Virus scanning algorithm

How will you handle polymorphic viruses?


#dth-0

Polymorphic viruses, in order to replicate must use some code which allows it to do that.

That code is mostly shared by all viruses (writeprocessmemory, ect) and as such is quite easily found.

(this is based on the human immune system, if you've read this months sciam).

From,
Nice coder

Actually there are some rather advanced polymorphic stuff out there which don't use "common" code pattern to spread, instead they insert dummy instructions which add to nothing thus making it impossible to find common patterns. They also use code chunks which can be inserted in different ways but still having the same flow of instructions. If I remember correct "Dark Avenger" was one of the first persons doing this thing, the code doing it was called "Dark Avenger's Mutation Engine" (also known as MTE or DAME).

The main tools used in todays AVs is Heuristic scan and generic decryptors (emulators).

But how exactly did it spread to another exe file?

It would either need to read in an exe, modify it, then write it back, Which is very suspicious if it does lots of files, quickly. Even a few files would eventually trip it.) or it would need to use writeprocessmemory, and change the exe in memory, shich is also suspicious. (you'd give the virus scanner a little common sense).

From,
Nice coder

The spreading is done in billions of different ways. One of the most successfull viruses Win32.CIH actually used a bug in win98 making it possible to go from ring3->ring0 by changing the interrupt descriptor table (IDT) and setting of an exception. When in ring0 you can indeed do anything without anyone noticing (by hooking low level openfile functions etc).

When spreading the virus often contain an encrypted part (unmodified code) which is decrypted and used to "recompile" the virus body in another exe file.

Now, sure the virus need to change the files alot. And sure, this could be found by an potential AV. But there is alot of anti-measures from the vx:es making them invisible to the AVs.
The fight continuous... =)

Regards

I'm moving to the AI forum, just because I think the thread is a better fit with AI than with math + physics.

Quote:

Original post by Nice Coder But how exactly did it spread to another exe file? It would either need to read in an exe, modify it, then write it back, Which is very suspicious if it does lots of files, quickly. Even a few files would eventually trip it.) or it would need to use writeprocessmemory, and change the exe in memory, shich is also suspicious. (you'd give the virus scanner a little common sense). From, Nice coder

As was stated before, you may want to look a little more closely at polymorphic engines. Even if the common thread was a few API calls in the virus you are still going to get nowhere as the whole file is actually encrypted (this was the reason for 'morphing ' it to begin with)

As a virus writer (not that I am one, just explaining the mindset), I don’t want you to be able to scan for common events or 'behaviors'. The improved mousetrap was to look for the encrypter / decrypter. The improved mouse is to randomize that mechanism to the point where its hard (not impossible, but hard) to distinguish from a valid file. So with a random encryption and a random header stub - the next trick is to use an emulator (which most engines today use if they suspect a poly-type virus). The idea is to let the virus decrypt itself and then catch it jumping into the virus code (or let it and then backtrack).

Sophisticated engines also need to take into consideration non-virus polymorphic behavior (commonly referred to as variants). The easiest way to explain this is with macro viruses. When Microsoft release VB5 (thanks a lot guys... like *anyone* really needed that sort of scripting support in my word processor...) it needed to convert older VB macros to the new VB5 standard. This would also 'morph' the virus, creating a variant. To compound the issue, converting the macro back to the original VB standard would often create a 3rd variant.

While less common, the issue did occur in file viruses usually as the result of a bug or other uncommon problem.


Regardless - if you are going to try to catch behaviors then you really are not writing a scanner per se (watching for multiple file modifications). However, that’s a whole different story. Probably the best approach I see towards this technique is at GreenBorder - and that is not a trivial piece of work. I know of two *very* big software companies (an OS company and an antivirus company) who both failed at building a tool like that. Not to say that its impossible - but it will be some serious work.

Some researchers on the topic I would do some searching on would be:

Jimmy (Chengi) Kuo
Eugene Kaspersky
Dmitry Gryaznov
Alan Solomon
Vesselin Bontchev


Anyhow - good luck with the research, it will be interesting to hear your results.


#dth-0

Interesting post xiuhcoatl!

But it still stands that eventually the virus has to reproduce. Now how would a polymorphic virus reproduce, if its every move is watched by the av program? (including a dummy program to look for virus infections).

From,
Nice coder

danke -

Then you are not talking about doing a virus scanner per se (meaning, scan my hard-drive for viruses) or an on-demand scanner (when I access the virus infected file, scan it then and make sure it isn't infected) which essentially work on the same principle: You have to have some way to detect polymorh and other hiding techniques and then other systems to handle them if they are detected because you are looking at the file on disk. You are talking about monitoring behavior and restricting functionality. The difference being you are not interested in detecting and classifying a specific virus, but rather preventing generic suspicious functionality. Right?

If you are talking about containership that is a completely different subject and I'll tell you right now - its not easy. This is essentially what GreenBorder does - everything runs in this 'safe box' that is considered unsafe. This is particularly useful for things like spyware - you let them 'infect' but they cannot 'spy' or report back to the mothership. However, at this point - who cares about detection? A nice button is provided so I can flush the box occasionally. A virus/spyware scanner can be used to validate suspect content and remove it from the 'safe box'.

Here is an independent review on their site:
http://www.greenborder.com/downloads/GreenBorder_KeyLabs_Report.pdf


Doing something in this manner is not trivial, again A LOT of smart people tried this and failed. It took these guys 3-4 years to get it solid - however it can be done, and would be a very challenging and interesting project. I'm under NDA so I can't talk about their architecture in specifics. However, some of their technology is patented (or in the process of) so may be able to get an idea how they did it from those documents.

Another approach is with Solaris 10 and their infrastructure - but its late and thats another show.


cya -


#dth-0