CIA’s ability to hack phones, computers, routers, TVs and just about anything didn’t surprise me – if NSA is able to do it, why couldn’t they. What impressed me the most is CIA’s witty approach to anti-virus evasion. Allow me to entertain you with world-class solutions to some problems in the field of AV evasion. This topic will be covered in a series of analytical articles as opposed to this relaxed introduction, so stay tuned!
Anti-Sandboxing: Wait for Mouse Click
Many anti-virus programs run the suspicious binary in emulated environment (sandbox) to see what happens. A handy trick, spotted by malware in the wild is to wait for the user to click before proceeding to malicious actions. A sandbox environments don’t mimic mouse actions (probably all of them) and will never execute the malicious behavior. This is probably effective against Kaspersky and others.
AVG Fake Installer Trick
Subtitle is kinda self-explanatory – naming your .exe “setup.exe” causes it to run undetected in many cases. Additional bonus, Windows will add the “shield” icon to the binary. Downside of this trick is a possible pop-up saying “Program didn’t install properly”, but it can be avoided by carefully crafting the manifest file.
Defeating Entropy Analysis
Avira and F-Secure are known for checking the amount of entropy in the binary so if the program contains encrypted shellcode, it won’t pass the test. Unless it has a RAR manifest file – then, of course, entropy is caused by archiving software. Also, CIA suggests adding RAR signature at the end of the file. Sweet!
Comodo Pitfalls
Let’s try with Comodo,a great piece of antivirus software (not sarcasm, really). Quote by CIA employee:
“Comodo is a giant PITA. It can and will catch and show your entire chain of execution and a great deal of your file I/O. If you drop and run, it will show where you drop, what you run, and what you run runs. Yeah, it’s that bad.”
But, there’s an oasis for malware binaries – Recycle Bin. Comodo doesn’t like trash, so it doesn’t dig there. Placing the binary in the root directory of the bin will ensure safe start for the malware, although the battle is not yet over as Comodo will detect some obviously malicious actions after that point.
Comodo takes a lot of computer resources to give malware authors mentioned colossal pain in the posterior. It literally monitors everything, including standard Windows services (!!). At least it did, before versions 6.X. Apparently, they decided that was suboptimal and made a step in the other direction. One big step, I gotta say – anything running with SYSTEM privileges is considered legit. Read that again, because if you got a kernel level exploit, you can play drums on the SYSTEM parts and as long as you run as SYSTEM, you’re fine. By the words of CIA employee: “this is a hole you could drive a very large wheeled freight carrying vehicle through”.
Unfortunately, many tricks are left as empty files and marked as “secret”, but let’s not be greedy here. If you like this topic, you can check CIA’s malware writing instructions that were written with forensic analysis in mind. Also, don’t miss my future series about evading anti-virus if you enjoy studying this as much as I do.
TheBitcoinNews.com – Bitcoin News source since June 2011 –
Virtual currency is not legal tender, is not backed by the government, and accounts and value balances are not subject to consumer protections. TheBitcoinNews.com holds several Cryptocurrencies, and this information does NOT constitute investment advice or an offer to invest.
Everything on this website can be seen as Advertisment and most comes from Press Releases, TheBitcoinNews.com is is not responsible for any of the content of or from external sites and feeds. Sponsored posts are always flagged as this, guest posts, guest articles and PRs are most time but NOT always flagged as this. Expert opinions and Price predictions are not supported by us and comes up from 3th part websites.
Advertise with us : Advertise
Our Social Networks: Facebook Instagram Pinterest Reddit Telegram Twitter Youtube
