Malware Writers Using Exclusion Lists To Linger

The New Acunetix V12 Engine


It seems malware writers using exclusion lists is not something new, but it’s still concerning people. To me it’d be a pretty obvious avenue, especially if you were crafting something a little more nefarious than average – like APT malware (Advanced Persistent Threat) tools.

Malware Writers Using Exclusion Lists To Linger

Definitely a chicken and egg problem, especially with Windows if you don’t exclude the OS and a bunch of system directories (including loads of ‘known’ software) you will have endless false positives. But then in this case, it can be abused.

Advanced malware writers are using anti-virus exclusion lists to better target victims, researchers say.

Software vendors use exclusion lists to explain the files and directories that antivirus software should ignore to avoid false positives and ensure an application’s proper operations.

Such lists are common: Citrix published one last week while it doesn’t take much Googling to find more. For example, here’s one from SolarWinds, and a few more from VMware, Microsoft, SAP, CA , Veritas and Sage.

When Citrix’s list emerged, The Reg pondered the lists’ possible use as a handy guide to the process names and directory locations hackers could target to take down users. Once you know, for example, that thisprocess.exe is whitelisted, creating an attack that runs as thisprocess.exe looks like an obvious tactic.

We were right: an independent malware researcher who prefers to be known as by his hacker handle “UnixFreakxjp” says some advanced malware writers are exploiting these published exclusions to produce malware targeted to particular enterprises.

“There are malware writers using whitelisted exclusion files, mostly APT (advanced persistent threat) and targeted infection groups rather than public malware operators,” he says.


The exclusion lists are actually really handy documents for malware authors as they even give executable names which are whitelisted to run. Plus directories that are exempt for scanning where you can stash your dodgy binaries.

It’s not like Windows needs more information out there on how to make it less secure..

He says the file exclusions are necessary to mitigate the “annoying” false positives caused by antivirus platforms, adding that many businesses are impacted by the erroneous flags.

Exclusions are, however, a band-aid fix and do not address core malware diagnosis problems.

Another respected security researcher requesting anonymity says he has not seen malware targeting exclusion lists but imagines it would be useful to advanced attackers.

He says the Locky ransomware actors, who tend to compromise corporates over individuals, could use a vendor’s recommended antivirus exclusion list to target clients.

“It would be interesting for attackers who know their victim is indeed using Citrix,” he says. Or known to be using any other exclusion-list-using vendor.

“The [exclusion] paths could be a nice place to store malware payloads before execution.”

He notes that organisations should have multi-layered defences and not rely solely on antivirus.

I don’t think most common garden malware floating around the web will use these kind of techniques, plus the average computer wont have software like Citrix installed on it anyway – but for corporates it’s something to be aware of.

And as mentioned above, and always, security is best treated with an onion approach of many layers (including security through obscurity) – so be on guard.

Source: The Register

Posted in: Malware


Latest Posts:


testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.


2 Responses to Malware Writers Using Exclusion Lists To Linger

  1. Nick December 10, 2016 at 9:24 am #

    Why exclude by name instead of just excluding signed executables or those that have a certain hash?

    • Darknet December 10, 2016 at 5:24 pm #

      Hash would require a lot of updates by AV vendors I guess, with so many exclusions, hash would change every time the software was updated/patched. And bad stuff has been signed before..