Have any viruses leveraging the GPU been discovered in the wild? What is the mitigation?

Question

This news article from 2010 discusses how a GPU can be used by a virus to avoid detection by common anti-malware/anti-virus software. The idea is to obfuscate the virus payload and leverage the GPU's computing power to unpack it, thus defeating a signature-based antivirus that is limited by CPU computing power.

• Has there been any documented instances of viruses leveraging the GPU occurring in the wild?

• How have antivirus and antimalware vendors responded to this threat?

• Does this mean WebGL and WebCL is another vector for exploit?

Answer 1

The first GPU-assisted malware is considered to be the Badminer trojan reported by Semantec in 2011. Although its GPU leverage level is pretty low and the risk is low too, this is still the first precedence of using the GPU maliciously in the wild.

Another more intrusive example of the same idea is RiskTool.Win32.BitCoinMiner.

Then antivirus designers started to think really hard. No AV vendor will invent effective GPU-related protection until high-risk GPU-assisted malware starts to appear in large volume and more traditional AV approaches fail. It won't happen very soon. Meanwhile, it's just not feasible to protect against a still imaginary danger.

Everything is a potential attack vector as soon as it becomes more and more profitable. There's no such thing in the world that is not attackable or misusable in some form. Regarding particular WebCL, from Wikipedia: "Currently, no browsers natively support WebCL, seeing as it is new. However, non-native add-ons are used to implement WebCL."