Home > Ask the Security Experts > Information Security Threats Questions & Answers > What are polymorphic viruses?
Ask The Security Expert: Questions & Answers
EMAIL THIS

What are polymorphic viruses?

Ed Skoudis, past SearchSecurity.com expert EXPERT RESPONSE FROM: Ed Skoudis, past SearchSecurity.com expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 13 December 2006
I've been hearing about a rise in polymorphic viruses. How do these threats work, and how dangerous are they? What can I do to prevent them?


BROWSE BY TAG
Information Security Threats,   Malware, Viruses, Trojans and Spyware,   Information Security Threats,   Expert Archive: Information Security Threats,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Information Security Threats
How to get rid of malware, botnets on a hospital IT network
Should a national cybersecurity strategy include offensive botnets?
How can search results lead to malware?
How to prevent brute force webmail attacks
How to prevent mobile phone spying
What are today's antivirus software trends?
How to detect input validation errors and vulnerabilities
Can secure USB devices prevent man-in-the middle attacks
How to prevent and build protection against online identity theft
Is there a spy on my mobile device?

Malware, Viruses, Trojans and Spyware
ISP shutdown latest cat-and-mouse game with hackers
How to get rid of malware, botnets on a hospital IT network
How can search results lead to malware?
Should a national cybersecurity strategy include offensive botnets?
How to prevent mobile phone spying
How to defend against rogue DHCP server malware
New Trojan stealing FTP credentials, attacking FTP websites
Cybercriminals exploit Michael Jackson, Farrah Fawcett deaths
When BIOS updates become malware attacks
Antispyware buying guide for Indian enterprises

Expert Archive: Information Security Threats
The telltale signs of a network attack
Will Google Chrome enhance overall browser security?
Are there antivirus suites that pick up more than just run-of-the-mill viruses?
What tools can a hacker use to crack a laptop password?
Are social networking sites an easy target for malicious hackers?
What are the dangers of cross-site request forgery attacks (CSRF)?
Should social engineering tests be included in penetration testing?
What kind of data is compromised during a Google hack?
Best practices for using restriction policy whitelists
Defining mobile device security concerns

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
bot worm  (SearchSecurity.com)
directory traversal  (SearchSecurity.com)
government Trojan  (SearchSecurity.com)
Kraken  (SearchSecurity.com)
man in the browser  (SearchSecurity.com)
polymorphic malware  (SearchSecurity.com)
RavMonE virus  (SearchSecurity.com)
RFID virus  (SearchSecurity.com)
Rock Phish  (SearchSecurity.com)
Zotob  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


Polymorphic code is actually a pretty simple idea, but a nasty one. Think of the word "polymorphic" in its piece parts: "poly" means "many," and "morphic" means "form." So, polymorphic refers to two or more pieces of code that have exactly the same functionality, but different code.

Two snippets of code could do exactly the same thing when they run, for example, but they might have entirely different sets of instructions. These pieces are "polymorphs" of each other.

Why would someone implement such code? To dodge strict signature-based detection, a major function of most antivirus and antispyware tools today.

Strict signature detection technologies match an exact sequence of bits on the hard drive or in memory. By self-morphing for each newly infected system, polymorphic code can create a new version that dodges the latest signatures. And, taken to the extreme, code could morph whenever it runs, each time creating a new version of itself that still performs the same function.

But, here's the good news. Most major antivirus tools today employ heuristic checks. Think of these like "fuzzy" signatures; instead of matching the exact contents of a file in the file system or in memory, heuristic technologies only require certain crucial piece parts of code to match. And, because the bad guys so frequently utilize key parts of their old code when creating new evil specimens, the heuristics catch a lot of the nastiness. There are often still enough patterns left even in polymorphic code for an antivirus tool to detect it.

So what preventative measures can you take? Make sure you have up-to-date antivirus and antispyware signatures and that you are using an AV/spyware tool that supports heuristics. Most of the antivirus tools have this type of functionality, but not all of the antispyware tools do. Check with your vendor if you really want to know for sure.

As always though, things are in flux. The bad guys are starting to experiment with radically polymorphic code that thwarts heuristic controls by removing as many patterns from the original code as possible. The vendors, in turn, are working to improve the intelligence of their heuristics. Other antimalware vendors are starting to move toward behavior-based detection. Such techniques monitor the behavior of malware rather than look for any pattern in the actual code. If a piece of malware, for example, alters some critical files, the antimalware product can detect such behavior and kill the infection.

I happen to like a blend of both heuristic and behavior-based defenses myself, but be aware that some vendors are devoted to one side or the other.

More information:

  • Learn about Warezov and its many variations.
  • Defend your mobile devices from viruses and other malware.



  • Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    Targeted Security Channel Tips for Resellers, Integrators and Consultants
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts