with a pass phrase that will be known only by the victim (who is completely unaware of it of course) and that'll be needed to decrypt the malicious code and run it at execution time?
Let's say some malicious code is encrypted using AES256 encryption function with a specific pass phrase. Then the encrypted resulting string is put into a JScript file that contains the instructions to decrypt it once the user type the pass phrase and run it through an eval() function at runtime. There is no way for the antivirus to know nor guess the pass phrase right? And no way to know there is malicious code hidden inside that JScript file. And since it'll be decrypted in memory only at runtime, without ever being written on the disk, signature-based detection and heuristics analysis will fail. Same for the sandboxing since no malicious action will be triggered without the user typing the pass phrase.
Now to make the user type the pass phrase, a simple kind of Captcha may be used, that asks the user to type the words he sees in a picture (or ASCII drawing for example ^^) in order to make sure he's not a robot. Then when the user will type it, the malicious code will be decrypted and executed.
How would one defend against this sort of attack? Perhaps an advanced antivirus using deep learning techniques might be able to detect it, but it seems to me that current antivirus programs are completely vulnerable to it.
Updated: code sample illustrating the above technique
Here is a simple implementation in JScript :
var encryptionFunction = ; // Any encryption function, e.g. AES256 from CryptoJS
var hiddenCode = ; // Write any code here, e.g. WScript.Echo('My code has been executed !');
var passphrase = "Any pass phrase"; // It'll be used as a CAPTCHA challenge-response, e.g. picture with the passphrase or ASCII drawing
var encryptedCode = encryptionFunction(hiddenCode, passphrase); // Our hidden code will be encrypted with the passphrase
var template = "var decryptionFunction = ;" + // The decryption function is defined here
"var passphrase = InputBox('Your CAPTCHA challenge goes here');" + // CAPTCHA in an Input Box, user's input = passphrase
"eval(decryptionFunction('" + encryptedCode + "', passphrase))"; // Decryption of the encrypted code thanks to the user's input and run at execution time through eval()
var file = ; // Create a new JScript file (or WSF) and put the template as its content
08/04/2017 - Proof of concept + Antivirus scan
I have added a proof of concept:
It's basically a simple WSF file that will display a window asking for a password, hidden in an ASCII drawing. Once the user types the correct password, the encrypted code embedded inside the file will be decrypted and executed at runtime, displaying a mere "My code has been executed !" inside a window.
As I thought, the decrypting routine wasn't considered as malicious by any antivirus on VirusTotal (0/56), here is the antivirus scan: