BFS-SA-2016-001: FireEye Detection Evasion and Whitelisting of Arbitrary Malware Feb 15 2016 02:39PM
Blue Frost Security Research Lab (research bluefrostsecurity de)

Vendor: FireEye, https://www.fireeye.com
Affected Product: FireEye FX, AX, NX, EX
Affected Version: FX < 7.5.1, AX < 7.7.0, NX < 7.6.1, EX < 7.6.2
Severity: High
Title: Detection Evasion and Whitelisting of Arbitrary Malware

An analysis engine evasion was identified which allows an attacker to
completely bypass FireEye's virtualization-based dynamic analysis on Windows
and add arbitrary binaries to the internal white list of binaries for which
the analysis will be skipped until the white list entry is wiped after a day.

This effectively allows an attacker to simply whitelist a binary before using
it in a targeted attack without fear of detection.

FireEye has released software updates to address the issue. The full advisory
with technical details is available at the following link:


[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus