Security researchers develop automated malware removal that works like a vaccine

• ECHO flips malware's own systems to attack itself - like fighting fire with fire, but smarter
• ECHO uses malware’s update channel to push out a digital self-destruct
• Georgia Tech’s tool makes botnet cleanup almost automatic

Malware infections, especially those linked to botnets, continue to cause major damage to enterprise systems, often going undetected until it's too late.

Techxplore reports researchers at Georgia Tech have developed a tool called ECHO that turns the tables by using malware’s own infrastructure to remove it.

ECHO exploits a key feature in many malware strains: built-in remote update mechanisms. By identifying and repurposing these mechanisms, ECHO can deploy a custom payload that disables the malware from within.

A self-spreading remedy for botnets

Botnets - a network of infected computers controlled by malicious actors - have long posed a serious cybersecurity threat. They can lock down workflows, expose sensitive data, and inflict financial losses.

Ordinarily, removing botnets is a tedious, manual process that can take days or even weeks. ECHO aims to change that. In testing, it successfully neutralized 523 out of 702 Android malware samples, achieving a 75% success rate.

The idea of hijacking malware’s communication channels isn’t entirely new. In 2019, Avast and French authorities collaborated to dismantle the Retadup botnet in Latin America. While successful, the effort was difficult to reproduce.

“This is a really good approach, but it was extremely labor-intensive,” said Brendan Saltaformaggio, associate professor at Georgia Tech. “So, my group got together and realized we have the research to make this a scientific, systematic, reproducible technique, rather than a one-off, human-driven, miserable effort.”

ECHO works by first mapping how the malware deploys code. It then analyzes whether these deployment channels can be reused to carry a new, benign payload that disables the original infection.

Once validated, this remediation code is tested and deployed. The process significantly reduces botnet response time and limits potential damage.

The tool, now open sourced on GitHub, isn’t meant to replace traditional security solutions but to complement them.

“We can never achieve a perfect solution, but we can raise the bar high enough for an attacker that it wouldn’t be worth it for them to use malware this way,” Saltaformaggio explained.

Organizations using antivirus, EPP, and other malware protection tools can turn to ECHO to streamline remediation once a breach is detected.

You might also like

• Downloaded something dodgy? These are the best ransomware protection tools
• Nail the basics with the best firewalls available now
• Companies becoming more accepting of robotics in the workplace, survey finds