Advanced Persistent Threats – Silver Bullets That Fail

 Employ anti-malware engines;      

 Most use a defense-in-depth approach, with protections adapted to various vectors of attack;          

 Are mainstream so they benefit from the deep experience of malware research teams;                

 They are scalable, easy to install and maintain, and the price per user is relatively low    

 They are proclaimed as dead;

 The signature based products are useless against zero-day malware and attacks;

 The APTs are sophisticated and use fragmented, “low and slow” attacks that pass undetected by many endpoint protection technologies;

 The attackers check the malware they use against collections of scan engines (eg. Virus Total) to be sure they pass undetected

Are effective in dropping the known malicious websites, dangerous objects, suspicious connections;

Learn the legitimate patterns of traffic of the users and normally even prioritize the legitimate traffic using caching;

The databases are easy to make, implement and maintain and they can rely on automatic updating from built-in modules;

Can make use of distributed, cloud-based information.

May use the concept of “internet object reputation” (object = IP, host, website) that is calculated according to algorithms and user reporting. If some users report a malicious object as legitimate it will be whitelisted and no questions will be asked furthermore, enhancing the probability of spread.

Blacklisting uses a signature-like model and we already know that signatures normally don’t help much when facing an APT.

A technology that has been here for a while so the attackers already have found ways to avoid it (for example IP spoofing, DNS spoofing or hijacks, connection interception).

Theoretically they use a sandbox environment (virtualization, emulation) to launch the suspicious file/action payload and make a diagnostic without damaging the real environment;

It is a mature technology, and there are many experts that can help vendors make this more efficient and less resource-intense;

It is simple and theoretically effective.

The sandboxing is entirely dependent on each vendor, so each one proposes a better or worse implementation of the concept. The compromise between resource consumption and depth of analysis is sometimes leading to a false sence of security.

It is very hard to see it happening real time “at wire speed”, not even when using custom hardware, ASIC processing based.

It is used for suspicious and unknown files, in the other cases it functions as a signature-based technology. False positive may be an issue too, making it hard to use.

We have had the chance to take a look on training curricula for “black hats”. They have dedicated entire chapters to sandbox detection and evasion techniques. Moreover, in the reconnaissance phase of the APT they use tools to detect virtual environments and emulation.

It is a form of scanning that outlines the “stateful” properties of everything that is executed on the host: active processes, connections, memory addresses etc. It provides a good snapshot of the state of the host.

Theoretically it can detect instantly malicious components, infected processes, attempts to infect legitimate processes, attempts to use zero-day exploits, to abuse memory (buffer overflow, over run etc.)

Once detected a malicious file or behavior, it is rejected (isolated) and a pattern/signature is added (either locally and in a collective database)

It may generate a serious number of false positives, especially when the scanning is set on higher levels.

It makes snapshots, therefore it leaves apart “low and slow” fragmented. It has, however, a window of opportunity to detect the malware when inflated/decrypted, eventually executing in the memory.

Are very expensive to acquire, implement and normally they imply a team of analysts that must analyze thoroughly the alerts. 

Detect vulnerabilities in software and OS’s and report them, eventually facilitating the patching – either vendor issued patches, workarounds or virtual patches.

Some more advanced versions allow the user to assign values of impact and criticality, generating risk scores. Therefore we have a prioritization of the assets that is essential for knowing what we want to protect. Alerts can be prioritized accordingly.

A mature technology, with more than 10 years of existence, hence advanced update mechanisms, consolidated databases of vulnerabilities, clearly defined routines for vulnerability reporting etc.

However, every day, more and more vulnerabilities are reported and added and the rate is increasing.

Can do little against Zero-days. If the vulnerability is unknown, not reported or no patch is available there is nothing they can do.

Virtual patching is a subject our colleagues have explored in another post. There are known limitations.

By prioritizing the assets, when abused, they can provide a “map of treasures” for attackers (we have seen cases of APTs where even though the penetration has been successful, the attackers were still “wandering” the network for the valuable info).