Since years ago, miscreants use JavaScript to craft web malware attacks such as drive-by download attack that is used for example to install the famous CoolWebSearch virus.
There are static methods that analyze the text of web pages and teach a learning machine to inform a classifier how to detect web malware based on signatures. This approach is not good because it is useless against obfuscated JavaScript code and zero-day attacks.
Other solutions exist and are based on the analysis of the dynamic behaviors of JavaScript using sandboxing environments or by setting a proxy (in both cases the page is not rendered for the user before its dynamic analysis).
My question: Why do sandboxing environments used to supervise JavaScript malware not rely on an anti-virus program and prefer to use programs coded to scan the state of the machine (virtual machine) in which they run? (Antiviruses programs also use dynamix analysis)
-
1Didn't you answer your own question? Anti-virus can be defeated by changing the behavior of the malware. Sandboxes exist to supplement anti-virus by analyzing the behavior, and not the code.– schroeder ♦Jul 8, 2014 at 15:07
-
@schroeder Sandboxes analyse behavior as you said. But how ? By checking the sensible parameters and the state of the machine on which the JavaScript code runs: also antiviruses check the state of the machine. So I do not see the difference and that is why I asked the question.– user45139Jul 8, 2014 at 15:09
-
@schroeder Thank you for the remark. I corrected it.– user45139Jul 8, 2014 at 15:40
-
4Hmm, I always thought sandboxes exist to restrict possible actions a program can perform, rather than analyse which actions it performs without restricting them. It is AV programs which perform analysis via various means. Am I wrong there?– Dmitry JanushkevichJul 8, 2014 at 16:42
-
@DmitryYanushkevich No, Sandboxes are used to supervise and monitor malicious code execution. I read this in several serious articles and I am working on this project for the moment.– user45139Jul 8, 2014 at 19:44
1 Answer
The problem is largely in the effectiveness of the dynamic analysis. How do you define malware? What does malware always do that normal programs never do? (Hint: there is no answer to this question)
Well-written malware can look innocent and perfectly legitimate programs can look dangerous.
Here's a simple example: the malware might try to join your computer to a botnet. So the dynamic analysis is looking for new outgoing connections? Well what if it's time-delayed? You won't catch that and you'll still serve it up to the user. So you look for code that will initiate a connection? What if it's a legitimate app that initiates connections to a server?
For almost any example, you can come up with either a way to circumvent detection, or a legitimate use case that would be blocked.
It's more effective to sandbox - to restrict the permissions of components that are likely to be compromised. For instance, don't allow your browser tabs (which are separate processes in something like chrome) to have filesystem access. Even if a tab-process gets compromised, it can't write malicious files to your disk (without prompting you for permissions)
-
1