Cyberattackers are often thought to be tech experts. Cyberattackers understand security vulnerabilities and loopholes that most people don't understand. However, the reality of a cyberattacker is that most are not that specialized — they bypass security solutions through small adjustments to already well-known attacks. By simply leveraging an already established attack sample that is available on the Web, hackers can and do consistently and efficiently modify attacks in order to stay one step ahead of their targets' security solutions. In fact, some malware strains have been designed to automatically modify themselves to avoid signature-based security offerings.
Even sandboxing security solutions — which involve opening suspect files in a controlled environment — are not deterring the ever-increasing rate of email attacks. Because sandboxing solutions have become popular among security practitioners, hackers have also developed sandbox-evasion techniques. Some of these techniques are quite straightforward, such as using the sleep mode to avoid scan detection. And some techniques involve more advanced tools such as sandbox presence detection, where malware runs "clean" code when a sandbox is detected.
In addition, most sandboxes run on machines with low processor counts, RAM, etc. This helps malware detect the difference between an actual computer and a sandbox. A lack of USB ports, small hard drives, no personal files, and no mail client can indicate a sandbox. Once the malware identifies the sandbox, specific techniques are then designed to evade detection. As a dynamic solution, sandboxes offer a way of effectively scanning a file to detect malware.
The bottom line is that as a general rule, today's security solutions rely on past attack experiences to identify present-day threat ..
Support the originator by clicking the read the rest link below.
