Kaspersky: Malware quality drops, quantity rises
Shoddy code and a whole lot of it in 2006
IDG News Service - They just don't make malware like they used to. Or at least like they did earlier this year.
Even low-quality malware, however, is taxing the resources of security companies, since it is being detected in ever-higher numbers.
Over the last six months, the technical creativity of malware has fallen along with the ability to cause massive damage, such as that created by the MyDoom and Sasser worms of years past, wrote Alexander Gostev, senior virus analyst for Kaspersky Lab Ltd., in a recent report.
Gostev's lab intermittently sees highly technical malware, but most is "the same unending stream of Trojans, viruses and worms," he wrote. In many cases, hackers simply take existing malware and create variants, by tweaking the older code to evade antivirus software.
At times, the process is simple trial and error. Malware writers use online scanners such as Virustotal, which check to see if their new code will be detected by antivirus software, said Mikko Hypponen, chief research officer for F-Secure Corp.
If the code is detectable, they can make a slight modification and run it through the scanner again.
"I'd like to tell you that we're winning this war," Hypponen said. "But frankly, I'm not so sure. We need new kinds of solutions."
Because much of the code is not new, it tends to remain effective for shorter periods of time before antivirus companies detect it. Still, the time it takes to identify and create a signature for a new virus, which can range from a few minutes to a few hours, is often long enough for hackers to infect computers.
"Antivirus companies are working at the limits of their capabilities in terms of speed," Gostev wrote.
To be sure, some malicious hackers are doing creative work. This year saw some sophisticated phishing attacks, and virus writers have been branching into relatively new areas like instant messaging and social networking sites, noted Christopher Boyd, security research manager for FaceTime Communications Inc. But the trend overall, he said, has been "quantity over quality."
Kaspersky Lab in Moscow is on the front lines of the battle. Its analysts added 2,000 signatures to their database in January 2005. Last month they added 10,000 signatures -- a five-fold increase, said Stanislav Shevchenko, head of the lab.
The virus analysts work 12-hours shifts, pulling up screen after screen of rolling lines of code. Automated tools analyze some pieces of malware, but human analysis is still needed for others.
A good analyst should process an average piece of malware within 5 minutes, Shevchenko said. But some of the rarer, more creative code is harder to crack. Polymorphic viruses -- ones that can change their byte sequences to throw off antivirus software -- can take up to a week to analyze, Shevchenko said.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!