“Now You See Me Now You Don’t”: Making Threat Detection Persistently Undetectable by Malware (part 2 of 3)
Lynx Software Technologies2014-07-28T12:09:36+00:00In our previous post we explained why evasion and persistence are the 2 main "malware virtues" challenging existing detection methods. We assert that a twofold new approach must be introduced to augment existing solutions, in order to successfully thwart advanced malware: Separation of the detection layer from the attack surface (this blog) Placement of high-interaction honeypots closer to the attacked users (next blog) First things first: Why is it so hard to detect advanced malware? Well, the short answer is: Because malware has become so sophisticated and fast-changing, while operating systems have become unbearably large and complex. Malware detection is uncomfortably situated between the rock and the hard place: It needs to deal with both the vulnerabilities and complexity of the operating system and the malicious activity to the malware. The attack surface: Size matters Windows XP, Windows 7 and Windows 8 are in the vicinity of 40-50 million lines of code each. It is estimated that Windows 7 kernel alone measures more than 2 million lines of code. This is a huge attack surface, and it's not likely to decrease in [...]