Researchers bypass Cylance AI malware detector with universal string

# Researchers bypass Cylance AI malware detector with universal string

https://gcdradar.vercel.app/incidents/researchers-bypass-cylance-ai-malware-detector-with-universa · AIR-2023-0018 · closed 2023-04-14

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2023-03-31
- AI role: Attack on AI
- Products: CylancePROTECT, Cylance Smart Antivirus

## Summary

Researchers created a universal bypass string that, when appended to malicious files, successfully evades detection by Cylance's AI malware detector. The research demonstrates a vulnerability in AI-based security classification systems.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-03-31: Statement's from Skylight Cyber CEO (https://security7.net/news/the-new-cylance-vulnerability-what-you-need-to-know)
- 2023-03-31: Skylight Cyber Blog Post, "Cylance, I Kill You!" (https://skylightcyber.com/2019/07/18/cylance-i-kill-you)
- 2023-03-31: Bypassing Cylance's AI Malware Detection (https://atlas.mitre.org/studies/AML.CS0003)
- 2023-03-31: AVID-2023-V004: Researchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file. (https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V004.json)

## Sources

- 2023-03-31 AVID: AVID-2023-V004: Researchers at Skylight were able to create a universal bypass string that evades detection by Cylance's AI Malware detector when appended to a malicious file. https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V004.json
- 2023-03-31 MITRE ATLAS: Bypassing Cylance's AI Malware Detection https://atlas.mitre.org/studies/AML.CS0003
- 2023-03-31 skylightcyber.com: Skylight Cyber Blog Post, "Cylance, I Kill You!" https://skylightcyber.com/2019/07/18/cylance-i-kill-you
- 2023-03-31 security7.net: Statement's from Skylight Cyber CEO https://security7.net/news/the-new-cylance-vulnerability-what-you-need-to-know

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.