Bypassing Malware Defenses

While most other areas of penetration testing are well understood, and their methodologies well documented, little information regarding testing and bypassing malware defenses is available in the public domain. Still, malware incidents remain the most expensive type of incidents caused by outsiders, while also being the most frequent type of incidents occurring to organizations. In addition, since malware payloads are normally executed on internal networks, bypassing most firewall restrictions, they do tend to be the weapon of choice for targeted attacks. Malware is used to perform multiple offensive activities: launching distributed denial of service attacks (DDoS), collecting classified information, etc. Consequently, testing and understanding the efficiency and configurations of malware defense systems is of uttermost importance. Firstly, the paper describes how host-based anti-virus signatures can be bypassed. The paper illustrates that known malware may sometimes bypass host-based anti-virus systems (AVs), even when the piece of malware has not been modified to do so. Secondly, we show how changing the signatures of known pieces of malware may help the adversary bypass most signature-based AVs and some behavior-based AVs. Techniques such as hex editing, repacking and reverse engineering are demonstrated to this end. Thirdly, we demonstrate how a new piece of malware, which bypasses all of the 42 AV products included in the test set and is able to use the target organization’s internal