How is it possible that in an industry dominated by advanced performance metrics and benchmarking tests, cybercriminals still manage to release unique malware that remains undetected for weeks by major antivirus vendors?
It’s pretty simple. Cybercrime is innovating much faster than the security industry is.
It used to be that cybercriminals hacked from the fringe, often acting alone and for personal fame. Now, cybercrime is a profitable career. It’s among the top national defense issues; it’s leveraged as a form of political protest; and it’s a relatively easy field to break into.
You might be surprised to how easy it is for anyone to access black markets online, pay a small fee (or nothing at all), and gain access to malicious processes that wreak havoc on company websites, steal financial information, and much more. And their labors are producing countless malware samples each day.
Here’s an up-close look at some of the nasty tactics today’s hackers are using—and why security vendors can’t stop them with yesterday’s approach.
4 Ways Hackers are Winning
- Do-it-yourself (DIY) malware cryptors – Malware cryptors, as we cyber nerds call them, are designed to mask malware from being discovered by computer security programs. Cybercriminals can build malware cryptors on their own with relative ease. The idea is: once malware authors release their cryptors into the wild, they have the ability to keep changing it until their malware becomes unrecognizable to antivirus scans. That’s a big “one up” over traditional security.
- Managed malware crypting services – Think of malware as a key that is trying to find a door (someone’s device) to unlock. Instead of trying to make your own custom key, you could go to someone who already knows a specific key is going to work. That’s the idea behind malware crypting as a managed service. This process allows cybercriminals to obtain only the malicious executables (the things that make your computer go “boom”) that have the best chance of being effective—without having to build anything on their own.
- Server-side polymorphism (SSP) – Server-side polymorphism (say that two times fast!) is malware that is difficult to identify by a computer scan, no matter how many times you clean your system. What’s particularly important to highlight is how it renders traditional server antivirus software totally useless.
- Quality assurance processes within the cybercrime ecosystem – Cybercriminals aren’t sloppy about their work. Before a malware campaign is launched, cybercriminals will usually pre-scan their malicious executable against all popular antivirus engines in order to ensure that it will successfully bypass the signature-based malware scanning used by them. The process is highly automated and is often offered as a service at selected cybercrime-friendly online communities.
So what is the security industry’s big mistake?
- A new virus or malware variant is discovered
- An antivirus vendor creates a new signature to protect against that specific piece of malware.
- The antivirus or malware signature is tested, and then pushed out to the vendor’s customers in the form of a signature update.
Dumping the barrel upside down
The future of online security can and should be based on behavior-based blocking techniques, which analyzes files by looking at how they’re acting and what they’re attempting to do, rather than comparing them to a list of known threats. It’s our best option to get a leg up on hackers.
Not only does signature-based threat detection slow your computer down, it also opens a rather large window for new malware to reach your Internet-connected devices while you wait for critical updates. It’s time for the security industry to wake and smell the malware. We did. And that’s why we created Webroot® SecureAnywhere™—an award-winning new approach to behavior-based Internet security.
As a consumer of computer security products, it’s important to know why cybercriminals currently have the upper hand on a fair amount of cyber security companies. We created this article to help you stay informed. If you’d like to learn more about signature-based threat detection on antivirus technology, Wikipedia does a pretty nice job of explaining the subject (click here to go to the article).
I understand what is going on. thanks for developing a new approach. I had your previous version before upgrading to Secure Anywhere, even then my system was pretty fast but I could tell when the Boogers were at work trying to get in. I was computer illiterate until 51 years old, but must run my small business from my netbook. Webroot was the first I purchased and the last.
I switched computers just to get away from Nosy Norton.
I hope you can keep Google chrome clean as it seems to be fastest browser going. Let us know real quick if we are going to have problems with their new plan
Keep up the good work!!!
Many have already incorporated behavioural based detection. Norton, BitDefender, F-Secure, etc.
This change in scanning approach makes me think of a police officer walking down a street, scanning for crime. Instead of trying to look at every face and try to remember if any of them match “wanted” posters, look for they guy putting up a ladder to the 2nd floor unlocked window in the alley. 🙂 Worse yet for other antivirus products, they’re the equivalent of the officer stopping every single person as they pass by…
Behaviour is one step towards . Cloud and IDS/HIPS etc are next step to tackle today’s cyber threats.
@John
Congratulations, you’ve just arrested a fireman. 🙂
why not become the first corporation to scan:
– pci/agp devices’ firmware
— checksum firmware and maintain cloud ref.
– router firmware
— checksum firmware and maintain cloud ref.
– BIOS
— checksum BIOS and maintain cloud ref.
it’s not enough to scan drives, we need to scan and checksum/compare signed firmware of the devices and BIOS!
Plenty of malicious attacks were held in past few years. We are looking for a permanent solution to this problem, but unfortunately, there is no such solution available. I believe using Endpoint security systems can help us:
http://www.softwaregold.net/softreview/2014/03/how-to-manage-endpoint-security/
Thanks for your post on “Why relying on antivirus signatures is simply not enough anymore” – it is a useful resource, informational, and I’ve
bookmarked it for future reference.
The 4 ways hackers are winning was educational!
Please also read
http://www.antivirusremovaltool.com/what-is-malware/
Are there any other antivirus
blogs or (web resources in general) that you can recommend to me?
Cheers!