Welcome!

Cloud Security Authors: Elizabeth White, Ed Featherston, Pat Romanski, Liz McMillan, Donald Meyer

Related Topics: Cloud Security

Cloud Security: Blog Post

Malware Delivery – Understanding Multiple Stage Malware

How trusted file attachments has opened the vector for continued intrusions.

To some of us, seeing an email with malware embedded in a PDF, Word or Excel attachment is common. In fact, it has become the new norm for malware delivery to use file types that are not obviously malicious (versus something like a .exe). Gone are the days of wide-open acceptance of all file extensions for attachments within an email. In today's network defense-in-depth techniques, one of the layers is naturally email security. This includes the scrutinizing of emails for embedded links or attachments that could be potentially malicious, scanning attachments for possible detectable viruses and even inspecting the mail header for details that could point to the continued use of a particular "sender" address targeting an organization.

With the delivery of the malware always evolving to avoid being detected, why is it so common to see multi-stage malware? What exactly IS multi-stage malware, and why can it be more difficult to detect through common defense-in-depth strategies? I recently sat with a customer who ran these questions by me.  They were concerned that this might be some kind of new and sophisticated attack being used against their organization that their security team was not aware of. Truth is, this type of attack method is more common than you know, and has been going on for a significant period of time.

Let's start by tackling the easiest questions.

Question: What is multi-stage malware?

Answer: It is malware that is delivered in stages.  Seriously, that's it.

Question: So then what are the stages?

Answer: Ah, I was hoping that was your next question...

The typical stages for the delivery are as follows;

Stage 1: The main goal of the first stage is to simply get some kind of execution on a victim computer to retrieve the larger portion of the malware.  Utilizing a legitimate looking file (PDF, DOC, XLS) that is embedded with the stage 1 malware, the attacker can entice the target to open it, and allow execution. After execution, the first stage malware may also find some way to make itself persistent. What do I mean by persistent? Well let's say that as soon as you open an infected PDF, the stage 1 malware begins execution on your computer, but you happen to immediately shut down your computer.  If that malware did not create some kind of way to re-execute after you start your computer, it will not execute again until you open the infected PDF again. Attackers know that it's unlikely you will re-open the attachment, so they like to build in a way for the malware to re-execute after your computer starts up.  That way it is guaranteed to finish its initial job, which is to retrieve the next stage malware.

Stage2: This is where the more robust malware sections of the malware are introduced, potentially causing an unfettered amount of damage to its victim computer. Stage 2 typically gives the attacker an array of capabilities that are not available with stage 1, such as:

  • Victim computer screen capture
  • Start webcam
  • Graphical ability to browse victim computer file system
  • Stealing of files and software
  • Deletion of files
  • Elevation or escalation of privileges
  • Keylogging and potential destruction of the victim file system

Furthermore, Stage 2 malware may also provide the ability for the attacker to migrate to another computer on the same network which provides the ability for even more extensive damage by allowing the attacker to spread out and cause an increase in damage.

Question: Are those the only stages of delivery?

Answer: Not always, but this is the most common.  Sometimes "plugins" or "modules" are available to add to the malware, and they can be delivered or removed on an as needed basis.  The attacker wants to limit the amount of network traffic to a particular domain that is hosting malware as this could lead to detection and blocking, which would stop the potential for successful delivery of any future malware or even stage 2.

Question: Why stage the delivery at all?  Why not just embed all of the malware instead of a portion in the infected document or file?

Answer: There are a few reasons for staging the delivery, one of them being size. Simply put, if the size of the malware is large enough then embedding the whole thing into a PDF would make the file quite large; therefore, more suspicious.  Another reason is to limit the possibility of detection through various scanners and traffic inspectors. The first stage of the malware is quite light in what commands and system calls that it makes which helps to evade detection by signature or even heuristics. It is not uncommon at all to see a PDF reader software open a PDF, then immediately connect to the Internet. Most PDF readers routinely check for updates as soon as they are opened, and attackers know this to be true often enough.  So the stage 1 malware just hides within that behavior, reducing its ability to be detected. Lastly, development of custom malware is expensive and takes time, so losing the entire piece of malware due to detection of any sort can be a huge set back to the attackers. Even if the attackers are using commercial or open source attack tools, rebuilding them to avoid antivirus detection can be time consuming and costly. Losing the stage 1 malware through  detection is easier to address than burning the complete malware package. By staging the delivery it limits the potential loss to the attacker. There many other reasons to break the malware up and retrieve upon infection, but these are some of the most important ones.

Question: This is making more and more sense to me, but just quickly can you go over why it's much harder to detect?

Answer: The smaller and more embedded the malware is, the more difficult to detect, especially inside of a commonly used and trusted file. When the commands for the malware are simplified as well as the needs from a victim computer to execute, again, detection is difficult. When malware is overly complicated, or it has large consumption requirements from the operating system to correctly function, the chances for detection though defense-in-depth techniques is increased. Large, complicated malware is more likely to break and alert the user to its presence, or even get detected by antivirus. It is also most likely to fail Deep Packet Inspection at the IDS/IPS layer due to possible signatures for specific system calls the malware makes. Small, simple malware finds a home inside of the most common files and documents that we not only use and open every day, but also are typically allowable as an attachment in an email. Because the malware is small, it can be easily modified, making signature development almost impossible. Breaking the malware apart also changes which security tools are inspecting the malware. If stage 1 is delivered through an email, than you will have to get through an IDS/IPS, an Email AntiVirus product (if you are dealing with an enterprise), as well as any attachment inspection that occurs on the email gateway. Stage 2 is then delivered after successful infection of victim computer, typically after the victim computer asks a particular web server for the stage 2 malware. If this request is done over SSL/HTTPS, then there is a good chance there will be no inspection of the malware until it reaches the host.  At delivery, the malware has to contend with antivirus on the victim computer, which is trivial for a sophisticated attacker to either bypass or defeat.

Question: If it's so damn hard to detect, how on earth do I stop it?

Answer: Excellent question, this is something we can address in my next blog, "Better Host Based Protection, Logically".

More Stories By Cory Marchand

Cory Marchand is a trusted subject matter expert on topics of Cyber Security Threats, Network and Host based Assessment and Computer Forensics. Mr. Marchand has supported several customers over his 10+ years within the field of Computer Security including State, Federal and Military Government as well as the Private sector. Mr. Marchand holds several industry related certificates including CISSP, EnCE, GSEC, GCIA, GCIH, GREM, GSNA and CEH.

@ThingsExpo Stories
SYS-CON Events announced today that ContentMX, the marketing technology and services company with a singular mission to increase engagement and drive more conversations for enterprise, channel and SMB technology marketers, has been named “Sponsor & Exhibitor Lounge Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York. “CloudExpo is a great opportunity to start a conversation with new prospects, but what happens after the...
The IoTs will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm and share the must-have mindsets for removing complexity from the development proc...
SYS-CON Events announced today that EastBanc Technologies will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. EastBanc Technologies has been working at the frontier of technology since 1999. Today, the firm provides full-lifecycle software development delivering flexible technology solutions that seamlessly integrate with existing systems – whether on premise or cloud. EastBanc Technologies partners with p...
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, will discuss the importance of WebRTC and how it enables companies to fo...
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discuss how businesses can gain an edge over competitors by empowering consumers to take control through IoT. We'll cite examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He'll also highlight how IoT can revitalize and restore outdated business models, making them profitable...
SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MangoApps provides modern company intranets and team collaboration software, allowing workers to stay connected and productive from anywhere in the world and from any device. For more information, please visit https://www.mangoapps.com/.
SYS-CON Events announced today the How to Create Angular 2 Clients for the Cloud Workshop, being held June 7, 2016, in conjunction with 18th Cloud Expo | @ThingsExpo, at the Javits Center in New York, NY. Angular 2 is a complete re-write of the popular framework AngularJS. Programming in Angular 2 is greatly simplified. Now it’s a component-based well-performing framework. The immersive one-day workshop led by Yakov Fain, a Java Champion and a co-founder of the IT consultancy Farata Systems and...
What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
SYS-CON Events announced today that MobiDev will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business managers to a full-scale mobile software company with over 200 develope...
As cloud and storage projections continue to rise, the number of organizations moving to the cloud is escalating and it is clear cloud storage is here to stay. However, is it secure? Data is the lifeblood for government entities, countries, cloud service providers and enterprises alike and losing or exposing that data can have disastrous results. There are new concepts for data storage on the horizon that will deliver secure solutions for storing and moving sensitive data around the world. ...
SoftLayer operates a global cloud infrastructure platform built for Internet scale. With a global footprint of data centers and network points of presence, SoftLayer provides infrastructure as a service to leading-edge customers ranging from Web startups to global enterprises. SoftLayer's modular architecture, full-featured API, and sophisticated automation provide unparalleled performance and control. Its flexible unified platform seamlessly spans physical and virtual devices linked via a world...
Companies can harness IoT and predictive analytics to sustain business continuity; predict and manage site performance during emergencies; minimize expensive reactive maintenance; and forecast equipment and maintenance budgets and expenditures. Providing cost-effective, uninterrupted service is challenging, particularly for organizations with geographically dispersed operations.
SYS-CON Events announced today TechTarget has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. TechTarget is the Web’s leading destination for serious technology buyers researching and making enterprise technology decisions. Its extensive global networ...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
The essence of data analysis involves setting up data pipelines that consist of several operations that are chained together – starting from data collection, data quality checks, data integration, data analysis and data visualization (including the setting up of interaction paths in that visualization). In our opinion, the challenges stem from the technology diversity at each stage of the data pipeline as well as the lack of process around the analysis.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Designing IoT applications is complex, but deploying them in a scalable fashion is even more complex. A scalable, API first IaaS cloud is a good start, but in order to understand the various components specific to deploying IoT applications, one needs to understand the architecture of these applications and figure out how to scale these components independently. In his session at @ThingsExpo, Nara Rajagopalan is CEO of Accelerite, will discuss the fundamental architecture of IoT applications, ...