Virus writers change tactics

gallery

Virus writers are changing tactics to try and catch out increasingly well guarded corporate networks, says security software company Symantec.

The tenth edition of its Internet Security Threat Report warns that malware code authors are harking back to an earlier era of virus writing in a bid to avoid detection and maximize harm.

This 'back to basics' approach has seen the reemergence of so-called polymorphic viruses as well as social engineering tactics.

Polymorphic viruses avoid detection by changing byte patterns as they replicate, ensuring that versions of the virus can continue infecting systems after the initial detection. With fewer viruses making it onto networks, this maximizes the damage from those that do get through.

Other virus writers seem to be abandoning the progress they have made in the last couple of years towards increasingly sophisticated methods of attack in favour of dependence on human error rather than computer weakness.

This social engineering approach recognizes that as network protection gets better, the 'people element' remains vulnerable to letting viruses in through the back door via phishing schemes and other methods.

"Large scale worms such as Nimda and CodeRed demonstrated that malicious code need not be highly sophisticated to infect large numbers of machines," said Ollie Whitehouse, security researcher at Symantec. "We are seeing an increased focus on targeted attacks and more subtle infection methods, with virus writers are using polymorphic techniques to avoid detection and aid propagation."

He cites a worldwide outbreak of two viruses earlier this year, Polip and Detnant, signifying, he says, that this old style of virus may be regaining prominence.

Their propagation may rely on relatively unsophisticated techniques, but they are hard to get rid of, says Symantec. "The detection of these viruses involves a complex process of cryptological and statistical analysis along with code emulation and data-driven engine designs," says Whitehouse.

Email to a friend

Print this page