Virus writers change tactics

Polymorphic viruses and social engineering driving virus development

Virus writers are changing tactics to try and catch out increasingly well guarded corporate networks, says security software company Symantec.

The tenth edition of its Internet Security Threat Report warns that malware code authors are harking back to an earlier era of virus writing in a bid to avoid detection and maximize harm.

This 'back to basics' approach has seen the reemergence of so-called polymorphic viruses as well as social engineering tactics.

Polymorphic viruses avoid detection by changing byte patterns as they replicate, ensuring that versions of the virus can continue infecting systems after the initial detection. With fewer viruses making it onto networks, this maximizes the damage from those that do get through.

Other virus writers seem to be abandoning the progress they have made in the last couple of years towards increasingly sophisticated methods of attack in favour of dependence on human error rather than computer weakness.

This social engineering approach recognizes that as network protection gets better, the 'people element' remains vulnerable to letting viruses in through the back door via phishing schemes and other methods.

"Large scale worms such as Nimda and CodeRed demonstrated that malicious code need not be highly sophisticated to infect large numbers of machines," said Ollie Whitehouse, security researcher at Symantec. "We are seeing an increased focus on targeted attacks and more subtle infection methods, with virus writers are using polymorphic techniques to avoid detection and aid propagation."

He cites a worldwide outbreak of two viruses earlier this year, Polip and Detnant, signifying, he says, that this old style of virus may be regaining prominence.

Their propagation may rely on relatively unsophisticated techniques, but they are hard to get rid of, says Symantec. "The detection of these viruses involves a complex process of cryptological and statistical analysis along with code emulation and data-driven engine designs," says Whitehouse.

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

Lazarus APT hacking group is targeting the defense industry
Security

Lazarus APT hacking group is targeting the defense industry

26 Feb 2021
Microsoft open sources CodeQL queries used in Solorigate inquiry
Security

Microsoft open sources CodeQL queries used in Solorigate inquiry

26 Feb 2021
CISA warns of ongoing Accellion File Transfer Appliance attacks
hacking

CISA warns of ongoing Accellion File Transfer Appliance attacks

25 Feb 2021
What is a Trojan?
Security

What is a Trojan?

25 Feb 2021

Most Popular

How to build a CMS with React and Google Sheets
content management system (CMS)

How to build a CMS with React and Google Sheets

24 Feb 2021
Npower shuts down app after hackers steal user data
hacking

Npower shuts down app after hackers steal user data

25 Feb 2021
New monitors for an agile new normal
Sponsored

New monitors for an agile new normal

19 Feb 2021