- Jul 22, 2014
- 2,525
When vendors tell you what to whitelist, crims are reading too
Advanced malware writers are using anti-virus exclusion lists to better target victims, researchers say.
Software vendors use exclusion lists to explain the files and directories that antivirus software should ignore to avoid false positives and ensure an application's proper operations.
Such lists are common: Citrix published one last week while it doesn't take much Googling to find more. For example, here's one from SolarWinds, and a few more from VMware, Microsoft, SAP, CA , Veritas and Sage.
When Citrix's list emerged, The Reg pondered the lists' possible use as a handy guide to the process names and directory locations hackers could target to take down users. Once you know, for example, that thisprocess.exe is whitelisted, creating an attack that runs as thisprocess.exe looks like an obvious tactic.
We were right: an independent malware researcher who prefers to be known as by his hacker handle "UnixFreakxjp" says some advanced malware writers are exploiting these published exclusions to produce malware targeted to particular enterprises.
"There are malware writers using whitelisted exclusion files, mostly APT (advanced persistent threat) and targeted infection groups rather than public malware operators," he says.
"APT attackers are better funded and conduct a lot of research before they launch attacks.
"They will more often insert their malware into the antivirus file exclusion categories, or in rarer cases force the antivirus configuration to exclude their specific malware files."
more in the link above.
Advanced malware writers are using anti-virus exclusion lists to better target victims, researchers say.
Software vendors use exclusion lists to explain the files and directories that antivirus software should ignore to avoid false positives and ensure an application's proper operations.
Such lists are common: Citrix published one last week while it doesn't take much Googling to find more. For example, here's one from SolarWinds, and a few more from VMware, Microsoft, SAP, CA , Veritas and Sage.
When Citrix's list emerged, The Reg pondered the lists' possible use as a handy guide to the process names and directory locations hackers could target to take down users. Once you know, for example, that thisprocess.exe is whitelisted, creating an attack that runs as thisprocess.exe looks like an obvious tactic.
We were right: an independent malware researcher who prefers to be known as by his hacker handle "UnixFreakxjp" says some advanced malware writers are exploiting these published exclusions to produce malware targeted to particular enterprises.
"There are malware writers using whitelisted exclusion files, mostly APT (advanced persistent threat) and targeted infection groups rather than public malware operators," he says.
"APT attackers are better funded and conduct a lot of research before they launch attacks.
"They will more often insert their malware into the antivirus file exclusion categories, or in rarer cases force the antivirus configuration to exclude their specific malware files."
more in the link above.
