1

For those who had windows computers when the WannaCry virus hit, how exactly did the virus bypass antivirus programs. I have tried to read some papers about this, but I don't understand how exactly that windows hole helped the virus evade antivirus software. Is this just a matter of people not having antivirus software, or did this virus somehow evade that?

0

Bypassing AVPs might be simple regardless of what is widely believed

The problem with "traditional anti-virus" is that they do not detect exploits or in memory malware which was the case of Wanancry. The SMB "hole" as you described it, was used -via EternelBlue (the exploit)- to execute remotely and in memory the piece of malware. This means:

It is almost impossible to protect against new malware that will use the EternalBlue exploit to propagate except when using next-generation endpoint protection with memory scanning capabilities and exploit detection. Traditional anti-virus without premium features or configured by default will not block the EternalBlue exploit.

Herer is a typical Wanancry execution flow:

enter image description here

  • Hello, your answer gave me some new information, as I was already aware of heuristic and signature based detection(sorry for not mentioning that in the question). However, can you elaborate on what endpoint protection with memory scanning is. Are there any papers? I am trying to understand the techniques to combat the virus in the first place. Thanks! – ilikeyoyo Aug 6 '17 at 23:23
  • I know what endpoint detection is, but I am confused as to how memory scanning capabilities are useful here – ilikeyoyo Aug 7 '17 at 0:20
  • I've found no paper on this but this is I think related to the detection of heap spraying, stack pivots, ROP attacks and memory permission modifications in addition to the detection of fileless piece of malwares... – Soufiane Tahiri Aug 7 '17 at 9:27
1

Antivirus software usually detect malware threats in two ways:

  • signature-based detection
  • heuristic detection

Antivirus software products did not have a virus definition or signature for WannaCry since it had not been seen before (previously undetected threat) being a newly created malware. So it escaped all signature based detection.

Heuristic detection relies upon observing active execution of a binary. For example, if an antivirus observes a virus scanning for and modifying or appending executables on a system, it would flag the binary as possible malware or suspicious. The way WannaCry works is by accessing specific crypto libraries on Windows (for the process of generating keys and subsequent encryption) and then scanning for common document file types such as DOCX, XLSX, JPG etc to encrypt. The antivirus heuristics engine fails to detect this as a typical malware infection. They will possibly add heuristic capabilities to stop ransomware as it is executing by observing its behavior some time in the near future. For example: https://www.wired.com/story/shieldfs-ransomware-protection-tool/

Also, as you mentioned, it is possible that a lot of users who got hit were not using a properly updated and effective Antivirus solution. If they were big on updating software, they would have updated their Windows OS and had a patch for MS17-010 Eternal Blue vulnerability.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.