--Storm Virus Showcases Failure of Anti Virus Technology
(5 March 2007)
By using more than 54,000 slightly different variants, the storm worm Trojan horse successfully used small changes to evade most anti virus products. This is a technique now used by most current and relevant malware. It demonstrates the futility of counting on anti virus software for protection.
http://www.securityfocus.com/news/11446?ref=rssStormy weather for malware defenses
Robert Lemos, SecurityFocus 2007-03-05
When the Storm Worm swept through the Internet in mid-January, the program's writers took a brute force approach to evading antivirus defenses: They created a massive number of slightly different copies of the program and released them all at the same time.
“ Signatures are still needed but the amount of malware that is being produced and the speed with which it changes means that you need a lot of researchers. ”
Alex Shipp, security researcher, MessageLabs On January 18, the day the misnamed program--a Trojan horse, not a worm--first appeared, more than 350 different variants were released, according to report penned by security firm CommTouch Software. Four days later, the number of slightly-different versions jumped to more than 7,300. By the end of January, more than 54,000 variants had hit the Internet, the report (PDF) stated, each one spammed out by computers previously compromised by the program.
"Virus writers' goals have changed," Amir Lev, CEO of CommTouch, said in an e-mail interview with SecurityFocus. "They are doing 'good' business now. They do not focus on finding vulnerabilities in Microsoft and other products, they look for 'vulnerabilities' (in) the AV (antivirus) systems."
The technique is effective. While antivirus program's pattern recognition algorithms, frequently referred to as heuristics, may have stopped a large fraction of the variants, creating signatures to catch all the versions takes time. Response to a new variant--including developing, testing and distributing a signatures--takes hours at a minimum. Responding to thousands can take much longer.
During a January interview, one McAfee researcher underscored the headaches caused by the Storm Worm.
"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in an interview with SecurityFocus. "They have had mass seedings of new variants every day this week."
The program highlights a number of changes in the techniques used by criminal Internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of e-mail through previously compromised computers. Each burst typically sends out a custom variant, trying to infect systems before the user updates their antivirus definitions. The program compromises systems by luring their users into opening the attachments of messages with subject lines regarding current news events, including violent storms in Europe--a characteristic that led to the program's naming.
While some other programs have used a similar tactics, the Storm Worm's focus on propagation through sheer permutation carries the trend to a new level. The technique exploits a weakness, not in the software, but in the system. Analyzing malicious code requires, for the most part, human researchers, and the coders hope to overwhelm the human component long enough to compromise as many systems as needed.
"Signatures are still needed but the amount of malware that is being produced and the speed with which it changes means that you need a lot of researchers," said Alex Shipp, a researcher for e-mail security provider MessageLabs.
Other firms have witnessed the trend first hand. In 2006, antivirus firm Kaspersky Lab added 80,000 virus-pattern records to its product, roughly doubling the number added in 2005, said Eugene Kaspersky, the co-founder and head of research and development for antivirus firm.
"This is a competition where the antivirus companies, I fear, are not in a good position," Kaspersky said.
The Storm Worm is all about creating massive networks of compromised computers that can be controlled by a single group or individual. The networks, known as bot nets, don't need to be large to be useful. A bot net of several thousand computers is more than enough to mount a severe denial-of-service attack or send out a digital deluge of stock spam--common uses for the networks--and, of course, send out more copies of the Trojan horse. (This aspect of the Storm Worm is the subject of the first part of this two-part series.)
"The guys are very aggressive with the variants, and that has defeated the more simplistic AV engines out there," said Jose Nazario, senior security researcher for Arbor Networks.
The Storm Worm is likely responsible for creating a bot net that contains more than 20,000 computers and perhaps as many as 100,000, Nazario said. Other evidence appears to indicate that there is more than one Storm Worm-related bot net.
The spread of the Storm Worm has forced antivirus firms to create better defenses to automatically block such threats, rather than depend on simple heuristics or signatures.
Unlike previous malicious code, such as mass-mailing computer viruses, the Storm Worm is not a program that spreads aggressively on its own. Rather, the Trojan horse awaits orders from a central command post to send out the next round of variants. The control has made the program, if not stealthy, then more difficult to stop. The bursts of new variants make a quick response even more important, and the fact that the variants do not exploit a single vulnerability, but users' trust, make them more difficult to stop.
"Vulnerability-based exploits only require a single, or at most a few, signatures," said Vince Hwang, group product manager for security response at Symantec, the owner of SecurityFocus. "The ones that rely on user interaction are definitely a challenge. It is all social engineering."
Other attacks, known as targeted Trojan horses, exploit a related issue to dodge antivirus defenses. By sending out malicious code to an extremely small number of victims--often fewer than 10 specific individuals--the malicious software attempts to sneak under defenders' radar. Underscoring the less-is-more tactic, programs--such as the Storm Worm and targeted Trojan horses--have not made the monthly top-10 lists of security firms' most pervasive threats. On MessageLabs latest top-10 list, for example, Netsky, MyDoom, and Bagle--viruses that are almost two years old--command six of the 10 slots.
For both variant-heavy threats such as the Storm Worm and sneaky targeted Trojan horses, blocking the threat immediately requires technology that does not need to know about the attack, or its pattern, beforehand. And self-propagation, the hallmark of computer viruses, is no longer an adequate indicator of bad behavior.
"For over a year now, viruses are not viruses," said CommTouch's Lev. "There are no more epidemics. Instead, they (spammers) use bot nets to send spam and then more malware."
Perhaps the most significant technology under development at various antivirus firms is typically referred to as behavior blocking. The technique identifies malicious programs by what actions they take, not by the code that makes them up.
The defense is actually a blast from the past. Antivirus firms and early developers played with the approach more than a decade ago. Gatekeeper for the Mac, created by Chris Johnson in the early 1990s, detected malicious code by noting suspicious actions. Personal firewalls attempt to block malicious programs from communicating out to the Internet.
Several antivirus firms--including Sophos, F-Secure and Grisoft--are building next-generation behavior analysis into their products. The modern technique creates a virtual sandbox for any program run on the system and monitors the behavior of the program until a determination can be made of whether the code is malicious or benign.
"If you are seeing something that is obviously poking its head into things that it shouldn't be, then we can shut it down," said Larry Bridwell, vice president of communications for antivirus firm Grisoft.
Unlike the simple techniques in the past that generally decided whether a program was malicious based on a single action, the latest techniques allow a program to run longer, reducing false alarms.
"What did it take for behavioral analysis to work?" said Bridwell. "Big processors, big memory and big bandwidth. And we didn't have that before."
While viruses make up a smaller portion of threats each year--about 10 percent of what Grisoft sees are viruses, said Bridwell--don't expect the term "antivirus" to go away. Grisoft attempted to sell a product as anti-malware and consumers panned it on the name alone.
"To some analysts, some press and every user, it doesn't matter what the program does, it's antivirus," Bridwell said.
