13

Are there, or have there ever been viruses that completely evade all virus scanners for a long time (e.g. longer than a year?)

Improve this question
2
  • A dormant virus in firmware would be totally undetectable until it actually "wakes up" and compromises the OS.
    – user42178
    Mar 8, 2015 at 12:35
  • 1
    I don't know why people keep answering with state level actors. Professional malware authors write viruses which completely evade virus scanners regularly, either with extremely frequent updates, or with highly advanced evasion tactics or targeted attacks with multiple payload stages.
    – forest
    Apr 8, 2016 at 2:23

2 Answers 2

Reset to default
13

Yes, consistently. Viruses must be used and found before a definition is created. APT (Advanced Persistent Threats) are a huge deal in recent times where people will spend years developing viruses, called 0 day threats, for specific targets that will remain undetected for very long periods of time. Viruses like these are usually a product of nation states as most common miscreants won't spend the time or have the sophistication to pull it off. I believe Stuxnet is one of these viruses (http://en.wikipedia.org/wiki/Stuxnet) that went a year or longer before being found out and once it was, other miscreants altered the code to do what they wanted the virus to do. It's likely more common than anyone would like to believe.

Red October: http://www.kaspersky.com/about/news/virus/2013/Kaspersky_Lab_Identifies_Operation_Red_October_an_Advanced_Cyber_Espionage_Campaign_Targeting_Diplomatic_and_Government_Institutions_Worldwide

Improve this answer
1
  • 5
    "0 day" refers specifically to exploitable vulnerabilities which do not have vendor patches or workarounds, typically because they have not been disclosed publicly or to the vendor. APT malware use 0 day exploits because they have no defense and also no anti-virus signature.
    – SecsAndCyber
    Mar 7, 2015 at 22:13
18

Yes. Stuxnet was being used to attack the Iranian nuclear facilities in 2007, but wasn't detected by AV or the public until June 2010. Part of its construction was designed to resist analysis by encrypting the payload against a value that could only be derived by a valid target system - it didn't appear to do anything particularly malicious outside of that payload.

It's not just malware, either. Bugs like Heartbleed and Shellshock are thought to have been exploited months or years in advance of disclosure. It was only once the exploit packets were known about that people were able to go back through their packet captures and identify cases where they may have been breached.

Improve this answer
2
  • is there any documented evidence that Heartbleed and/or shellshock was exploited before the vulnerability was made public? Since my understanding was that Heartbleed was detected by the Google engineer and once it was made public only then people tried to exploit it over the Internet.
    – void_in
    Mar 7, 2015 at 14:50
  • 5
    Sorry, I should've been more clear. From memory, one of the major internet watch organisations stated that they'd found packets from 2011 which looked like someone trying out the same bug, but they couldn't be sure. Shellshock is thought to have been used by a small botnet in 2012, though the bot developers may not have known how significant their find was.
    – Polynomial
    Mar 7, 2015 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .