Hackers can 'wreak havoc' with zero byte scripts

Security experts have warned that cyber-criminals could "wreak havoc" by reworking the decade-old malware-disguising technique of adding zero byte entries to scripts. Belgian IT security expert Didier Stevens wrote in a blog posting that, without zero byte padding, 25 out of 32 IT security applications tested could easily detect his malware script. As more padding is added to the script, however, the detection rate went down at 254 zero-bytes between the individual characters of the script.

Only one antivirus application was still able to detect the obscured script, and at 255 none detected it. According to vendor Tier-3, the technique can still be used to fool "most signature-based" antivirus and anti-malware software.