Sandbox Gateway Appliances- Advanced Breed Of Security Solutions

Sandbox execution, or virtual environment execution, does have its own limitations which are specifically targeted by advanced next-generation malware. A major limitation here is that Sandbox Gateway Solutions can only execute and monitor the executables for limited time duration. They cannot wait endlessly to observe and detect malicious behavior as and when it arises. This key limitation is quite easy to take advantage of and today’s malware samples simply wait for more than 10-15 minutes before they start their malicious activity. In other words, they simply go to sleep and maintain the executable behavior as normal for the initial 10-15 minutes.

Another limitation is that several complex vulnerability exploits are triggered only for particular environments which are hard to recreate in virtual environments. For example, a specific exploit will work only if a particular version of Adobe Reader is used on a particular version of Windows running a specified Service Pack. Such a situation will be hard to emulate in a Sandbox environment. These targeted APTs are expertly designed by conducting a deep and thorough study of the targeted organizations. They are made for situations where in these specific environment scan be recreated at endpoints that are suitable for vulnerability exploits. Such targeted APTs will be extremely hard to detect in simulated or virtual environment executions. Moreover, newer malware variants are also designed to proactively detect if they are being executed in a virtual machine or in an actual machine as well.

At the Quick Heal Threat Research Labs, we have come across a new malware sample that was able to breach this Sandbox protection. It successfully worked its way around this mechanism and reached auser’s inbox without getting detected. Detailed analysis of this sample revealed that it has been designed to infect highly protected networks. It also has several anti-virtual machine and anti-Sandbox tricks implemented within it. This malware was reported on 4th August and it has been named APT1508-04. We believe this discovery signals a new pattern wherein malware authors will devise new methods to invade Sandbox appliances, and then these appliances will release improved versions to combat them. Hence, Sandbox appliances will end up in a similar situation as that of the prevailing endpoint security industry.

We are in the midst of analyzing this APT threat further, and will be releasing a detailed analysis report soon. What this attack has taught us is that even the most advanced Sandbox-Based appliance protection can be breached. As a result, enterprises need to consider and implement multiple layers of protection to safeguard their networks. While the network breaches of the last few years have raised concerns about the effectiveness of endpoint security protection, future breaches are also sure to raise the question - Can Sandbox appliances provide reliable protection against APTs?