What Attackers Want And What Attackers Need

I think there’s often a lot of confusion when it comes to understanding why malware works the way it does. People forget that malware is a business, very little malware serves only to needlessly destroy or mess with people and the vast majority of it is used to make money somehow.

Typically an infection occurs through the following process:

1) A user is tricked or forced to view an exploit page running either blackhole or ivy or some other kit.

2) The users browser or browser plugin is exploit allowing an attacker to gain control of the process.

3) The now infected process downloads a separate payload.

4) The infected process executes that payload.

That’s your typical infection. There are more sophisticated attacks and attacks that might stay within a browser or do something entirely different but most of the time this is how it goes.

And this is where the confusion starts. Attackers do this because it’s easy – having your exploit code call a separate payload means that you can change your payload at any time. From a managerial standpoint the benefits are numerous – if you’re selling this exploit page you can customize the payload on a per customer basis, if one payload is detected you just replace it on the server’s end and you keep your exploit page the same, you can tailor the payload to the system, etc.

At no point does an attacker need to use a separate payload. Anything payload.exe can do so can the process that launched it. This is why antiexecutables are great for preventing your typical malware but anyone can see the weakness.

Attackers also don’t necessarily need the highest privilege necessary. From a standard user account I can do quite a lot. If I’ve just infected your browser process I’ve got access to everything your browser has. I can install a malicious extension (a form of persistence) or plugin and work as a bank trojan. There are a ton of things you can do without admin privilege. And you don’t need to patch the kernel anymore either – ZeroAccess ditched its kernelmode 32bit driver because maintaining one driver is simpler.

Defending against an attacker shouldn’t start by finding out what they wantit should start out by preventing what they need. Find the critical part of an attack and prevent that part.