Abusing File Processing in Malware Detectors for Fun and Profit
Open Access
- 1 May 2012
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- No. 10816011,p. 80-94
- https://doi.org/10.1109/sp.2012.15
Abstract
We systematically describe two classes of evasion exploits against automated malware detectors. Chameleon attacks confuse the detectors' file-type inference heuristics, while werewolf attacks exploit discrepancies in format-specific file parsing between the detectors and actual operating systems and applications. These attacks do not rely on obfuscation, metamorphism, binary packing, or any other changes to malicious code. Because they enable even the simplest, easily detectable viruses to evade detection, we argue that file processing has become the weakest link of malware defense. Using a combination of manual analysis and black-box differential fuzzing, we discovered 45 new evasion exploits and tested them against 36 popular antivirus scanners, all of which proved vulnerable to various chameleon and werewolf attacks.Keywords
This publication has 2 references indexed in Scilit:
- Regular expressions considered harmful in client-side XSS filtersPublished by Association for Computing Machinery (ACM) ,2010
- Secure Content Sniffing for Web Browsers, or How to Stop Papers from Reviewing ThemselvesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2009