Is there a common method that such malware uses to send its collection back to the hacker? For instance, do they generally contact a server directly and separately, or utilize an existing connection through a web browser or other benign program?
Not with any consistency there isn't. Here's a range of methods Mr Hacker could use:
In both of the above two cases, an authenticated proxy server might help, simply because it reduces the chance of an outbound connection as not all malware is capable of detecting or using proxies.
Several improvements can be made on these from the malware perspective.
- Hooking another application and executing any of the outbound/inbound connections in the context of that process.
- Using a rootkit to simply refuse to allow local (as in on the system) scanning software to even know the outbound connection exists.
What is the solution?
Well, probably the best way is to keep your computer clean in the first place. Prevention is absolutely better than cure, especially in the case of a kernel level infection. However, knowing you have a problem is clearly important too, so:
- Intrusion detection systems.
- Monitor logs for suspicious activity. Firewall logs, operating system logs etc. See IDS, but do it yourself too.
That's about it. If all the ports you don't need are turned off and you're passing all connections you want through proxies or reasonably scanning them, the best you can do is reactive defence in this case.
From a personal perspective, I am very much interested in Mandatory Access Control. I honestly think a lot of benefit can be derived from designating specific resources an application requires and I say that as a programmer as it helps define specifications. If you're using a platform capable of some level of MAC you might be interested in investigating it. I've also recently answered a question on Sandboxie which looks like an excellent piece of kit for Windows.