Later archive addition
The Adventures of AV and the Leaky Sandbox
Malware on an endpoint with no direct internet access hides data in a file that the host's cloud antivirus uploads to its own internet-connected analysis sandbox, where the sample runs and beacons the data out. The AV product itself becomes the egress channel, defeating strict outbound filtering and network segregation, and the researchers released a tool implementing it.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.