Malware Vaccines: Stopping Ransomware's Spread

Security experts are investigating whether infection-spoofing code can protect Windows systems from attacks

What's better, prevention or cure? For a long time, the global cybersecurity industry has operated by responding to attacks and computer viruses. However, with ransomware continuing to grow in complexity, more proactive measures are necessary.

Malware vaccines have become a topic of discussion at recent cybersecurity conferences, such as the ONE Conference in The Hague. Justin Grosfelt, senior manager for the Reversing, Emulation, and Testing team at Recorded Future, presented new research showing that it is possible to develop code that makes only minor changes to a Windows PC to trick malware into not attempting an infection.

When ransomware enters a Windows machine, it typically scans cached memory, registry keys, file paths, and running processes to determine if the system is already infected, being used by a malware analyst, or running in a sandboxed environment. If it detects any of these signs, it will stop, but if not, it sends a message to cybercriminals' servers and begins downloading a payload that steals data, locks files, and demands payment.

So far, vaccines have worked by creating "infection markers" on Windows systems to trick malware into giving up. This includes placing small decoy files on the PC, editing the registry, or creating fake mutex objects. While decoy files are less of an issue because they don't actually do anything, if malware checks the processes running on the machine, it may see "mal.exe" or "vmware-vmx.exe" and assume the machine is either infected or using virtual machine software.

Editing the registry has more serious consequences, but it has been used successfully to disable malware. For example, Binary Defense's researchers created the EmoCrash kill switch in 2020. James Quinn used a PowerShell script to create fake registry keys with a "null" data value that caused the banking trojan Emotet to overflow and crash, preventing it from running.

Another approach involves the use of mutex (mutually exclusive) flags, which govern Windows resources and allow one process to take control over shared resources. Malware also needs to use the mutex to run its payloads, so if you can convince it that the payload is already running, it quits before accessing the kernel. This was demonstrated by Recorded Future with the Rhadamanthys data-stealing malware.

While these vaccines are clever, the problem is that developing enough of them to target multiple malware families is challenging. Additionally, vaccine files could interfere with legitimate software or system behavior. The easier the vaccine is to implement, the easier it is for threat actors to bypass it with minor code changes. Binary Defense's kill switch, for instance, worked for only six months before Emotet's authors patched it.

Grosfelt suggests that the next phase should involve a single vaccine that affects multiple malware families. His team's idea involved hooking commands in PowerShell profiles, so every time a command is run, it returns a specific value. By renaming this value, multiple data-stealing strains of malware that scan PCs in the same way before executing payloads can be tricked.

For example, the PowerShell profile could be modified to say "IsVirtualMachine = true." Nothing actually changes in the PC's operating system, and there isn't any virtual machine software running, but the malware doesn't know that. This almost incidental research, not part of any commercial solutions, has led Recorded Future to explore creating an open source community where researchers share information to help create and deliver malware vaccines against ransomware families.

This approach is similar to how Sigma rules, which detect cybersecurity threats in log files for Security Information and Event Management (SIEM) systems, are maintained on GitHub by the cybersecurity industry, which has been successful.

Grosfelt believes that the future of vaccines should not just be tied to major cyberattacks but should involve researchers finding and sharing them regardless. Although malware vaccines have existed since the 1980s, they remain few and far between. Experts acknowledge that no one in the cybersecurity industry is seriously working to make vaccines commercially viable.

Professor Alan Woodward, a computer security expert at the University of Surrey, agrees. He notes that Microsoft claims to have been creating vaccines since 2015, but what they consider vaccines are slightly different, often involving "shadow copies" to hide data so ransomware cannot wipe it. This requires registry editing, which is included in Patch Tuesday updates.

Otherwise, the cybersecurity industry often operates independently, with each firm concerned only with their own customers and sending out CVE patches as soon as new vulnerabilities are discovered. This is quite different from other technologies where companies collaborate in consortia to develop standards.

Brendan Saltaformaggio, an associate professor at Georgia Tech's School of Cybersecurity and Privacy, highlights the lack of standardization in cybersecurity practices, which varies by country and region. He heads a lab that spent five years analyzing hundreds of malware-infected Android devices to develop an automated tool called Echo, which can detect malware strains linked to botnets, generate a vaccine, and distribute it to victim devices over the internet.

Saltaformaggio notes that it has been difficult for enterprises, critical infrastructure providers, or governments to share information about cyberattacks due to the stigma associated with admitting to such incidents. He emphasizes the need for a shared knowledge base to learn from mistakes and build standards.

Alex Lanstein, chief technology officer at StrikeReady, feels that industry collaboration is sufficient as it is. He mentions tight collaboration on specific actors between companies and cybersecurity vendors, especially regarding North Korean issues or APT Chinese espionage threats.

Grosfelt is more nuanced, noting that while there is private shared intelligence among government channels, competitor channels, and vendors, public collaboration between major threat intelligence writers is minimal. He emphasizes the importance of curating and validating intelligence before discussing it publicly.

Woodward supports an open source community for developing malware vaccines but suggests it should be "open contribution" to prevent cybercriminals from interfering. He warns that without major players involved, such initiatives are likely to fail.

Georgia Tech's Saltaformaggio believes it is a shame that malware vaccines are not taken more seriously. He notes that the science behind them is still being proven, and his lab's research is just one example of the ongoing efforts to demonstrate their feasibility.

Lanstein disagrees with the concept of malware vaccines, citing their limited effectiveness on enterprise networks. He argues that while home users may not face significant downsides, enterprises require more robust solutions.

There is also a case to be made for more public funding of cybersecurity research and training, according to Saltaformaggio, whose lab is funded by the National Science Foundation (NSF), DARPA, and the Office for Naval Research. He warns of the dangers of an autocracy of cybersecurity and stresses the importance of publicly available discoveries and bridging the gap between lab research and real-world applications.

Lanstein agrees, highlighting the loss of Gary Warner's computer forensics lab at the University of Alabama at Birmingham due to funding cuts. He emphasizes the need for more funding in cybersecurity training, as the current focus is on reactive measures rather than fundamental research.