Why antivirus companies like mine failed to catch Flame and Stuxnet

[nsane.forums]

F-Secure's Chief Research Officer: A/V outfits were out of their league.

Mikko Hypponen is the Chief Research Officer of F-Secure. He has been working with computer security for over 20 years and has fought the biggest virus outbreaks in the net, including Loveletter, Blaster, Conficker and Stuxnet. His TED Talk on computer security has been seen by almost a million people and has been translated to over 35 languages.

A couple of days ago, I received an e-mail from Iran. It was sent by an analyst from the Iranian Computer Emergency Response Team, and it was informing me about a piece of malware their team had found infecting a variety of Iranian computers. This turned out to be Flame: the malware that has now been front-page news worldwide.

When we went digging through our archive for related samples of malware, we were surprised to find that we already had samples of Flame, dating back to 2010 and 2011, that we were unaware we possessed. They had come through automated reporting mechanisms, but had never been flagged by the system as something we should examine closely. Researchers at other antivirus firms have found evidence that they received samples of the malware even earlier than this, indicating that the malware was older than 2010.

What this means is that all of us had missed detecting this malware for two years, or more. That’s a spectacular failure for our company, and for the antivirus industry in general.

It wasn’t the first time this has happened, either. Stuxnet went undetected for more than a year after it was unleashed in the wild, and was only discovered after an antivirus firm in Belarus was called in to look at machines in Iran that were having problems. When researchers dug back through their archives for anything similar to Stuxnet, they found that a zero-day exploit that was used in Stuxnet had been used before with another piece of malware, but had not been noticed at the time. A related malware called DuQu also went undetected by antivirus firms for over a year.

Stuxnet, Duqu and Flame are not normal, everyday malware, of course. All three of them were most likely developed by a Western intelligence agency as part of covert operations that weren’t meant to be discovered. The fact that the malware evaded detection proves how well the attackers did their job. In the case of Stuxnet and DuQu, they used digitally signed components to make their malware appear to be trustworthy applications. And instead of trying to protect their code with custom packers and obfuscation engines—which might have drawn suspicion to them—they hid in plain sight. In the case of Flame, the attackers used SQLite, SSH, SSL and LUA libraries that made the code look more like a business database system than a piece of malware.

Someone might argue that it’s good we failed to find these pieces of code. Most of the infections occurred in politically turbulent areas of the world, in countries like Iran, Syria and Sudan. It’s not known exactly what Flame was used for, but it’s possible that if we had detected and blocked it earlier, we might have indirectly helped oppressive regimes in these countries thwart the efforts of foreign intelligence agencies to monitor them.

But that’s not the point. We want to detect malware, regardless of its source or purpose. Politics don’t even enter the discussion, nor should they. Any malware, even targeted, can get out of hand and cause “collateral damage” to machines that aren’t the intended victim. Stuxnet, for example, spread around the world via its USB worm functionality and infected more than 100,000 computers while seeking out its real target, computers operating the Natanz uranium enrichment facility in Iran. In short, it’s our job as an industry to protect computers against malware. That’s it.

Yet we failed to do that with Stuxnet and DuQu and Flame. This makes our customers nervous.

The truth is, consumer-grade antivirus products can’t protect against targeted malware created by well-resourced nation-states with bulging budgets. They can protect you against run-of-the-mill malware: banking trojans, keystroke loggers, and e-mail worms. But targeted attacks like these go to great lengths to avoid antivirus products on purpose. And the zero-day exploits used in these attacks are unknown to antivirus companies by definition. As far as we can tell, before releasing their malicious codes to attack victims, the attackers tested them against all of the relevant antivirus products on the market to make sure that the malware wouldn’t be detected. They have unlimited time to perfect their attacks. It’s not a fair war between the attackers and the defenders when the attackers have access to our weapons.

Antivirus systems need to strike a balance between detecting all possible attacks without causing any false alarms. And while we try to improve on this all the time, there will never be a solution that is 100 percent perfect. The best available protection against serious targeted attacks requires a layered defense, with network intrusion detection systems, whitelisting against known malware and active monitoring of inbound and outbound traffic of an organization’s network.

This story does not end with Flame. It’s highly likely there are other similar attacks already underway that we haven’t detected yet. Put simply, attacks like these work.

Flame was a failure for the antivirus industry. We really should have been able to do better. But we didn’t. We were out of our league, in our own game.

View: Original Article

[visualbuffs]

nice

[grouchysmurf]

So, I guess what I am getting from this is that it does not matter what av product you have,

they are all worthless.

Before someone yells at their screen, remember, there is no "almost" with av software.

It either keeps you safe or not.

[myidisbb]

no. your a/v did what it was suppose to do. state made software that is made to spy and do things to other states is going to be what one would call a super software bug. dont download from a state government computer where ever you are at. these nasties are the reason the us government turn off usb ports for memory sticks.

[DKT27]

no. your a/v did what it was suppose to do. state made software that is made to spy and do things to other states is going to be what one would call a super software bug.

+1

[grouchysmurf]

no. your a/v did what it was suppose to do. state made software that is made to spy and do things to other states is going to be what one would call a super software bug. dont download from a state government computer where ever you are at. these nasties are the reason the us government turn off usb ports for memory sticks.

I see what you are saying, but my point did not seem to translate well...

If you are an AV company, than your JOB is to be able to deal with the cyber war. I do not care if GOD himself made the damn virus, as an av company, you best get a handle on it.

But wait, there are programs that might already.....what about sandbox? How about VM? What about the time freeze program I just saw offered up in here.....any of these might work simply because they keep everything contained in a virtual environment.

My point is, we need to expand the way we look at protecting ourselves. Some people put all their faith into the "av" programs and are willing to accept the "97%" capture rate. I never have been satisfied with that.

just my opinion

[myidisbb]

oh i agree we need to relook at our securities. but A/V companies are not going to be able to do much against government special software in these days of ages. the only way they might be is if they went line by line of code of possible nasties with someone that knows what its reading. that still take a long time and no real protection either. the A/V we use is made to protect against software that is targeted at OUR level. this stuff with Iran is above us and our software.

[johndoe]

Someone might argue that it’s good we failed to find these pieces of code. Most of the infections occurred in politically turbulent areas of the world, in countries like Iran, Syria and Sudan. It’s not known exactly what Flame was used for, but it’s possible that if we had detected and blocked it earlier, we might have indirectly helped oppressive regimes in these countries thwart the efforts of foreign intelligence agencies to monitor them.

That is NOT ON! Your job as an antivirus company is to tackle and disable malicious code, period. No excuses, no arguments and you certainly cannot and should NOT judge or justify whether any piece of malicious code might ever have caused any good to anyone in any way! Just STFU, do your !@#$%^ job and stop making excuses!

[ck_kent]

Wait, so what F-Secure is saying here is that if a malware/trojan was "hidden" in plain sight then antiviruses would not detect it? :wtf: That's alarming.

[grouchysmurf]

Wait, so what F-Secure is saying here is that if a malware/trojan was "hidden" in plain sight then antiviruses would not detect it? :wtf: That's alarming.

I too find it..less than satisfying. I for one have been looking at my security. I have never used a sandbox program, but it seems the firewall I am currently using has one built in...think I might give it a shot.

I am also considering doing ALL of my cyber'ing from a vm state. Virtual might be the way to go. I need to read up on the whole VM thing, as I have never used that environment either.