Malware Writers Research Articles

The network structure of malware development, deployment and distribution

The Internet is a global infrastructure, connecting individuals, regardless of their proximity to one another. But, the ability to connect on such a large scale has also been leveraged to coordinate illicit activities. This has led to the emergence of online illicit networks that have enabled broader participation in cybercrime. Online stolen data markets have been of particular interest to researchers, though the networks involved in the development, deployment and distribution of malicious software are far less explored, despite being intricately tied to the growing issue of cyber security. The current study identifies community structures within a larger network of hackers, malware writers and market actors and examines the underlying characteristics of these networks. Results suggest that the network is composed of modular communities formed largely of weak, non-redundant ties that follow the ubiquitous structure of complex networks. Implications, limitations and directions for future research conclude this paper.

Evil Offspring - Ransomware and Crypto Technology

Crypto ransomware is increasingly clever. For anyone contending with it, it helps to know the options available to the malware writers and how they might be tripped up or deflected.

An HMM and structural entropy based detector for Android malware: An empirical study

Smartphones are becoming more and more popular and, as a consequence, malware writers are increasingly engaged to develop new threats and propagate them through official and third-party markets. In addition to the propagation vectors, malware is also evolving quickly the techniques adopted for infecting victims and hiding their malicious nature to antimalware scanning. From SMS Trojans to legitimate applications repacked with malicious payload, from AES encrypted root exploits to the dynamic loading of a payload retrieved from a remote server: malicious code is becoming more and more hard to detect.In this paper we experimentally evaluate two techniques for detecting Android malware: the first one is based on Hidden Markov Model, while the second one exploits structural entropy. These two techniques have been successfully applied to detect PCs viruses in previous works, and only one work in literature analyzes the application of HMM to the detection of Android malware. We demonstrate that these methods, which reveal effective for PCs virus, are also successful for detecting and classifying mobile malware.Our results are promising: we obtain a precision of 0.96 to discriminate a malware application, and a precision of 0.978 to identify the malware family.

Protecting Software through Obfuscation

Software obfuscation has always been a controversially discussed research area. While theoretical results indicate that provably secure obfuscation in general is impossible, its widespread application in malware and commercial software shows that it is nevertheless popular in practice. Still, it remains largely unexplored to what extent today’s software obfuscations keep up with state-of-the-art code analysis and where we stand in the arms race between software developers and code analysts. The main goal of this survey is to analyze the effectiveness of different classes of software obfuscation against the continuously improving deobfuscation techniques and off-the-shelf code analysis tools. The answer very much depends on the goals of the analyst and the available resources. On the one hand, many forms of lightweight static analysis have difficulties with even basic obfuscation schemes, which explains the unbroken popularity of obfuscation among malware writers. On the other hand, more expensive analysis techniques, in particular when used interactively by a human analyst, can easily defeat many obfuscations. As a result, software obfuscation for the purpose of intellectual property protection remains highly challenging.

TSSDroid: realization of an efficient and usable TSS API for the Android software stack

AbstractThe advancement in smartphones capabilities has attracted malware writers to build more sophisticated attacks on these devices. Traditional software‐based security mechanisms have failed to provide strong security against these attacks. Similar threats on the PC have been countered using the concepts of Trusted Computing—a highly flexible trust mechanism with strong security properties. However, smartphone platforms have yet to see any Trusted Computing applications—primarily because of the difficulty in adopting this relatively new paradigm of security. In this paper, we present the design of a high‐level application programming interface (API) that allows Android‐based smartphone application developers to adopt Trusted Computing and use it in their applications without having to learn the intricate details of how Trusted Computing works. The API abstracts away the complexity in using Trusted Computing constructs by offering easy‐to‐use interfaces for complex tasks. The API has enhanced the usability of Trusted Computing development by significantly reducing the number of lines and complexity of code required to perform these diverse tasks. This paper provides a reference implementation for the proposed API in order to show that the API is efficient in terms of performance overhead. Copyright © 2016 John Wiley & Sons, Ltd.

Malware detection techniques and tools for Android

Smartphone, with its powerful capabilities, has been wildly used in every area of our day-to-day life. The enormous kinds of applications installed in these smartphones like WhatsApp and Viber have changed the way people live and communicate. An estimate by Gartner indicates that 90% of the phones by the end of 2018 will be smartphones (MobileStorm, 2014). The most popular mobile operating system today in the industry is Android. However, with the prevalence of Android smartphone, malware authors have started to target it. Although mobile anti-malware solutions could be installed to scan malicious apps before they are made available for download, existing mobile anti-malware software relies exclusively upon a prior knowledge of malware samples in order to extract and deploy signatures for subsequent detection. Moreover, malware writers may update existing malware samples to dodge detection. Hence, this imprudent nature makes them inadequate in identifying new or mutated malware. This paper explores different techniques and tools available to analyse and detect Android malware. It also highlights the features and limitations of these techniques and tools.

Prevention Mechanism for Prohibiting SMS Malware Attack on Android Smartphone

Nowadays, use of android smartphone is increasing tremendously, because of their attractive features and capabilities. People store their confidential information on smartphones. Malware writers are more interested in writing malwares for smartphones, therefore malware attacks on smartphone devices have increased nowadays. Malware attack can be performed in various ways. The new evolving malwares are not detected by existing anti-malware software. In this dissertation we propose a malware, which will send SMS in background without knowledge of smartphone user. This malware can also collect all contacts; inbox messages and send it to command and control server, which is present in wireless network. In our system, we deploy the malware on the smartphone device present in our wireless network, by attracting user to download our malicious Sudoku app. To counteract for such SMS sending malware, we propose one application named as Monitor. Monitor app will be a system application with root permissions. This app will alert user, if malicious app sends SMS in background. Monitor app will display all running background services and apps to the user.

A framework for metamorphic malware analysis and real-time detection

Metamorphism is a technique that mutates the binary code using different obfuscations. It is difficult to write a new metamorphic malware and in general malware writers reuse old malware. To hide detection the malware writers change the obfuscations (syntax) more than the behavior (semantic) of such a new malware. On this assumption and motivation, this paper presents a new framework named MARD for Metamorphic Malware Analysis and Real-Time Detection. As part of the new framework, to build a behavioral signature and detect metamorphic malware in real-time, we propose two novel techniques, named ACFG (Annotated Control Flow Graph) and SWOD-CFWeight (Sliding Window of Difference and Control Flow Weight). Unlike other techniques, ACFG provides a faster matching of CFGs, without compromising detection accuracy; it can handle malware with smaller CFGs, and contains more information and hence provides more accuracy than a CFG. SWOD-CFWeight mitigates and addresses key issues in current techniques, related to the change of the frequencies of opcodes, such as the use of different compilers, compiler optimizations, operating systems and obfuscations. The size of SWOD can change, which gives anti-malware tool developers the ability to select appropriate parameter values to further optimize malware detection. CFWeight captures the control flow semantics of a program to an extent that helps detect metamorphic malware in real-time. Experimental evaluation of the two proposed techniques, using an existing dataset, achieved detection rates in the range 94%–99.6%. Compared to ACFG, SWOD-CFWeight significantly improves the detection time, and is suitable to be used where the time for malware detection is more important as in real-time (practical) anti-malware applications.

A Framework for Analysis and Comparison of Dynamic Malware Analysis Tools

Malware writers have employed various obfuscation and polymorphism techniques to thwart static analysis approaches and bypassing antivirus tools. Dynamic analysis techniques, however, have essentially overcome these deceits by observing the actual behaviour of the code execution. In this regard, various methods, techniques and tools have been proposed. However, because of the diverse concepts and strategies used in the implementation of these methods and tools, security researchers and malware analysts find it difficult to select the required optimum tool to investigate the behaviour of a malware and to contain the associated risk for their study. Focusing on two dynamic analysis techniques: Function Call monitoring and Information Flow Tracking, this paper presents a comparison framework for dynamic malware analysis tools. The framework will assist the researchers and analysts to recognize the tools implementation strategy, analysis approach, system wide analysis support and its overall handling of binaries, helping them to select a suitable and effective one for their study and analysis.

Hunting for metamorphic JavaScript malware

The Internet plays a major role in the propagation of malware. A recent trend is the infection of machines through web pages, often due to malicious code inserted in JavaScript. From the malware writer’s perspective, one potential advantage of JavaScript is that powerful code obfuscation techniques can be applied to evade detection. In this research, we analyze metamorphic JavaScript malware. We compare the effectiveness of several static detection strategies and we quantify the degree of morphing required to defeat each of these techniques.

GPU-assisted malware

Malware writers constantly seek new methods to increase the infection lifetime of their malicious software. To that end, techniques such as code unpacking and polymorphism have become the norm for hindering automated or manual malware analysis and evading virus scanners. In this paper, we demonstrate how malware can take advantage of the ubiquitous and powerful graphics processing unit (GPU) to increase its robustness against analysis and detection. We present the design and implementation of brute-force unpacking and runtime polymorphism, two code armoring techniques based on the general-purpose computing capabilities of modern graphics processors. By running part of the malicious code on a different processor architecture with ample computational power, these techniques pose significant challenges to existing malware detection and analysis systems, which are tailored to the analysis of CPU code. We also discuss how upcoming GPU features can be used to build even more robust and evasive malware, as well as directions for potential defenses against GPU-assisted malware.

Generic Packing Detection Using Several Complexity Analysis for Accurate Malware Detection

The attackers do not want their Malicious software (or malwares) to be reviled by anti-virus analyzer. In order to conceal their malware, malware programmers are getting utilize the anti reverse engineering techniques and code changing techniques such as the packing, encoding and encryption techniques. Malware writers have learned that signature based detectors can be easily evaded by “packing” the malicious payload in layers of compression or encryption. State-of-the-art malware detectors have adopted both static and dynamic techniques to recover the payload of packed malware, but unfortunately such techniques are highly ineffective. If the malware is packed or encrypted, then it is very difficult to analyze. Therefore, to prevent the harmful effects of malware and to generate signatures for malware detection, the packed and encrypted executable codes must initially be unpacked. The first step of unpacking is to detect the packed executable files. The objective is to efficiently and accurately distinguish between packed and non-packed executables, so that only executables detected as packed will be sent to an general unpacker, thus saving a significant amount of processing time. The generic method of this paper show that it achieves very high detection accuracy of packed executables with a low average processing time. In this paper, a packed file detection technique based on complexity measured by several algorithms, and it has tested using a packed and unpacked dataset of file type .exe. The preliminary results are very promising where achieved high accuracy with enough performance. Where it achieved about 96% detection rate on packed files and 93% detection rate on unpacked files. The experiments also demonstrate that this generic technique can effectively prepared to detect unknown, obfuscated malware and cannot be evaded by known evade techniques.

Smartphone Malware and Its Propagation Modeling: A Survey

Smartphones are pervasively used in society, and have been both the target and victim of malware writers. Motivated by the significant threat that presents to legitimate users, we survey the current smartphone malware status and their propagation models. The content of this paper is presented in two parts. In the first part, we review the short history of mobile malware evolution since 2004, and then list the classes of mobile malware and their infection vectors. At the end of the first part, we enumerate the possible damage caused by smartphone malware. In the second part, we focus on smartphone malware propagation modeling. In order to understand the propagation behavior of smartphone malware, we recall generic epidemic models as a foundation for further exploration. We then extensively survey the smartphone malware propagation models. At the end of this paper, we highlight issues of the current smartphone malware propagation models and discuss possible future trends based on our understanding of this topic.

A Supervised Classification Approach for Detecting Packets Originated in a HTTP-based Botnet


 
 
 The possibilities that the management of a vast amount of computers and/or networks offer is attracting an increasing number of malware writers. In this document, the authors propose a methodology thought to detect malicious botnet traffic, based on the analysis of the packets that flow within the network. This objective is achieved by means of the extraction of the static characteristics of packets, which are lately analysed using supervised machine learning techniques focused on traffic labelling so as to proactively face the huge volume of information nowadays filters work with.
 
 

Metamorphic code generation from LLVM bytecode

Metamorphic software changes its internal structure across generations with its functionality remaining unchanged. Metamorphism has been employed by malware writers as a means of evading signature detection and other advanced detection strategies. However, code morphing also has potential security benefits, since it can serve to increase the “genetic diversity” of software. We have created a metamorphic code generator within the LLVM compiler framework. LLVM is a three-phase compiler that supports multiple source languages and target architectures. It uses a common intermediate representation (IR) bytecode in its optimizer. Consequently, any supported high-level programming language is transformed to this IR bytecode as part of the LLVM compilation process. Our metamorphic generator functions at the IR bytecode level, which provides many advantages over morphing at the assembly or source code level. The morphing techniques that we employ include dead code insertion and transposition, where the dead code is actually executed within the morphed code, making its detection and removal more challenging. We have verified the effectiveness of our code morphing using hidden Markov model analysis.

MAMA: MANIFEST ANALYSIS FOR MALWARE DETECTION IN ANDROID

The use of mobile phones has increased because they offer nearly the same functionality as a personal computer. In addition, the number of applications available for Android-based mobile devices has increased. Google offers programmers the opportunity to upload and sell applications in the Android Market, but malware writers upload their malicious code there. In light of this background, we present here manifest analysis for malware detection in Android (MAMA), a new method that extracts several features from the Android manifest of the applications to build machine learning classifiers and detect malware.

Pushdown model checking for malware detection

The number of malware is growing extraordinarily fast. Therefore, it is important to have efficient malware detectors. Malware writers try to obfuscate their code by different techniques. Many well-known obfuscation techniques rely on operations on the stack such as inserting dead code by adding useless push and pop instructions, or hiding calls to the operating system, etc. Thus, it is important for malware detectors to be able to deal with the program's stack. In this study, we propose a new model-checking approach for malware detection that takes into account the behavior of the stack. Our approach consists in: (1) Modeling the program using a pushdown system (PDS). (2) Introducing a new logic, called stack computation tree predicate logic (SCTPL), to represent the malicious behavior. SCTPL can be seen as an extension of the branching-time temporal logic CTL with variables, quantifiers, and predicates over the stack. (3) Reducing the malware detection problem to the model-checking problem of PDSs against SCTPL formulas. We show how our new logic can be used to precisely express malicious behaviors that could not be specified by existing specification formalisms. We then consider the model-checking problem of PDSs against SCTPL specifications. We reduce this problem to emptiness checking in Symbolic Alternating Buchi Pushdown Systems, and we provide an algorithm to solve this problem. We implemented our techniques in a tool and applied it to detect several viruses. Our results are encouraging.

A Survey on Security for Mobile Devices

Nowadays, mobile devices are an important part of our everyday lives since they enable us to access a large variety of ubiquitous services. In recent years, the availability of these ubiquitous and mobile services has significantly increased due to the different form of connectivity provided by mobile devices, such as GSM, GPRS, Bluetooth and Wi-Fi. In the same trend, the number and typologies of vulnerabilities exploiting these services and communication channels have increased as well. Therefore, smartphones may now represent an ideal target for malware writers. As the number of vulnerabilities and, hence, of attacks increase, there has been a corresponding rise of security solutions proposed by researchers. Due to the fact that this research field is immature and still unexplored in depth, with this paper we aim to provide a structured and comprehensive overview of the research on security solutions for mobile devices. This paper surveys the state of the art on threats, vulnerabilities and security solutions over the period 2004-2011, by focusing on high-level attacks, such those to user applications. We group existing approaches aimed at protecting mobile devices against these classes of attacks into different categories, based upon the detection principles, architectures, collected data and operating systems, especially focusing on IDS-based models and tools. With this categorization we aim to provide an easy and concise view of the underlying model adopted by each approach.

Android malware and mitigations

Just as the ubiquitous nature of Windows made it an enticing target for malware writers and cyber-criminals, so it is with Android. The maliciously inclined have not been slow to exploit the popularity of the platform. Steve Mansfield-Devine examines the nature of the malware problem and how Google's open approach to distribution makes implementing countermeasures difficult. But mitigation is possible, and there are signs that something is finally being done about the problem. Android might be a victim of its own popularity. Just as the ubiquitous nature of Windows made it an enticing target for malware writers and cyber-criminals, so it is with Android. Google's mobile OS is on more smartphones than any other operating system and products such as the Nexus 7 and Nexus 10 may finally result in Android gaining real traction in the tablet market. IDC estimates that more than 100 million Android smartphones were sold just in the first quarter of 2012, and in the third quarter, three out of four smartphones sold were running the OS. The maliciously inclined have not been slow to exploit this opportunity, but are they being helped by technical and procedural flaws in Android's architecture and the way apps are distributed?

Antivirus Software Shield Against Antivirus Terminators

In the last several decades, the arms race between malware writers and antivirus programmers has become more and more severe. The simplest way for a computer user to secure his computer is to install antivirus software on his computer. As antivirus software becomes more sophisticated and powerful, evading the detection of antivirus software becomes an important part of malware. As a result, malware writers have developed various approaches to increase the survivability and concealment of their malware. One of these technologies is to terminate antivirus software right after the execution of the malware. In this paper, we propose a mechanism, called ANtivirus Software Shield (ANSS), to prevent antivirus software from being terminated without the consciousness of the antivirus software users. ANSS uses System Service Descriptor Table (SSDT) hooking to intercept specific Windows APIs and analyzes them to filter out hazardous API calls that will terminate antivirus software. When using several pieces of malware that can terminate various brands of antivirus applications to make our experiments, the results show that ANSS can protect antivirus software from being terminated by them with at most 0.42% CPU performance overhead and 1.77% memory write performance overhead.