syssec_red_book

12. Malwarethan 128 million malware samples in their database [73]. Symantec reportsthat in 2012, one in 291 emails contained some form of malware [75].At the same time, the increasing professionalism of cyber criminals makesdefending against sophisticated malware increasingly hard. Once sophisticatedtricks of the most skilled virus authors, advanced evasion techniques like codeobfuscation, packing, and polymorphism are now the norm in most instancesof malicious code. Using polymorphism, the malware is mutated so that eachinstance acquires a unique byte pattern, thereby making signature extractionfor the whole breed infeasible. As the number of new vulnerabilities andmalware variants grows at a frantic pace, detection approaches based onthreat signatures, which are employed by most virus scanners and intrusiondetection systems, cannot cope with the vast number of new malicious codevariants [302].12.2 Who Is Going to Be Affected?Any computing device of sufficient capabilities can potentially be infectedby malware. Besides personal computers and servers, the traditional targetsof malware, mobile phones and tablets have recently started being plaguedby malicious applications. Indicatively, McAfee reports that the growth inthe number of mobile malware threats almost doubles every quarter, with95% of the total number of samples in their database arriving in 2012 [73].Computers and mobile devices, however, are not the only target. Malwarecan infect routers [141], phones [139], printers [140], gaming consoles [236],cars [123], and essentially any programmable computing device. As discussedin Chapter 6, industrial systems are often exposed to various threats, includingmalware infection, while malware managed to creep even into the InternationalSpace Station [64].12.3 What Is Expected to Happen?Practice has shown that malware authors continually try to devise new ways ofevading existing detection systems, improve the stealthiness of their maliciouscode, and expand their reach to as many systems as possible. This is evident inseveral recent trends, including the proliferation of signed malware, server-sidepolymorphism, and the significant increase in the number of malware samplesfor mobile devices and typically less-targeted operating systems, such as MacOS X [73].Malware that has been digitally signed using a trusted certificate is capableof infecting even systems with strict configurations that allow the installationof software only from trusted sources. In recent incidents, malware authorsmanaged to steal digital certificates from reputable software companies, whichthey then used to sign their malware binaries. Server-side polymorphism is88