Fileless attacks: compromising targets without malware

Mansfield-Devine, Steve

doi:10.1016/s1353-4858(17)30037-5

Cited by 34 publications

(17 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Twitoor [99] is an Android backdoor and botnet which imitates like a MMS app and accepts commands via tweets. The evolution of malware into its innumerous avatars have now recently reached the fileless malware approach also known as Advanced Volatile Threats (AVTs) [100,101]. AVTs execute its malicious activities in the volatile main memory and is able to escape anti-analysis techniques as the infection traces are available only in memory during its execution.…”

Section: Botnetmentioning

confidence: 99%

“…AVTs execute its malicious activities in the volatile main memory and is able to escape anti-analysis techniques as the infection traces are available only in memory during its execution. It tricks common tools like PowerShell, Windows Management Instrumentation, command prompt, .NET framework, Remote Desktop Protocol (RDP) into attack vectors [56,[100][101][102].…”

Section: Botnetmentioning

confidence: 99%

See 1 more Smart Citation

A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead

Selvaganapathy

Sadasivam

Ravi

2021

JCSANDM

View full text Add to dashboard Cite

Smartphones usage have become ubiquitous in modern life serving as a double-edged sword with opportunities and challenges in it. Along with the benefits, smartphones also have high exposure to malware. Malware has progressively penetrated thereby causing more turbulence. Malware authors have become increasingly sophisticated and are able to evade detection by anti-malware engines. This has led to a constant arms race between malware authors and malware defenders. This survey converges on Android malware and covers a walkthrough of the various obfuscation attacks deployed during malware analysis phase along with the myriad of adversarial attacks operated at malware detection phase. The review also unscrambles the difficulties currently faced in deploying an on-device, lightweight malware detector. It sheds spotlight for researchers to perceive the current state of the art techniques available to fend off malware along with suggestions on possible future directions

show abstract

Section: Botnetmentioning

confidence: 99%

Section: Botnetmentioning

confidence: 99%

A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead

Selvaganapathy

Sadasivam

Ravi

2021

JCSANDM

View full text Add to dashboard Cite

show abstract

“…In contrast to all prior existence of malware, fileless malware requires no file to operate and they purely reside in memory and take advantage of existing system tools e.g. powershell [62].…”

Section: Fileless Malwarementioning

confidence: 99%

Malware Dynamic Analysis Evasion Techniques

et al. 2019

View full text Add to dashboard Cite

The Cyber world is plagued with ever-evolving malware that readily infiltrates all defense mechanisms, operates viciously unbeknownst to the user and surreptitiously exfiltrate sensitive data. Understanding the inner workings of such malware provides a leverage to effectively combat them. This understanding, is pursued through dynamic analysis which is conducted manually or automatically. Malware authors accordingly, have devised and advanced evasion techniques to thwart or evade these analyses. In this paper, we present a comprehensive survey on malware dynamic analysis evasion techniques. In addition, we propose a detailed classification of these techniques and further demonstrate how their efficacy hold against different types of detection and analysis approach.Our observations attest that evasive behavior is mostly interested in detecting and evading sandboxes. The primary tactic of such malware we argue, is fingerprinting followed by new trends for reverse Turing test tactic which aims at detecting human interaction. Furthermore, we will posit that the current defensive strategies beginning with reactive methods to endeavors for more transparent analysis systems, are readily foiled by zeroday fingerprinting techniques or other evasion tactics such as stalling. Accordingly, we would recommend pursuit of more generic defensive strategies with emphasis on path exploration techniques that has the potential to thwart all the evasive tactics.

show abstract

“…Another way to take advantage of DNS RDATA field is in the case of fileless malware. This type of malware is a stealthy variant of malicious software where the binary of the malware exists solely on the volatile computer memory, such as RAM or the system's registry, and does not leave any trace of activity on the hard disk [17]. This way, fileless malware is resistant to the existing anti-virus strategies.…”

Section: Fileless Malwarementioning

confidence: 99%

Another Step in the Ladder of DNS-Based Covert Channels: Hiding Ill-Disposed Information in DNSKEY RRs

Αναγνωστόπουλος

Seem

2019

Information

View full text Add to dashboard Cite

Covert channel communications are of vital importance for the ill-motivated purposes of cyber-crooks. Through these channels, they are capable of communicating in a stealthy way, unnoticed by the defenders and bypassing the security mechanisms of protected networks. The covert channels facilitate the hidden distribution of data to internal agents. For instance, a stealthy covert channel could be beneficial for the purposes of a botmaster that desires to send commands to their bot army, or for exfiltrating corporate and sensitive private data from an internal network of an organization. During the evolution of Internet, a plethora of network protocols has been exploited as covert channel. DNS protocol however has a prominent position in this exploitation race, as it is one of the few protocols that is rarely restricted by security policies or filtered by firewalls, and thus fulfills perfectly a covert channel’s requirements. Therefore, there are more than a few cases where the DNS protocol and infrastructure are exploited in well-known security incidents. In this context, the work at hand puts forward by investigating the feasibility of exploiting the DNS Security Extensions (DNSSEC) as a covert channel. We demonstrate that is beneficial and quite straightforward to embed the arbitrary data of an aggressor’s choice within the DNSKEY resource record, which normally provides the public key of a DNSSEC-enabled domain zone. Since DNSKEY contains the public key encoded in base64 format, it can be easily exploited for the dissemination of an encrypted or stego message, or even for the distribution of a malware’s binary encoded in base64 string. To this end, we implement a proof of concept based on two prominent nameserver software, namely BIND and NDS, and we publish in the DNS hierarchy custom data of our choice concealed as the public key of the DNS zone under our jurisdiction in order to demonstrate the effectiveness of the proposed covert channel.

show abstract

Fileless attacks: compromising targets without malware

Cited by 34 publications

References 0 publications

A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead

A Review on Android Malware: Attacks, Countermeasures and Challenges Ahead

Malware Dynamic Analysis Evasion Techniques

Another Step in the Ladder of DNS-Based Covert Channels: Hiding Ill-Disposed Information in DNSKEY RRs

Contact Info

Product

Resources

About