Evading and crashing anti-malware solutions via data collection overloading during analysis serialization

TL;DR

This paper introduces Telemetry Complexity Attacks (TCAs), exploiting vulnerabilities in malware analysis systems' telemetry pipelines to cause denial-of-analysis states through data overloads, affecting 18 platforms with some CVEs assigned.

Contribution

It identifies a new class of vulnerabilities in telemetry systems, demonstrating how data collection overloads can disrupt malware analysis without requiring elevated privileges.

Findings

7 products failed at different telemetry pipeline stages

2 CVEs have been assigned related to these vulnerabilities

Some systems exhibited unresponsive dashboards or missing behavioral reports

Abstract

Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mechanisms and bounded processing capabilities. Our method recursively spawns child processes to generate deeply nested and oversized objects that stress serialization and storage boundaries, as well as visualization layers, e.g., JSON/BSON depth and size limits. Depending on the product, this leads to truncated or missing behavioral reports, rejected database inserts, serializer recursion and size errors, and unresponsive dashboards, with some cases also exhibiting normal malicious execution that was not recorded or presented to analysts. We evaluate our technique against 18 commercial and open-source malware analysis platforms and endpoint detection and response (EDR) solutions. Seven products fail at different stages of the telemetry pipeline; two CVE identifiers have been assigned (CVE-61301 and CVE-61303); one more is pending; one has been assigned to an underlying library, and others have issued patches or configuration changes. We discuss root causes and propose mitigation strategies to prevent DoA attacks triggered by adversarial telemetry.