Hacker fingerprints - the future of malware detection?
Posted on 19.07.2010
It has been obvious for a time now that security companies will have to find a new malware detection technique that will complement their heuristic engines searching for generic malware signatures, since anti-malware solutions aren't blocking enough malicious code.

The solution for this problem is seems to be on the horizon - if the claims of Greg Hoglund, CEO of HBGary, are to be believed.

Hoglund in scheduled to hold a briefing during Black Hat 2010 next week, in which he is going to present the findings of his recent analysis of binaries of malware executables, and explain how his "hacker fingerprints/signatures" approach might just be the thing that will revolutionize the anti-malware market.

We all know that malicious code - like any other - is written in specific environment. He professes that he managed to detect specific tool marks that would help discover which individual or group is behind a specific piece of malware, and through this offer a good guess about the author(s) motive - money, information, fame, politics?

He offers as an example one particular malware executable whose fingerprint can be based on the author's preference for Back Orifice 2000, Ultra VNC remote desktop support software, and code from a 2002 Microsoft programming guide. Even with slight changes, he claims, this makes for a signature that will last for a long time - longer than the generic ones, in fact.

"The bad guys don't change their code that often," Hoglund said for ComputerWorld. Of course, this detection technique is not made to be used by itself, but as an addition to the existing ones. But, it could provide for a new way of ranking potential dangers.

Knowing the ultimate motive behind the malware would allow an individual to give more attention to a banking Trojan than to malware designed to steal intellectual property, while a company would rank the last threat much higher than the first. Also, it would provide vital information to businesses as to the scope of the attack - are they targeted by an organized group or a random attacker?

Hoglund and his team analyzed around 150,000 pieces of malware, and they found that the people behind them are not as numerous as we imagine - hundreds rather than thousands. He will also be presenting Fingerprint, a tool they designed to detect these specific tool marks.






Spotlight

eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Wed, Dec 17th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //