We are often asked about how anti-malware engines running on Windows can detect Linux or Android based malware or vice versa. Most anti-malware software vendors have solutions for the Microsoft Windows platform, and many of them have support for Linux as well. The majority of these anti-malware products were developed in the 1990's or 2000's, so they have quite a long history. On the other hand, many new anti-malware products have been released for Android platform in the last few years. The Android platform is relatively new from an anti-malware perspective. The first product was released around the second half of the 2000's.
The question: do these facts affect the detection capabilities of different products developed for different platforms, and how can a product detect malware written for another platform?
Why should we detect malware written for another platform?
It is common to find different server and workstation computers in an IT environment. Server computers may run Linux or Windows, and may provide file, mail or web server functionality. The desktop computers on the other end accessing services on the servers may also run Windows or Linux. So what happens in a specific case where the mail is Linux-based and the enduser accesses his or her mailbox from a Windows computer?
Without any anti-malware products on the mail server, the Windows computer can easily get infected by Windows malware. The same thing could happen if the anti-malware product that provides the protection for the Linux-based mail server isn’t able to recognize the Windows malware. You may be thinking, “It is true, but why should I worry about this? I have anti-malware installed on my desktop”. You are right. Normally, desktop anti-malware products should catch malware and should prevent infections. That being said, it is important to note some of the limitations of desktop anti-malware products:
- Why should we rely on a single anti-malware engine when multi-scanning technology is available?
- Why should we rely on the anti-malware installed on our computers when they can be difficult to manage and insure that they are up to date?
- Why should we trust desktop computers in an environment where endusers have admin privileges that could result in potential threats? (unfortunately many organizations don't care about this)
To achieve multiple levels of protection, we can expect that anti-malware engines should detect malware apart from the protection platform and apart from the malware platform. If this concept proves true, then we can use Linux-based firewalls with content filtering, Linux-based email servers, and Linux-based web proxies to catch malware before it attacks our desktop computers.
How do scan engines work?
In order to have the right expectations for scan engines, it is useful to know how anti-malware scan engines work.
Each anti-malware engine consist of two main parts: the engine core or engine binary and a signature database (of course these components could be spread into multiple files). The engine core is the heart of the scan engine. It contains the scan logic, knows how to analyze different files, how to extract archives, etc. In summary, the engine core knows how to scan files for known and unknown threats.
At the beginning of the antivirus era, scan engines used only simple pattern matching to recognize malware. Nowadays, scan engines are using more advanced techniques to detect threats. This is a cat-and-mouse game. Malware writers are always working on new disguises to make detection harder (encryption, polymorphism, rootkit, …) . On the other side of the spectrum, anti-malware vendors are discovering new approaches to detect threats. Modern scan engines use CPU emulation, operating system emulation, cryptanalysis, sandboxing, heuristic and many other complex methods to detect threats. A scan engine can utilize one or more technologies to achieve an optimal detection rate and detection speed, depending on the type of the currently analyzed file.
Currently, there are more than 300 million different malware samples out there. Many anti-malware vendors are using generic detection technologies to reduce the size of signature databases and to provide protection against a large amount of different malware types, proactively. Despite their efforts, signature databases are still robust. Most of them are 100-200 MByte and many vendors release a new update at least once a day.
Signature updates are usually released after thorough quality testing has been performed. These tests require time and a huge amount of resources, so anti-malware vendors usually use the same database for all supported platforms. Not only is the database the same, but the actual functionality of the scan engine itself is nearly the same on each supported platform. This indicates that the detection capabilities should change through the platforms.
Android and limited resources
As you might recognize after reading the previous chapter, malware scanning is a resource intensive process in terms of processor usage needed to run the multiple detection technologies and in terms of memory/disk usage needed to keep signature database. Although modern Android based mobile phones and tablets have much more processor and memory/disk resources than desktop computers did 10-20 years ago, there are still many Android devices with very limited hardware. Can this lightweight hardware run anti-malware scan engines and store the big signature databases on the device? Most likely it cannot. Standard anti-malware engines would overload these devices and would make them unusable.
After quick market research, we can conclude that most security applications made for Android platforms contain a lightweight scan engine and/or signature database to detect malicious Android applications. Findings indicate that these scan engines couldn’t detect all of the other malware written for other types of platforms. A few security applications use vendor cloud services to check hashes of scanned files that can provide detection for non-Android threats.
It is important to note that Android was built on a different foundation than other platforms. On Android, a sandbox technique ensures that an application may only access its own data. This is also true for anti-malware products. These products cannot monitor file system changes to scan all files, nor can they do a full file system scan to look for malicious programs. Third-party security applications can rely on hooks that the Android operating system provides by default, which is enough for scanning applications but not enough to catch other types of malwares, such as those stored on a SD card.
Revealing testing results
We have collected a variety of 3rd party test results where you can check detection capabilities of many anti-malware products.
AV- Comparatives and AV-Test.org are independent anti-malware testing organizations focusing primarily on anti-malware product research and product testing. They test not only Windows-based products but they also provide test results for mobile protections, mainly for Android based security products. Their mobile protection test results includes detection rates for malicious Android applications.
VirusBulletin is a UK-based security information portal and testing company, focusing on the global threat landscape. They perform anti-malware product testing six times per year. Every test is based on a different platform, including many for both Windows versions and Linux platforms. Every test includes WildList samples and recent malware samples. They test proactive and reactive detection capabilities as well. The malware is mostly written for Windows platforms, but if we check the Linux-based tests, we can discover that products written for Linux platforms have same detection capabilities as the Windows-based products from the same vendor.
Anti-malware tests for these organizations don’t include many malware samples written for Linux platforms, as the main target for malware writers is still Windows, so we have collected scan results from our free multi-scanning tool, Metascan Online. We were curious about cross-platform detection capability of scan engines, so we focused only on ELF binaries for Linux platforms, as most engines in Metascan Online were Windows-based. We have checked the average detection rate for 5 different Windows-based products, and we found that an average 95% of Linux-based malware detected by the Windows-based anti-malware products. If we combine scan result of different scan engines we found the 100% of Linux-based malware are detected by our multi-scanning solution.
However Android APK files (Android program install packages) not likely be found on corporate networks as a file we have checked detection capabilities of Windows-based anti-malware products on APK files also. We have picked many Android samples and tested it with our Windows-based multi-scanning solution. We have checked anti-malware products from those vendors who have protection for Android-based devices also and whose Android-based product provides a detection rate greater than 95%. We can assume that these vendors have processed Android samples in their laboratory. Based on the results we found, we can conclude that the vendor’s Windows-based products could also detect Android-based samples around the same detection level as their mobile protection product could. An another interesting fact we have found during out data analysis, was that if we checked the aggregated result of our multi-scanning solution called Metascan Online, then the detection rate was 100%.
Conclusion
As we have seen, detection capabilities for Linux and Windows-based anti-malware products are almost the same. Products made for these platforms are able to detect malware written for another platform. In corporate environments, where the platform selection can be based on other business decisions, one is freely choose the platform of the protection independently from the platform of devices to be protected up until we talk about Linux and Windows platforms.
The Android platform is a bit different. Android-based protections are great for infected Android application detection, but in general these products are not designed to detect malware samples written for another platform. This is not an issue if we use our mobile device carefully. Every time we make a connection to a desktop PC to transfer files between a mobile device and a PC, or we move a SD card between our devices, we have to make sure that our desktop computer has up-to-date protection. Protection is important for Android devices and Android-based platforms, because malicious programs can easily place or drop malware programs to our SD card and to our PC to infect further devices.
