Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security Software IT Technology

Frankenstein Code Stitches Code Bodies Together To Hide Malware 111

mikejuk writes "A recent research technique manages to hide malware by stitching together bits of program that are already installed in the system to create the functionality required. Although the Frankenstein system is only a proof of concept, and the code created just did some simple tasks, sorting and XORing, without having the ability to replicate, computer scientists from University of Texas, Dallas, have proved that the method is viable. What it does is to scan the machine's disk for fragments of code, gadgets, that do simple standard tasks. Each task can have multiple gadgets that can be used to implement it and each gadget does a lot of irrelevant things as well as the main task. The code that you get when you stitch a collection of gadgets together is never the same and this makes it difficult to detect the malware using a signature. Compared to the existing techniques of hiding malware the Frankenstein approach has lots of advantages — the question is, is it already in use?" Except for the malware part, this has a certain familiar ring.
This discussion has been archived. No new comments can be posted.

Frankenstein Code Stitches Code Bodies Together To Hide Malware

Comments Filter:
  • by Trax3001BBS ( 2368736 ) on Saturday September 01, 2012 @11:54PM (#41203615) Homepage Journal
    Quoting a portion of http://news.slashdot.org/story/01/01/25/1343218/directvs-secret-war-on-hackers [slashdot.org]
    Posted by michael on Thursday January 25 2001

    "...It was apparent that DirecTV had lost this battle, relegating DirecTV to hunting down Web sites that discussed
    their product and using their legal team to sue and intimidate them into submission.

    "Four months ago, however, DirecTV began sending several updates at a time, breaking their pattern. While the
    hacking community was able to bypass these batches, they did not understand the reasoning behind them. Never before
    had DirecTV sent 4 and 5 updates at a time, yet alone send these batches every week. Many postulated they were
    simply trying to annoy the community into submission. The updates contained useless pieces of computer code that
    were then required to be present on the card in order to receive the transmission. The hacking community
    accommodated this in their software, applying these updates in their hacking software. Not until the final batch of
    updates were sent through the stream did the hacking community understand DirecTV. Like a final piece of a puzzle
    allowing the entire picture, the final updates made all the useless bits of computer code join into a dynamic
    program, existing on the card itself. This dynamic program changed the entire way the older technology worked. In a
    masterful, planned, and orchestrated manner, DirecTV had updated the old and ailing technology. The hacking
    community responded, but cautiously, understanding that this new ability for DirecTV to apply more advanced logic
    in the receiver was a dangerous new weapon. It was still possible to bypass the protections and receive the
    programming, but DirecTV had not pulled the trigger of this new weapon.

    "Last Sunday night, at 8:30 pm est, DirecTV fired their new gun. One week before the Super Bowl, DirecTV launched a
    series of attacks against the hackers of their product. DirecTV sent programmatic code in the stream, using their
    new dynamic code ally, that hunted down hacked smart cards and destroyed them. The IRC DirecTV channels overflowed
    with thousands of people who had lost the ability to watch their stolen TV. The hacking community by and large lost
    not only their ability to watch TV, but the cards themselves were likely permanently destroyed. Some estimate that
    in one evening, 100,000 smart cards were destroyed, removing 98% of the hacking communities' ability to steal their
    signal. To add a little pizzazz to the operation, DirecTV personally "signed" the anti-hacker attack. The first 8
    computer bytes of all hacked cards were rewritten to read "GAME OVER"..."

    end quote
  • Re:Interesting (Score:4, Interesting)

    by 1u3hr ( 530656 ) on Sunday September 02, 2012 @12:04AM (#41203653)

    aliens, could construct a data stream to take over a receiving computer on any listening planet.

    Basically the plot for "A for Andromeda", the 1961 TV series written by Fred Hoyle. A message is decoded to a computer program for a powerful AI that can answer just about any question. It seems the inventions it creates are designed to make us destroy ourselves; in the sequel it turns out that it was actually an exercise of "tough love" to force us to work together to defeat it rather than nuke each other to oblivion as most intelligent species do.

Genetics explains why you look like your father, and if you don't, why you should.

Working...