Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 7 down vote favorite
1

Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?

share|improve this question
Do you mean malware once installed setting up a backdoor which requires portknocking to open? I can't think that this questionmakes any sense otherwise? – Rory Alsop♦ Dec 4 '10 at 10:42
Correct, I will clarify the question. – sdanelson Dec 4 '10 at 14:49

2 Answers

up vote 11 down vote accepted
+50

  • Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature.

  • Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt this technique for opening backdoors on victimized systems" but doesn't provide any examples.

share|improve this answer
+1, thanks for the links. – 0xC0000022L Mar 7 '11 at 15:11
up vote -4 down vote

I don't think there are any--back in '99, one of the early botnet tools called Stacheldraht contained some pretty awesome crypto features; but soon after that, malware authors realized that infosec people hardly ever review their firewall logs, and stopped trying to hide or secure their command and control channels. These days, they mostly just use plaintext IRC for C&C.

share|improve this answer
4  
I've not heard about port-knocking for use in malware, but I disagree nearly with everything you have said. First of all, most malware authors do use strong encryption mechanisms both for data transfer and in malware itself. Secondly, IRC is obsolete for C&C. Thirdly, malware authors do their best to make long-living C&C's, thus developing distributed and decentralized systems. Where did you got such outdated information? – anonymous Dec 4 '10 at 17:58
The command and control channels for some of the newer malware are impressive examples of the way to hide and/or secure comms pathways. – Rory Alsop♦ Dec 5 '10 at 0:24
@Ams: +1, however IRC is not yet obsolete. It's certainly on the way out, but it still gets used. You see eggdrop dropped onto compromised Linux boxen still. – Graham Lee Dec 5 '10 at 13:22
Ams, it seems you're correct that IRC C&C is being phased out in favor of web-based control; however, recent articles still list IRC C&C as a major risk. The malware with cool technical features get the writeups by their reversers, but the bread and butter malware is still comparitively simple. – user502 Dec 5 '10 at 16:44
Well, I just wanted to point out that assumption of IRC based C&C prevalence in these days is not correct. Though, this type of control will exist forever because it is easy to deploy - that's why it is often the choice of newbie malware writers. Regularly reading technical write-ups about modern malware that posses threat to masses, I have not seen for a long time any mentions about IRC. So, we are all right at some point. – anonymous Dec 5 '10 at 17:47
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.