Malware, Encryption, and Rerandomization – Everything Is Under Attack

Abstract

Abstract. A malware author constructing malware wishes to infect a specific location in the network. The author will then infect n initial nodes with n different variations of his malicious code. The malware continues to infect subsequent nodes in the network by making similar copies of itself. An analyst defending M nodes in the network observes N infected nodes with some malware and wants to know if any sample is targeting any of his nodes. To reduce his work, the analyst need only look at unique malware samples. We show that by encrypting the malware payload and using rerandomization to replicate malware, we can make the N observed malware samples distinct and increase the analyst's work factor substantially.

Evaluation of Local Security Event Management System vs. Standard Antivirus Software

“…Self-encryption: The use of encryption algorithms or functions that contain a key included in the body of the malware that allows it to perform the encryption or decryption function in an automated manner [32].…”

Efficient Cloud-based Secret Shuffling via Homomorphic Encryption

“…Given pk and a ciphertext E(x) of a plaintext x, rerandomization is an operation that computes a valid ciphertext E ′ (x) without decryption. With high probability, E(x) = E ′ (x) is ensured such that the output distributions of rerandomization and encryption are computationally indistinguishable [14]. For Paillier's cryptosystem, it can be performed by multiplication with the encrypted identity element 0 as depicted in (3) [28].…”