Malware Uncertainty & False Positives

The antivirus industry has been trying to deal with false positive detection issues for a long, long time -and it’s not going to be fixed anytime soon. To better understand why, the physicist in me draws an analogy with Heisenberg’s Uncertainty Principle – where, in its simplest distillation, the better you know where an atom is, the less likely you’ll know it’s momentum (and vice versa) – aka the “observer effect“. In the malware detection world, the more positive you are that something is malware, the less likely you’ll catch other malware. And the reverse of that, the better you are at detecting a spectrum of malware, the less positive you will be that it is malware.

If that particular geek-flash doesn’t make sense to you, let me offer you this alternative insight then. The highest fidelity malware detection system is going to be signature based. The more exacting the signature (which optimally would be a unique hash value for a particular file), the greater the precision in detecting a particular malicious file – however, the precision of the signature means that other malicious files that don’t meet the exacting rule of the signature will slip by. On the other hand, a set of behaviors that together could label a binary file as malicious is less exacting, but able to detect a broader spectrum of malware. The price for that flexibility and increased capability of detecting bad stuff comes at the cost of an increased probability of false positive detections.

In physics there’s a variable, ℏ the reduced Planck constant – that acts a bit like the fulcrum of a teeter-totter (“seesaw” for the non-American rest-of-the-world); it’s also a fundamental constant of our universe – like the speed of light. In the antivirus world of Uncertainty Principles the fulcrum isn’t a universal constant, instead you could probably argue that it’s a function of cash. The more money you throw at the uncertainty problem, the more gravity-defying the teeter-totter would appear to become.

That may all sound a little discomforting. Yes, the more capable your antivirus detection technologies are in detecting malware, the more frequently false positives will crop up. But you should also bear in mind that, in general, the overall percentage of false positives tends to go down (if everyone is doing things properly). What does that mean in reality? If you’re rarely encountering false positives with your existing antivirus defenses, you’re almost certainly missing a whole lot of maliciousness. It would be nice to say that if you’re getting a whole lot of false positives you must, by corollary, be detecting (and stopping) a shed-load of malware — but I don’t think that’s always the case; it may be because you’re just doing it wrong. Or, as the French would say – C’est la vie.

DIY Malware - Octopus Keylogger

As is so often the case, I'm trying to pull content together fresh content for a presentation at the last minute - this one about DIY malware creator kits.

So, with a quick browse and a few Google searches I come across a batch of new DIY kits - "new" in the context that I hadn't stumbled upon them before (neither for public download as a generator kit or circulating "in the wild" as malware).

I find it interesting that there is such a variety of region-specific DIY kits.

One of the regional DIY kits I came across has just made the transition from freeware to a commercial offering. This kit - called "Octopus Keylogger" - has been developed by a Spanish author and offers the usual assortment of keylogging goodies for the low price of €20 ($30)...

* Encrypted FTP and Email of captured key logs,
* UPX compression
* Local and remote keylogging
* Peer-to-peer infection vectors
* Bypassing of host system logging
* Downloader creator
* "100% undetectable" executable stub
* Scheduled uploading of captured key logs
* Disabling of Task Manager
* Add two autorun's (HKEY_LOCAL_MACHINE) and (HKEY_CURRENT_USER)
* Supports Windows XP SP2/SP3, Windows Vista and Windows 7

The author, SharkI, has been experimenting with the keylogging technology for quite some time and this latest commercial version appears to have been based off the the DigitalX.

SharkI has previously published the keyloggers and DIY creators kits called:
* Royal Stealer (now in to its second edition - source code for the first version is now public)
* Virus Maker (written in visual basic)
* Call of Duty WAW Stealer (game license key stealer)
* Call of Duty 4 Stealer



On the point of Royal Stealer, it's interesting to note which applications the tool is designed to steal passwords and obtain registration keys from...
* Internet Explorer
* Mozilla Firefox
* Windows Live Messenger
* Winzip
* PhotoShop 7.0
* Symantec Anti-virus
* No-Ip
* mIrc
* Norton Antivirus
* COD SAGA (Game)
* Burnout Paradise (Game)
* Crysis Wars (Game)
* Counter Strike (Game)
* BattleField2 (Game)
* RainbowSix (Game)
* The Gladiators (Game)

Mobile Phone Viruses

There's a very interesting article in the latest issue of Science titled "Understanding the Spreading Patterns of Mobile Phone Viruses". While the whole article isn't online, the supporting documentation is available - but if you want to read the article, then you'll have to pick up a copy of the latest Science magazine.

The article covers the spread of mobile phone viruses and makes use of a dataset associated with 6.2 million mobile customers and some 10,000 mobile phone towers. I hope that data was sufficiently anonymized.

From the abstract:
"We model the mobility of mobile phone users to study the fundamental spreading patterns characterizing a mobile virus outbreak. We find that while Bluetooth viruses can reach all susceptible handsets with time, they spread slowly due to human mobility, offering ample opportunities to deploy antiviral software. In contrast, viruses utilizing multimedia messaging services could infect all users in hours, but currently a phase transition on the underlying call graph limits them to only a small fraction of the susceptible users. These results explain the lack of a major mobile virus breakout so far and predict that once a mobile operating system’s market share reaches the phase transition point, viruses will pose a serious threat to mobile communications."

I've been looking in to mobile phone viruses and methods for protecting against them for a few years now, and I'd largely agree with the findings of the article and there are some very pretty diagrams as to how the viruses propagate via Bluetooth and MMS, which is helpful in introducing others to the topic.

An area of contention though relates to the MMS propagation path. While MMS viruses can propagate very fast and to a much broader population (requiring no physical proximity), unlike Bluetooth viruses, they are much easier to stop. Since the payloads have to pass through the carriers MMS transport, it is easy to intercept the malicious content centrally - thereby halting propagation.

To some degree the major carriers have started down this path, and were eventually successful against mobile viruses like CommWarrior a few years back. Future mass-MMSing malware will be easy enough to detect and stop using the technologies already in place - subject to client-side polymorphism adoption (which hasn't been done seriously beyond some proof-of-concept samples -- yet!).

An area of future concern though is standard Web propagation techniques. Since most new smartphones allow comprehensive Internet access and have their own Web browsers (and other online services), I believe that mobile phones are increasingly going to fall to drive-by-download attack vectors and most of the badness that desktop hosts have been combating for several years.

That said, I don't think that third-party developed host-based protection (e.g. "desktop" Anti-virus) is a real solution for mobile phones. The dynamics between carrier, device and customer are very different when compared to desktop relationships. The consequence of this different relationship is that the mobile phone carrier has to do the heavy lifting in protection but, more importantly, they're in a much better position to do this.