Phantom Malware: Conceal malicious actions by imitating user activity

https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=9186656#8866

by MalwareGuy • 5 years ago

89 24 5 years ago

ieeexplore.ieee.org

rychco• 5 years ago

The author also created a video demonstrating a PoC https://youtu.be/uf08omKOoxY

sabas123• 5 years ago

Imitating users to avoid detection isn't really a new technique

dang• 5 years ago

Submitted title was "New powerful malware obfuscation technique". Submitters: please don't do that. The site guidelines ask: "Please use the original title, unless it is misleading or linkbait; don't editorialize."

https://news.ycombinator.com/newsguidelines.html

We've changed the title above to the article title now (shortened to squeeze into HN's 80 char title limit.)

unnouinceput4• 5 years ago

All these techniques are based on the malicious software already having access to the system. As Raymond said "you're already on the other side of airtight door".

Perhaps instead of relying on antivirus/antimalware programs to protect you, better educate the user. In no future time will ever exists a program that will be 100% idiot proof ("the Universe will always come with a better idiot" - quote from somebody way smarter than me)

px432• 5 years ago

Or maybe instead of educating the users we should be educating the criminals so they can get paid to work on more productive things. Lots of solutions here.

etiam• 5 years ago

I like the basic idea, but at least if educating is to be understood as imparting trade knowledge and/or skills I seriously doubt if that particular deficit is what keeping most of those people off the straight and narrow.

cmeacham98• 5 years ago

While this is a potentially good idea to do in parallel, it is effectively impossible to reduce crime rate to literally zero, and the nature of the internet means that users can receive the same volume of malicious emails/ads and other malware vectors with fewer actors.

alisonkisk• 5 years ago

The idea that a single user can outsmart thousands of motivated professional criminals with powerful computers is a complete nonstarter.

unnouinceput4• 5 years ago

"Don't trust anything on internet"

"Don't click on links you don't trust"

See? 2 simple rules, that's all it takes.

supertrope• 5 years ago

Thus the appeal of walled gardens. The user can’t run malware if they can’t install any off app store software by default. Linux repositories are an earlier example. The current Windows ecosystem of the first search result being malware, downloading often unsigned .exe files and conditioning users to click next until they get what they want is a mess.

unnouinceput4• 5 years ago

Playstore is a walled garden. And this article is a wolf cry exactly against malware from Playstore. In the end same social engineer techniques employed to trick people to install malware directly (see Windows) can be employed to trick the walled garden gatekeepers to allow malware there.

I would argue that having walled garden is actually worse. Once malware is inside can wreck havoc far greater than the open system of Windows. Sure, you get fewer bad actors inside but those who do manage to get inside will be fully free because of the false security its users feel.

hoseja• 5 years ago

That "airtight door" phrase of his has always irked me very much. The audacity, when a new air leak springs about every fortnight.

unnouinceput4• 5 years ago

Yep, air leaks do happen. Not his fault though, but his blog is a gold mine of information, definitely top 5 to read religiously every day, don't you agree?

px432• 5 years ago

Unless you're using publicly available malware that is known to be used for crime, AV isn't going to detect anything. That's how it works, and that's how it has to work.

I haven'y fully read through the paper, but it doesn't look much different than what attackers have been doing with compiled AutoIT binaries for decades.

If it's on Github I'd be interested in looking at the code. If not it seems like just another academic paper misunderstanding the real problems faced by both attackers and defenders.

teilo• 5 years ago

Next-gen AV does not rely on signatures to detect malware so much as heuristics on steroids. I am especially familiar with SentinelOne. It can detect 0-day ransomeware, for example, as soon as it tries to encrypt files, and stop it in its tracks. Any product that does rely on signatures is useless these days.

dogma11383• 5 years ago

The heuristics aren’t on steroids but rather basic, SentinalOne, CrowdStrike, CarbonBlack etc. are still as dumb as a door knob, yes they can detect ransomeware because it’s quite easy to detect but their heuristics don’t extend to anything that is remotely sophisticated and doesn’t simply nuke the entire system.

ricardoa20• 5 years ago

In my opinion, we should be much more cautious with malware, since it can infect us and our information, even causing the loss of it. That is why to prevent them we must be more informed in cybersecurity. I recommend https://demyo.com/

Phantom Malware: Conceal malicious actions by imitating user activity

Related Stories