[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
BFS-SA-2016-001: FireEye Detection Evasion and Whitelisting of Arbitrary Malware
Vendor: FireEye, https://www.fireeye.com
Affected Product: FireEye FX, AX, NX, EX
Affected Version: FX < 7.5.1, AX < 7.7.0, NX < 7.6.1, EX < 7.6.2
Title: Detection Evasion and Whitelisting of Arbitrary Malware
An analysis engine evasion was identified which allows an attacker to
completely bypass FireEye's virtualization-based dynamic analysis on Windows
and add arbitrary binaries to the internal white list of binaries for which
the analysis will be skipped until the white list entry is wiped after a day.
This effectively allows an attacker to simply whitelist a binary before using
it in a targeted attack without fear of detection.
FireEye has released software updates to address the issue. The full advisory
with technical details is available at the following link: