[Paper Review] From Malware Signatures to Anti-Virus Assisted Attacks

Christian Wressnegger, Kevin Freeman+2 more|arXiv (Cornell University)|Oct 19, 2016

Advanced Malware Detection Techniques20 references3 citations

TL;DR

This paper presents a novel method to automatically extract byte-pattern signatures from commercial antivirus software without reverse engineering. It demonstrates how these signatures—often overly simplistic and poorly designed—can be weaponized by remote attackers to maliciously flag benign data as malicious, thereby enabling anti-virus assisted attacks that compromise data availability across multiple threat scenarios.

ABSTRACT

Although anti-virus software has significantly evolved over the last decade, classic signature matching based on byte patterns is still a prevalent concept for identifying security threats. Anti-virus signatures are a simple and fast detection mechanism that can complement more sophisticated analysis strategies. However, if signatures are not designed with care, they can turn from a defensive mechanism into an instrument of attack. In this paper, we present a novel method for automatically deriving signatures from anti-virus software and demonstrate how the extracted signatures can be used to attack sensible data with the aid of the virus scanner itself. We study the practicability of our approach using four commercial products and exemplarily discuss a novel attack vector made possible by insufficiently designed signatures. Our research indicates that there is an urgent need to improve pattern-based signatures if used in anti-virus software and to pursue alternative detection approaches in such products.

Motivation & Objective

• To investigate the feasibility of using antivirus signatures as attack vectors against benign data.
• To develop an automated method for extracting signature patterns from commercial antivirus products without reverse engineering.
• To evaluate the practicality of these signatures in enabling remote, privilege-assisted data deletion or blocking.
• To demonstrate real-world attack scenarios where antivirus software is manipulated into harming legitimate user data.
• To highlight the urgent need for improved signature design and alternative detection mechanisms in antivirus software.

Proposed method

• The authors developed a signature derivation technique that analyzes antivirus behavior by observing file scanning responses to crafted inputs.
• The method uses differential analysis on file scanning outcomes to infer byte-pattern signatures used by the antivirus engine.
• It leverages similarity metrics such as Levenshtein distance and normalized edit distance to cluster and match patterns across different scanner outputs.
• The approach is agnostic to antivirus implementation, relying only on observable scanning behavior and output differences.
• The derived signatures are validated by testing their ability to trigger detection on benign files.
• The method was empirically applied to four commercial antivirus products to assess signature quality and attack feasibility.

Experimental results

Research questions

• RQ1 Can antivirus signatures be automatically extracted from commercial products without reverse engineering?
• RQ2 To what extent are extracted signatures simplistic or semantically unrelated to actual malware?
• RQ3 Can these signatures be used to remotely manipulate antivirus software into marking benign data as malicious?
• RQ4 How effective are such signatures across different antivirus products, and can they be used to exploit differences between gateway and endpoint security?
• RQ5 What are the real-world implications of such signature-based attacks on data availability?

Key findings

• On average, 38% of the extracted signatures could be approximated using simple byte pattern combinations, indicating widespread use of basic pattern matching.
• Only 8% of the signatures were detected by more than one antivirus product, enabling attackers to exploit product-specific detection differences.
• The study demonstrated three practical attack scenarios: covering up password guessing, deleting user emails, and removing browser cookies via scanner-triggered deletion.
• The attacks were feasible remotely, without requiring direct access to the target system or software exploits.
• Many signatures were found to match non-malicious artifacts such as packer headers, text strings, or environment checks, indicating poor design.
• The results underscore the risk of relying on simplistic, pattern-based signatures and call for improved detection mechanisms in antivirus software.