Bugs in Malware Serve as Backdoor to Undo Damage

guest · Oct 22, 2021

Bugs in Malware Serve as Backdoor to Undo Damage
System Infection Can Be Prevented Using Flaws in Malware
October 20, 2021
https://www.databreachtoday.com/bugs-in-malware-serve-as-backdoor-to-undo-damage-a-17763

Researchers at Zscaler say that malware is often prone to bugs and coding errors that can cause it to crash or serve as a backdoor for defenders to undo the damage it might have caused.

Zscaler researchers Nirmal Singh Bhary, director of Malware Labs, and Uday Pratap Singh, staff security researcher, presented the findings of a paper titled, "Bugs in malware - uncovering vulnerabilities found in malware payloads" at the VB2021 conference.

"Security researchers find ways to patch such bugs in products to make effective detection statically and dynamically. There has been a lot of research on anti-VM and anti-sandbox techniques and techniques for bypassing AV products, but we haven’t seen much on the opposite side: finding bugs in pieces of malware that stop them from spreading and infecting the system," the researchers note.
Click to expand...

"Authors often develop malware according to their local environment and don’t take into consideration techniques that may be present in target environments, such as address space layout randomisation and data execution prevention, causing the malware to crash," the researchers at Zscaler note.

Over this six-month period, the researchers found that over 8,800 samples marked as malware - out of 500,000 samples - showed execution errors - 1.76%. The researchers also found several malware families with a common set of bugs in their code and found that a single malware family has multiple bugs, which can help security researchers to help victims.

"We found that not all, but a few bugs can be helpful in preventing or cleaning infection, stopping encryption and the spreading of malware if they are used as a kill-switch in a local system," the researchers note.
Click to expand...

Bugs in malware – uncovering vulnerabilities found in malware payloads

To illustrate multiple bugs and coding errors in malware, we have performed a large-scale analysis of a data set of malicious samples that crashed in the Zscaler Cloud Sandbox. We collected such samples from late 2019 to March 2021 in the Zscaler Cloud. Furthermore, research & analysis is performed on multiple malware families showing crashes or running idle due to coding errors.

We will look at recent malware, botnets and ransomware with such different kinds of vulnerabilities and coding errors. We will also present a methodology to categorize malware families based on vulnerabilities and also detection in a cloud sandbox based on minimal activity before crash.
Click to expand...

Log in or Sign up

Bugs in Malware Serve as Backdoor to Undo Damage

guest Guest

Log in or Sign up

Bugs in Malware Serve as Backdoor to Undo Damage

guest Guest

Useful Searches