Virus writers change tactics

Polymorphic viruses and social engineering driving virus development

Virus writers are changing tactics to try and catch out increasingly well guarded corporate networks, says security software company Symantec.

The tenth edition of its Internet Security Threat Report warns that malware code authors are harking back to an earlier era of virus writing in a bid to avoid detection and maximize harm.

This 'back to basics' approach has seen the reemergence of so-called polymorphic viruses as well as social engineering tactics.

Polymorphic viruses avoid detection by changing byte patterns as they replicate, ensuring that versions of the virus can continue infecting systems after the initial detection. With fewer viruses making it onto networks, this maximizes the damage from those that do get through.

Other virus writers seem to be abandoning the progress they have made in the last couple of years towards increasingly sophisticated methods of attack in favour of dependence on human error rather than computer weakness.

This social engineering approach recognizes that as network protection gets better, the 'people element' remains vulnerable to letting viruses in through the back door via phishing schemes and other methods.

"Large scale worms such as Nimda and CodeRed demonstrated that malicious code need not be highly sophisticated to infect large numbers of machines," said Ollie Whitehouse, security researcher at Symantec. "We are seeing an increased focus on targeted attacks and more subtle infection methods, with virus writers are using polymorphic techniques to avoid detection and aid propagation."

He cites a worldwide outbreak of two viruses earlier this year, Polip and Detnant, signifying, he says, that this old style of virus may be regaining prominence.

Their propagation may rely on relatively unsophisticated techniques, but they are hard to get rid of, says Symantec. "The detection of these viruses involves a complex process of cryptological and statistical analysis along with code emulation and data-driven engine designs," says Whitehouse.

Featured Resources

2021 Thales cloud security study

The challenges of cloud data protection and access management in a hybrid and multi cloud world

Free download

IDC agility assessment

The competitive advantage in adaptability

Free Download

Digital transformation insights from CIOs for CIOs

Transformation pilotes, co-pilots, and engineers

Free download

What ITDMs did next - and what they should be doing now

Enable continued collaboration and communication for hybrid workers

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
UK and Singapore align closer on digital trade
Policy & legislation

UK and Singapore align closer on digital trade

1 Dec 2021