Malware Authors Learn Market Segmentation From the Best 49
Earthquake Retrofit writes "The Register has a rather funny story about the Zeus botnet: 'The latest version of the Zeus do-it-yourself crimeware kit goes to great lengths to thwart would-be pirates by introducing a hardware-based product activation scheme similar to what's found in Microsoft Windows. ... They've also pushed out multiple flavors of the package that vary in price depending on the capabilities it offers. Just as Windows users can choose between the lower-priced Windows 7 Starter or the more costly Windows 7 Business, bot masters have multiple options for Zeus.'"
Re:Version 1.4 (Score:5, Informative)
Plenty of virus scanners can pick up on dynamic executables (also called polymorphic). One problem you run in to is that you have to pass the scanner before you get to execute, so that means that even if your thing can really scramble itself upon execution, if they have info on the versions that are being distributed online, those can be blocked and you don't get a chance to change. However as a practical matter, your code is still there no matter what, has to be to run, and the advanced scanner can pick up on that. They also can perk up and look harder when you do uncommon things like self-modify and so on.
What it really comes down to though is that these kind of programs are going after low hanging fruit. The botnet authors aren't trying to bypass every defense, they just want to get a big net of infected PCs and there are plenty of choices with crap defense. Besides, the ones without defenses are ones more likely to not clean up the infection. If someone goes through the trouble to secure their system, they may also watch it and will notice problems if you infect it. That doesn't do you much good if they just clean it up after a couple hours. You want a system you can hang on to.
www.t10t.net (Score:1, Informative)
Very cool I admire this
Thank you all
Re:Version 1.4 (Score:4, Informative)
Engines these days are more advanced than just signature matching. They do that too, since it works well against most threats, but they have more advanced tricks to detect viruses despite obfuscation attempts. They are fairly advanced these days.
Also remember you have a far more complex system to contend with. On DOS you had direct access to any and everything. Not the case in Windows or any other modern OS. You have to interface with the OS's calls and you have to deal with thing like processor enforced privilege levels and so on. You can't write your code in any way you like or the OS will simply refuse to execute it and throw an error.
Finally, I think you may be a bit confused. In x86 (and x64) assembly at least, there's no such thing as a partial op-code. Each instruction is one or more bytes and the CPU doesn't just skip over invalid data as some did (like some 6502 variants). So you can't change any bit in an op-code or you'll change what that op-code is and thus what it does. For example 74 is JZ, jump to the address (specified afterward) if the zero flag is set. 75 is JNZ, jump to the address if the zero flag is NOT set. Change one bit, changes the whole meaning of the instruction. You can't fiddle with parts and have a different op-code that does the same thing.
Re:Maybe they are from the same company. (Score:3, Informative)
From that article you linked:
SAN FRANCISCO, July 15 - Add personal computers to the list of throwaways in the disposable society.
On a recent Sunday morning when Lew Tucker's Dell desktop computer was overrun by spyware and adware - stealth software that delivers intrusive advertising messages and even gathers data from the user's machine - he did not simply get rid of the offending programs. He threw out the whole computer.
Mr. Tucker, an Internet industry executive who holds a Ph.D. in computer science, decided that rather than take the time to remove the offending software, he would spend $400 on a new machine.
Mr. Tucker is a dumbass. There are plenty of people who could have completely cleared out that computer for under $100 in man hours.