Fast and Evasive Attacks: Highlighting the Challenges Ahead

Abstract

Abstract. Passive network monitors, known as telescopes or darknets, have been invaluable in detecting and characterizing malware outbreaks. However, as the use of such monitors becomes commonplace, it is likely that malware will evolve to actively detect and evade them. This paper highlights the threat of simple, yet effective, evasive attacks that undermine the usefulness of passive monitors. Our results raise an alarm to the research and operational communities to take proactive countermeasures before we are forced to defend against similar attacks appearing in the wild. Specifically, we show how lightweight, coordinated sampling of the IP address space can be used to successfully detect and evade passive network monitors. Equally troubling is the fact that in doing so attackers can locate the "live" IP space clusters and divert malware scanning solely toward active networks. We show that evasive attacks exploiting this knowledge are also extremely fast, overtaking the entire vulnerable population within seconds.

Characterizing Dark DNS Behavior

“…Previous work has demonstrated the ease of detecting the location of general network sensors [10,11] through active probing. Recent work by Rajab et al [12] describes how evasive techniques can be used by malware to detect honeypots by selective sampling of the IP address space. Discrepancies in the behavior of IP network stacks can also be exploited for sensor detection, as demonstrated by shown the Honeyd detector named Winnie [13].…”

On Using Mobility to Propagate Malware

“…Rajab et al have presented an efficient probe-response attack that can be used to discover the locations of network monitors deployed on the (wired) Internet [16]. A similar technique could potentially be applied in the context of mobile infections.…”

Demystifying Internet-Wide Service Discovery

“…The latter type of scan significantly reduces the burden on remote networks and is useful when a 5-10-s estimate of the number of responsive hosts (rather than their IP addresses) is required. While we do not specifically cover dynamic scope reduction (e.g., using prior scan history [46], live feedback [57], or external information [25]), our techniques may be used in conjunction with such approaches to optimally load-balance the traffic across target networks. While several large-scale measurements have been conducted in the past [6], [14], [18], [44], researchers initially considering a similar project are often faced with delays on the order of months for individual tests to run [6], [44].…”