Vulnerabilities / Threats

4/10/2012
10:26 PM
50%
50%

Malware Encryption Efforts Mixed, But Getting Stronger

Russian botnets mostly use crypto, Chinese attacks mostly don't, but attack analysis finds that the bad guys are increasingly using better encryption

When a new software threat is discovered, reverse engineers dig into the code to find ways to detect the attack, identify the code and its authors, and discover the purpose behind the malware.

Such investigations pit the digital detectives who reverse- engineer malicious programs against the developers who created the malware. In the cat-and-mouse game, reverse engineers can easily find copies of the software to crack open and analyze, and attackers respond by throwing up a number of hurdles to slow down analysts' efforts. Chief among the roadblocks are encryption and obfuscation.

In the not-too-distant past, encryption in malware was a sign of an ambitious effort on the part of the program's author. Today, nearly all malware uses some encryption, and perhaps two-thirds of botnets use encrypted communications to obfuscate their activities, says Jeff Edwards, a research analyst with network security firm Arbor Networks.

"There is a gradual trend toward improving their encryption," Edwards says. "It all comes down to whether the botnet operators and authors feel pressure to evolve."

With the takedown of the Rustock and Kelihos botnets, which counted tens of thousands of compromised computers among their nodes, the underground operators controlling the botnets are likely feeling pressure to hide their activities to an even greater extent. In addition, as malicious software developers grow more experienced, they frequently add more complex and better implemented encryption to their products.

[Less than one day after botnet hunters announced they had crippled the Kelihos.B/Hlux.B botnet, a new version of the tenacious botnet is now back up and running today. See It's (Already) Baaack: Kelihos Botnet Rebounds With New Variant.] 

The Black Energy bot software, for example, originally used a basic encryptor to scramble its executable to avoid detection by antivirus software, and it used Base64 encoding to scramble its communications. Both were easily reverse-engineered. The latest version of Black Energy, however, uses a variant -- somewhat flawed, it turns out -- of the more robust RC4 stream cipher to encode its communications.

In a recent set of blog posts, Arbor Networks analyzed the encryption of four major bot programs used for denial-of-service. The analyses have found a wide variety of encryption methods, from custom substitution algorithms to the RC4 stream cipher, a popular encryption method used in Secure Sockets Layer, among other protocols. In one analysis, Arbor researched the Dark Comet remote access Trojan, which uses RC4 to encrypt its communications and uses other interesting techniques to obfuscate the encryption keys.

"It's all over the map -- you get everything from no encryption to really solid encryption," Edwards says. "RC4 is the most popular one right now, or some variation of RC4. It's a standard, it's well-understood, and it's reasonably secure."

Encryption in botnets has evolved slowly. Five years ago, the Sinowal, or Torpig, Trojan used a modified version of the XTEA block cipher to encrypt its configuration data, according to Kurt Baumgartner, senior security researcher with Kaspersky Lab. Since late 2008, the Waledac and Kelihos, or Hlux, botnets used custom implementations of the advanced encryption standard (AES) mixed with other encoding and compression to obfuscate their code and communications, he says.

"Over the past several years, we have seen malware applying encryption schemes rise and fall," Baumgartner says. "These guys are not giving up on it."

Oddly enough, the programs that researchers expect to use encryption sometimes use only simple obfuscation. While malware coming from Russia and Europe have gradually used better encryption methods, Chinese cybercriminals still use simpler methods and sometimes no obfuscation at all. Many attacks that are considered advanced persistent threats (APT) eschew encryption and use other types of obfuscation.

"We see odd, modified encoding schemes and compression schemes in their malware toolset, but not a lot of elegant or complex crypto," says Baumgartner. "It appears that it is all maintained to fly under the radar as best they can."

The situation underscores a trade-off in malware's use of encryption. Encrypted data is generally easy to detect, but not decrypt. Custom encryption or obfuscation can hide data less securely, but more effectively get around security tools, such as antivirus detection.

"These schemes are very sensitive to the amount of noise they may sound out to listening anti-malware technologies," Baumgartner says. "Some anti-malware [programs] are much better or much worse at listening for that noise than others."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.