Broad Band Lightning Fast Internet Connection!

Not all malware detection is created equal

The internet is now the number-one conduit for infecting users with malware. SophosLabs reports that in 2009, 23,500 new infected web pages are discovered every day. That’s one every four seconds or so, four times worse than what it was in the same period in 2008. Malware authors are very successful with a popular method: compromising popular, high-traffic, legitimate sites in order to kick-start the infection process .

Users visiting a hijacked site have no way of knowing the site has been compromised because the malicious code is invisible but executed as soon as the page loads in the user’s browser. The code typically will utilize cross-site scripting to fetch an even more malicious payload from a third-party site that will then attempt to leverage one of dozens of known exploits in the browser or operating system to infect it, steal data or subvert it into a botnet.

The scope of these attacks cannot be underestimated, since all types of sites—from government websites to educational establishments to popular news portals, blogs and social networking sites—have been targeted.

As security vendors add detection for this kind of malicious web code, the attackers constantly evolve it in order to evade being caught. As this game of cat and mouse intensifies, the attackers have turned to using JavaScript for delivering their attacks. Why?:

»»JavaScript is very powerful and universal with rich capabilities supported in all browsers and operating systems.

»»JavaScript provides great flexibility for them to hide (or obfuscate) the malicious code.

Consequently, proactive generic detection becomes harder to achieve. We have seen numerous mass-defacement attacks during 2009 in which tens of thousands of legitimate sites have been compromised (their pages injected with malicious JavaScript code). These attacks invariably use heavily obfuscated JavaScript as a means of evading detection for as long as possible.

A good example of this attack is known as Gumblar, in which many sites were injected with a malicious script that used simple character substitution to hide its payload. As you can see, the payload is not visible in the injected script. But after manual deobfuscation, the payload is obvious —loading of a malicious script from a remote site.

The reach of mass-defacement attacks like such as Gumblar can be huge. Very quickly after adding detection (as Troj/JSRedir-R), that threat quickly rose to the top position in SophosLabs’ web threat stats, dwarfing other threats at that time.

Commercial script packers

There is nothing malicious in obfuscating JavaScript code. In fact, there are commercial tools available that individuals can use in order to obfuscate their code. Why?:

»»Protection of intellectual property: Users may choose to use such tools to obfuscate their code in an attempt to prevent others from copying it.

»»Efficiency: Some tools can produce smaller scripts that are quicker to download, resulting in more responsive sites.

This creates yet another problem for analysts and content scanners. When attackers use commercial tools to obfuscate their malicious scripts, anti-malware analysts have to be careful not to generate a false positive on legitimate scripts that are obfuscated with the same tool.

Server-side polymorphism (SSP)

Many of today’s threats also use advanced scripting techniques on the server in order to create polymorphic malicious code. For example, during 2009, SophosLabs identified several attacks aiming to infect users with Zbot that were aggressively using SSP. In these attacks, the malicious scripts being used to exploit vulnerabilities on user machines were dynamically created on the server, resulting in a slightly different script on each request.

SSP is essentially a special case of obfuscation, which again poses a challenge to anti-malware analysts and content scanners.

About the Author:

This article was provided by Sophos and is reproduced here with their full permission. Sophos provides full data protection services including: security software, encryption software, antivirus, and malware.

Article Source: ArticlesBase.com – Not all malware detection is created equal

Ak47s VPN

Cisco AIM-VPN/BPII DES/3DES/AES VPN Encryption/Compress $129.64

Cisco CISCO2811HSECK9 2811 Bundle w/AIM-VPN/SSL-2,Ad $2,616.60

Cisco CISCO2801-HSEC/K9 2801 w/ AIM-VPN/SSL $2,022.35

AIM-VPN/SSL-1 Lowest Price Genuine 100% Working $528.92

CISCO AIM-VPN/BPII 2600XM VPN MODULE CCNA SECURITY LAB $51.84

Cisco AIM-VPN/SSL-3 Advanced Integration Module $1,550.46

Cisco AIM-VPN-SSl-3 DES/3DES/AES/SSL VPN 3845 2851 $1,400.09

CISCO 3825 Router w 256 D /64F + AIM-VPN/EPII-PLUS $2,587.56

CISCO 3845 Router 256 64F AIM-VPN/SSL-3 CISCO3845 12.4 $5,180.32

New Cisco VPN cryptographic accelerator AIM-VPN/SSL-1 $912.64

Cisco 2821 1GB/256F CISCO2821-HSEC/K9 w/ AIM-VPN/SSL-2 $1,654.17

Cisco 2821 1GB/256F w/ AIM-VPN/SSL-2 CISCO2821-HSEC/K9 $1,654.17

AIM-VPN/BPII-PLUS - Original Cisco - Lowest Price $124.45

AIM-VPN/SSL-3 CISCO Encryption Mod 3725 3745 3825 3845 $1,737.14

CISCO AIM-VPN/EPII-PLUS CISCO AIM-VPN,WARRANTY!!! JB $20.74

CISCO AIM-VPN/EPII-PLUS CISCO AIM-VPN,WARRANTY!!! JB $20.74

NEW Genuine Cisco AIM-VPN/SSL-3 (Hologram) - 4 Avail $1,865.74

Cisco AIM-VPN/SSL-3 SSL3 DES/3DES/AES VPN Module TNET $1,996.42

Cisco 1841-HSEC/K9 1841 Bundle w/AIM-VPN/SSL- $1,322.29

Cisco CISCO2801-HSEC/K9 2801 w/AIM-VPN/SSL- $2,338.65

Cisco CISCO3845-HSEC/K9 3845 Bund. w/AIM-VPN/ $10,636.49

Cisco 2821-HSEC/K9 2821 Bundle w/AIM-VPN/SSL- $3,623.32

Cisco 2851-HSEC/K9 2851 Bundle w/AIM-VPN/SSL- $3,740.20

Cisco 3825-HSEC/K9 3825 Bund. w/AIM-VPN/SSL-3 $6,911.24

CISCO AIM-VPN/EPII-PLUS VPN ENCRYPTION $181.49

Cisco DES/3DES VPN Data Encryption AIM Module (Enhanced Performance) ( AIM-VPN/EP= ) $765.38 Cisco VPN Module - Encryption module...

3845 Integrated Svcs Router Sec Bndl with Aim-vpn/hpii Plus Adv Ip $10,289.60 Item #: 482863. Cisco Systems is redefining best-in-class enterprise routing with a new portfolio of Integrated Services Routers optimized for secure, wire-speed delivery of concurrent data, voice, and video services. Founded on 20 years of innovation, the Cisco 3800 Series of Integrated Services Routers extends Cisco Systems' leadership in multiservice routing, providing customers with unparallel...

Cisco Syst. DES/3DES VPN ENCRYPTION MODULE ( NM-VPN/MP= ) The data encryption modules, AIM-VPN/HP for the Cisco 3660 and NM-VPN/MP for the Cisco 3620 and 3640, are hardware Layer 3 (IPSec) encryption modules and provide DES(56-bit) and 3DES(168-bit) IPsec encryption for multiple T1s or E1s of bandwidth. This level of performance is a dramatic increase over that achievable when running IPSec in software on the main CPU of the Cisco 2600 or 3600. These pro...

Cisco 3660 DES/3DES VPN Encrypt AIM High Perform Aimvpnhp Cisco 3660 DES/3DES VPN Encrypt AIM High Perform Aimvpnhp. Product may differ from image shown....

DES/3DES/AES/SSL Vpn Encryption/compression $1,557.99 - Product Name: DES/3DES/AES VPN Encryption Module - Marketing Information: The VPN Advanced Integration Module (AIM) for the 2800 Series Integrated Services Routers optimizes the Cisco Integrated Services Router platforms for virtual private networks in both IP Security (IPSec) and Secure Sockets Layer (SSL) Web and VPN deployments. - Product Type: Advanced Integration Module Interfaces/Por...

Cisco Syst. 3825 Security Bundle, AIM-VPN/SSL-3, Adv. IP Serv, 128 MB Flash, 512 MB DRAM $13,794.37 Product Name: 3825 Router with Enhanced Security BundleMarketing Information: The integrated services routing architecture of the Cisco 3825 builds on the powerful Cisco 3700 Series routers designed to embed and integrate security and voice processing with advanced services for rapid deployment of new applications, including application layer functions, intelligent network services, and converged ...