Could antivirus programs not just scan all files as they are created instead of using on access scanning. Would this kind of approach not be much more scure?
1
-
3what about when a file modifies itself to become malicious?– schroeder ♦Mar 25, 2015 at 21:22
Add a comment
|
5 Answers
No, scanning for viruses only at creation time is not secure for several reasons:
- Anti-virus heuristics and signatures update continuously, so something could be missed upon creation but would be caught at execution time.
The anti-virus system might not be loaded when the file is created:
- Perhaps A/V was temporarily disabled for some reason
- Perhaps it is a removable drive and the file was created elsewhere
- Perhaps the system was booted into another operating system
- Does "creation time" include modifications?
- What about code executed in-line that is never created as a file?
There are also more complicated scenarios. For example: You get an encrypted payload (containing the virus). A/V can't detect this because it cannot decrypt it. Much later, you have a second file arrive. This file isn't technically malicious, but it does decrypt the first file, which then runs and infects your system. This is an increasingly common trick for avoiding detection in both traditional A/V as well as malware sandboxes like FireEye.
A system that hashes files and checks those hashes against an up-to-date file reputation service would only have to scan unknown hashes. Cloud sandbox systems like Cisco AMP do this.
-
-
@ǝɲǝɲbρɯͽ, nice find, that's a great example of malware that spreads via USB sticks (my reason #2, second bullet). That FireEye njworm writeup looks well researched and well presented. Mar 26, 2015 at 5:27
-
1Yes; I've seen inside some malware myself, started writing and realized I could look it up. I thought their Houdini(H)RAT write-up was a little better/meant to link it first but ran out of time. fireeye.com/blog/threat-research/2013/09/… Hopefully they'll keep at it.– ǝɲǝɲbρɯͽMar 26, 2015 at 14:27
You would still have to scan during reads whenever the source is untrusted - removable storage, network drives, etc.
In principle if you always scanned files on creation/modification, then it would be safe to read local files without scanning. I don't know of any desktop AV software that has that behaviour though. It would be a performance improvement, not for security, as you have (more or less) the same blind spots either way.
In fact, I have seen this behaviour in real systems: some file servers do AV scanning on writes only. In that case the scanning is not to protect the server, rather to protect clients that access the shares, in case their desktop AV misses something. The performance advantages can be significant here, so this seems a pretty smart move.
Yes, that would be very secure. It will still let some bad stuff through, since it is still signature-based, but the bigger concern is that it would bring any system to its knees.
For my job I analyze forensics for infected computers, and am in and out of the MFT and USN Journal a LOT. Files and mutexes are being created, altered, and deleted constantly from all parts of the operating system. To run each individual object through an AV engine every microsecond of every day is a terrible idea.
That approach could somehow open another attack vector. If you can run the malicious code without being on disk first, run it from a removable media (where the infected code already exists and therefore wouldnt be checked) or run an apparently harmful file. In order to propagate the virus would just need to create an empty file and than after update it with malicious code that will allow future execution (run upon boot, run on user request, run on event like boot, etc).
Virus would probably start being spreaded in two stages. First as an apparently good file (1. sort of a transported host), with the malicious code hidden by encryption/whatever). And than The virus would than create the file and after update it with the malicious code (2. Virus copying).
This approach/technique in AV scanning will fail in the event of file less infections, behaviour based threats, file infectors, hijackers and backdoors etc.
And as a matter of fact, importance of signature based threat detection is getting lower and lower due to the sophisticated technologies involved in threat creation, analysis, detection as well as time delay between threat detection and signature delivery.
Even though scanning files when being created enhance other detection techniques, this has a very low success rate as a standalone technique.
