Can a antivirus software detect a malware that steals data?

Question

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with code. Maybe this can be done with a single line of code. Even a lot of well-known software can do this. Pdf viewer, media player etc.

It wouldn't crash or slow down the PC, only scan txt files on Desktop and upload to its own servers. For example I have seen a lot of program that request outbound internet connection on my Firewall Software, and these programs are well-known programs used by millions of people.

I'm guessing antivirus solutions don't block these processes. Is this a valid concern for ordinary PC users? Many users don't know or understand firewalls.

Is there something I missed? Maybe I'm wrong and Antivirus or Windows OS can detect and block this easily.

Note: I don't want suggestions such as use Linux or Open Source programs. I am not researching how to avoid this.

I just wonder if this process could be that easy?

Answer 1

The technique that you are asking for is called Data Exfiltration and yes. There are ways of detecting DE.

Depending on the level of maturity of the threat this exfiltration could be more or less sophisticated. For example, the malware could grab sensitive information, cipher it and send it to the attacker. Or it could use a way easier method of exfiltration as taking advantage of the allow-listed domains as giphy.com, put the data into a gif, and upload it as a regular gif. Another example would be to exfiltrate simply using emails. In general, this depends on the creativity of the adversary. You can find more examples here: https://www.fortinet.com/resources/cyberglossary/data-exfiltration

If we go to the detection methods, there are some:

• If the attacker is exfiltrating a lot of information we would probably see a big spike in the FW control panel.
• If the attacker's c2 is not using a secure channel, it would be possible to see the clear text traffic being sent.
• Relevant signatures. For example, a common tactic while attacking windows is to create a DUMP of the LSASS process that may contain credentials. EDRs/AVs can be able to detect when an LSASS dump has touched the disk and act accordingly blocking the threat.

Be aware that detecting these threats may require a certain maturity level of the blue team.

Answer 2

Can antivirus software detect malware that steals data?

Your question basically boils down to "If x operation is performed can a computer determine if its malicious or not"

The answer is well sometimes it can.

How would computers go on about doing that?

Well for starters computers can go and check if such a file has been earlier seen and if it was classified as malicious or not and to what degree was it classified malicious by seeing what operation it performs and determining should the program really be doing that.

Defeating such a system shouldn't be that hard.

But if we really think about it after the code has been executed it pretty much can do anything like check if it's running in a virtual environment, spawn a different process and copy its code there, inject into another process, download another exe, or dll and then execute the functions in them.

So in short determining, if a file upload function is malicious or not is almost impossible for computers and extremely tough for humans taking into account the headache malware writer went into obfuscating his actions.

Answer 3

Anti Malware detection based two technologies.

• Signature Based Detection- They only detect previously identified signatures only. They connect with signature database and compare application signature with database. When they detect matching signature it will automatically blocked.

• Behavioral based Detection - Some time this technology called as a heuristic detection. Based on behavior of application malware detection is done. They use signature based detection as well. According to your question sometimes it could be detect under this technology but behavioral based technology is not fully developed and it gives false positives many occasions.

Old and generic anti-malware don't use heuristic based detection and therefore those solution will not detect situation you have mentioned.

Linux is kernel and it is not a anti virus. Linux got attacked from linux based virus, But windows based virus may not run. Those things are two distinction situation.

Answer 4

The prevention of this would align more closely with DLP, or Data Loss Prevention. A corporate environment should have both well-developed AV/NGAV and a DLP program, but DLP programs are more rare for end-users or home PC's.

Data extraction is not always malware necessarily, but often an actual person running commands. They are both threat vectors. Often, data extraction is the ultimate goal of Advanced Persistent Threats (e.g. Nation State/sponsored attackers) or corporate hacks, and are targeted in nature (COVID Research was a major target in 2020, The Sony hacks were also the work of a North Korean APT, etc). Compare this to conventional malware which is generally more of a "low-hanging fruit approach."

While some AV's can sometimes detect data loss/extraction/uploads, it's really not what they're for and are not very good at detecting it. While "Next-Gen AV's" are becoming more sophisticated and no longer use legacy methods, it's still not really the core of AV's functionality.