Zero Byte Padding Detection Evasion

Via vnunet.com -

Security experts have warned that cyber-criminals could "wreak havoc" by reworking the decade-old malware-disguising technique of adding zero byte entries to scripts.

Belgian IT security expert Didier Stevens wrote in a blog posting that, without zero byte padding, 25 out of 32 IT security applications tested could easily detect his malware script.

As more padding is added to the script, however, the detection rate went down at 254 zero-bytes between the individual characters of the script.

Only one antivirus application was still able to detect the obscured script, and at 255 none detected it.

According to vendor Tier-3, the technique can still be used to fool "most signature-based" antivirus and anti-malware software.

"The code 'obfuscation' technique first appeared more than a decade ago as malware writers attempted to hide their scripts from Windows 98 antivirus software," said Tier-3 chief technology officer Geoff Sweeney.

"By adding zero byte entries to the first 32 characters of a script, the malware could escape the attention of most of the signature-based detection software of the mid-1990s.

"Now it appears that malware authors have stumbled on the fact that many of today's 32-bit and 64-bit IT security software still limit signature analyses to the first 256 or 512 bytes of a script.

"If a script is padded out with a lengthy string of zero byte entries, then it follows that a modern script can pass unnoticed and wreak havoc on a Windows-driven computer system."

Sweeney added that questions need to be asked as to why some antivirus products and internet browsers are still susceptible to this well-documented obfuscation technique.

-------------------------

This is just a single technique used by malware authors...they have a systematic detection evasion playbook and the bad guys are getting first downs.