Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/18/2013
12:52 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Slide Show: 10 Ways Attackers Automate Malware Production

Peeking into an attacker's toolbox to see how malware production is automated and the Internet is flooded with millions of unique malware applications
Previous
1 of 10
Next


A full field of malware creation tools has enabled attackers to transition from manually creating single-use and easily defeated malware to developing an automated production line to develop an "army of armored malware" to carry out attack campaigns, says Christopher Elisan, principal malware scientist for RSA NetWitness. Author of Malware, Rootkits & Botnets: A Beginner's Guide and a longtime malware reverser, Elisan recently offered up an extended explanation of how the process works. By using DIY malware kits like Zeus Builder, attackers with very little programming experience can create nearly infinite numbers of malware variants. From there, they can develop both protection from penetration and further variation of samples by running them through armoring tools, such as packers, crypters, and joiners. And once that process is done, they can develop automated quality assurance by running the variants through tools that lean on various AV engines to ensure that the malware remains undetected. It's a process that "basically killed AV," Elisan says and one that depends on tools like the ones outlined here.

Tool: Spy Eye

Tool Type: DIY Kit

How They're Using It: "The main idea of DIY kits is you don't need to have assembly language skills or any programming skills for that matter to create your own malware," says Elisan, who explains that these kits have actually been evolving for the better part of two decades since a 15-year-old created Virus Creation Lab (VCL) in 1992. Spy Eye is one of the first well-used kits of the modern era to use advanced features, such as encryption, and offer it in an easy GUI.

Image Credit: Christopher Elisan/RSA

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 10
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Exploitation, Phishing Top Worries for Mobile Users
Robert Lemos, Contributing Writer,  2/28/2020
Kr00k Wi-Fi Vulnerability Affected a Billion Devices
Robert Lemos, Contributing Writer,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3006
PUBLISHED: 2020-02-28
On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for so...
CVE-2015-5361
PUBLISHED: 2020-02-28
Background For regular, unencrypted FTP traffic, the FTP ALG can inspect the unencrypted control channel and open related sessions for the FTP data channel. These related sessions (gates) are specific to source and destination IPs and ports of client and server. The design intent of the ftps-extensi...
CVE-2020-6803
PUBLISHED: 2020-02-28
An open redirect is present on the gateway's login page, which could cause a user to be redirected to a malicious site after logging in.
CVE-2020-6804
PUBLISHED: 2020-02-28
A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system.
CVE-2019-4301
PUBLISHED: 2020-02-28
BigFix Self-Service Application (SSA) is vulnerable to arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.