GSN Aug/Sept Digital Edition

Cybersecurity and ConvergenceAdvanced Persistent Threat: Key featuresof modern malwareBy Don Maclean,Chief Cybersecurity Technologist,DLT SolutionsMalware, like legitimate technology, progressesat breakneck pace, continuously introducingnew and ingenious features. Sadly,the technical sophistication and ingenuity, ifaimed at legitimate goals, could benefit theworld – and the developers themselves. Let’s take alook at some of the salient features in today’s world ofmalware.Targeted and Self-LimitingMost malware tries to spread as quickly as possibleto as many systems as possible. The more infectedsystems, the greater the damage and the wider thedragnet for gathering data illicitly. Wide dispersion,however, multiplies the odds of detection and speedsremediation.Advanced Persistent Threats (APTs) work differently.Aimed at a specific company, individual, or groupof systems, this pernicious class of software stays underthe radar as long as possible by infecting a smallgroup of high-value targets. It’s a sniper rifle, ratherthan a machine gun.Some APTs are so precisely targeted that they erasethemselves if very specific circumstances – operatingsystem version, configuration settings, file versionsand other parameters – are not present. They even createinstallation keys based on the requisite parametersto ensure proper targeting.APTs are also far less “persistent” than the namewould suggest. Many of them uninstallthemselves by design at a pre-designateddate, or when they have achieved a specificobjective. Still others will self-destruct immediatelywhen they have been discovered,or if they detect a virtual environment commonlyused for detection, detonation, andanalysis.Campaign-OrientedAPT designers do their homework and are patientenough to mount long-term, multi-stage campaignsto compromise a high-value target. For instance, the“Duqu 2.0” malware that recently infected KasperskyLabs was clearly designed to evade the very specificmalware protection systems in use on the target system.Success required thorough reconnaissance to determinethe detection systems in use and painstakingresearch to create highly specific evasion mechanisms.Windows will not allow installation of drivers lackinga valid digital signature. Consequently, malwarerequiring a driver must either evade the signature requirementor use a stolen certificate. The latter methodis rare, because stealing a certificate is difficult evenfor advanced hackers, but its use indicates the lengthsto which bad actors will go to compromise their target. [1]Advanced Design ElementsModern malware exhibits a wide range of highly sophisticateddesign elements features. I’ll look at a fewin-depth and list the others for those who want to digin deeper on this topic.Hiding Command-and-Control Traffic26