About Sarah
Articles with the tag: favicon
Malware Steganography
Sun, 12 Apr 2015 02:56PM
6 years ago (yikes!) I wrote about image steganography as a concept. At the moment there are a couple of pieces of malware that use steganography, such as Vawtrak (aka Neverquest) and ZeuS, to hide the command and control servers (C&C) or configuration files in images. This means that the malware does not need to contain a static list of C&Cs which will become old quickly, but can just download an innocent looking image from the internet; decode the hidden message and then connect out. The advantages are that the image can be refreshed with C&C data without having to recompile the malware; and the images can be hidden in plain sight; e.g. on legitimate message boards.
Previous blog entries
Blog categories
- Forensics & science (7)
- Homemade arts & crafts (11)
- Rabbits (8)
- Programming (6)
- Miscellaneous (25)
- Recipes (5)
- Reviews (14)
- Digital Forensics & Malware (42)
- Trips & Visits (16)
- Cyber Security & Threat Management (12)
- IT & Computers (7)
- HCI & Design (6)
Blog tags
Firefox malware analysis fabric captcha foreman Lake Como Microsoft Word iPod Touch malware text Edinburgh metaphors web browser forensics ballistics counting qualifications Google Python chew Lockheed Martin draught excluder tags python cards laptop data privacy Chilli art gallery piggy bank play Nybble Mosaic O2 visualisation batch files pyjamas Etsy Windows microsoft edge sewing web history kill chain Sainsbury's stand-up iMessage criminology bibliography file headers Data Protection Act Windows 7 programming government gig Strathclyde OCFA train etiquette court report internet history statistics abandoned buildings
