This article originally appeared in Dark Reading on June 27, 2019.
Polymorphic malware is far from a new thing. But today, what is good for attackers is also good for defenders. Here’s why.
I first wrote about polymorphic malware four years ago. I recall having a hard time getting an editor to approve publication of my piece because he claimed none of his readers would be interested in the concept. Yet in the time since then, polymorphism has gone from virtually unknown to standard practice by malware writers. Indeed, it has become so common that most descriptions of attacks don’t even call it out specifically. Webroot in its annual threat assessment from earlier this year reported that almost all malware it has seen had demonstrated polymorphic properties.
The term refers to malware that can adapt to conditions and change its behavior to try to avoid detection. A recent example is the After-Shock-3PC malware which targeted a number of media websites. It frequently switched its active code to spoof online payment systems, in the process trying to appear as if it belonged on the computers that it infected. It was even partially successful.
Polymorphic malware has become popular because criminals can purchase malware construction kits that include this feature, such as the kits that have produced the Cobalt Strike, Fallout, and Orcus malware families. Another reason for the attraction is that polymorphic code is harder for researchers to pick apart and track down its shifting series of operations.
Actually, polymorphic malware is far from a New Thing. The first piece of such malware could be traced to 1990 with Ralf Burger’s Chameleon. But what is good for attackers is also good for defenders. Using polymorphic principles to confuse an attacker has become a rich research area, especially for academics. They also call the concept a “moving target defense,” and there have been two major two Association of Computing Machinery conferences devoted to the subject: the first one in November 2014 in Arizona and a second one in November 2015 in Denver.
That research has spawned a number of vendors that incorporate polymorphic methods using one (or more) of three major protective tactics to defend your resources:
- Using network-based actions such as changing IP addresses,
- Using host-based actions such as changing host names and other identifying characteristics, and
- Using application-based actions such as recompiling code or changing memory locations of executables.
This last tactic is used by several vendors, including Polyverse and Morphisec. The latter has been a leader in this area and earlier this year closed a $12 million series B funding round. Its software is now installed on over 3 million endpoints. Other startup vendors, such as CyActive, have been absorbed by PayPal, indicating how important this technology is for online-centric businesses that want to shore up their defenses.
Shape Security has a network-based product that is used to block distributed denial-of-service and man-in-the-browser attacks, working with an ordinary network firewall to redirect traffic to critical web resources. There are also numerous other security vendors that claim to block some kinds of polymorphic malware vectors as part of their overall firewall, web app/email security gateways, or intrusion-detection products.
Clearly, its time has come, on both offensive and defensive sides.
What are the main takeaways for security staffs? First, study the concepts behind the moving target defense to see if this can benefit your own operations. Next, consider using one of the defensive vendors mentioned above to protect your most critical online assets. Look at recompiling your custom apps to include polymorphic methods to help stay ahead of attackers. Finally, examine your existing threat detection portfolio and check to see if anything can recognize polymorphic attack scenarios properly. Certainly, the attackers will continue to use these methods to evade detection, so we have to get better at ferreting them out and stopping them.
