The security threat of evasive malware
Posted on 25.02.2013
Lastline has released a new report that looks at how malware authors are able to exploit the limited visibility of automated malware analysis systems (sandboxes) and ensure that targeted attacks and zero day exploits remain successful. The use of stalling codes is resulting in a growing trend of evasive threats.


The report highlights two techniques currently used by malware authors: environmental checks and stalling code.

While environmental checks have been well documented, stalling code is the latest technique being utilized to spread malware. It delays the execution of a malicious code inside a sandbox and instead performs a computation that appears legitimate.

Once the sandbox has timed out, the evasive malware is free to execute. The report finds that stalling codes are particularly troublesome because they “can no longer be handled by traditional sandboxes (even if the trick is known).”

“Current sandboxes have a lack of visibility into the execution of a malware program,” said Giovanni Vigna, CTO of Lastline. “To detect this new breed of evasive threats, a sandbox needs to have visibility and must be able to do this stealthily. Otherwise, as we have seen in stalling code, the malware will react accordingly and remain undetectable.”





Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals it’s our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //