From: InfoSec News (alertsinfosecnews.org)
Date: Tue Jul 18 2006 - 00:46:41 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.zdnetasia.com/news/security/0,39044215,39375900,00.htm

By Tom Espiner
ZDNet UK
July 18 2006

Malicious software writers are increasingly using open-source
methodologies when developing their code, according to security company
McAfee.

In its Global Threat Report for 2006, McAfee warned that more hackers are
sharing source code and ideas freely. This includes distributing source
code with documented explanations and annotations of how that code works,
which helps programmers adapt it.

McAfee said that this can be an extremely effective way of developing
code, both legitimate and malicious.

"Like any powerful tool, open source can also be used for malicious
purposes, particularly in security," McAfee said in its Global Threat
Report for 2006.

"DoomJuice was a mass-mailer that distributed a copy of MyDoom. Maybe the
author was proud of their skills being reused. It contained the documented
source code of MyDoom, like a Lego kit with instructions," said McAfee UK
security consultant Greg Day.

So-called script kiddies, who download easy-to-use malicious software from
the Internet, have long been a reality. But McAfee's report claims that
more virus writers, especially those involved in organized crime, are
forming communities and typically share information over IRC (Internet
Relay Chat) networks.

However, these groups are much harder to join than open-source software
communities, as the malicious software writers try hard not to attract the
attention of the authorities.

McAfee said that malicious software now has a long-term development cycle,
with code being developed, bugs being fixed, and betas and final versions
being distributed among the malicious software community in ways similar
to those used in legitimate open-source communities.

"You could say open-source methodology allows them to build better-quality
attacks," Day told ZDNet UK. "Today's news is group development."

Hacker tools are also created and distributed freely on an open-source
model, according to McAfee. Versions of SDBot, a Trojan horse that opens a
backdoor, included an add-in for an FU rootkit, a cloaking piece of
software available on the Internet. McAfee claims it is possible to find
documented copies of the FU rootkit online "if you hunt around." It is
also possible to find documented copies of Morphine, a tool used by
hackers to circumvent antivirus protection.

Day said that few virus writers are devoting time to coding from scratch
and resolving bugs. Hackers are also acting as paid consultants--an
enterprise also known as "patronage"--offering guidance once their source
code has been opened.

"This is an effective methodology for ill-gotten gains," Day said. "If
anything, this shows that open source is an effective way of coding--a
good idea being used for bad intent."

_________________________________
Attend the Black Hat Briefings and
Training, Las Vegas July 29 - August 3
2,500+ international security experts from 40 nations,
10 tracks, no vendor pitches.
www.blackhat.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]