« Microsoft Speeds Out Security Fix | Main | Podcast: Spam on the Front Lines - Talking With Message Partners About Service Providers and Spam »

An article in Dark Reader details how Javascript has become one of the favorite tools of cybercriminals to both attack a computer and disguise the attack. While, to the naked eye, this form of attack is often hard to distinguish, every Java-Script encoded payload also has to also carry the tools to decode the disguised malware.

"They use JavaScript to obscure what's going on. It looks almost encrypted, so researchers look at it and say they can't make heads or tails of it," Jose Nazario, senior software and security engineer for Arbor Networks, says. But adds: "The decoder ships along with it so the browser can decode [the JavaScript] and run. So we simply run the decoder."

And once the malware is decoded, the malware often reveals characteristics of the attacker as well as pinpoint its different distribution points and close them down. The malware also will reveal what information the attacker was after and what they plan to do with it. Explains Nazario, "We can find out if there's spyware, where is the information going? If they are taking information stolen from a computer and emailing to an account at Gmail, we contact the security [people] there and tell them here are the mailboxes used to receive information from spyware-infected boxes," he explains.

This is part of the trend of cybercriminals focusing on clients and web browsers. And being able to essentially reverse engineer malware allows them to profile the criminals. And while most malware is just copied by the attacker with little change, that’s not always the case: "We see a very small number of people who write their own private exploit code. You know then that you've got an adversary who studies the technology, is highly motivated, and making a bunch of money off of this."

While the ability to reverse-engineer malware is a good way to fight back, if it becomes too prevalent, expect the cybercriminals to adapt to it. As you may have already predicted, Nazario say they have already seen a few anti-reverse engineering techniques.

To read more go to: Dark Reader

Posted by pschooff in |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1647