Posted by Virus Bulletin on May 14, 2013
Users cautioned to be wary of a false sense of security.
Could you defeat VM-aware malware by making your system aware of VM-aware malware?
Tricks to frustrate researchers and make automatic analysis more difficult are a common feature of today's malware. One such trick is to make the malware 'VM-aware': it won't run if it detects that it is being executed in a virtual environment.
Two researchers at Rapid7, the company behind the Metasploit tool, have attempted to turn this trick on its head and use it against the malware. They have written a small proof-of-concept program that creates a number of registry keys, files and directories and starts some processes - all of which make it look as if the machine on which the program is running is, in fact, a virtual environment and that a popular debugger is being used.
While, as the researchers readily admit, this is by no means a new idea, it is a nice one and could work against many of the larger malware outbreaks. It is part of the general idea of 'security through obscurity', which also includes running services on non-standard ports, or using non-default directory names for web tools like WordPress. If the obscurity is performed well enough, it could work against many automated threats.
But one should be wary of a false sense of security: malware would work just as well without the anti-analysis functionality. Malware authors may also start to include checks for tools like the one created by the researchers.
Cryptography experts commonly refer to Kerckhoff's principle: the idea that a cryptographic system should be secure, even if everything about it (except for the key) is known to the attacker. This applies here as well: the tools could prevent some malware from infecting your machine, and that would of course be a good thing, but you should still act as if you are just as vulnerable.
Posted on 14 May 2013 by Martijn Grooten
