Conference paper Open Access

A Game of "Cut and Mouse": Bypassing Antivirus by Simulating User Inputs

Genç, Z.; Lenzini, G.; Sgandurra, D.

To protect their digital assets from malware attacks, most users and companies rely on anti-virus (AV) software. But AVs’ protection is a full-time task and AVs are engaged in a cat-and-mouse game where malware, e.g., through obfuscation and polymorphism, denial of service attacks and malformed packets and parameters, try to circumvent AV defences or make them crash. On the other hand, AVs react by complementing signature-based with anomaly or behavioral detection, and by using OS protection, standard code, and binary protection techniques. Further, malware counter-act, for instance by using adversarial inputs to avoid detection, et cetera. This paper investigates two novel moves for the malware side. The first one consists in simulating mouse events to control AVs, namely to send them mouse “clicks” to deactivate their protection. We prove that many AVs can be disabled in this way, and we call this class of attacks Ghost Control. The second one consists in controlling high-integrity white-listed applications, such as Notepad, by sending them keyboard events (such as “copy-and-paste”) to perform malicious operations on behalf of the malware. We prove that the anti-ransomware protection feature of some AVs can be bypassed if we use Notepad as a "puppet" to rewrite the content of protected files as a ransomware would do. Playing with the words, and recalling the cat-and-mouse game, we call this class of attacks Cut-and-Mouse.

Files (1.2 MB)
Name Size
23-A Game of Cut and Mouse-Bypassing Antivirus by Simulating User Inputs.pdf
md5:7853de3264f68d61b77b53a4f8be9ef5
1.2 MB Download
12
8
views
downloads
All versions This version
Views 1212
Downloads 88
Data volume 9.8 MB9.8 MB
Unique views 1212
Unique downloads 88

Share

Cite as