11:00 AM

Malware Writers Pack In Better Encryption

Expert analysis finds the bad guys increasingly use stronger encryption to protect their malware and botnets.

When a new software threat is discovered, reverse engineers dig into the code to find ways to detect the attack, identify the code and its authors, and discover the purpose behind the malware.

Such investigations pit the digital detectives who reverse engineer malicious programs against the developers who created the malware. In the cat-and-mouse game, reverse engineers can easily find copies of the software to crack open and analyze, and attackers respond by throwing up a number of hurdles to slow down analysts' efforts. Chief among the roadblocks are encryption and obfuscation.

In the not-too-distant past, encryption in malware was a sign of an ambitious effort on the part of the program's author. Today, nearly all malware uses some encryption, and perhaps two-thirds of botnets use encrypted communications to obfuscate their activities, says Jeff Edwards, a research analyst with network security firm Arbor Networks.

"There is a gradual trend toward improving their encryption," Edward says. "It all comes down to whether the botnet operators and authors feel pressure to evolve."

With the takedown of the Rustock and Kelihos botnets, which counted tens of thousands of compromised computers among their nodes, the underground operators controlling the botnets are likely feeling pressure to hide their activities to an even greater extent. In addition, as malicious software developers grow more experienced, they frequently add more complex and better implemented encryption to their products.

The Black Energy bot software, for example, originally used a basic encryptor to scramble its executable to avoid detection by antivirus software and used Base64 encoding to scramble its communications. Both were easily reversed engineered. The latest version of Black Energy, however, uses a variant--somewhat flawed, it turns out--of the more robust RC4 stream cipher to encode its communications.

In a recent set of blog posts, Arbor Networks analyzed the encryption of four major bot programs used for denial-of-service. The analyses have found a wide variety of encryption methods, from custom substitution algorithms to the RC4 stream cipher, a popular encryption method used in Secure Sockets Layer, among other protocols. In one analysis, Arbor researched the Dark Comet remote access trojan, which uses RC4 to encrypt its communications and uses other interesting techniques to obfuscate the encryption keys.

"It's all over the map--you get everything from no encryption to really solid encryption," Edward says. "RC4 is the most popular one right now, or some variation of RC4. It's a standard, it's well understood, and it's reasonably secure."

Encryption in botnets has evolved slowly. Five years ago, the Sinowal, or Torpig, trojan used a modified version of the XTEA block cipher to encrypt its configuration data, according to Kurt Baumgartner, senior security researcher with Kaspersky Lab. Since late 2008, the Waledac and Kelihos, or Hlux, botnets used custom implementations of the advanced encryption standard (AES) mixed with other encoding and compression to obfuscate their code and communications, he says.

Read the rest of this article on Dark Reading.

See the future of business technology at Interop Las Vegas, May 6-10. It's the best place to learn how cloud computing, mobile, video, virtualization, and other key technologies work together to drive business. Register today with priority code CPQCNL07 to get a free Expo Pass or to save 25% on Flex and Conference passes..

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Published: 2015-10-09
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.

Published: 2015-10-09
The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.

Published: 2015-10-09
The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.