Randomly obfuscated JavaScript code beats AV scanners

["'Richard M. Smith'" <rms () computerbytesman com>]

http://www.infoworld.com/article/07/08/03/Malignant-Javascript-mutates_1.htm
l 

SANS' Internet Storm Center (ISC) said on Thursday it has come across the
attack on a compromised Web site, where an iframe was used to deploy various
pieces of malicious code via JavaScript; iframes allow content from one Web
site to be embedded in another Web site. 

This technique itself isn't new, but researchers found that the server
deploying the malicious JavaScript was heavily modifying it -- "obfuscating"
it -- so as to be undetectable by anti-virus detectors, the ISC said.
Moreover, the obfuscations were generated randomly and on the fly, according
to ISC handler Bojan Zdrnja. 

"What makes this new is that the hosting Web site generates this code
dynamically," he wrote in an analysis. "Every time you request this Web
page, it will use completely random names for all variables and functions
... changing variable and function names even causes the payload information
to change." 

The technique makes the script code effectively undetectable by common types
of malware scanners, Zdrnja said.

 

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.