what is server-side polymorphism?

server-side polymorphism is a type of polymorphism where the polymorphic engine (the transformation function responsible for producing the malware's many forms) doesn't reside within the malware itself...

just as conventional polymorphism was constrained to housing the polymorphic engine within the virus its meant to operate on (because the code doing the copying has to have access to the transformation function), server-side polymorphism requires the polymorphic engine to be part of the system (generally a website) that serves (hands out) copies of the non-replicative malware it's used on instead of being in the malware itself...

this has proven to be very effective and very hard to counter from a conventional known-malware perspective... the reason is because with the polymorphic engine staying on the server instead of residing within the malware itself the transformation function can remain unknown to the malware analysts... although the analysts can try to perform black-box analysis of the transformation function, without knowing all the variables the function takes into account it's not possible to model the entire algorithm and predict all possible outputs... further, the transformation function can be arbitrarily complex, it could involve actually recompiling the malware with different parameters, or it might not even be an algorithm at all (someone might literally be manually changing the malware that the server is handing out)...

given this, it's not really possible in the general case for signature-based known-malware detection technology to reliably detect all instances of a piece of malware that employs server-side polymorphism but there are some facts that anti-malware vendors can use to their advantage... first, while signatures probably won't work, heuristics should be able to have some success against the various instances of such malware (assuming the polymorphism isn't too complex)... second, polymorphism has never been easy to develop and so the use (and sale) of kits may be helpful since the kits should contain the polymorphic engine and therefore give the analysts access to the transformation function... finally, there are detection and prevention technologies (behaviour-based detectors, whitelists, etc) that can often stop malware without needing to know what the malware looks like and vendors are increasingly including such technology in their suites...

back to index

what is metamorphism?

metamorphism can be thought of as a kind of polymorphism that doesn't use decryptors... in fact many of the techniques that polymorphic viruses used to vary their decryptors metamorphic viruses have used to vary their entire bodies...

metamorphism, like polymorphism, was a type of camouflage that was meant to fool anti-virus technology of the day... one of the successful solutions to polymorphism was to use a polymorphic virus' decryptor against it generically... by allowing it to run in an emulated environment so that the decryptor would reverse the obfuscation that had been performed on the main body of the virus, the de-obfuscated static virus body could then easily be matched against signatures...

rather than encrypt the virus' body and decrypt it when needed as a conventional polymorphic virus would, a metamorphic virus would vary it's entire body the way a polymorphic virus varied it's decryptor... since the transformation function used didn't need to be reversed in order for the code to run (otherwise decryptors in polymorphic viruses would have needed additional decryptors of their own), this meant that the virus' main body was generally never returned to an untransformed state during the normal operation of the virus and so would foil the previously mentioned tactic used against conventional polymorphism...

that said, the metamorphic engine (like the polymorphic engine) still must reside within the virus (in order for copies to have a different form the code doing the copying must have access to the transformation function) and that in itself was a weakness as it gave anti-virus vendors knowledge of the transformation function and therefore the ability to know (or at least derive) all forms a metamorphic virus could take...

back to index

what is polymorphism?

in the malware context, polymorphism refers to a property of self-replicating malware (viruses and worms, *although self-modifying non-replicative programs take on different forms by virtue of modifying themselves so the term polymorphism can technically apply to them also) whereby the offspring (the copies) potentially take on a different form than the parent (the original)...

typically polymorphism works by encrypting the main virus body (which was actually unchanging) using a variable key (in order to make the ciphertext actually be different from one instance to the next a different key is needed each time, otherwise it would simply be considered *encrypted) and using a decryptor (a stub that decrypts the main body of the virus in order for it to execute) that is also variable (otherwise the decryptor itself could be easily used to detect the virus)...

polymorphism is a type of camouflage that was originally developed back when anti-virus products were just using simple scan strings to compare against samples in the process of looking for viruses... a virus that changed it's contents could easily fool such a simple scanner because there would be no single sequence of bytes that would match all instances of the virus... as a result anti-virus companies developed technology that would use the virus' decryptor against it by allowing it to decrypt the main body of the virus so that that could then be used to identify the virus...

the term polymorph, in the malware context, arose out of a long telephone conversation between frisk (fridrik skulason) and alan solomon as a way to describe viruses that mutated or garbled themselves (according to dr. solly's retelling anyways) but over the years it has been narrowed to exclude cases where the decryptor didn't change (variably encrypted), or only changed into relatively few alternate forms (oligomorphs), or cases that didn't use a decryptor at all...

back to index

(*updates/improvements thanks to vesselin's comments)