About Sarah
Articles with the tag: favicon
Malware Steganography
Sun, 12 Apr 2015 02:56PM
6 years ago (yikes!) I wrote about image steganography as a concept. At the moment there are a couple of pieces of malware that use steganography, such as Vawtrak (aka Neverquest) and ZeuS, to hide the command and control servers (C&C) or configuration files in images. This means that the malware does not need to contain a static list of C&Cs which will become old quickly, but can just download an innocent looking image from the internet; decode the hidden message and then connect out. The advantages are that the image can be refreshed with C&C data without having to recompile the malware; and the images can be hidden in plain sight; e.g. on legitimate message boards.
Previous blog entries
Blog categories
- Forensics & science (7)
- Homemade arts & crafts (11)
- Rabbits (8)
- Programming (6)
- Miscellaneous (25)
- Recipes (5)
- Reviews (14)
- Digital Forensics & Malware (42)
- Trips & Visits (16)
- Cyber Security & Threat Management (12)
- IT & Computers (7)
- HCI & Design (6)
Blog tags
stew programming MP3 sharing Internet Explorer Number One Barafu CV case management laptop SANS Snapfish confirmation bias Microsoft Word hacking Registry Barranco camp mentoring Facebook chat qualifications naughty bunny captcha sewing favourites kill chain Pixel Girl Geeks page breaks Edinburgh Fringe Itiel Dror passwords Demand Five batch files rock polaroid Megalosaurus Moo forensics section breaks Skye privacy Routine Activities Theory comedy styles Lake Como chew cases pyjamas insider fraud The cloud Istanbul qualitative intelligence proxy logs Brigitte Reusch Malware internet history wifi steganography Edinburgh O2
