Cybercrooks get better at concealing code

Cybercrooks who rig websites to break into PCs are getting better at hiding their malicious code, a security expert said on Wednesday.

Increasingly the actual code, often JavaScript, used to attack PCs is hidden in Flash animations or scrambled, so that anyone who examines the source of a page can't easily identify it, said Jose Nazario, a senior software engineer at Arbor Networks, in a presentation at the CanSecWest security confab.

"Their obfuscation tools are primitive but effective," Nazario said. "They use obfuscation to avoid simple signatures," he said, referring to security techniques based on signatures to detect malicious websites. Signatures are fingerprints of known attacks.

Web attacks have become commonplace. Tens of thousands of websites attempt to install malicious code, according to StopBadware.org. The sites, the bulk of which are compromised sites, often drop a Trojan horse or other pest onto a PC through a security hole in the web browser.

Many attacks use JavaScript. Initially miscreants used plain JavaScript in their attacks, but that has changed, Nazario said. He has spotted an encoded script function called "makemelaugh" that downloads a Trojan horse that captures bank information, and a Paris Hilton Flash animation that installs a tool that makes a PC part of a botnet.

Attackers also are trying to outsmart security pros by programming malicious sites to load their malicious code only once on the same PC, Nazario said. Furthermore, a new toolkit called NeoSploit identifies the browser and is packed with security exploits to launch the proper attack, he said.

There are things security professionals can do to investigate attacks, Nazario said. "Bad guys are limited by the fact that JavaScript has to be decoded to be used by the browser. As long as you can analyse it outside the browser, you can figure out what it is going to do," he said.

The scrambled code can be made legible since it typically uses simple Base64 encoding for obfuscation and not actual encryption, Nazario said. He suggested NJS, SpiderMonkey and Rhino as tools to investigate script code. Flash files can be analysed using a program called Flasm, he said.

Malicious JavaScript can be embedded in a web page and will typically run without warning when the page is viewed in any ordinary browser. Attackers could try to lure you to their own rigged website. But an attack could also lurk on a trusted website by exploiting a common flaw known as cross-site scripting.

To shield against malicious JavaScript, web surfers can disable JavaScript, but that can affect the functionality of many websites. An alternative is to use security tools that have blacklists of known bad sites, such as McAfee's SiteAdvisor or Google's Toolbar or Desktop software.

Another alternative is Exploit Prevention Labs' LinkScanner, which monitors traffic going into a PC and blocks known exploits.