What is a Fileless Attack? Everything You Need to Know | IPSYSTEMS, Inc.
loader
Blog:

What is a Fileless Attack? Everything You Need to Know

“Fileless” threats are a different breed of threats. The name itself gives the impression that the threat doesn’t come in a file container. Today’s threat actors are relentless in developing sophisticated techniques that defy detection. Their motivation is that security measures are constantly improving in identifying and nullifying malware and similar threats.

Non-malware attacks are on the rise. They're also known as zero-footprints attacks, macro attacks, or fileless attacks. While conventional reasoning expects cybercriminals to install files on a user's computer, fileless attacks function in a contrary manner, making them exceptionally sturdy in the presence of antivirus software.

Hackers trust fileless attacks because they are effective. These attack forms comprised 77% of compromised attacks in 2017. That’s according to The Ponemon Institute’s The State of Endpoint Security Risk Report. The document expects that fileless attacks have ten times the chance of succeeding compared to file-based attacks.

Why Do Fileless Malware Matter?

Fileless attacks are not a new phenomenon in cybersecurity. The industry has been aware of them for more than 40 years and has actively sought solutions to the menace. The goal of eliminating them is still a distant one in a landscape teeming with devices interconnected across all types of networks.

Hijacking the flow of a running application enables fileless malware to be the engine behind a plethora of zero-day attacks. Therefore, while web attacks such as cross-site scripting and SQL injection seem to get all the bad press (which they also deserve!), fileless attacks are the most dangerous cyber attack in existence. Unfortunately, it's the one only a few people understand.

What Else Can Fileless Attacks Evade?

Many antivirus tools are weak in dealing with fileless attacks. What’s worse is they’re also capable of exploiting whitelisting. Whitelisting only permits the installation of specific applications on a machine.

How then do fileless attacks work? They leverage applications present on the approved list. It then shows that terms such as "fileless," "non-malware," or "zero-footprint" seem a bit off considering that they usually rely on users downloading malicious attachments and leave traces on your computer that a knowledgeable user can find.

A fileless attack would typically use a specific string of Base-64-encoded instructions, called the payload, to elude checks. The payload can reach the target host via many channels, including:

  1. an input field on a website form
  2. a link to a web page
  3. a packet on a communication protocol; including DNS, HTTP, RTP, TCP/IP, WebRTC, and so forth
  4. a script within a file

The payload proceeds to exploit a buffer-overflow vulnerability in a running process on the target system. An example of viable running processes is some type of server linking the organization's internal network to the Internet. This server may be a DNS server, mail server, SSH server, web server, or any kind of daemon.

Hackers prefer to target daemons because these long-running programs restart in the event of a crash, automatically rebooting the application. Threat actors can leak information about the target program to improve their attack with each crash and reboot. They do this until their attack is entirely successful.

Cristiana Brafma Kitner, FireEye, Inc.’s Senior Threat Intelligence Analyst, explains that the concept of fully zero-footprint malware does not exist. According to her, there are ways to detect malware even if it avoids installing on your hard drive(s).

Besides, such malware does not completely evade antivirus detection since the protection software can still sniff out malicious links or attachments, even when they don’t contain any executable.

Besides, such malware does not completely evade antivirus detection since the protection software can still sniff out malicious links or attachments, even when they don't contain any executable.

Fileless attacks only have a higher probability of penetrating the user's machine. Such default stealth capability is what makes fileless attacks a real headache. Companies such as Samsung Research rely on innovative methods like adopting behavior-based systems and endpoint protection to detect evasive malware.

Consider the scenario where visitors connect to an enterprise network; the defenses can pick up malware that would otherwise beat the users' antivirus tools. Keyloggers and password-hunting applications are often present on visitor laptops, posing a considerable threat to enterprise data security.

Types of Fileless Malware Attacks

Fileless attacks fall into three broad categories:

1. Windows registry manipulation

In this variant, attackers use a malicious link or file. Clicking on this link uses a standard Windows process to write and execute fileless code into the registry.

Kovter and Powelike are examples of this type of fileless attack. They essentially transform your now-infected system into a click bot by linking with websites and click-through ads.

2. Memory code injection

This type of fileless attack involves concealing malicious code in the memory of whitelisted applications. While processes critical to Windows activity are running, the malware goes into virus mode, distributing and reinjecting itself into these processes.

Attacks like these exploit vulnerabilities in browsers, specific programs, and phishing campaigns to gain access and run code in the target device’s memory.

Detection is a significant issue with fileless malware. The malicious program often attacks other programs such as MWI and Windows PowerShell, hiding behind the legitimate commands these default programs are executing.

3. Script-based methods

The third category of fileless attacks is script-based. They may not be totally fileless, but they can be challenging to detect. The Operation Cobalt kitty and SamSam ransomware are examples of fileless attacks using script-based methods.

SamSam keeps getting better, so it’s increasingly challenging to identify and deal with it. It doesn’t spread automatically like other malware because the creator needs to enter a password. For the disk decryption or the payload to run, the creator needs to enter their password.

SamSam is usually for single-purpose, targeted attacks.

Operation Cobalt Kitty used malicious PowerShell to target one Asian firm for nearly six months. A spear-phishing email helped to penetrate over 40 PCs and servers.

The Best Protection Against Fileless Attacks

A comprehensive solution against fileless malware attacks comprises more than antivirus tools like Bitdefender Endpoint detection and response (EDR) solutions are more reliable. They constantly monitor phishing emails, network traffic, and unwanted tasks in operations such as PowerShell and WMI.

Since humans are essential to successful cyber attacks, some individual best practices will include:
  1. exercising caution with application downloads and installation
  2. using the latest security patches and updates
  3. updating web browsers often
  4. learning to spot phishing emails

lorem

The standard recommendation is to engage a cybersecurity solutions provider such as IPSYSTEMS to prevent and mitigate fileless attacks. Their security solutions will include memory analysis, protection, and intelligence sharing alongside behavior analysis.

Cyberbullying Infographics

Blog: Combating Bullying in Digital Classrooms: Empowering Students for a Safer Learning Environment Bullying is a pervasive issue that inflicts emotional, psychological, and physical

Read More »