Cylance - Targeted and Bypassed

[artek]

Nah.... that's just the way the industry and process work.

Vendors don't just whitelist a few games and / or other random files.

White lists are vast.

White lists in six-figures can be purchased from established vendors.

This article alludes to the enormity of the problem.

And don't misunderstand me.... I'm a Cylance fan. I use it and like it. The model is great. It works. They just need to go in and fix the algorithm -- which is doable but can be an arduous task.

It's literally what the article is describing - a strong bias towards a specific game. That's not to say there's not other files that won't fall under the same category. But if there's no evidence of something like that out there, it's a hell of an asumption to make. Publications often overblow the severity of a problem to get clicks. Calling this a monumental problem that is difficult to fix is disingenuous when the only thing Cylance needs to do to prevent these false negatives is to tell their algorithms to disregard that specific string that they've been using as a whitelisting mechanism.

Here's the quote again:

"Combining an analysis of the feature extraction process, its heavy reliance on strings, and its strong bias for this specific game, we are capable of crafting a simple and rather amusing bypass. Namely, by appending a selected list of strings to a malicious file, we are capable of changing its score significantly, avoiding detection."

Here's another quote:

"By taking STRINGS from an online gaming program and APPENDING them to malicious files, researchers were able to trick Cylance’s AI-based antivirus engine into thinking programs like WannaCry and other malware are benign."

If you wanted to call it lazy whitelisting I'd agree with you. But hard to fix? Get outa here.

 

[ForgottenSeer 58943]

But it does indicate - I think - the fact that they really took the cheap way out in this case. Sure, they can remove bias toward that game, which is likely their hotfix. But what other ones exist? I assume hundreds, if not thousands? What about the override system in place to reduce false positives that rejects every single flag on the model up to the override point?

I guess if anything, it sort of shows that a layered approach with different technologies is going to be the way to handle malware. Cylance is sort of a one-trick-pony in this regard as it doesn't offer any layers should their unbelievable technology fail.

 

[artek]

But it does indicate - I think - the fact that they really took the cheap way out in this case. Sure, they can remove bias toward that game, which is likely their hotfix. But what other ones exist? I assume hundreds, if not thousands? What about the override system in place to reduce false positives that rejects every single flag on the model up to the override point?

I guess if anything, it sort of shows that a layered approach with different technologies is going to be the way to handle malware. Cylance is sort of a one-trick-pony in this regard as it doesn't offer any layers should their unbelievable technology fail.

There's no reason to assume that is the case without further evidence. Like I said above, the game would have had to have been of sufficient popularity in order to qualify for a global whitelist like that. Cylance isn't going to need to do something like that for a title like The Red Strings Club.

You would need an application that was both widespread/popular, behaved typically like malware, and changed frequently enough that they felt the need to flub the whitelisting like this.

 

[Burrito]

But it does indicate - I think - the fact that they really took the cheap way out in this case. Sure, they can remove bias toward that game, which is likely their hotfix. But what other ones exist? I assume hundreds, if not thousands? What about the override system in place to reduce false positives that rejects every single flag on the model up to the override point?

I guess if anything, it sort of shows that a layered approach with different technologies is going to be the way to handle malware. Cylance is sort of a one-trick-pony in this regard as it doesn't offer any layers should their unbelievable technology fail.

Yeah, I think so. I think it's probably huge -- since every single whitelisted file could be appended.

It's fixable, and the fix will make the product better. But yeah, they seem to have taken the cheap way out.

I'll talk with my Cylance rep later this coming week... no telling if he'll disclose the full deal though.

Some Cylance products do offer other layers though... which in a way is their tacit admission that ML can't do it all.

Not that it really will make a big difference at this point, but Cylance Smart users should make sure to update their products, both the "Updates" and the "Policy Update" which is done separately.

 

[436880927]

I've already documented on this forum before that the technique you're all talking about can be used to bypass certain ML/AI systems - it depends on how they were designed.

Namely, I discussed VoodooAi in the past when I brought this up, as far back as two years ago at least.

There's other techniques you can apply alongside stealing strings from genuine applications: you can steal icons, file information, code and even digital signatures. All of these aforementioned techniques are realistically simple to apply and you can make tools to automate all of the work for you each time.

All I got was arguments and reported posts because people couldn't fathom the fact that ML/AI is and never will be invincible. People didn't like that I could make applications that simulated malicious behavior but always hit a safe threshold with certain ML/AI systems, even though I was just shining light on ML/AI design flaws because I myself use ML technologies and thus it is in my best interest to understand the flaws so I can work towards making my own systems more reliable.

There will always be a flaw if you look hard enough. Even if someone managed to fix every single known flaw in something, a new one will inevitably arise. Patches to design flaws can introduce new flaws. Nothing is perfect.

This is nothing new.

 

[Mikesierra]

On July 18th, researchers publicly disclosed a specific bypass of CylancePROTECT®. We verified the issue was not a universal bypass as reported, but rather a technique that allowed for one of the anti-malware components of the product to be bypassed in certain circumstances. The issue has been resolved for cloud-based scoring and a new agent will be rolled out to endpoints in the next few days.

Resolution for BlackBerry Cylance Bypass

BlackBerry Cylance has verified the issue was not a universal bypass as reported. The issue has been resolved for cloud-based scoring and a new agent will be rolled out to endpoints in the next few days.

threatvector.cylance.com

By the way, In the past it was usual to first contact the manufacturer and give him time to solve the problem before it was published. However, fame and honor is obviously more important nowadays.

 

[Dhruv2193]

Good and lucky for me as i have appcheck also installed alongwith Cylance!!