Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As per title...

The malware can easily be de-obfuscated if it was obfuscated using common and known XOR techniques. Why don't malware authors use any other method that make it much harder to automatically de-obfuscate and identify malicious embedded code?

My thoughts: Malware authors actually do use other encryption methods, Simplicity of implementing the algorithm, Size limitations on the code, Pre-packed options (metasploit) offer these techniques, There is no need - XOR techniques bypass most of the detection mechanisms already

Even so, malware is already incredibly complex, why isn't obfuscation always complex too?

share|improve this question
add comment

1 Answer

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware.

There is an article on searchsecurity by Margareth Rose detailing how this works:

Metamorphic and polymorphic malware are two categories of malicious software programs (malware) that have the ability to change their code as they propagate.

Metamorphic malware is rewritten with each iteration so that each succeeding version of the code is different from the preceding one. The code changes makes it difficult for signature-based antivirus software programs to recognize that different iterations are the same malicious program.

In spite of the permanent changes to code, each iteration of metamorphic malware functions the same way. The longer the malware stays in a computer, the more iterations it produces and the more sophisticated the iterations are, making it increasingly hard for antivirus applications to detect, quarantine and disinfect.

Polymorphic malware also makes changes to code to avoid detection. It has two parts, but one part remains the same with each iteration, which makes the malware a little easier to identify.

For example, a polymorphic virus might have a virus decryption routine (VDR) and an encrypted virus program body (EVB). When an infected application launches, the VDR decrypts the encrypted virus body back to its original form so the virus can perform its intended function. Once executed, the virus is re-encrypted and added to another vulnerable host application. Because the virus body is not altered, it provides a kind of complex signature that can be detected by sophisticated antivirus programs.

In another example, a new key might be randomly generated with each copy to change the appearance of the encrypted virus body -- but the virus decryption routine woud remain constant. In either scenario, it is the static part of the code that makes it possible for an anti-virus program to identify the presence of malware.

Metamorphic malware is considered to be more difficult to write than polymorphic malware. The author may use may use multiple transformation techniques, including register renaming, code permutation, code expansion, code shrinking and garbage code insertion. Consequently, advanced techniques such as generic decryption scanning, negative heuristic analysis, emulation and access to virtualization technologies are required for detection.

Now if you are trying to keep things small, XOR is an excellent way of writing your virus. XOR is an instruction which your processor understands, so this means that to implement a XOR encoder you will need only a few lines of assembly code (if you are writing the virus in assembly) opposed to vast amounts of code when you want to implement either of the above mentioned techniques.

share|improve this answer
    
+1 pretty much this. There is always a trade-off. Sometimes file size/computational complexity is more important than obfuscation. Certainly highly complex obfuscation technologies exist. –  lynks Jul 14 '13 at 10:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.