VB2016 paper: Defeating sandbox evasion: how to increase successful emulation rate in your virtualized environment

In order to analyse a potentially malicious binary, an important first step is to run it in a specialised virtual environment, or sandbox environment, and see what it does – if it exhibits some known malicious behaviour, it is probably worth blocking it.

However, malware authors are wise to this analysis technique, and most pieces of modern malware – even those that perpetrate relatively simple attacks – look for signs they are being run inside a sandbox. If a piece of malware detects a sandbox environment, it will terminate execution (or, in some cases,

exhibit decoy behaviour

). This can lead to significant security-related problems.

Today, we publish the VB2016 paper “Defeating sandbox evasion: how to increase successful emulation rate in your virtualized environment” (

here

in HTML format and

here

in PDF format) by

Check Point

researchers Stanislav Skuratovich and Aliaksandr Chailytko, in which they suggest a number of ways to harden a sandbox and make it less easy for an executable running inside it to detect. In particular, they make a number of suggestions for the popular open-source

Cuckoo

sandbox, which they have already discussed with its developers and are likely to be implemented.

We have also uploaded the video of their presentation to our

YouTube

channel.