Dynamic code obfuscation

Ice_Czar · Jan 8, 2007

http://www.scmagazine.com/uk/news/article/624822/report-new-hacking-techniques-used-spread-malware/
http://www.finjan.com/content.aspx?id=827

Growing numbers of cyber criminals are using complex code to bypass traditional signature-based filters to spread malware, according to the latest Security Trends Report from Finjan.

Researchers claim that hackers are directing users to malicious sites, with varying code based on random functions and parameter name changes, to infect computers with botnets and other spyware.

"Dynamic code obfuscation techniques are the latest salvo from hackers in the ongoing battle of wits between security vendors and their criminal opponents," said Yuval Ben-Itzhak, Chief Technology Officer at Finjan. "With their creation of dynamic obfuscation utilities, which enable virtually anyone to obfuscate code in an automated manner, they have dramatically escalated the threat to web security."

He added: "This threat is dynamic, not static, and the signature variations allow the code to infiltrate the company network and infect the machines. Hackers are moving to the next phase and this will be one of the biggest trends this year."

Ben-Itzhak believes the growth of this technique will be linked to the adoption of Microsoft's new operating system Vista. "The driving force behind the increase in dynamic code obfuscation will be the new Vista platform," he said. "The switch to Vista will trigger this wave of complex code from malicious users who have had time to plan their techniques."

The report also predicts that attacks using Web 2.0 technologies will rise this year. Researchers believe hackers will use blogs, wikis and RSS to embed malicious code in high traffic websites, as users become more aware of email-based scams.
"Web 2.0 technology will be used by hackers as a platform to install spyware and adware," said Ben-Itzhak. "Hackers have begun to take advantage of new web technologies to create complex and blended attacks, which are likely to soar in 2007."
Click to expand...

http://www.net-security.org/secworld.php?id=4573

Dynamic code obfuscation -- the latest method used by hackers to evade detection

The Finjan report provides several examples of dynamic code obfuscation techniques identified by Finjan’s MCRC as an especially insidious threat that undermines the ability of security vendors to detect and counter encrypted malicious code. These strategies entail providing each visitor to a malicious site with a different instance of obfuscated malicious code, based on random functions, parameter name changes, etc. To counter this threat, a conventional signature-based security solution theoretically would need millions of signatures to detect the existence of this particular piece of malicious code and to block it.
Click to expand...

Another development in 2006 was the commercialization of malicious code, as financial motivations played an increasing role in the evolution of malware. Motivated by financial gain, hackers are trading vulnerabilities in online auctions, commercializing products such as malicious website creation toolkits, and developing new distribution techniques, including spam, for the propagation of malicious code.

Looking forward to 2007, the Web Security Trends Report predicts that as Windows Vista and Internet Explorer 7.0 begin to achieve critical mass, this development will likely trigger a new wave of exploits from professional hackers who have had time to prepare in advance for this scenario.
Click to expand...

sandbox or virtualize web applications now

Log in or Sign up

Dynamic code obfuscation

Ice_Czar Registered Member

Log in or Sign up

Dynamic code obfuscation

Ice_Czar Registered Member

Useful Searches