I Don't Believe in Imaginary Property writes "Malware writers have been obfuscating their JavaScript exploit code for a long time now and SANS is reporting that they've come up with some new tricks. While early obfuscations were easy enough to undo by changing eval() to alert(), they soon shifted to clever use of arguments.calle() in a simple cipher to block it. Worse, now they're using document.referrer, document.location, and location.href to make site-specific versions, too. But SANS managed to stop that with an 8-line patch to SpiderMonkey that prints out any arguments to eval() before executing them. It seems that malware writers still haven't learned that DRM never works — if my computer can access something in plaintext, I can too." Link to Original Source
This discussion was created for logged-in users only, but now has been archived.
No new comments can be posted.
Thwarting New JavaScript Malware Obfuscation 0 Comments More Login /
Get More Comments