Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:

eval(gzinflate(str_rot13(base64_decode('huge-string'))));
die;

Why do attackers bother doing all of this? Any developer can trivially reverse these steps to see the source code.

The only reason I can imagine is an attempt to prevent antivirus detection against an existing codebase (base64() the script, you have a 'new' virus, at least for a few minutes).

This vector is largely successfully mitigated by things like heuristic virus detection, which looks precisely for suspicious snippets of source like this.

share|improve this question
2  
In very simple terms, it defeats grep. –  Jeff Ferland Aug 1 '12 at 19:50
2  
Funnily enough, if I see base64_decode or eval anywhere it immediately sets off alarm bells as it's something that is rarely seen in 'normal' code. –  Chris S Aug 1 '12 at 22:49

1 Answer 1

up vote 16 down vote accepted

This isn't aimed at defeating human analysis, it's aimed at defeating intrusion detection / prevention systems, and other automated scans, as the code comes into the network.

PHP is a Turing-complete language, which means that a single piece of code can be represented in a near-infinite number of ways. Automated systems have limited resources, and are designed with this fact in mind - they'll attempt to unravel basic eval obfuscation and other simple tricks, but there's little point attempting to analyse and identify every possible obfuscation technique. It's a losing battle, and their developers' time is much better spent implementing other features.

Once the code gets onto an internal system, it can be scanned by anti-malware software. These systems have access to the code as it runs, so it can be much more easily identified. There's no point analysing all the complex packing code when they can just identify the unpacked in-memory string using a simple detection signature.

share|improve this answer
    
Ah, so I was on the right track! Thanks, Polynomial. –  msanford Aug 1 '12 at 19:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.