'Anti-forensic' malware on the rise
Published: 28 Jul 2006 10:15 BST
The latest threat to intellectual property comes in the shape of malicious software that is capable of infecting a computer, hiding itself until the user accesses specific files or Web sites — in order to steal files or passwords — and then deleting any trace of itself.
Speaking at the IT Security in Government Conference in Canberra, Australia on Friday, Brian Denehy, security assurance engineer at CyberTrust, told delegates the vast majority of new malware uses "some type of stealth" or anti-forensic technology in an attempt to remain undetected before, during and after an attack.
According to Denehy, techniques used not only include "the obvious ones" such as encryption and rootkits but also "compression bombs" — which are compressed files that try to make life difficult for forensic tools by attempting to expand to an infinite size when executed.
He said: "Generally these techniques are seen in about 65 percent of all forensic investigation these days.
"Some just do a complete wipe on the disk — equivalent to a low level format — to make sure that some of the remnant magnetisation is not left behind. Most of you may well appreciate that just writing on a hard disk still leaves evidence there that can be recovered with the right tools.
"People also use the slack space at the end of files or introduce extras in the bad sectors list to hide their data... it makes life more difficult."
When conducting investigations, it's always Denehy's hope that these techniques haven't been used by hackers. "It is pleasing to find an inexperienced hacker that has not used these things and has made it easy to analyse," he said.
Did you find this article useful?
128 out of 229 people found this useful
- Share this article:
