Frankenstein Code Stitches Code Bodies Together To Hide Malware 111
mikejuk writes "A recent research technique manages to hide malware by stitching together bits of program that are already installed in the system to create the functionality required. Although the Frankenstein system is only a proof of concept, and the code created just did some simple tasks, sorting and XORing, without having the ability to replicate, computer scientists from University of Texas, Dallas, have proved that the method is viable. What it does is to scan the machine's disk for fragments of code, gadgets, that do simple standard tasks. Each task can have multiple gadgets that can be used to implement it and each gadget does a lot of irrelevant things as well as the main task. The code that you get when you stitch a collection of gadgets together is never the same and this makes it difficult to detect the malware using a signature. Compared to the existing techniques of hiding malware the Frankenstein approach has lots of advantages — the question is, is it already in use?" Except for the malware part, this has a certain familiar ring.
Re:Is this actually hard to detect? (Score:4, Insightful)
The first thing it would find was its own scanning code, and before you know it your AV system has decided that it is itself an unacceptable risk, and has self-quarantined.
Re:Fun but not interesting (Score:5, Insightful)
The Windows model is somewhat better, albeit has it's own problems. Most windows applications, even when they have shared libraries, distribute the shared libraries they use and keep them in their own directories.
How is having seventy-five copies of zlib, all with different security holes, scattered around your system better than having one copy provided by the OS?