Stories About Botnets - Part 2

In the first part of this series, I talked about a few botnets that are using random domain generation algorithms in order to conceal their Command and Control (CnC) servers. But that's not the only type of evasion being used by advanced malware. There are other types of polymorphism as well.

Some of the polymorphic strains found in these malware are as follows:

1. Random domain generation (as I talked about in Part 1)
2. Random URL and HTTP header generation
3. Custom obfuscated protocols
4. Disguised as legitimate objects like a gif or jpeg image file, etc.

Today, I would like to talk about type 2—botnets that are good at randomizing their HTTP communication. Readers will see shortly how intelligently these malware are bypassing signature-based defenses.

More Flame/sKyWIper CNC Behavior Uncovered

When news of the Flame/SkyWiper malware hit the headlines last month, the world went into a frenzy. Flame was immediately hailed as the world’s most sophisticated malware. While security researchers will surely be talking about Flame for years to come, FireEye has since made another discovery regarding Flame’s command and control (CNC) behavior: it appears that the Flamer/sKyWIper malware’s callback has recently changed.

How Advanced Malware Bypasses Process Monitoring

One of the primary aims of an anti-virus (AV) engine is to monitor all process activity—while malware, on the other hand, wants to avoid detection by AV. The philosophy of most rootkits is to run silent and deep, which also aligns with the goals of advanced malware as it evades detection by most enterprise class host-based security solutions (HBSS) and AV.

So how does malware evade detection when starting new rogue processes? Easy—it directly attacks the operating system’s kernel. Microsoft provides the kernel routine PsSetCreateProcessNotifyRoutine to allow security software to monitor process creation and termination events in the Windows kernel, and security software calls the PsSetCreateProcessNotifyRoutine in order to be notified by the kernel when these events occur. These security solutions will then act on process creation and termination events in order to track system activity and protect critical resources.

Why I’ve Joined FireEye: The Pressing Market Needs and the Company’s Ability to Deliver

This marks my first week as board chairman at FireEye, and I’m tremendously excited to be joining the company. FireEye has talented people and brilliant solutions that meet a critical need in the market, and has been growing rapidly as a result. With these fundamental assets and upcoming innovations, the prospects as we move forward are very promising.

Stories About Botnets - Part 1

The malware threat landscape is changing very fast. New and improved malware are hitting the attack surface on a daily basis. No wonder advanced malware like to operate in stealth mode. They try to change their behaviors, shapes and patterns as much as they can do to fool their enemies. Not only do we need a signature-less technology to handle such malware, but we also need a news resource continuously talking about these emerging threats, and this is where a series of blogs on this topic comes into play.

For the first of these series, I am going to talk about four different botnets that have recently been spotted randomizing their command and control domains. I will call these generically “New Botnet” A, B, C, and D so that we can focus on the details of the morphing behaviors. All of these botnets use custom algorithms to generate/locate their CnCs. The use of random CnC domains is not a new concept. In the past, we have seen Conficker, Srizbi, and Rustock using similar techniques, but in recent days we have seen more and more botnets adopting these stealth tactics.

Guest Blog: Former CIA CISO on Nation-State Security Challenges

There has been a growing realization by the global cyber security community that cybercriminals of all shapes, sizes, and motivations are getting a lot better at finding and exploiting zero-day attacks. Furthermore, while the bulk of these attacks still target the Microsoft family of operating systems, increasingly attacks are being targeted at the Unix/Linux family of operating systems. Correspondingly, there is also more recent awareness of the extent of Advanced Persistent Threat (APT) rootkits that were also previously unknown. So, many are asking what is the source of this very worrisome increase in sophisticated cyber attacks?