0

I've been reading a lot about how AVs use different heuristic methods to detect obfuscated malware and it seems like some of these methods are very time/processor intensive. For example, to detect encrypted malware AVs will sometimes emulate their execution and examine its memory after it has fully decrypted itself. I imagine it would be untenable to do this on every executable in a system and a malware with an especially long decryption process might be troublesome.

My question is, are AV companies equipped to defend against more-or-less any type of known malware out there or are there types of known malware that AV vendors simply choose for their products to not even try to detect because there is no efficient method to do so?

closed as primarily opinion-based by Overmind, Xander, MechMK1, Tobi Nary, Ghedipunk Jul 3 at 20:00

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • There is no way to detect all malware, not even all known malware somdetection is always an optimization game between time/resources and missing or false detections. – eckes Jun 30 at 15:13
  • Your question is opinion-based. AV companies today differ quite significantly from some 'not bothering' to dig into various complex stuff to some having very advanced adaptive countermeasures and on-line real-time threat detection capabilities. – Overmind Jul 1 at 8:32
  • @Overmind Can you explain to how on-line real-time threat detection gives the AV vendors such an advantage against obfuscated malware? I'm not very familiar with these capabilities – chillsauce Jul 2 at 21:45
  • I've put that along with some other things into an answer. – Overmind Jul 3 at 5:46
1

...that they simply choose to not even try to detect because there is no efficient method to do so?

AV does not specifically choose to not analyze some malware since it is too hard. If it would know up-front that this is malware but too hard to analyze than it could simply block it based on this knowledge.

AV simply has limited capabilities and therefore cannot find every malware. These capabilities are limited because the signatures and heuristics are based on knowledge of existing malware. They are limited because the user expects a quick response so that amount of time an AV can spend for analysis is short. They are limited because malware might show its malicious behavior only in specific environments and AV cannot simulate every possible environment. They are limited because it is not always clear if a specific behavior is just unusual or actually malicious - and the user does not like it if the AV blocks innocent software.

But AV or the programs calling AV (like inside a firewall) do usually choose to not analyze files which are unlikely to contain malware in the first place. These might be files of specific types, i.e. something which looks like an image although an attacker might fool the analysis system using polyglots. Or it might be files which are too large, although attackers can exploit this limitation by specifically hiding their malware in large files.

  • I'm sorry, the wording of my question is ambiguous, but I do appreciate the relevant information you provided. What I mean to ask is whether some known malwares would require such computationally intensive detection that the AV VENDOR would choose to not allow their product to perform the testing necessary to classify a file as that malware. I will edit my original question to make that more clear. – chillsauce Jun 30 at 14:48
  • @chillsauce: " What I mean to ask is whether some known malwares would require such computationally intensive detection that the AV VENDOR would choose to not allow their product to perform the testing necessary to classify a file as that malware. " - As I said, the AV only has limited time for analysis and can also not run the potential malware in every possible environment, i.e. the AV will stop after a while since it would be too computationally intensive to continue. And such limits gets actually used by malware to bypass AV. – Steffen Ullrich Jun 30 at 15:13
0

Well, yes.

As with any technical problem, you need to bound the effort you put into it. For example, AV could just be running a VM that replicates the host truthfully, and preexecute anything people download to analyze what it's actually doing. Not doing that is a deliberate choice. (Lesser versions of that are done, but, again, in an effort-limited way.)

Generally, AV is far from perfect – most detection simply relies on trivial signature matching, which hardly isn't virus detection at all, it's just "file checksum checking". Then, they added lots and lots of heuristics, but how far you take a heuristic simply is limited by the amount of data and time you have.

So, I'll go with

are AVs equipped to defend against more-or-less any type of malware?

Um, no. They're somewhat equipped to deal with known instances of malware, and to deal deterministically with some very specific behaviours, and heuristically with some narrow behavioural patterns.

That's not "defending against more-or-less any type", that's defending "against a fixed set of known, and a very limited set of behaviourally known types of malware".

In the end this is the decades old argument between "whitelisting good software" vs "trying to blacklist bad software". Everyone agrees that blacklisting doesn't work 100%, but whitelisting is mostly impractical for both usage and speed reasons.

  • Thanks for your response. A corollary question I have is that if this is the case, why don't malware authors always write malwares that are computationally difficult to detect? Would a reasonably skilled malware author be readily capable to produce malwares that, even after being found and analyzed, no AV vendor would choose to detect because of the complexity of their detection? – chillsauce Jun 30 at 14:41
  • Well, if that was easy, they'd do that. But then AV vendors would sswing and try to recognize these cases. – Marcus Müller Jun 30 at 14:48
  • So, at-the-moment are their any known obfuscation techniques malwares may try to use that AV vendors do not know how to defend against or choose not to defend against? – chillsauce Jun 30 at 15:06
  • yes, and yes. If that wasn't the case, there would be no new malware that goes undetected at first. Is that surprising? – Marcus Müller Jun 30 at 15:28
  • What I thought previously that the malware would go undetected only until it was found and a signature generated and distributed. What is new to me is the idea that there are currently malwares that even after being found and thoroughly examined, we still do not know how to detect them. – chillsauce Jun 30 at 15:34
0

AV companies today differ quite significantly from some 'not bothering' to dig into various complex stuff to some having very advanced adaptive countermeasures and on-line real-time threat detection capabilities.

While some still use a classic system and limit to that, others already have behavior detection, exploit prevention host intrusion prevention capabilities which make the AV solution much more than a simple classic AV.

As requested in the comment, I'll tell you a little about this new system some big AV companies use.

Additionally to the local database, anomalies are compared against a real-time powerful threat analysis system that is able to assess what something does. By observing how a specific thing reacts in multiple cases, the efficiency of such a system becomes very high as the analysis results end up to be very relevant. This is a lot quicker as a threat no longer has to go through multiple steps to end up on a database. Instead of the usual required steps of reporting, developing countermeasures and adding that to the AV system, the new advanced system, based upon observed events, can immediately counter a threat.

So as a conclusion, big vendors will not ignore a threat due to it being too complex. The assessment possibilities of today make it a lot easier to identify and counter new threats.

Not the answer you're looking for? Browse other questions tagged or ask your own question.