See No Evil: Evasions in Honeymonkey Systems

Client-side attacks have emerged in recent years to become the most popular means of propagat-ing malware. In order to keep up with this new wave of web-based malware, companies such as Google routinely crawl the web, feeding suspi-cious pages into virtual machines that emulate client systems (known as honeymonkeys or hon-eyclients). In this paper, we will demonstrate that although this approach has been successful to date, it is vulnerable to evasion by attackers: by guarding exploit code with client-side checks to determine whether a visitor is a human or an automated system, attackers can ensure that only human users are exploited, causing the page to look benign when viewed by a honeyclient. Our 13 evasions, which include both observa-tional and interactive proofs of humanity, are able to easily distinguish between honeyclients and human victims. We evaluate the strengths and weaknesses of these evasions, and speculate on even more powerful attacks and defenses.