Drive By Download Sites Using New Tricks To Avoid Detection

From http://threatpost.com/en_us/blogs/hackers-use-php-scripts-compromise-sites-102011:

 

thanks MrBrian. Another interesting read.

 

Fascinating!

These are really sophisticated techniques.

But the basic idea of evasion is at least four years old. Finjan had a quite detailed article in 2007. A few of the points:

Evasive Attacks Hit Once and Disappear to Minimize Visibility to Security Products
2007
http://www.finjan.com/Pressrelease.aspx?id=1527&PressLan=1230&lan=3

One clever technique was appending a suffix to the URL/filename of the malware.
Note the random letters following the ?trk= in the filename:



If you wanted to test the site again with that URL, you got a 404 error because that set of letters would not serve up the exploit a second time:



And so it goes... sometimes I think we just go 'round and 'round in one big circle and nothing really changes!
Just one big cat and mouse game: as one set of evasive techniques are solved by the good guys, another set evolves from the bad guys.

regards,

-rich