Why Antivirus Software fails

Share it with your friends Like

Anti-virus software is present on most desktops and even mobile devices. It is also used on servers to filter messages. Daniel Sauder takes a look at how anti-virus solutions work and how they fail. He describes his presentation at DeepSec 2014 in his own words:

“Based on my work about antivirus evasion techniques (see link below), I started using antivirus evasion techniques for testing the effectivity of antivirus engines. I researched the internal functionality of antivirus products, especially the implementation of heuristics by sandboxing and emulation and succeeded in evasion of these.

A result of my research are tests, if a shellcode runs within a x86 emulation engine. One test works by encrypting the payload, which is recognized as malicious normally. When the payload is recognized by the antivirus software, chances are high, that x86 emulation was performed.
Further test techniques I developed are, for example Windows API calls, using enhanced CPU features, as FPU, MMX registers etc., 64bit payloads, and other ways.

At the time of this writing I developed 36 different techniques as proof of concept code and tested them against 8 different products. More techniques and engines are pending.
Together with documentation, papers and talks from other researchers, this gives a deeper understanding for the functionality of antivirus software and shows, where it is failing generally and in particular.”


Write a comment

%d bloggers like this: