Black Hat Europe资料eu-15-Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels-wp.pdfVIP

Hiding in Plain Sight Advances in malware covert communication channels  Pierre-Marc Bureau, Christian Dietrich Black Hat 2015, Whitepaper Introduction Steganography, the art of concealing information in different types of medias, is a very old practice. Yet, it only recently started being used by malware operators on a large scale. Malware programmers and operators are increasing their efforts in developing covert communication channels between infected computers and their command and control servers. In addition to steganography, recent examples include hiding communication in inconspicuous network traffic such as DNS. When used properly, these covert communication channels can bypass automated detection mechanisms and render malware communication difficult to detect and block. From an attackers perspective, covert communication channels are a valuable addition because they allow messages to blend in with legitimate traffic and thus significantly lower the chance of being detected even when inspected by a human analyst. Covert Communication Channels By definition, malware is designed to perform malicious actions on an infected host. In most cases, these actions need to be done without catching attention from the user. In order to remain undetected, communication between an attacker and the malware needs to be done in a manner that is as stealthy as possible. As a result, malware authors increasingly use covert communication channels in order to hide their communication from infected users and network analysts. From