Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 906645" data-attributes="member: 83059">Yeah these classes of techniques (including things like opening a VNC or RDP session to oneself or using virtualization software on the device to present a keyboard/mouse to the host that mimics user actions) are really hard for antimalware to detect because they all tend to have an anti-false-positive measure that attempts to allow either the user or trusted applications do the dirty deed.In terms of exploiting the target machine, one attack I&#039;ve previously demonstrated here is that you can add malware to Python libraries for legitimate apps that use Python like machine learning / AI python IDEs, and a very small subset of antimalware software was able to detect those apps directly going after My Documents &quot;through the front door&quot; so to speak, but stacked with better techniques for encrypting user data, it can be really hard to detect.FWIW, one thing I learned months after my POC attacks is that even though initially they were undetected on VT, after a few months about half of the engines detected some aspect of my attack. Trying to defeat all of them was really hard without going back to the drawing board and fundamentally designing a new attack. It&#039;s yet another cat and mouse game -- what gets demonstrated today as a viable technique, if it actually takes off, quickly results in a myriad of detection methods by different AV vendors, and in my experience as soon as any vendor&#039;s AV engine automatically detects the threat, most other vendors are quick to follow suit.Note that some OS&#039;es do try to provide hardened protection against pretending to be the user. For example, on macOS there is an &quot;accessibility&quot; permission required to inject keyboard/mouse events to apps. The permissions dialogs that pop up on macOS for things like accessing your Documents folder cannot be easily clicked over VNC using automation. On Windows, UAC dialogs have modest protection by default against manufactured clicks. I really think these need to be a lot better but it&#039;s certainly a start.</blockquote>

[QUOTE="MacDefender, post: 906645, member: 83059"] Yeah these classes of techniques (including things like opening a VNC or RDP session to oneself or using virtualization software on the device to present a keyboard/mouse to the host that mimics user actions) are really hard for antimalware to detect because they all tend to have an anti-false-positive measure that attempts to allow either the user or trusted applications do the dirty deed. In terms of exploiting the target machine, one attack I've previously demonstrated here is that you can add malware to Python libraries for legitimate apps that use Python like machine learning / AI python IDEs, and a very small subset of antimalware software was able to detect those apps directly going after My Documents "through the front door" so to speak, but stacked with better techniques for encrypting user data, it can be really hard to detect. FWIW, one thing I learned months after my POC attacks is that even though initially they were undetected on VT, after a few months about half of the engines detected some aspect of my attack. Trying to defeat all of them was really hard without going back to the drawing board and fundamentally designing a new attack. It's yet another cat and mouse game -- what gets demonstrated today as a viable technique, if it actually takes off, quickly results in a myriad of detection methods by different AV vendors, and in my experience as soon as any vendor's AV engine automatically detects the threat, most other vendors are quick to follow suit. Note that some OS'es do try to provide hardened protection against pretending to be the user. For example, on macOS there is an "accessibility" permission required to inject keyboard/mouse events to apps. The permissions dialogs that pop up on macOS for things like accessing your Documents folder cannot be easily clicked over VNC using automation. On Windows, UAC dialogs have modest protection by default against manufactured clicks. I really think these need to be a lot better but it's certainly a start. [/QUOTE]

Verification