When asked to identify different malware behaviors, it turns out that a significant percentage of cybersecurity professionals are lagging when it comes to the latest tricks and tendencies of malicious code.
A Lastline survey found that while 93% of respondents correctly identified a Trojan as malware disguised as something that a user wants or something legitimate, over three quarters (77%) agreed with the statement that a virus actively seeks new computers to infect, which is actually the behavior of a worm. And half indicated that a rootkit creates a network of compromised devices for use in a coordinated attack, which actually is what a botnet does.
“When deciding how to prioritize security strategies and technology investments, it’s important to know what types of behaviors a given piece of malware has and how they behave,” said Brian Laing, vice president at Lastline. “For example, when reading that WannaCry is a worm, it’s important to know what a worm is and how it spreads so that you know, for example, that cleaning the initially infected machine will not eradicate it from the network.”
Also, most are aware that malware can turn a webcam on to see if anyone is sitting in front of the computer (98%); and most know it can monitor a keyboard to see if a user is typing (97%). However, only 70% knew that malware is able to avoid being detected by a sandbox.
“Malware has been able to sniff out that it resides on a virtual machine (used as a sandbox) for years now, so it is a little worrying that nearly a third of cybersecurity professionals were unaware of this,” said Laing. “Malware often plays a game of deception, pretending to be a perfectly benign program when analyzed by a defensive tool. Once it is past defences, it can then perform the malicious activities it was programmed for when running on a user's device.”
Respondents were also given a list of names and asked to identify which ones were strains of malware. Respondents correctly identified the real strains of malware on average 28% of the time, with the best results attributed to the widespread malware, Slammer (40%) and SpyEye (37%).
“Given the level of media attention that some malware discoveries get, it is interesting that the majority of respondents couldn’t identify them, but not surprising. It just doesn’t matter when you’re fighting cybercrime today,” said Laing. “Given the volume of malware, the pace at which it evolves, and how criminals borrow from each other and re-write the code, there are not clear distinctions or naming connections between one attack and a subsequent attack using what may largely be the same code. What’s important is detecting it, by whatever name, and understanding its behaviors so you can mitigate and remediate.”
The stakes are high, as shown by the results of another Lastline survey, which found that 44% of security professionals would rather have root canal surgery than make the dreaded walk of shame to the boardroom to explain that they’ve suffered a data breach.