New RAT family makes its traffic look legitimate
Posted on 18.01.2013
RATs - Remote Access Trojans - are often used by cyber attackers to maintain a foothold in the infected computers and make them do things unbeknownst to their owners.

But, in order to do that and not be spotted, RATs must employ a series of obfuscation techniques.

Take for example the FAKEM RAT variants recently analyzed by Trend Micro researchers: in order to blend in, some try to make their network traffic look like Windows Messenger and Yahoo! Messenger traffic, and others as HTML.

Usually delivered via spear phishing emails, once executed the malware copies itself using the into the %System% folder.

When contacting and sending information to remote servers, the malicious traffic begins with headers similar to actual Windows Messenger and Yahoo! Messenger traffic. But checking the traffic after it clearly shows its malicious nature.

The communication between the compromised computer and the RAT's controller is also encrypted. The RAT starts with sending out information about the compromised system, and can receive simple codes and commands that make it do things like execute code, go to sleep, execute shell commands, allows the attacker to browse directories, access saved passwords, and more.

"Now that popular RATs like Gh0st and PoisonIvy have become well-known and can easily be detected, attackers are looking for methods to blend in with legitimate traffic," the researchers noted .

"While it is possible to distinguish the network traffic FAKEM RAT variants produce for the legitimate protocols they aim to spoof, doing so in the context of a large network may not be not easy. The RATís ability to mask the traffic it produces may be enough to provide attackers enough cover to survive longer in a compromised environment."





Spotlight

Infographic: 25 years of the firewall

Posted on 24 July 2014.  |  The firewall turned 25, and McAfee is celebrating with an infographic that creatively depicts its lifetime. If you take a moment to scan the infographic, youíll notice the firewall's introduction and evolution coincide with certain security events.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Jul 25th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //