funsec mailing list archives
RE: Randomly obfuscated JavaScript code beats AV scanners
From: "Debasis Mohanty" <debasis.mohanty.listmails () gmail com>
Date: Thu, 9 Aug 2007 01:22:38 +0530
Funny that this made news! Obfuscating malicious javascript code to evade AVs is so 5+ yrs old. The only thing I believe new in this news is the way it obfuscates the code every time the page is loaded. However the fact that is obfuscated in this whole crappy news is, this kind of mal code obfuscation can only evade AVs which are actually incapable (NOD32, AVG etc) of doing behavioural/heuristic analysis. Any decent AV like Symantec, F-Secure or McAfee will be able to block such codes irrespective of the way the malware obfuscate the code. Most of the current AVs with behavioural analysis will trap malicious command executions by javascript by monitoring libraries like wsscript or kernel level hooks. No decent AVs will behave immaturely by detecting javascript malicious code by only using signatures. -d ________________________________________ From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org] On Behalf Of 'Richard M. Smith' Sent: 04 August 2007 01:57 To: funsec () linuxbox org Subject: [funsec] Randomly obfuscated JavaScript code beats AV scanners http://www.infoworld.com/article/07/08/03/Malignant-Javascript-mutates_1.htm l SANS' Internet Storm Center (ISC) said on Thursday it has come across the attack on a compromised Web site, where an iframe was used to deploy various pieces of malicious code via JavaScript; iframes allow content from one Web site to be embedded in another Web site. This technique itself isn't new, but researchers found that the server deploying the malicious JavaScript was heavily modifying it -- "obfuscating" it -- so as to be undetectable by anti-virus detectors, the ISC said. Moreover, the obfuscations were generated randomly and on the fly, according to ISC handler Bojan Zdrnja. "What makes this new is that the hosting Web site generates this code dynamically," he wrote in an analysis. "Every time you request this Web page, it will use completely random names for all variables and functions ... changing variable and function names even causes the payload information to change." The technique makes the script code effectively undetectable by common types of malware scanners, Zdrnja said. _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- Randomly obfuscated JavaScript code beats AV scanners 'Richard M. Smith' (Aug 03)
- RE: Randomly obfuscated JavaScript code beats AV scanners Debasis Mohanty (Aug 08)