A new analysis of botnets has come up with a possible reason for their prodigious ability to infect PCs – many anti-virus programs are near to useless in blocking the binaries used to spread them.
According to FireEye chief scientist Stuart Staniford, detection rates are so poor that, on average, only around 40 percent of security software can detect binaries during the period of greatest infectivity and danger, namely the first few days after a particular variant starts being used by botnet builders.
In a detailed blog, he describes how he uploaded a sample of 217 binaries culled from FireEye appliances in customer premises between September and November to the independent VirusTotal test website. This runs 36 anti-virus programs – a representative sample of the security programs used by businesses and individuals – giving researchers access to data on get statistics on how many malware binaries have already been uploaded to the site by other researchers, when they were uploaded and how many were detected by each program.
Roughly half of the binaries picked up by FireEye were unknown to VirusTotal, a result indicative of the core problem of detecting botnet malware – speed.
Because malware often uses ‘polymorphism’ – programs are constantly changed very slightly to evade binary pattern detection – the problem of detecting and blocking malware quickly is huge. According to Staniford, this makes it important that anti-virus programs can spot malware in the first week of its use.
“The sample is likely to get discarded by the bad guys pretty soon after that,” he notes.
