News21,305 Articles

News spotlights:

News by company:

News by product:

August 6, 2007

Mutating javascript malware on the loose

Undetectable by conventional antivirus

Matthew Broersma, Techworld

Hackers are using a new technique to infect desktop PCs via compromised websites, while avoiding antivirus detectors, according to the SANS Institute.

SANS' ISC (Internet Storm Center) said on Thursday it has come across the attack on a compromised website, where an iframe was used to deploy various pieces of malicious code via Javascript. Iframes allow content from one website to be embedded in another website.

This technique in itself isn't new, but researchers found that the server deploying the malicious Javascript was heavily modifying it - "obfuscating" it - so as to be undetectable by antivirus detectors, the ISC said. Moreover, the obfuscations were generated randomly and on the fly, according to ISC handler Bojan Zdrnja.

"What makes this new is that the hosting website generates this code dynamically," he wrote in an analysis.

"Every time you request this web page it will use completely random names for all variables and functions... changing variable and function names even causes the payload information to change."

The technique makes the script code in effect undetectable by common types of malware scanners, Zdrnja said.

"Such heavy obfuscation makes signature-based detection much more difficult, if not impossible," he wrote. None of the antivirus programs Zdrnja tested were able to detect the modified code.

The code contains what Zdrnja called a "typical" set of exploits, making use of known vulnerabilities in ADODB, QuickTime, WinZip and other software.

The code also included a less well-known, but highly pernicious exploit for the NCTAudioFile2 ActiveX control, Zdrnja said.

"A fully working exploit was publicly released in April, and what's worse is that the affected ActiveX control is delivered with dozens of popular audio/video applications," Zdrnja wrote.

<<newer story | back to index | older story>>

Comments received

dragonthoughts said on Wednesday, 08 August 2007

This article claims that current anti-virus programs cannot detect it.

This is in conflict with McAfee's claim at vil.nai.com/vil/content/v_141906.htm#tab2

that it could detect this since May 31st 2007 - 2 months before this article was published.

CaffeineAddiction said on Wednesday, 08 August 2007

Yah, just obfuscating the variable names and subs wouldn't be enough. That would allow it to get past a regular hash check, but there are other ways of checking a file. If the person who wrote the code left one unique comment, or one unique piece of code (one that either isnt used that often or at all in any other program) it would be able to be found by just that one or two lines.

Obfuscating malicious code is not a new idea, and for some stuff it works like a charm, but in order for it to be totally immune to anti virus it would almost have to morph at the byte level which is much more complicated.

ParalaMedicalistik said on Wednesday, 08 August 2007

Ya, I agree with laddy dragonthoughts comments! It also seem 2 meself, that ur seem 2B a bit behind, in reporting these issues. Not only McAfee had earlier detection but as well, Avira's AntiVir, Crawler's ClamAV, Sophos AV, F-Secure & on & on & ++++

So get with it thar Matey!!!

Submit to: Digg Digg Slashdot delicious Del.icio.us reddit Reddit