Chinese Trojan blocks cloud-based security defences

[Malcontent]

http://www.theregister.co.uk/2011/01...usting_trojan/

Miscreants have released a Trojan specially designed to disable cloud-based anti-virus security defences.

The Bohu blocks connections from infected Windows devices and cloud anti-virus services in place to protect them. Malware writers have long included routines to disable components of desktop anti-virus software packages or block access to anti-virus websites from infected machines.

Bohu - which was spotted by anti-virus researchers working for Microsoft in China - is hardwired to block access to cloud-based net services from Kingsoft, Qihoo, and Rising. All three firms are based in China.

[funkydude]

More detail: https://blogs.technet.com/b/mmpc/arc...the-cloud.aspx

[Kernelwars]

ah thanks for posting this.. I dont like to rely on antivirus for protection..I do have em but thats it..I believe that if you have a clean image to fall back you are good to go no matter what IMO

[drhu22]

Read this thread from #6 onwards

http://www.wilderssecurity.com/showt...ighlight=panda

https://www.infosecisland.com/blogvi...Antivirus.html

"Technique 1: Evade hash-based detection using file modifications. Bohu writes random junk data into the end of its key payload components to avoid hash-based detection commonly used by cloud-based antivirus technologies."

[Sm3K3R]

So the cloud based detection has been nailed ?!

Of course!

[drhu22]

Can anyone test this with immunet?

[dr pan k]

not that i have tested it but for now it only "blocks" chinese vendors (rising,qihoo and kingsoft). the technology used by bohu can be easily implemented on other known malware pieces and trust me on this one, it will be within days or so.

actually lots of people were waiting for something like this to pop up for quite some time now

ps: on second read it probably interacts with norton and kaspersky too, at some extencion

[Ibrad]

Interesting, everyone knew that malware like this would eventually come. However the cloud vendors will most likely push out a client side update that allows the engine to detect the threat without being on the cloud. The back and forth game continues.

Originally Posted by Ibrad

However the cloud vendors will most likely push out a client side update that allows the engine to detect the threat without being on the cloud. The back and forth game continues.

... and Bohu 2 will kill the cloud again and so on ...