February 23, 2012Dancho Danchev By Dancho Danchev

Why relying on antivirus signatures is simply not enough anymore

How is it possible that in an industry dominated by advanced performance metrics and benchmarking tests, cybercriminals still manage to release unique malware that remains undetected for weeks by major antivirus vendors?

It’s pretty simple. Cybercrime is innovating much faster than the security industry is.

It used to be that cybercriminals hacked from the fringe, often acting alone and for personal fame. Now, cybercrime is a profitable career. It’s among the top national defense issues; it’s leveraged as a form of political protest; and it’s a relatively easy field to break into.

You might be surprised to how easy it is for anyone to access black markets online, pay a small fee (or nothing at all), and gain access to malicious processes that wreak havoc on company websites, steal financial information, and much more. And their labors are producing countless malware samples each day.

Here’s an up-close look at some of the nasty tactics today’s hackers are using—and why security vendors can’t stop them with yesterday’s approach.

4 Ways Hackers are Winning

  • Do-it-yourself (DIY) malware cryptors – Malware cryptors, as we cyber nerds call them, are designed to mask malware from being discovered by computer security programs. Cybercriminals can build malware cryptors on their own with relative ease. The idea is: once malware authors release their cryptors into the wild, they have the ability to keep changing it until their malware becomes unrecognizable to antivirus scans. That’s a big “one up” over traditional security.
  • Managed malware crypting services – Think of malware as a key that is trying to find a door (someone’s device) to unlock. Instead of trying to make your own custom key, you could go to someone who already knows a specific key is going to work. That’s the idea behind malware crypting as a managed service. This process allows cybercriminals to obtain only the malicious executables (the things that make your computer go “boom”) that have the best chance of being effective—without having to build anything on their own.
  • Server-side polymorphism (SSP) – Server-side polymorphism (say that two times fast!) is malware that is difficult to identify by a computer scan, no matter how many times you clean your system. What’s particularly important to highlight is how it renders traditional antivirus software totally useless.
  • Quality assurance processes within the cybercrime ecosystem – Cybercriminals aren’t sloppy about their work. Before a malware campaign is launched, cybercriminals will usually pre-scan their malicious executable against all popular antivirus engines in order to ensure that it will successfully bypass the signature-based malware scanning used by them. The process is highly automated and is often offered as a service at selected cybercrime-friendly online communities.
So what is the security industry’s big mistake?
Habit. Security companies have been relying solely on an outdated system, signature-based threat detection, for catching malware and other threats—a system that slows down people’s computers and doesn’t address today’s threat environment.
Signature-based threat detection works like this:
  1. A new virus or malware variant is discovered
  2. An antivirus vendor creates a new signature to protect against that specific piece of malware.
  3. The signature is tested, and then pushed out to the vendor’s customers in the form of a signature update.
Year after year, the goal for antivirus companies has been to collect the most signatures. This not only slows down your computer because it requires a large amount of space on your hard drive, but it also relies heavily on YOU to update your own antivirus program, which increases the risk for infection.
This means that even on the day you purchase most security suites, they are outdated and ill-equipped to protect you against the newest malware. By the time updates are addressed, it’s often too late. In other words, we’ve been trying to bob for apples in a barrel when we should be dumping the barrel upside down.

Dumping the barrel upside down
The future of online security can and should be based on behavior-based blocking techniques, which analyzes files by looking at how they’re acting and what they’re attempting to do, rather than comparing them to a list of known threats. It’s our best option to get a leg up on hackers.

Not only does signature-based threat detection slow your computer down, it also opens a rather large window for new malware to reach your Internet-connected devices while you wait for critical updates. It’s time for the security industry to wake and smell the malware. We did. And that’s why we created Webroot® SecureAnywhere™—an award-winning new approach to behavior-based Internet security.

As a consumer of computer security products, it’s important to know why cybercriminals currently have the upper hand on a fair amount of cyber security companies. We created this article to help you stay informed. If you’d like to learn more about signature-based threat detection on antivirus technology, Wikipedia does a pretty nice job of explaining the subject (click here to go to the article).

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on  Twitter.
Share Button


  1. […] do so, they periodically introduce new features in the exploit kits, initiate new partnerships with managed malware/script crypting services, and do their best to stay ahead of the security […]

  2. […] to the overall availability of malware crypting on demand services, we believe that it’s only a matter of time before the cybercriminals behind this campaign […]

  3. […] email databases, boutique cybercrime-friendly services, services offering access to hacked PCs, managed malware crypting on demand, and managed email hacking as as service, the cybercrime ecosystem is also a thriving marketplace […]

  4. […] 2012 it’s becoming increasingly common for cybercriminals to apply basic quality assurance (QA) tactics to their campaigns. Next to QA, they also emphasize on campaign optimization strategies […]

  5. […] the findings of this study a trend or a fad? Sadly, the cybercriminals’ ability to bypass antivirus protection is an emerging trend within the cybercrime ecosystem, rendering popular antivirus solutions […]

  6. […] the findings of this study a trend or a fad? Sadly, the cybercriminals’ ability to bypass antivirus protection is an emerging trend within the cybercrime ecosystem, rendering popular antivirus solutions […]

  7. […] that’s not bad enough, earlier this year Dancho Danchev penned an interesting blog for WebRoot, pointing out when it comes to obfuscating malcode, malware developers are hard at […]

  8. […] basis, it’s fairly logical to conclude that over the years, the bad guys have adapted to signature-based antivirus scanning protection mechanisms, and have achieved disturbing levels of automation and efficiency. How do […]

  9. […] the findings of this study a trend or a fad? Sadly, the cybercriminals’ ability to bypass antivirus protection is an emerging trend within the cybercrime ecosystem, rendering popular antivirus solutions […]

  10. […] and adaptation to the ubiquitous endpoint protection mechanisms, such as for instance, signatures-based antivirus scanning, the cybercrime ecosystem is currently enjoying the monetary joys of its mature […]

  11. […] taking advantage of today’s managed malware crypting services to ensure that the actual payload remains undetected before it is distributed to the […]

  12. […] efficiently convert the traffic into ransomware-infected hosts, the source code of the ransomware, managed crypting of the actual binaries, money laundering tips for the fraudulently obtained funds, as well as instructions on how to […]

  13. […] tools, or services allowing novice cybercriminals to generate a completely undetected — using signatures-based scanning techniques — pieces of malicious […]

  14. […] This international underground market ad is a great example of penetration pricing, by undercutting the country/region based prices for specific items — for instance games — in an attempt by the cybercriminal behind the shop to achieve asset liquidity for the compromised items. Based on the feedback provided by “happy customers” of this e-shop, we can conclude that this is not a one-time inventory of compromised assets, but a long-term operation which we believe is fueled by an ongoing botnet operation relying on commercially/publicly obtainable DIY (do-it-yourself) malware generating tools, in combination with malware crypting services. […]

  15. […] this service, and the community that’s apparently orbiting around it, greatly reminds us of the limitations of signatures-based antivirus scanning in 2013. Thanks to commercially available DIY malware crypting services, commercially available […]

  16. […] the fact that the ransomware doesn’t pose any sophisticated features — bypassing signatures based antivirus scanning is not a feature, it is an every day reality – it provides and example of an efficient […]