POW-HOW: An enduring timing side-channel to evade online malware sandboxes
Antonio Nappa, Panagiotis Papadopoulos, Matteo Varvello, Daniel, Aceituno Gomez, Juan Tapiador, Andrea Lanzi

TL;DR
This paper introduces POW-HOW, a novel timing side-channel attack that uses Proof-of-Work algorithms to detect sandbox environments, significantly reducing malware detection effectiveness and exposing scalability issues in online malware analysis services.
Contribution
The paper presents a new sandbox evasion technique using PoW algorithms and the POW-HOW framework to automate evasion strategies, demonstrating its durability and impact on detection rates.
Findings
Reduces malware detection rate by a factor of 10
PoW-based evasion is durable and hard to fingerprint
Bare-metal environments cannot scale with malware submissions
Abstract
Online malware scanners are one of the best weapons in the arsenal of cybersecurity companies and researchers. A fundamental part of such systems is the sandbox that provides an instrumented and isolated environment (virtualized or emulated) for any user to upload and run unknown artifacts and identify potentially malicious behaviors. The provided API and the wealth of information inthe reports produced by these services have also helped attackers test the efficacy of numerous techniques to make malware hard to detect.The most common technique used by malware for evading the analysis system is to monitor the execution environment, detect the presence of any debugging artifacts, and hide its malicious behavior if needed. This is usually achieved by looking for signals suggesting that the execution environment does not belong to a the native machine, such as specific memory patterns or…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
