Hackers camouflage 100% of Web attacks, IBM researcher says
385 views 
Hackers now mask virtually every Web browser exploit as part of their normal procedure to evade detection by security software, said IBM's X-Force research team today. By the end of last year, according to Kris Lamb, director of IBM Internet Security Systems' X-Force, nearly 100% of all Web exploits were either self-encrypted or relied on obfuscation techniques to make it difficult for standard intrusion detection and intrusion prevention technologies to identify the attack code.
"In 2006, we saw about 50% of Web exploits obfuscated or encoded," said Lamb, adding that, on average, 80% were camouflaged throughout 2007. "But that jumped to almost 100% by the end of the year."
The reason for the cover-up boost is straightforward, said Lamb. "They're not dumb. They only do what they're forced to do," he explained. "For them to continue to get a high rate of return, they had to understand the protection technologies that were being used. And [security] vendors were doing a pretty good job.
"A lot of network security technologies were doing a good job in 2006, when they shifted from e-mail to Web browser as an [exploit] entry point. Vendors have been keeping up with that trend and building new types of [security] technologies to keep up with technologies extending the browser, like Flash and JavaScript," Lamb continued.
Modern browser
Modern browser vulnerabilities are very easy to obfuscate. Most of the new exploits are using javascript, and just like perl in javascript there is more than one way to do the same thing.
eg. many IDS system look for some CLSID, lets say clsid:1122-3344, and new exploits very easily bypass this by string concatenation in javascript
var foo = 'clsid'+'11'+'22'+'-'+'3344';
document write (foo);
If this wasnt sufficient enough, malware authors are injecting non-printable characters between \x00 - \x20 ( as they are ignored in HTML documents ).
And last but not the least, encode everything in gzip.
Now how many IDS system would detect this :D
BTW, there is a metasploit
BTW, there is a metasploit module to do all this :)... IOW, everything is served to them on a plate
Post new comment