6.858 / Fall 2011 / Paper Reading Questions

Please remember to print your answer for each day's paper question on a sheet of paper and hand it in at the beginning of class.

JavaScript malware often uses a variety of environment detection techniques. One such technique is to check the version of the browser, plugins such as Adobe Acrobat or Flash, operating system, etc. before delivering an exploit deliberately designed for that platform and environment configuration, as illustrated by the pseudocode below.

if(browser-is-ie-6 && adober-flash-version==10.1){
  heap_spray();
}

This leads to more reliable, successful exploits for the attacker. Do you see how this pattern may lead to false negatives in a runtime detector?