|By Cory Marchand||
|December 21, 2012 11:32 AM EST||
To some of us, seeing an email with malware embedded in a PDF, Word or Excel attachment is common. In fact, it has become the new norm for malware delivery to use file types that are not obviously malicious (versus something like a .exe). Gone are the days of wide-open acceptance of all file extensions for attachments within an email. In today's network defense-in-depth techniques, one of the layers is naturally email security. This includes the scrutinizing of emails for embedded links or attachments that could be potentially malicious, scanning attachments for possible detectable viruses and even inspecting the mail header for details that could point to the continued use of a particular "sender" address targeting an organization.
With the delivery of the malware always evolving to avoid being detected, why is it so common to see multi-stage malware? What exactly IS multi-stage malware, and why can it be more difficult to detect through common defense-in-depth strategies? I recently sat with a customer who ran these questions by me. They were concerned that this might be some kind of new and sophisticated attack being used against their organization that their security team was not aware of. Truth is, this type of attack method is more common than you know, and has been going on for a significant period of time.
Let's start by tackling the easiest questions.
Question: What is multi-stage malware?
Answer: It is malware that is delivered in stages. Seriously, that's it.
Question: So then what are the stages?
Answer: Ah, I was hoping that was your next question...
The typical stages for the delivery are as follows;
Stage 1: The main goal of the first stage is to simply get some kind of execution on a victim computer to retrieve the larger portion of the malware. Utilizing a legitimate looking file (PDF, DOC, XLS) that is embedded with the stage 1 malware, the attacker can entice the target to open it, and allow execution. After execution, the first stage malware may also find some way to make itself persistent. What do I mean by persistent? Well let's say that as soon as you open an infected PDF, the stage 1 malware begins execution on your computer, but you happen to immediately shut down your computer. If that malware did not create some kind of way to re-execute after you start your computer, it will not execute again until you open the infected PDF again. Attackers know that it's unlikely you will re-open the attachment, so they like to build in a way for the malware to re-execute after your computer starts up. That way it is guaranteed to finish its initial job, which is to retrieve the next stage malware.
Stage2: This is where the more robust malware sections of the malware are introduced, potentially causing an unfettered amount of damage to its victim computer. Stage 2 typically gives the attacker an array of capabilities that are not available with stage 1, such as:
- Victim computer screen capture
- Start webcam
- Graphical ability to browse victim computer file system
- Stealing of files and software
- Deletion of files
- Elevation or escalation of privileges
- Keylogging and potential destruction of the victim file system
Furthermore, Stage 2 malware may also provide the ability for the attacker to migrate to another computer on the same network which provides the ability for even more extensive damage by allowing the attacker to spread out and cause an increase in damage.
Question: Are those the only stages of delivery?
Answer: Not always, but this is the most common. Sometimes "plugins" or "modules" are available to add to the malware, and they can be delivered or removed on an as needed basis. The attacker wants to limit the amount of network traffic to a particular domain that is hosting malware as this could lead to detection and blocking, which would stop the potential for successful delivery of any future malware or even stage 2.
Question: Why stage the delivery at all? Why not just embed all of the malware instead of a portion in the infected document or file?
Answer: There are a few reasons for staging the delivery, one of them being size. Simply put, if the size of the malware is large enough then embedding the whole thing into a PDF would make the file quite large; therefore, more suspicious. Another reason is to limit the possibility of detection through various scanners and traffic inspectors. The first stage of the malware is quite light in what commands and system calls that it makes which helps to evade detection by signature or even heuristics. It is not uncommon at all to see a PDF reader software open a PDF, then immediately connect to the Internet. Most PDF readers routinely check for updates as soon as they are opened, and attackers know this to be true often enough. So the stage 1 malware just hides within that behavior, reducing its ability to be detected. Lastly, development of custom malware is expensive and takes time, so losing the entire piece of malware due to detection of any sort can be a huge set back to the attackers. Even if the attackers are using commercial or open source attack tools, rebuilding them to avoid antivirus detection can be time consuming and costly. Losing the stage 1 malware through detection is easier to address than burning the complete malware package. By staging the delivery it limits the potential loss to the attacker. There many other reasons to break the malware up and retrieve upon infection, but these are some of the most important ones.
Question: This is making more and more sense to me, but just quickly can you go over why it's much harder to detect?
Answer: The smaller and more embedded the malware is, the more difficult to detect, especially inside of a commonly used and trusted file. When the commands for the malware are simplified as well as the needs from a victim computer to execute, again, detection is difficult. When malware is overly complicated, or it has large consumption requirements from the operating system to correctly function, the chances for detection though defense-in-depth techniques is increased. Large, complicated malware is more likely to break and alert the user to its presence, or even get detected by antivirus. It is also most likely to fail Deep Packet Inspection at the IDS/IPS layer due to possible signatures for specific system calls the malware makes. Small, simple malware finds a home inside of the most common files and documents that we not only use and open every day, but also are typically allowable as an attachment in an email. Because the malware is small, it can be easily modified, making signature development almost impossible. Breaking the malware apart also changes which security tools are inspecting the malware. If stage 1 is delivered through an email, than you will have to get through an IDS/IPS, an Email AntiVirus product (if you are dealing with an enterprise), as well as any attachment inspection that occurs on the email gateway. Stage 2 is then delivered after successful infection of victim computer, typically after the victim computer asks a particular web server for the stage 2 malware. If this request is done over SSL/HTTPS, then there is a good chance there will be no inspection of the malware until it reaches the host. At delivery, the malware has to contend with antivirus on the victim computer, which is trivial for a sophisticated attacker to either bypass or defeat.
Question: If it's so damn hard to detect, how on earth do I stop it?
Answer: Excellent question, this is something we can address in my next blog, "Better Host Based Protection, Logically".
SYS-CON Events announced today that Embotics, the cloud automation company, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Embotics is the cloud automation company for IT organizations and service providers that need to improve provisioning or enable self-service capabilities. With a relentless focus on delivering a premier user experience and unmatched customer support, Embotics is the fas...
Oct. 21, 2016 02:00 PM EDT Reads: 610
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
Oct. 21, 2016 02:00 PM EDT Reads: 6,770
SYS-CON Events announced today that Coalfire will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Coalfire is the trusted leader in cybersecurity risk management and compliance services. Coalfire integrates advisory and technical assessments and recommendations to the corporate directors, executives, boards, and IT organizations for global brands and organizations in the technology, cloud, health...
Oct. 21, 2016 01:45 PM EDT Reads: 1,448
The IoT industry is now at a crossroads, between the fast-paced innovation of technologies and the pending mass adoption by global enterprises. The complexity of combining rapidly evolving technologies and the need to establish practices for market acceleration pose a strong challenge to global enterprises as well as IoT vendors. In his session at @ThingsExpo, Clark Smith, senior product manager for Numerex, will discuss how Numerex, as an experienced, established IoT provider, has embraced a ...
Oct. 21, 2016 01:00 PM EDT Reads: 900
Cloud based infrastructure deployment is becoming more and more appealing to customers, from Fortune 500 companies to SMEs due to its pay-as-you-go model. Enterprise storage vendors are able to reach out to these customers by integrating in cloud based deployments; this needs adaptability and interoperability of the products confirming to cloud standards such as OpenStack, CloudStack, or Azure. As compared to off the shelf commodity storage, enterprise storages by its reliability, high-availabil...
Oct. 21, 2016 01:00 PM EDT Reads: 916
SYS-CON Events announced today that MathFreeOn will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. MathFreeOn is Software as a Service (SaaS) used in Engineering and Math education. Write scripts and solve math problems online. MathFreeOn provides online courses for beginners or amateurs who have difficulties in writing scripts. In accordance with various mathematical topics, there are more tha...
Oct. 21, 2016 12:15 PM EDT Reads: 862
@ThingsExpo has been named the Top 5 Most Influential Internet of Things Brand by Onalytica in the ‘The Internet of Things Landscape 2015: Top 100 Individuals and Brands.' Onalytica analyzed Twitter conversations around the #IoT debate to uncover the most influential brands and individuals driving the conversation. Onalytica captured data from 56,224 users. The PageRank based methodology they use to extract influencers on a particular topic (tweets mentioning #InternetofThings or #IoT in this ...
Oct. 21, 2016 12:00 PM EDT Reads: 8,049
More and more brands have jumped on the IoT bandwagon. We have an excess of wearables – activity trackers, smartwatches, smart glasses and sneakers, and more that track seemingly endless datapoints. However, most consumers have no idea what “IoT” means. Creating more wearables that track data shouldn't be the aim of brands; delivering meaningful, tangible relevance to their users should be. We're in a period in which the IoT pendulum is still swinging. Initially, it swung toward "smart for smar...
Oct. 21, 2016 10:50 AM EDT Reads: 220
Complete Internet of Things (IoT) embedded device security is not just about the device but involves the entire product’s identity, data and control integrity, and services traversing the cloud. A device can no longer be looked at as an island; it is a part of a system. In fact, given the cross-domain interactions enabled by IoT it could be a part of many systems. Also, depending on where the device is deployed, for example, in the office building versus a factory floor or oil field, security ha...
Oct. 21, 2016 10:45 AM EDT Reads: 1,640
SYS-CON Events announced today that Transparent Cloud Computing (T-Cloud) Consortium will exhibit at the 19th International Cloud Expo®, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The Transparent Cloud Computing Consortium (T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data proces...
Oct. 21, 2016 10:30 AM EDT Reads: 1,228
Donna Yasay, President of HomeGrid Forum, today discussed with a panel of technology peers how certification programs are at the forefront of interoperability, and the answer for vendors looking to keep up with today's growing industry for smart home innovation. "To ensure multi-vendor interoperability, accredited industry certification programs should be used for every product to provide credibility and quality assurance for retail and carrier based customers looking to add ever increasing num...
Oct. 21, 2016 09:15 AM EDT Reads: 272
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and ...
Oct. 21, 2016 08:45 AM EDT Reads: 1,371
@ThingsExpo has been named the Top 5 Most Influential M2M Brand by Onalytica in the ‘Machine to Machine: Top 100 Influencers and Brands.' Onalytica analyzed the online debate on M2M by looking at over 85,000 tweets to provide the most influential individuals and brands that drive the discussion. According to Onalytica the "analysis showed a very engaged community with a lot of interactive tweets. The M2M discussion seems to be more fragmented and driven by some of the major brands present in the...
Oct. 21, 2016 08:45 AM EDT Reads: 11,123
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to impr...
Oct. 21, 2016 08:00 AM EDT Reads: 5,583
Data is the fuel that drives the machine learning algorithmic engines and ultimately provides the business value. In his session at Cloud Expo, Ed Featherston, a director and senior enterprise architect at Collaborative Consulting, will discuss the key considerations around quality, volume, timeliness, and pedigree that must be dealt with in order to properly fuel that engine.
Oct. 21, 2016 07:45 AM EDT Reads: 3,735
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
Oct. 21, 2016 07:15 AM EDT Reads: 1,284
Virgil consists of an open-source encryption library, which implements Cryptographic Message Syntax (CMS) and Elliptic Curve Integrated Encryption Scheme (ECIES) (including RSA schema), a Key Management API, and a cloud-based Key Management Service (Virgil Keys). The Virgil Keys Service consists of a public key service and a private key escrow service.
Oct. 21, 2016 07:15 AM EDT Reads: 883
Web Real-Time Communication APIs have quickly revolutionized what browsers are capable of. In addition to video and audio streams, we can now bi-directionally send arbitrary data over WebRTC's PeerConnection Data Channels. With the advent of Progressive Web Apps and new hardware APIs such as WebBluetooh and WebUSB, we can finally enable users to stitch together the Internet of Things directly from their browsers while communicating privately and securely in a decentralized way.
Oct. 21, 2016 06:45 AM EDT Reads: 1,796
Amazon has gradually rolled out parts of its IoT offerings, but these are just the tip of the iceberg. In addition to optimizing their backend AWS offerings, Amazon is laying the ground work to be a major force in IoT - especially in the connected home and office. In his session at @ThingsExpo, Chris Kocher, founder and managing director of Grey Heron, explained how Amazon is extending its reach to become a major force in IoT by building on its dominant cloud IoT platform, its Dash Button strat...
Oct. 21, 2016 06:15 AM EDT Reads: 4,656
Two weeks ago (November 3-5), I attended the Cloud Expo Silicon Valley as a speaker, where I presented on the security and privacy due diligence requirements for cloud solutions. Cloud security is a topical issue for every CIO, CISO, and technology buyer. Decision-makers are always looking for insights on how to mitigate the security risks of implementing and using cloud solutions. Based on the presentation topics covered at the conference, as well as the general discussions heard between sessi...
Oct. 21, 2016 05:45 AM EDT Reads: 5,053