通过分析序列化期间的数据收集过载来规避和崩溃反恶意软件解决方案
Evading and crashing anti-malware solutions via data collection overloading during analysis serialization
AI总结：
本文研究了通过在分析序列化过程中数据收集过载来规避和崩溃反恶意软件解决方案的问题，提出了Telemetry Complexity Attacks（TCAs）这一新类漏洞，利用无界收集机制与有界处理能力之间的不匹配，导致数据处理组件出现拒绝分析（DoA）状态，并评估了该技术对18种商业和开源恶意软件分析平台和终端检测与响应（EDR）解决方案的影响。
摘要：
恶意软件分析系统，包括动态分析沙箱和数字取证与事件响应（DFIR）平台，依赖于由数据收集代理、序列化器和数据库后端组成的遥测管道来捕获和呈现程序行为给分析师。我们证明这些数据处理组件构成了一个可利用的攻击面，可以导致拒绝分析（DoA）状态，而无需禁用传感器或要求提升权限。我们提出了Telemetry Complexity Attacks（TCAs），一种新的漏洞类别，利用无界收集机制与有界处理能力之间的不匹配。我们的方法通过递归生成子进程来生成深度嵌套和超大对象，从而压力序列化和存储边界，以及可视化层，例如JSON/BSON深度和大小限制。根据产品不同，这会导致报告截断或缺失、数据库插入被拒绝、序列器递归和大小错误以及无响应的仪表板，某些情况还表现出未被记录或呈现给分析师的正常恶意执行。我们评估了我们的技术对18种商业和开源恶意软件分析平台和终端检测与响应（EDR）解决方案的影响。七种产品在遥测管道的不同阶段失败；两个CVE标识符已分配（CVE-61301和CVE-61303）；一个待分配；一个已分配给底层库，其他已发布补丁或配置更改。我们讨论了根本原因并提出了防止由对抗性遥测触发的DoA攻击的缓解策略。
英文摘要：
Malware analysis systems, including dynamic-analysis sandboxes and digital forensics and incident response (DFIR) platforms, rely on telemetry pipelines comprising collection agents, serializers, and database backends to capture and present program behavior to analysts. We show that these data-handling components constitute an exploitable attack surface that can lead to denial-of-analysis (DoA) states without disabling sensors or requiring elevated privileges. We present Telemetry Complexity Attacks (TCAs), a new class of vulnerabilities that exploit mismatches between unbounded collection mechanisms and bounded processing capabilities. Our method recursively spawns child processes to generate deeply nested and oversized objects that stress serialization and storage boundaries, as well as visualization layers, e.g., JSON/BSON depth and size limits. Depending on the product, this leads to truncated or missing behavioral reports, rejected database inserts, serializer recursion and size errors, and unresponsive dashboards, with some cases also exhibiting normal malicious execution that was not recorded or presented to analysts. We evaluate our technique against 18 commercial and open-source malware analysis platforms and endpoint detection and response (EDR) solutions. Seven products fail at different stages of the telemetry pipeline; two CVE identifiers have been assigned (CVE-61301 and CVE-61303); one more is pending; one has been assigned to an underlying library, and others have issued patches or configuration changes. We discuss root causes and propose mitigation strategies to prevent DoA attacks triggered by adversarial telemetry.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
