Reducing the Time for Adaptation

Periodically security professionals and security vendors tout the idea that reducing the reaction time between an event and employing a counter strategy can potentially resolve the evolutionary arms races within information security. This idea is similar to an Observe, Orient, Decide and Act (OODA) loop.

In strategy, there is Boyd's OODA loop which emphasizes the idea that reducing the time required for planning and reacting faster than an opponent will provide an advantage and subsequently enhances the likelihood of the opponent making a mistake. By deceasing the time that is required to react appropriately to a situation, the initiative is maintained and consequently an opponent is always responding to the situation. The more time an opponent spends reacting, the less time they have to observe and plan; increasing the likelihood that a mistake will be made. This concept has been raised recently on the panel discussions at the CATCH 2009 conference. References to this particular type of strategy, arise periodically from malware vendors in that if the time between the release of malware and the release of generally available anti-malware signatures can be reduced, it could help to solve or alleviate the malware threat.

Applying the OODA loop or simply reducing the reaction time could potentially go a long way towards helping to alleviate the malware threat. But, it should be considered that malware will always be able to evolve more quickly than an operating system, a web application, a database or even the anti-malware tool as it has the initiative and malware is typically smaller in size and less complex. Looking at this strategy from an evolutionary biology perspective, it is similar to the Red Queen hypothesis that occurs between diseases/parasites and their hosts. It is also similar to the evolutionary arms race between malware and the rest of the information security community (anti-virus,browsers, office automation applications, operating systems, application services, etc). Viruses have genomes on the order of 10^4 base pairs, bacteria have genomes on the order of 2x10^6 base pairs, and humans have genomes on the order of 6.6x10^9 base pairs (Evolution 3rd Edition, Ridley). Modern operating systems have about 40 - 55 million lines of code (equating to 2.5 - 4 GB installed), while most malware is a few orders of magnitude smaller, approximately 119 - 134 KB in the case of Conficker.

As is the case with viruses and other more complex organisms within the real world, smaller organisms are capable of evolving at a much faster rate than large complex organisms. Consider the case of RNA viruses which have a mutation rate of about 1 mutation/generation. While bacteria have about 10^-3 mutations/generation, and humans have about 200 mutations/generation (Evolution 3rd Edition, Ridley and Evolutionary Biology 3rd Edition, Futuyma). Some diseases mutate frequently enough that every replication event experiences the likelihood that the disease will have changed. Although humans have a much higher mutation rate than diseases (such as viruses and bacteria), the generation span of a human is much longer than that of most diseases. The generation lifespan on a human is on the order of 15 - 30 years, while diseases typically have generation lifespans on the order of seconds to minutes. Per unit time diseases (e.g. viruses and bacteria) can evolve much more rapidly, and yet large complex organisms are able to survive as they have strategies which allow them to combat these adaptations. Despite the rate at which diseases are capable of evolving, they do not always win. Influenzavirus has the potential of being fatal but in most cases it is not considered life threatening.

Large complex organisms have multiple methods for allowing them to survive in an environment where diseases can rapidly evolve. Entities with smaller genomes have effectively less space in which to maintain a set of strategies which they can use to exploit their environment, while larger more complex organisms have more space in which they can record their survival strategies. Some bacteria use enzymes to protect against viral infections. Eukaryotes employ even more defenses against infection, while entities like vertebrates have evolved immune systems which are capable of responding to infection by disease. One segment of the Human genome, the Major Histocompatibility Complex (MHC) contains approximately 3.6 million base pairs or 140 genes which control a portion of the human immunological system. As of October 2004, the Immunogenetic Related Information Source (IRIS) database estimates the percentage of the human genome that controls the human immune system is approximately 7%, or 1562 genes. Although the percentage of the human genome related to the human immune system seems small, it is important to consider that a significant portion of the human genome is inactive. It is estimated that 25% of the genome is attributed to diseases which have inserted their genetic code into our genome and are now inactive, while other sections contain pseudogenes which are no inactive version of ancient genes. The percentage of the human active genome which relates to the immune system could be substantially higher than currently theorized. The cost of surviving in an evolutionary arms race can be high, as significant resources are required to defend an organism from infection by diseases and parasites.

Recently researchers, such as Banerjee in An Immune System Inspired Approach to Automated Program Verification, have looked at applying some of the methods that the immune system uses for protecting itself from disease by investigating an Automated Immune System (AIS) which can be implemented in information systems.

Implementing an immune system to handle rapidly evolving threats does not eradicate the threat. Immune systems will act as a selection pressure that will cause only those diseases which are capable of adapting to survive. Some adaptations can include methods for remaining undetected by the immune system, while others can include methods for exploiting the immune system and subverting it for its own use. In essence, these systems represent another vector in which disease can exploit a host. Human Immunodeficiency Virus (HIV) actively exploits the immune system; even at the cost of its own reproductive fitness to remain active in the host to survive when anti-HIV drugs are administered. Similarly with anti-malware products, flaws in these systems have allowed malware to exist and even spread in the form of computer worms. Malicious code routinely attempts to disable anti-virus before downloading and installing malicious components. In order to remain undetected, some malware will re-enable the anti-virus products to prevent the user from noticing anything conspicuous. Anti-virus software is complex enough that it has its own vulnerabilities which may be exploited by malware. In 2006, Symantec Anti-virus had a vulnerability (CVE-2006-2630) which allowed for a privilege escalation that was exploited by the W32.Rinbot.L worm.

Simply reducing the response time will not eradicate the threat. It will provide an advantage but it will not solve the problem. In order to respond to diseases which are able to quickly adapt to host evolutionary responses, large complex organisms have had to evolve complex responses that do not rely on a single strategy to ensure their survival. The cost of ensuring survival in an evolutionary arms race can be high, as numerous strategies need to be available to counter act the threat of disease and parasites.

Disruptive/Stabilizing Selection Pressures and Virtualization

In evolutionary biology disruptive selection pressures are commonly seen when there is a radical change in the environment in which an entity is attempting to survive in. The more drastic the environmental change, the stronger the selection pressure that will be applied to the population. Sometimes the changes will be drastic enough that the population goes extinct, while in other cases the population will be able to evolve and adapt to the new environment. In information security, an emerging potentially drastic change is the application of virtualization through out the computing environment.

There have been a number of suggestions and even implemented systems which use Virtualization as a security measure. Some systems even treat it as the ultimate solution to malware propagation on the Internet. Aside from the increased overall complexity of the resulting system and requirements for management, using virtualization as a security measure will be a game changing event, but not one which solves the malware issue. Looking at the implementation of virtualization as a security mechanism from an evolutionary biology point of view, this virtualization strategy will act as both a disruptive and stabilizing selection pressure in the co-evolutionary system of information security.

Disruptive selection pressures cause an entity to abandon their current strategy and pursue a different strategy. These pressures select against those who employ a specific strategy. In the case of stabilizing selection, pressures act on an entity to reinforce their current strategy and selects against employing other strategies. There are two ways in which malware can respond to the wide spread adoption of virtualization. It can either abandon the items being virtualized or it can exploit virtualization to its advantage.

• In the first case, malware abandons operating in the virtualized layers of the operating system and applications. Virtualization acts as a disruptive selection pressure in which malware evolves to exploit the layers above and below the virtualized layers.
• In the second case, malware evolves to exploit the new virtualized environment. Virtualization has made new exploitable resources available and will act as a stabilizing selection pressure as malware beings to evolve strategies which exploits virtualization.

In the case of disruptive selection, malware's response will move out of the virtualized layers of the information system (e.g. the operating system and possibly the application environment) and into the layers either above or below the virtualization. The layers above the virtualization would be considered to operate within a browser environment. Virtualization can even be applied to specific applications such that if one is exploited, it will not affect the host operating system. Despite this fact, virtualization will not protect the system against attacks such as Cross Site Scripting (XSS), Cross Site Request Forgery (CRSF), Phishing, Sidejacking, and SQL Injection. It will not protect against attacks which exploit the user through social engineering and still allows malicious scripts to ex-filtrate private and/or sensitive information from the system.

Also, this disruptive selection pressure can cause malware to move down through layers towards the BIOS, firmware, and hardware of an information system. Generally virtualization will be able to protect an information system as data is being processed or once it has already been processed. If an attack ignores these layers, it can exploit the system without being detected. Fundamentally, virtualization trusts the hardware in which is it operating and this trust relationship can be exploited. There are a large number of places in which malware can hide on a system besides at the application and operating systems layers such as in BIOS, Firmware (e.g. a NIC) or even within the processor.

Evolutionary biologists have previously conducted experiments which focused on evolutionary adaptation of bacteria which demonstrated that given a resource limited environment bacteria can evolve by selection to fully exploit environmental changes. A population of E. coli was placed under controlled environmental conditions which allowed the organism to survive and maintain population levels. The bacteria essentially had a disruptive selection pressure applied to its main method of harvesting resources from the environment. The new environment contained resources which if a few changes were made to the metabolic process of the E. coli organism, it would all it to utilize the new resources which it would otherwise not be able to use. The bacteria's progress was measured throughout the experiment, and eventually the right mutations occurred and the bacteria's population grew exponentially as it was able to harvest additional resources in the environment.

Virtualization can act as a stabilizing selection pressure on the evolution of malware. Instead of causing malware to move to other layers of the system, virtualization offers new resources which malware may be able to exploit. Presently there is a significant number of malware that are capable of detecting virtualization but this detection exists to only prevent it from executing as most malware analysis workstations inspect malware inside a virtualized environment. Escapes from a virtualized environment have already been demonstrated, as have VM exploits. If virtualization becomes common through out the environment, malware will be able to evolve its strategies such that it can survive in this environment.

The widespread adoption of virtualization as an information security counter-strategy will in some cases provide no selection pressure on an attacker's strategy. Virtualization will also not address a number of exploitation strategies which exploit the interconnections between systems. It will not be able to provide a defense against man-in-the-middle attacks or attacks which focus on the protocols which are used to connect information systems together.

Lastly, it will take time to make a virtualized solution common in the environment. In the short term, the virtualized clients will have an advantage in that they occupy a small portion of the entire population, but as time passes the likelihood that malware can exploit this new virtualized strategy will increase. Like with the example of E. coli adapting to an environment which initially severely limits its fitness, eventually malware will be evolve to exploit its new environment. Rolling out virtualization to the entire population of computers will not be done over-night and it will take a few years. Unlike the E. coli which was suddenly exposed to an environment which hampered its fitness, malware will be more gradually exposed to virtualized environments. Despite the time difference in the exposure to the emergence of a selection pressure, just like the E. coli malware will be forced to change by its environment, allowing it to evolve the necessary adaptations which will allow it to survive. It is not a question of can it evolve, but rather how long it will take to evolve.

Simply using virtualization as a defense does not mean that a system is instantly protected against all existing malware strategies. It will stop some exploitation strategies but it is not a complete defense and can even increase the risk to the environment as virtualization adds software which must be secured in addition to the increased complexity to the system in its operation and management.

There are a number of directions in which using Virtualization as a common defense could force malware strategies to evolve. Malware could evolve under stabilizing selection pressures which would cause it to evolve strategies for escaping and exploiting the very software which is used to protect the system. Malware could also evolve under disruptive selection pressures and evolve strategies to target the hardware which has traditionally been assumed to be trusted. Attacks against Firmware, BIOS, CPU, NICs, and even the Trusted Platform Modules have been successfully demonstrated. Although virtualization is not the only selection pressure in causing the creation of hardware attacks, it will increase the selection pressure and force these attack strategies to move in that direction. Already there have been discussions and demonstrations about implementing System Management Mode (SMM) rootkits by poisoning the system's cache. Beyond that, using virtualization as an information security measure will not protect a system from scripted attacks, social engineering or man-in-the-middle attacks.

Selection Pressure, Yesterday's Strategies, Resource Exploitation and Evolutionary Costs

When attempting to think of information security from an evolutionary perspective, there are a few concepts from evolutionary biology to consider. Selection pressures, adaptive time lags, and resource/population exploitation are important to how an entity's strategies evolve.

Evolutionary pressures, selection agents, or selection pressures usually refer to the same entity within evolutionary biology; a thing or a force which causes an organism to respond and/or adapt. Selection pressures originate from the natural environment of the organisms and include things like: resource availability, changing/adverse environmental conditions, interspecies predation and intra-species competition. The more pronounced the selection pressure, the quicker an entity must respond in order to survive. Those entities that are not able to adapt (i.e. contain the required characteristics to survive) are eventually eliminated. Stronger selection pressures will eliminate maladapted entities more quickly than those which already are surviving or are able to acquire the necessary characteristics to survive.

Selection pressures can select for a characteristic to evolve in a directional, stabilizing or disruptive way. Directional selection pressures force a characteristic in a "direction." For example, directional selection pressures select for a larger or smaller characteristic. Stabilizing selection pressures force a characteristic to remain the same, and select against larger and smaller characteristics. Disruptive selection pressures select against a specific characteristic in the population. A disruptive selection pressure could select for the larger or smaller characteristic and select against the average value of the characteristic which results in the selecting characteristic to diverge.

In information security, the security controls that are implemented can be considered to be the survival strategies of an information system and even selection pressures acting upon an adversary. If an adversary does not have the ability to compromise any one of the implemented security controls, they will not be able to access the resources which the system is protecting. So in order to survive, an adversary must develop counter-strategies which are capable of exploiting the strategies that were implemented in order to survive.

Organizations should understand that their strategies will succeed and fail based on the counter strategies employed against them. While the root cause of a compromise is being analyzed, one should also investigate what selection pressures should be applied to move the organization in the direction towards secure business processes. If an organization consistently receives poor quality applications from their vendors, they should determine what selection pressures could be applied early in the process to affect the desired changes. Should the organization hold the developer responsible for a compromise of the application? The organization is contracted to provide an application that supports the business processes. A compromised application/system does not support the business goals of the organization.

Some selection pressures are strong enough that they will exert enough evolutionary pressure on a population that all of the resulting entities within the population are identical as a response to the selection pressures. Because of the strength of the selection pressure operating on the population, all of the variance of a characteristic has to be eliminated in order for members of the population to survive. Stronger selection pressures will remove the variance from the population faster than smaller selection pressures. Stated another way, some strategies exert enough of a filtering pressure that all entities must develop a specific counter strategy in order to survive.

Most malware and BotNets have a characteristic which is hard to escape; their reliance on a method to make initial contact with their controllers and join the BotNet. Initially these control channels were handled over IRC (this method has not been abandoned and is still in use), and since then they have now migrated to Peer-to-Peer communications. More recently the bots are attempting to contact their controllers via HTTP requests as Peer-to-Peer communications are filtered by boundary protection devices. Now these HTTP requests carry a name that must be looked up in DNS (e.g. part of a fast-flux DNS network). This method is becoming more common as organizational selection pressures push the bots in this direction. The reliance making initial contact with the bot-net is essentially a bottle neck which can be exploited. If the DNS look up is always a consistent or predictable string then it can be blocked by either filtering the appropriate Internet addresses even if they are part of a fast-flux network.

In evolutionary biology, it takes time for organisms to adapt to their environment. There is a time lag between when a counter strategy is employed against a population and when an entity has evolved a strategy to deal with the counter strategy. The current generation is better adapted to the previous environment than the one in which it exists (or selected for) based on conditions that existed previously. The current environment and the previous environment may have changed.

This lag commonly expresses itself in information security when systems are designed. If they are designed properly they are designed to counter all of the existing exploitation strategies that are known. Depending upon how long it takes to go from design to implementation and to delivery, the threat environment may have drastically changed. The delivered system may not be able to address all of the current threats in the environment and may need to be modified. Additionally a few years following the deployment of a system, if it is not updated, there may be emerging threats that the existing design is incapable of addressing.

This time lag also appears in the conflict between malware and anti-malware tools or attacks and intrusion detection/prevention systems, which rely on signatures to detect, identify and remove malware or attacks. A signature must be created to detect the malware, and pushes out to all of the clients before they can respond to a malware infection. In order to create a signature, a new malware variant must have been identified. Occasionally a rule will be created that was general enough that it may detect/prevent attacks that have not yet been implemented due to similarities in the way an attack's strategy attempts to exploit a target.

In evolutionary biology there is competition for resources and the easiest or the most abundant resources are typically exploited first. Sometimes the most abundant resources are not exploited right away as a population must evolve the ability to consume those resources. The abundance of a resource does not mean that it must be abundant every where, only that it is encountered frequently enough in the environment and there is sufficient competition for other resources that evolution will move an entity in that direction. Developing the ability to exploit a resource takes time and resources.

In information security this is similar to having a sufficient base of similar operating systems, browsers, databases, or frameworks to make the effort of developing an attack strategy worth while. This does not mean that just because a resource is not very common in the environment, it will not be exploited. Some operating systems will claim that they are more secure than the dominate competition, but as the number of systems increase so do the attacks against that platform. Although Microsoft Windows composes an overwhelming majority of the market, Apple has been gaining market share and the gains have been large enough that malware authors have begun to more frequently target the platform. Within the last year there has been an increase in the number of Trojans that target the Apple platform.

Although resource availability is important in determining if a platform will be exploited, another factor is apparent in the case of information security; the value of the resource being exploited. In the case of financial or government systems, which may be hosted on less common platforms there is additional incentive in targeting and exploiting these resources due to the perceived value of the system. There is some value in being able to compromise a home user's system (less so if it has a slower connection to the Internet) and there is more value in being able to compromise a web application server, but in reality some of the highest value resources are the databases which contain important information.

In short, selection pressures cause the survival strategies of entities to evolve. If they are unable to evolve, they will not survive. Responding to selection pressures, either directly (i.e. developing counter strategies) or indirectly (i.e. exploiting an unused resource) does not occur instantaneously, there is almost always delay between when the selection pressure first begins to work and a population's adaptive responses.