2

I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered. These techniques seem to be utilized to evade recurrent detections by AVs and IDSs. It occurred to me that it might be a high priority goal of malware authors to prevent their malware from being ever being analyzed in the first place. Are there any analogous techniques that malware authors have employed in order to prevent their malware from being first discovered so that they never get reported/analyzed in the first place?

  • 4
    This is a good question but too broad since there are a LOT of such techniques... Generally encryption and obfuscation methods are used but there are e.g. a lot of obfuscation methods like dead-code insertion, code transportation, migration etc... – game0ver Oct 29 '19 at 18:06
  • I would recommend you to read this paper first to get a good basic understanding of how malware is hidden from various detection mechanisms, and also about the countermeasures for them. – Ayush Ambastha Oct 29 '19 at 19:35
  • "Are there specific techniques?" -- yes, polymorphic and metamorphic, as you said. Is there a more specific question you wanted to ask? – schroeder Oct 29 '19 at 19:53
  • @schroeder I think those techniques are employed more to evade detection by AVs and IDSs once the malware has already been discovered, analyzed, and signatures extracted. I was wondering if there are any analogous techniques used specifically to prevent the malware's initial discovery so that no one would bother reporting, analyzing, or extracting signatures from it in the first place. – chillsauce Oct 29 '19 at 22:15
  • 1
    dang it, my long comment got cut off... basically, think beyond the malware itself. Sign it with stolen certs, so it looks legit. Test it in internal environments so it's not widely-available, prior to you deploying it. Minimize code reuse... – Angelo Schilling Oct 29 '19 at 23:41
0

As comments suggests, the subject of "malware vs. anti-virus software" as a whole is complex, and generally too broad for an answer here. However, I'd like to address what I believe may be a misconception on your part that led to your question.

In the question, you write (my emphasis):

I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered.

and in a comment you add (also my emphasis):

I think those techniques are employed more to evade detection by AVs and IDSs once the malware has already been discovered, analyzed, and signatures extracted. I was wondering if there are any analogous techniques used specifically to prevent the malware's initial discovery so that no one would bother reporting, analyzing, or extracting signatures from it in the first place.

From my reading of the above, what I think you think happens is:

  • Someone deploys a new piece of malware.
  • It is discovered, analysed and "detection signatures" are extracted. AV software is now primed against the new malware.
  • The malware now starts to use polymorphic measures to evade further detection.

I'm not an expert in the malware vs. anti-virus battle, but what I believe happens is more along the lines of:

  • Various examples of existing malware are analysed and "detection signatures" are extracted. These can vary enormously in their complexity/subtlety, but at their simplest, these are sequences of bytes that any future malware – derived in a simplistic way from existing malware – are likely to contain.
  • Someone creates a new piece of malware. To disguise its origins, and to try and evade existing "detection signatures", the writer adopts one or more polymorphic techniques.
  • If "successful", the new malware won't be automatically detected by AV software: it will require manual detection. This would often only happen after the undesirable effects of the malware have triggered, and infected machines are forensically analysed.
  • I imagine that polymorphism is active from the very moment the malware is deployed. I don't think it prevents the malware from being discovered the first time though - in fact a self-decrypting executable probably is a red flag to AVs - but it does make it a lot harder to tell what type of malware it is. Honestly unless the malware is ransomware or something that has a pop-up that tells the user they've been infected I have no idea how analysts discover new malwares. – chillsauce Oct 30 '19 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.