2

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with code. Maybe this can be done with a single line of code. Even a lot of well-known software can do this. Pdf viewer, media player etc.

It wouldn't crash or slow down the PC, only scan txt files on Desktop and upload to its own servers. For example I have seen a lot of program that request outbound internet connection on my Firewall Software, and these programs are well-known programs used by millions of people.

I'm guessing antivirus solutions don't block these processes. Is this a valid concern for ordinary PC users? Many users don't know or understand firewalls.

Is there something I missed? Maybe I'm wrong and Antivirus or Windows OS can detect and block this easily.

Note: I don't want suggestions such as use Linux or Open Source programs. I am not researching how to avoid this.

I just wonder if this process could be that easy?

4
  • What you are describing sounds like typical backup software. You would have to be able to determine the true intent of the software, which may be impossible. Mar 5 at 23:33
  • No, I didn't describe backup software. I'm not even talking about a specific software. For example, Potplayer is famous media player and I controlled it on my Firewall. I noticed that this program requests outbound internet connection a lot. What I'm curious about is this: If the Potplayer developers want to send the my txt files from my Desktop dictionary to their own server, will they be able to do that? Will Windows or antivirus software stop this?
    – birisix
    Mar 6 at 7:02
  • That’s my point, how does anti-virus know the difference between your files being backed up, and your data stolen? Mar 6 at 15:20
  • Yes, If so, this is a serious security gap for privacy and security. It is very difficult to avoid this for the casual user. It sounds horrible...
    – birisix
    Mar 7 at 7:24
1

The technique that you are asking for is called Data Exfiltration and yes. There are ways of detecting DE.

Depending on the level of maturity of the threat this exfiltration could be more or less sophisticated. For example, the malware could grab sensitive information, cipher it and send it to the attacker. Or it could use a way easier method of exfiltration as taking advantage of the allow-listed domains as giphy.com, put the data into a gif, and upload it as a regular gif. Another example would be to exfiltrate simply using emails. In general, this depends on the creativity of the adversary. You can find more examples here: https://www.fortinet.com/resources/cyberglossary/data-exfiltration

If we go to the detection methods, there are some:

  • If the attacker is exfiltrating a lot of information we would probably see a big spike in the FW control panel.
  • If the attacker's c2 is not using a secure channel, it would be possible to see the clear text traffic being sent.
  • Relevant signatures. For example, a common tactic while attacking windows is to create a DUMP of the LSASS process that may contain credentials. EDRs/AVs can be able to detect when an LSASS dump has touched the disk and act accordingly blocking the threat.

Be aware that detecting these threats may require a certain maturity level of the blue team.

1

Can antivirus software detect malware that steals data?

Your question basically boils down to "If x operation is performed can a computer determine if its malicious or not"

The answer is well sometimes it can.

How would computers go on about doing that?

Well for starters computers can go and check if such a file has been earlier seen and if it was classified as malicious or not and to what degree was it classified malicious by seeing what operation it performs and determining should the program really be doing that.

Defeating such a system shouldn't be that hard.

But if we really think about it after the code has been executed it pretty much can do anything like check if it's running in a virtual environment, spawn a different process and copy its code there, inject into another process, download another exe, or dll and then execute the functions in them.

So in short determining, if a file upload function is malicious or not is almost impossible for computers and extremely tough for humans taking into account the headache malware writer went into obfuscating his actions.

0

Anti Malware detection based two technologies.

  • Signature Based Detection- They only detect previously identified signatures only. They connect with signature database and compare application signature with database. When they detect matching signature it will automatically blocked.

  • Behavioral based Detection - Some time this technology called as a heuristic detection. Based on behavior of application malware detection is done. They use signature based detection as well. According to your question sometimes it could be detect under this technology but behavioral based technology is not fully developed and it gives false positives many occasions.

Old and generic anti-malware don't use heuristic based detection and therefore those solution will not detect situation you have mentioned.

Linux is kernel and it is not a anti virus. Linux got attacked from linux based virus, But windows based virus may not run. Those things are two distinction situation.

4
  • I understand from your answer that this process is not easy as I think. For example Scanning txt files and uploading to server is probably detected by Anti Malware. e.g. CCleaner was very blamed on this issue. Was it wrong concern?
    – birisix
    Mar 5 at 11:44
  • ccleaner is not anti malware. "Scanning txt files and uploading to server can be detected by Anti Malware" In signature base detection, doesn't matter what anti malware is doing, if signature match, it will blocked, delete or quarantine
    – Infra
    Mar 5 at 11:50
  • Excuse me for my English a little bad. I know CCleaner is not anti malware. I tried to say the CCleaner was accused of being spyware. Also Signature Based Detection you mentioned did'nt sound safe. If I was a programmer, Anti-Malware wouldn't be able to detect my small program that I sent to my friend since there isn't any malware with matching to i written program. Because it would be unique signature. Except that I use malware program code templates. Am I right? Thank you for your patience. I'm a little ignorant this issues.
    – birisix
    Mar 5 at 12:12
  • yes. don't forget if you want exploit, you have to have a vulnerability. In some situation protection is provided by operating system itself. As a programmer you might have very good understanding about it. Operating system doesn't allow execute some kernel level programms without having proper security clearance. Your requirement is simple as just upload file from devices, it is quite possible. But Without identifying vulnerability you are unable to exploit on it.
    – Infra
    Mar 5 at 13:29
0

The prevention of this would align more closely with DLP, or Data Loss Prevention. A corporate environment should have both well-developed AV/NGAV and a DLP program, but DLP programs are more rare for end-users or home PC's.

Data extraction is not always malware necessarily, but often an actual person running commands. They are both threat vectors. Often, data extraction is the ultimate goal of Advanced Persistent Threats (e.g. Nation State/sponsored attackers) or corporate hacks, and are targeted in nature (COVID Research was a major target in 2020, The Sony hacks were also the work of a North Korean APT, etc). Compare this to conventional malware which is generally more of a "low-hanging fruit approach."

While some AV's can sometimes detect data loss/extraction/uploads, it's really not what they're for and are not very good at detecting it. While "Next-Gen AV's" are becoming more sophisticated and no longer use legacy methods, it's still not really the core of AV's functionality.

3
  • DLP not is related to this question
    – Infra
    Mar 6 at 1:56
  • By definition, it absolutely is. The question is "consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server." This is EXACTLY the definition of data loss. Data leaving your environment that you do not want to leave your environment.
    – SomeGuy
    Mar 7 at 6:56
  • Entire process is blocked by DLP. According to your policy you can't upload files to internet or specific service. Even intentionally you can't upload. Additionally without talking about data classification, DLP is totally useless. Therefore DLP not related to at all.
    – web_guy
    Mar 7 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.