2

Are there industry-wide measures that identify how long it typically takes to identify, develop and distribute new malware signatures? I want to understand how long organizations are typically exposed to new malware before a signature is available to them.

  • I know it depends on the level of risk, which takes into account the number of vulnerable users, number of incidents seen so far, and sensitivity of targets (think Stuxnet vs. Word macro virus). I imagine this is how antivirus analysts prioritize their reverse engineering efforts. In fact, PR probably plays a big part since dumb acronyms and logos spawn excessive FUD for end users that may question the effectiveness of their AV. I don't think there's a published industry standard. – armani May 26 '15 at 22:15
  • CVSS with its temporal score tries to standardize ranking tho not response time – Neil Smithline May 27 '15 at 0:11
  • More important nowdays is how accurate their heuristics engines are at noting past behaviors, unwanted and malicious behaviors, and matching up against variants to block activity before a signature is available. Signature only based malware detection is dead. You can custom order malware, each instance sold is recompiled to break signatures. There is no period of time at which you are ever safe. Exposure across the malware spectrum is continuous. – Fiasco Labs Sep 5 '15 at 19:11
1

Exact information on how long it takes organisations to detect and publish signatures to their AV products will be proprietary and closely guarded by the various AV vendors.

There are number of clues to the general time frame dotted around though. Kim Zetters book Countdown to Zero Day, conducted thorough research to tell the story of stuxnet, in the book she goes into great depth about the workings of the malware industry. In a passage specifically about Symantec she says the following;

"When the company first entered the antivirus business, it was considered a good response time to turn around a threat -from discovery to delivery of signatures- within a week. But Symantec aimed to reduce this to less than a day. To accomplish this the company needed analysts in multiple time zones to spot viruses in the wild when they first appeared and to get signatures out to customers in the US before they woke up and began clicking on malicious e-mail attachments."

So Symantec and I presume their main competitors in the market have a very fast turnaround, when they successfully detect new malware or new strains of malware.

In 2010, which in technology terms may as well be a lifetime ago, there was certain circumstances when at least a week was still possible for signatures to be published to some AV products for known malware.

Kaspersky Lab created 10 harmless files and flagged them to malware aggregators VirusTotal that Kaspersky considered them as malicious.

According to the Reuters news agency;

"Within a week and a half, all 10 files were declared dangerous by as many as 14 security companies that had blindly followed Kaspersky's lead, according to a media presentation given by senior Kaspersky analyst Magnus Kalkuhl in Moscow in January 2010."

Another organisation admitted to conducting a similar experiment 3 years ago, they also quoted a week until they saw signatures being published. So not much had changed from the 2010 experiment, which suggests that the procedures and practices of some AV companies don't change that much over time.

Based on this I would suggest that AV signatures from malware detection to the publishing of a signature could be anywhere between 1 day to 1 week, depending on the AV vendor. Clearly this includes a lot of assumptions though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.