SlideShare a Scribd company logo

Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection

•Download as PPTX, PDF•
•
Neel Pathak
Neel Pathak

The document provides an overview of how anti-virus software works and techniques used to bypass antivirus detection. It discusses how antiviruses use signature-based, heuristic-based, behavioral, and sandboxing techniques to detect malware. It also explains common techniques used to evade detection like packers, splitters, code obfuscation, and injection. The document concludes that while antivirus has improved, virus creators continually develop new methods to bypass protections and that additional security measures are still needed.

Technology
1 of 40
By, Neel H. Pathak [121060751003]
Agenda + Introduction + Anti-virus: how they actually work? + Anti-virus detection techniques + PE Portable Executable –simplified + !%##$*@@$ where the signatures are stored? + Anti-virus Bypassing Techniques + Conclusion
Introduction • Anti-virus software has in true sense evolved a lot since last decade. • Time has gone where AVs only supported “string based detection”
Introduction
List of the Malwares (Virus/worms) reported
Introduction • Even though our AVs detects and eliminates the newly discovered viruses then why we see such a great number of viruses increasing each year ? • Are the Virus coders so stupid ?
Some really smart people (Hackers/Crackers) already know how to bypass AVs protection
Anti-virus: How they actually work • Now a days AV scans our system on real-time basis. • Information is analyzed based on the origin of the information i.e. source of information. • Operates differently depending upon source of information.
Anti-virus working from top level view. If the file is found malicious then the information will not be copied onto the destination location. (Here destination in our case is HD)
One of the two possibilities takes place • When the data is found to be legitimate, the scanner forwards that data to the destination location. • When virus is detected then a warning is sent to UI for user`s action. Interface may vary.
Process flow of working of AV. AV scanner, scanning information on real time.
AV detection techniques(Scan Engines) • Signature Based detection (also sometimes called as “string based” detection) • AV maintains a dictionary of the signatures of known Viruses, malwares, spywares etc. • This dictionary is stored at client side and is usually in binary. • Next-generation signature based detection • Disadvantage ?
Signature based detection
Heuristic based Detection • Used to detect new, unknown viruses in your system that has not yet been identified. • Based on the piece-by-piece examination of a virus. • Looks for the sequence of instruction that differentiate the virus from ‘normal programs’
Behavioral based detection • Just observes how the program executes, rather than merely emulating its execution. • Identify malware by looking for suspicious behavior. • Works similarly as Behavioral HIDS. • Disadvantage ?
Sandboxing Based detection • What is “sandbox” ? • Isolate the files which are to be scanned and monitors their activity.
PE Portable Executable- Simplified • Do you think that an executable file is one single file ? • PE or Portable executable is a file format for executables, object code, dlls used in 32bit and 64bit versions of windows operating system.
PE File Structure
Where you can find PE? • When you explore your executable in some debugger like Olly debug or your executable in some hex editor then you can view it.
Exploring an executable
Where the signatures are stored? • When we examine the any executable with some hex editor or some debugger we can get the file signature. • It is not necessary that malicious file signature are found only in MZ header, it may be present in any of the sections just explained.
Alert: Signature found!!
Caution!! AV bypassing techniques This are those techniques that the hackers and crackers already knew. These are: • Binders and packers • Using splitter • Code conversion from EXE to client side script • Code obfuscation • Using metasploit framework • Code or DLL Injection
Binders and Packers • Binders
• Packers: Similar to binders but just one difference. Popular Binders and Packers are Infector v2, Exe Maker, Exe Joiner, Elitewrap and UPX etc. available widely on internet. Note: These techniques are not effective now a days..
Splitting the File • These are those programs that split a single files into no. of small sized files.
• One may change some code into some small chunked file to evade AV detection and again join it and scan it to check whether AV flags it malicious or not. A trial and Error method.. • POC
Code conversion from exe to client scripts One may convert file to client side scripts which are also executable. But again needless to say that this technique is also not full proof.
Code Obfuscation • This simply means transforming the code into some other form. • There are many ways for code obfuscation, major are: 1. Polymorphism 2. Metamorphism etc.
Using metasploit framework • Using metasploit framework also one can easily bypass AV. • Here the code is encoded and a decoding routine is added in code itself. Upon executing the code is first decoded and then it is run • Note: Encoding and decoding are different.
• Msfencode: It is useful tool that alters the code in an executable so that it looks different to antivirus software but will still run the same way.
Code or DLL Injection • What the heck is Code or DLL Injection • Most stealth method till now for POST exploitation phase in pentesting.
Conclusion • As mentioned afore AV has really evolved a lot but at the same time the techniques to bypass the detection has also evolved. • Installing AV and thinking that you are safe would be not more than a stupidity. • Virus coders will always look for different ways or means to evade any anti-virus products and infect the systems.
Conclusion • One may install a real-time port monitor to identify any malicious virus that may have bypassed AV detection. • One may also implement strict policies, maintaining update routines and look for existing vulnerabilities in system which may be exploited.
References 1) Real time virus reporting http://bitdefender.com/resourcecenter/real-time-reporting 2) Online malware and spyware scanning portal: virus total http://www.virustotal.com 3) Two ways to prevent viruses entering your computer. http://www.netsecurity.org/article.php?id=485&p=1 4) A whitepaper on Injector Mask or a Tool, 2010 by Amit Malik 5) Signature based scanning. http://blogs.avg.com/business/signature-based-detection/ 6) Heuristic based scanning http://techinicalplanet.blogspot.in/2013/02/antivirus-mechanism.html http://www.pandasecurity.com/usa/homeusers/support/card/?Id=7&idIdioma=2&Ref=TechPortal 7) Sandbox http://searchsecurity.techtarget.com/definition/sandbox 8) PE file format http://win32assembly.programminghorizon.com/pe-tut1.html 9)PE Sections http://www.csn.ul.ie/~caolan/publink/winresdump/winresdump/doc/pefile2.html 10) Olly Debugger (Ollydbg) www.ollydbg.de/version2.html 10:1) White paper on Bypassing Anti-virus Scanners by Internet Security Team 11) UPX: The ultimate packer http://upx.sourceforge.net/ 12) Blackhat USA presentation, 0wning Anti-virus by Alex Wheeler and Neel Mehta 13) http://upx.sourceforge.net/ 14) Audit Results of famous AVs by Alex Wheeler and Neel Mehta 15) 4 types of vulnerabilities in Anti-viruses: Whitepaper on Attacking Anti-virus by Feng Xue, Technical Lead, Nevis Labs.
References 16) Spike http://www.immunitysec.com/resources-freesoftware.shtml 17) Sully http://code.google.com/p/sulley 18) Webfuzz http://www.fuzzing.org/wp-content/webfuzz.zip 19) CalmAv http://www.clamav.net/lang/en/ 20) AxMan http://www.metasploit.com/users/hdm/tools/axman/ 21) ComRaider http://labs.idefence.com/software/fuzzing.php#more_comraider 22) sc.exe Utility in MS environment http://technet2.microsoft.com/WindowsServer/en/library/0a658e97-51d5-4109b461a474c799964e1003.mspx 23) Code Injection http://securityxploded.com/bypassing-antivirus-using-code-injection.php
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection

Recommended

Anti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and CountermeasuresAnti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and Countermeasures
n|u - The Open Security Community
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Intro to Malware Analysis
Intro to Malware AnalysisIntro to Malware Analysis
Intro to Malware Analysis
wremes
 
Virus and malware presentation
Virus and malware presentationVirus and malware presentation
Virus and malware presentation
Amjad Bhutto
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
xabean
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware Lab
Digit Oktavianto
 
Reversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basicsReversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basics
Cysinfo Cyber Security Community
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 

Recommended

Anti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and CountermeasuresAnti-Virus Evasion Techniques and Countermeasures
Anti-Virus Evasion Techniques and Countermeasures
n|u - The Open Security Community
 
Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Intro to Malware Analysis
Intro to Malware AnalysisIntro to Malware Analysis
Intro to Malware Analysis
wremes
 
Virus and malware presentation
Virus and malware presentationVirus and malware presentation
Virus and malware presentation
Amjad Bhutto
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
xabean
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware Lab
Digit Oktavianto
 
Reversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basicsReversing malware analysis training part10 exploit development basics
Reversing malware analysis training part10 exploit development basics
Cysinfo Cyber Security Community
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 
Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston Hecker
EC-Council
 
Malware classification and detection
Malware classification and detectionMalware classification and detection
Malware classification and detectionChong-Kuan Chen
 
Signature based virus detection and protection system
Signature based virus detection and protection systemSignature based virus detection and protection system
Signature based virus detection and protection system
Md. Hasan Basri (Angel)
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware Infections
Ramon
 
Lecture 12 malicious software
Lecture 12 malicious software Lecture 12 malicious software
Lecture 12 malicious software
rajakhurram
 
Exploitation techniques and fuzzing
Exploitation techniques and fuzzingExploitation techniques and fuzzing
Exploitation techniques and fuzzing
G Prachi
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012
Stephan Chenette
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to android
Cysinfo Cyber Security Community
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sample
Michel Coene
 
Malicious software
Malicious softwareMalicious software
Malicious softwarerajakhurram
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
Security Bootcamp
 
Hacking Web Apps by Brent White
Hacking Web Apps by Brent WhiteHacking Web Apps by Brent White
Hacking Web Apps by Brent White
EC-Council
 
Dll preloading-attack
Dll preloading-attackDll preloading-attack
Dll preloading-attack
Cysinfo Cyber Security Community
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
Chelsea Sisson
 
Lecture malicious software
Lecture malicious softwareLecture malicious software
Lecture malicious softwarerajakhurram
 
Web backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detectionWeb backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detection
n|u - The Open Security Community
 
Program security
Program securityProgram security
Program security
G Prachi
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
Virus detection system
Virus detection systemVirus detection system
Virus detection system
Akshay Surve
 
Hacker bootcamp
Hacker bootcampHacker bootcamp
Hacker bootcamp
Gregory Hanis
 
Antivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methodsAntivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methods
Somanath Kavalase
 
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDayAntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
INCIDE
 

More Related Content

What's hot

Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston Hecker
EC-Council
 
Malware classification and detection
Malware classification and detectionMalware classification and detection
Malware classification and detectionChong-Kuan Chen
 
Signature based virus detection and protection system
Signature based virus detection and protection systemSignature based virus detection and protection system
Signature based virus detection and protection system
Md. Hasan Basri (Angel)
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware Infections
Ramon
 
Lecture 12 malicious software
Lecture 12 malicious software Lecture 12 malicious software
Lecture 12 malicious software
rajakhurram
 
Exploitation techniques and fuzzing
Exploitation techniques and fuzzingExploitation techniques and fuzzing
Exploitation techniques and fuzzing
G Prachi
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012
Stephan Chenette
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to android
Cysinfo Cyber Security Community
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sample
Michel Coene
 
Malicious software
Malicious softwareMalicious software
Malicious softwarerajakhurram
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
Security Bootcamp
 
Hacking Web Apps by Brent White
Hacking Web Apps by Brent WhiteHacking Web Apps by Brent White
Hacking Web Apps by Brent White
EC-Council
 
Dll preloading-attack
Dll preloading-attackDll preloading-attack
Dll preloading-attack
Cysinfo Cyber Security Community
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
Chelsea Sisson
 
Lecture malicious software
Lecture malicious softwareLecture malicious software
Lecture malicious softwarerajakhurram
 
Web backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detectionWeb backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detection
n|u - The Open Security Community
 
Program security
Program securityProgram security
Program security
G Prachi
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
securityxploded
 
Virus detection system
Virus detection systemVirus detection system
Virus detection system
Akshay Surve
 
Hacker bootcamp
Hacker bootcampHacker bootcamp
Hacker bootcamp
Gregory Hanis
 

What's hot (20)

Security by Weston Hecker
Security by Weston HeckerSecurity by Weston Hecker
Security by Weston Hecker
 
Malware classification and detection
Malware classification and detectionMalware classification and detection
Malware classification and detection
 
Signature based virus detection and protection system
Signature based virus detection and protection systemSignature based virus detection and protection system
Signature based virus detection and protection system
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware Infections
 
Lecture 12 malicious software
Lecture 12 malicious software Lecture 12 malicious software
Lecture 12 malicious software
 
Exploitation techniques and fuzzing
Exploitation techniques and fuzzingExploitation techniques and fuzzing
Exploitation techniques and fuzzing
 
Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012Watchtowers of the Internet - Source Boston 2012
Watchtowers of the Internet - Source Boston 2012
 
Advanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to androidAdvanced malware analysis training session8 introduction to android
Advanced malware analysis training session8 introduction to android
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sample
 
Malicious software
Malicious softwareMalicious software
Malicious software
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
 
Hacking Web Apps by Brent White
Hacking Web Apps by Brent WhiteHacking Web Apps by Brent White
Hacking Web Apps by Brent White
 
Dll preloading-attack
Dll preloading-attackDll preloading-attack
Dll preloading-attack
 
The Rising Threat of Fileless Malware
The Rising Threat of Fileless MalwareThe Rising Threat of Fileless Malware
The Rising Threat of Fileless Malware
 
Lecture malicious software
Lecture malicious softwareLecture malicious software
Lecture malicious software
 
Web backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detectionWeb backdoors attacks, evasion, detection
Web backdoors attacks, evasion, detection
 
Program security
Program securityProgram security
Program security
 
Understanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case StudyUnderstanding CryptoLocker (Ransomware) with a Case Study
Understanding CryptoLocker (Ransomware) with a Case Study
 
Virus detection system
Virus detection systemVirus detection system
Virus detection system
 
Hacker bootcamp
Hacker bootcampHacker bootcamp
Hacker bootcamp
 

Viewers also liked

Antivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methodsAntivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methods
Somanath Kavalase
 
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDayAntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
INCIDE
 
ANTIVIRUS AND VIRUS Powerpoint presentation
ANTIVIRUS AND VIRUS Powerpoint presentationANTIVIRUS AND VIRUS Powerpoint presentation
ANTIVIRUS AND VIRUS Powerpoint presentation
abhijit chintamani
 
Virus and antivirus final ppt
Virus and antivirus final pptVirus and antivirus final ppt
Virus and antivirus final ppt
aritradutta22
 
Binders and crypters
Binders and cryptersBinders and crypters
Binders and crypters
Tej Singh
 
Antivirus Bypass Techniques - 2016
Antivirus Bypass Techniques - 2016Antivirus Bypass Techniques - 2016
Antivirus Bypass Techniques - 2016
Raghav Bisht
 
Anti Virus Software
Anti Virus SoftwareAnti Virus Software
Anti Virus Software
Pradeepkrajyaguru
 
11 virus vs. antivirus
11 virus vs. antivirus11 virus vs. antivirus
11 virus vs. antivirus
singhhp10699
 
Computer virus (Microsoft Powerpoint)
Computer virus (Microsoft Powerpoint)Computer virus (Microsoft Powerpoint)
Computer virus (Microsoft Powerpoint)ainizbahari97
 
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las VegasGet the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
Shawn Tuma
 
Computer virus and antivirus
Computer virus and antivirusComputer virus and antivirus
Computer virus and antivirus
Maryam Malik
 
Windows Registry Tips & Tricks
Windows Registry Tips & TricksWindows Registry Tips & Tricks
Windows Registry Tips & TricksRaghav Bisht
 
mimikatz @ asfws
mimikatz @ asfwsmimikatz @ asfws
mimikatz @ asfws
Benjamin Delpy
 
Virus vs anti virus
Virus vs anti virusVirus vs anti virus
Virus vs anti virus
Xʎz ʞsɥ
 
ppt on antivirus and computer virus
ppt on antivirus and computer virusppt on antivirus and computer virus
ppt on antivirus and computer virus
Naveen Goyal
 
Analysis of mass SQL injection attacks
Analysis of mass SQL injection attacksAnalysis of mass SQL injection attacks
Analysis of mass SQL injection attacks
Miroslav Stampar
 
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamarEvasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
INCIDE
 
Metasploit Humla for Beginner
Metasploit Humla for BeginnerMetasploit Humla for Beginner
Metasploit Humla for Beginner
n|u - The Open Security Community
 

Viewers also liked (20)

Antivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methodsAntivirus - Virus detection and removal methods
Antivirus - Virus detection and removal methods
 
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDayAntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
AntiVirus Evasion Techniques Use of Crypters 2k14 at MundoHackerDay
 
ANTIVIRUS AND VIRUS Powerpoint presentation
ANTIVIRUS AND VIRUS Powerpoint presentationANTIVIRUS AND VIRUS Powerpoint presentation
ANTIVIRUS AND VIRUS Powerpoint presentation
 
Virus and antivirus final ppt
Virus and antivirus final pptVirus and antivirus final ppt
Virus and antivirus final ppt
 
Binders and crypters
Binders and cryptersBinders and crypters
Binders and crypters
 
Antivirus Bypass Techniques - 2016
Antivirus Bypass Techniques - 2016Antivirus Bypass Techniques - 2016
Antivirus Bypass Techniques - 2016
 
Anti Virus Software
Anti Virus SoftwareAnti Virus Software
Anti Virus Software
 
11 virus vs. antivirus
11 virus vs. antivirus11 virus vs. antivirus
11 virus vs. antivirus
 
Antivirus
AntivirusAntivirus
Antivirus
 
Computer virus (Microsoft Powerpoint)
Computer virus (Microsoft Powerpoint)Computer virus (Microsoft Powerpoint)
Computer virus (Microsoft Powerpoint)
 
Avast! antivirus protection
Avast! antivirus protectionAvast! antivirus protection
Avast! antivirus protection
 
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las VegasGet the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
Get the FUD out of Cybersecurity! ISACA CSXNA 2016 in Las Vegas
 
Computer virus and antivirus
Computer virus and antivirusComputer virus and antivirus
Computer virus and antivirus
 
Windows Registry Tips & Tricks
Windows Registry Tips & TricksWindows Registry Tips & Tricks
Windows Registry Tips & Tricks
 
mimikatz @ asfws
mimikatz @ asfwsmimikatz @ asfws
mimikatz @ asfws
 
Virus vs anti virus
Virus vs anti virusVirus vs anti virus
Virus vs anti virus
 
ppt on antivirus and computer virus
ppt on antivirus and computer virusppt on antivirus and computer virus
ppt on antivirus and computer virus
 
Analysis of mass SQL injection attacks
Analysis of mass SQL injection attacksAnalysis of mass SQL injection attacks
Analysis of mass SQL injection attacks
 
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamarEvasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
Evasion_AVs_Uso_de_Crypters-MundoHackerDay_2k14_apasamar
 
Metasploit Humla for Beginner
Metasploit Humla for BeginnerMetasploit Humla for Beginner
Metasploit Humla for Beginner
 

Similar to Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection

Jason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional ToolsJason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional Tools
centralohioissa
 
PoS Malware and Other Threats to the Retail Industry
PoS Malware and Other Threats to the Retail IndustryPoS Malware and Other Threats to the Retail Industry
PoS Malware and Other Threats to the Retail Industry
Invincea, Inc.
 
Virus Detection Based on the Packet Flow
Virus Detection Based on the Packet FlowVirus Detection Based on the Packet Flow
Virus Detection Based on the Packet FlowAntiy Labs
 
Commodity malware means YOU
Commodity malware means YOUCommodity malware means YOU
Commodity malware means YOU
Michael Gough
 
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
Orbid
 
Is av dead or just missing in action - avar2016
Is av dead or just missing in action - avar2016Is av dead or just missing in action - avar2016
Is av dead or just missing in action - avar2016
rajeshnikam
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and Analysis
Prashant Chopra
 
Bypass_AV-EDR.pdf
Bypass_AV-EDR.pdfBypass_AV-EDR.pdf
Bypass_AV-EDR.pdf
Farouk2nd
 
Finalppt metasploit
Finalppt metasploitFinalppt metasploit
Finalppt metasploitdevilback
 
Continuous security testing - sharing responsibility
Continuous security testing - sharing responsibilityContinuous security testing - sharing responsibility
Continuous security testing - sharing responsibility
VodqaBLR
 
Is Antivirus (AV) Dead or Just Missing in Action
Is Antivirus (AV) Dead or Just Missing in Action Is Antivirus (AV) Dead or Just Missing in Action
Is Antivirus (AV) Dead or Just Missing in Action
Quick Heal Technologies Ltd.
 
NextGen Endpoint Security for Dummies
NextGen Endpoint Security for DummiesNextGen Endpoint Security for Dummies
NextGen Endpoint Security for Dummies
Atif Ghauri
 
Cyber-Security-Unit-4.pptx
Cyber-Security-Unit-4.pptxCyber-Security-Unit-4.pptx
Cyber-Security-Unit-4.pptx
TikdiPatel
 
Malware 101 by saurabh chaudhary
Malware 101 by saurabh chaudharyMalware 101 by saurabh chaudhary
Malware 101 by saurabh chaudhary
Saurav Chaudhary
 
A trust system based on multi level virus detection
A trust system based on multi level virus detectionA trust system based on multi level virus detection
A trust system based on multi level virus detectionUltraUploader
 
Malware ppt final.pptx
Malware ppt final.pptxMalware ppt final.pptx
Malware ppt final.pptx
LakshayNRReddy
 
Security threats explained
Security threats explained Security threats explained
Security threats explained
Abhijeet Karve
 
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
PaloAltoNetworks
 
SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012
Rian Yulian
 

Similar to Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection (20)

Jason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional ToolsJason Kent - AppSec Without Additional Tools
Jason Kent - AppSec Without Additional Tools
 
PoS Malware and Other Threats to the Retail Industry
PoS Malware and Other Threats to the Retail IndustryPoS Malware and Other Threats to the Retail Industry
PoS Malware and Other Threats to the Retail Industry
 
Virus Detection Based on the Packet Flow
Virus Detection Based on the Packet FlowVirus Detection Based on the Packet Flow
Virus Detection Based on the Packet Flow
 
Commodity malware means YOU
Commodity malware means YOUCommodity malware means YOU
Commodity malware means YOU
 
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
WatchGuard - Cryptolocker en het gevecht tegen IT 's grootste vijand - Orbid ...
 
Is av dead or just missing in action - avar2016
Is av dead or just missing in action - avar2016Is av dead or just missing in action - avar2016
Is av dead or just missing in action - avar2016
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and Analysis
 
Bypass_AV-EDR.pdf
Bypass_AV-EDR.pdfBypass_AV-EDR.pdf
Bypass_AV-EDR.pdf
 
Finalppt metasploit
Finalppt metasploitFinalppt metasploit
Finalppt metasploit
 
Continuous security testing - sharing responsibility
Continuous security testing - sharing responsibilityContinuous security testing - sharing responsibility
Continuous security testing - sharing responsibility
 
Is Antivirus (AV) Dead or Just Missing in Action
Is Antivirus (AV) Dead or Just Missing in Action Is Antivirus (AV) Dead or Just Missing in Action
Is Antivirus (AV) Dead or Just Missing in Action
 
NextGen Endpoint Security for Dummies
NextGen Endpoint Security for DummiesNextGen Endpoint Security for Dummies
NextGen Endpoint Security for Dummies
 
Cyber-Security-Unit-4.pptx
Cyber-Security-Unit-4.pptxCyber-Security-Unit-4.pptx
Cyber-Security-Unit-4.pptx
 
Malware 101 by saurabh chaudhary
Malware 101 by saurabh chaudharyMalware 101 by saurabh chaudhary
Malware 101 by saurabh chaudhary
 
A trust system based on multi level virus detection
A trust system based on multi level virus detectionA trust system based on multi level virus detection
A trust system based on multi level virus detection
 
anti_virus
anti_virusanti_virus
anti_virus
 
Malware ppt final.pptx
Malware ppt final.pptxMalware ppt final.pptx
Malware ppt final.pptx
 
Security threats explained
Security threats explained Security threats explained
Security threats explained
 
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
Pro Tips for Power Users – Palo Alto Networks Live Community and Fuel User Gr...
 
SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012SANS Digital Forensics and Incident Response Poster 2012
SANS Digital Forensics and Incident Response Poster 2012
 

Recently uploaded

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
Fwdays
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
CatarinaPereira64715
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
Abida Shariff
 

Recently uploaded (20)

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi"Impact of front-end architecture on development cost", Viktor Turskyi
"Impact of front-end architecture on development cost", Viktor Turskyi
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
ODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User GroupODC, Data Fabric and Architecture User Group
ODC, Data Fabric and Architecture User Group
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 

Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection

  • 2. Agenda + Introduction + Anti-virus: how they actually work? + Anti-virus detection techniques + PE Portable Executable –simplified + !%##$*@@$ where the signatures are stored? + Anti-virus Bypassing Techniques + Conclusion
  • 3. Introduction • Anti-virus software has in true sense evolved a lot since last decade. • Time has gone where AVs only supported “string based detection”
  • 6. Introduction • Even though our AVs detects and eliminates the newly discovered viruses then why we see such a great number of viruses increasing each year ? • Are the Virus coders so stupid ?
  • 7. Some really smart people (Hackers/Crackers) already know how to bypass AVs protection
  • 8.
  • 9.
  • 10. Anti-virus: How they actually work • Now a days AV scans our system on real-time basis. • Information is analyzed based on the origin of the information i.e. source of information. • Operates differently depending upon source of information.
  • 11. Anti-virus working from top level view. If the file is found malicious then the information will not be copied onto the destination location. (Here destination in our case is HD)
  • 12. One of the two possibilities takes place • When the data is found to be legitimate, the scanner forwards that data to the destination location. • When virus is detected then a warning is sent to UI for user`s action. Interface may vary.
  • 13. Process flow of working of AV. AV scanner, scanning information on real time.
  • 14. AV detection techniques(Scan Engines) • Signature Based detection (also sometimes called as “string based” detection) • AV maintains a dictionary of the signatures of known Viruses, malwares, spywares etc. • This dictionary is stored at client side and is usually in binary. • Next-generation signature based detection • Disadvantage ?
  • 16. Heuristic based Detection • Used to detect new, unknown viruses in your system that has not yet been identified. • Based on the piece-by-piece examination of a virus. • Looks for the sequence of instruction that differentiate the virus from ‘normal programs’
  • 17. Behavioral based detection • Just observes how the program executes, rather than merely emulating its execution. • Identify malware by looking for suspicious behavior. • Works similarly as Behavioral HIDS. • Disadvantage ?
  • 18. Sandboxing Based detection • What is “sandbox” ? • Isolate the files which are to be scanned and monitors their activity.
  • 19. PE Portable Executable- Simplified • Do you think that an executable file is one single file ? • PE or Portable executable is a file format for executables, object code, dlls used in 32bit and 64bit versions of windows operating system.
  • 21. Where you can find PE? • When you explore your executable in some debugger like Olly debug or your executable in some hex editor then you can view it.
  • 23. Where the signatures are stored? • When we examine the any executable with some hex editor or some debugger we can get the file signature. • It is not necessary that malicious file signature are found only in MZ header, it may be present in any of the sections just explained.
  • 25. Caution!! AV bypassing techniques This are those techniques that the hackers and crackers already knew. These are: • Binders and packers • Using splitter • Code conversion from EXE to client side script • Code obfuscation • Using metasploit framework • Code or DLL Injection
  • 27. • Packers: Similar to binders but just one difference. Popular Binders and Packers are Infector v2, Exe Maker, Exe Joiner, Elitewrap and UPX etc. available widely on internet. Note: These techniques are not effective now a days..
  • 28. Splitting the File • These are those programs that split a single files into no. of small sized files.
  • 29. • One may change some code into some small chunked file to evade AV detection and again join it and scan it to check whether AV flags it malicious or not. A trial and Error method.. • POC
  • 30. Code conversion from exe to client scripts One may convert file to client side scripts which are also executable. But again needless to say that this technique is also not full proof.
  • 31. Code Obfuscation • This simply means transforming the code into some other form. • There are many ways for code obfuscation, major are: 1. Polymorphism 2. Metamorphism etc.
  • 32. Using metasploit framework • Using metasploit framework also one can easily bypass AV. • Here the code is encoded and a decoding routine is added in code itself. Upon executing the code is first decoded and then it is run • Note: Encoding and decoding are different.
  • 33. • Msfencode: It is useful tool that alters the code in an executable so that it looks different to antivirus software but will still run the same way.
  • 34.
  • 35. Code or DLL Injection • What the heck is Code or DLL Injection • Most stealth method till now for POST exploitation phase in pentesting.
  • 36. Conclusion • As mentioned afore AV has really evolved a lot but at the same time the techniques to bypass the detection has also evolved. • Installing AV and thinking that you are safe would be not more than a stupidity. • Virus coders will always look for different ways or means to evade any anti-virus products and infect the systems.
  • 37. Conclusion • One may install a real-time port monitor to identify any malicious virus that may have bypassed AV detection. • One may also implement strict policies, maintaining update routines and look for existing vulnerabilities in system which may be exploited.
  • 38. References 1) Real time virus reporting http://bitdefender.com/resourcecenter/real-time-reporting 2) Online malware and spyware scanning portal: virus total http://www.virustotal.com 3) Two ways to prevent viruses entering your computer. http://www.netsecurity.org/article.php?id=485&p=1 4) A whitepaper on Injector Mask or a Tool, 2010 by Amit Malik 5) Signature based scanning. http://blogs.avg.com/business/signature-based-detection/ 6) Heuristic based scanning http://techinicalplanet.blogspot.in/2013/02/antivirus-mechanism.html http://www.pandasecurity.com/usa/homeusers/support/card/?Id=7&idIdioma=2&Ref=TechPortal 7) Sandbox http://searchsecurity.techtarget.com/definition/sandbox 8) PE file format http://win32assembly.programminghorizon.com/pe-tut1.html 9)PE Sections http://www.csn.ul.ie/~caolan/publink/winresdump/winresdump/doc/pefile2.html 10) Olly Debugger (Ollydbg) www.ollydbg.de/version2.html 10:1) White paper on Bypassing Anti-virus Scanners by Internet Security Team 11) UPX: The ultimate packer http://upx.sourceforge.net/ 12) Blackhat USA presentation, 0wning Anti-virus by Alex Wheeler and Neel Mehta 13) http://upx.sourceforge.net/ 14) Audit Results of famous AVs by Alex Wheeler and Neel Mehta 15) 4 types of vulnerabilities in Anti-viruses: Whitepaper on Attacking Anti-virus by Feng Xue, Technical Lead, Nevis Labs.
  • 39. References 16) Spike http://www.immunitysec.com/resources-freesoftware.shtml 17) Sully http://code.google.com/p/sulley 18) Webfuzz http://www.fuzzing.org/wp-content/webfuzz.zip 19) CalmAv http://www.clamav.net/lang/en/ 20) AxMan http://www.metasploit.com/users/hdm/tools/axman/ 21) ComRaider http://labs.idefence.com/software/fuzzing.php#more_comraider 22) sc.exe Utility in MS environment http://technet2.microsoft.com/WindowsServer/en/library/0a658e97-51d5-4109b461a474c799964e1003.mspx 23) Code Injection http://securityxploded.com/bypassing-antivirus-using-code-injection.php