McAfee recently reported over 75 million new malware samples detected in 2011. This number, while shocking, no longer matters as an absolute value. It also highlights a glaring flaw in network defense philosophy.
First, this number is only calculated from all detected hashes. Any changes in the binary results in a new, unique, hash. This means that only a small change by the adversary is necessary to effect a “new” piece of malware. A simple thought experiment: if there were 75 million malware samples, each with only one byte difference between them – this method would count 75 million “unique” pieces of malware.
Second, the number alone says nothing about the threat environment. It does not illustrate the attack vectors, vulnerabilities, or exposures used by the malware; nor does it describe the danger or effectiveness of the various malware samples. Maybe there is only one piece of malware and it’s 75 million varieties are all harmless. 75 million is now a very large number signifying nothing.
However, it does matter as a relative value showing the number of unique samples over time. For example, in 2007 unique malware samples rose 565% from the previous year [from A Brief History of Malware]. The velocity of unique malware samples detected in the wild (or the slope of the line if you prefer) is clearly increasing.
Why? It means that malware authors and operators are exploiting the primary network defense practice: default allow all – the black list. Defenders are still stuck in the “allow all” mind-set to trust everything except code which does not pass certain tests or follows certain behavior. To exploit this mind-set an adversary only has to change their malware enough to bypass these filters (e.g. AntiVirus). As defenders update their blacklists/AntiVirus/firewalls, the malware authors make a small change or re-pack and re-deploy the malware bypassing the new rules/filters/etc.
For an adversary, changing their capability slightly and re-deploying is a relatively inexpensive operation – particularly with pervasive exploit kits such as BlackHole. Whereas the cost for the defender to find the new malware, develop a signature, and deploy that signature is relatively costly leaving the security accounting on the side of the adversary.
To win this battle, the defender must switch to a known-good model, or “deny all with exceptions.” Also known as the white list. However, as we have seen – this simply adds a new target for the adversary: the white list itself.
Kelly Freeman Miller
Change the defender’s mind set… it MUST be done…
Warren
Just where did u actually end up getting the concepts to create ““Why
Malware Numbers Don?t Matter and What it Means for Security Accounting ? ActiveResponse.
org”? Thanks ,Preston
Kenneth K Carter
White list are effective, yes; but to what end? The real answer isn’t as simple but does come from the concept of a known source that is contained in the ‘white listing’ concept. If an indivdual or a singular orgainzation proposes to whitelist on thier own based on their own ‘known sources’ they also knowingly restrict sources that they obviously do not know that are valid and in fact could provide value if only they were ‘known’.
The solution to this catch 22 I would think would be a consortum of collective knowns that could be pooled together. Classified by content class for filter appropriate use, and then subsribed to by the contributors. By each submitting their subset they would recieve a superset of knowns that then would comprise a white list that would be of much greater value than their much more narrow subset would have offered them.
Just thinking out loud.
Regards,
Ken