Toolkits Side-Stepping Anti-Virus Software
Anti-virus software has been part of the network security plan seemingly forever (at least, I never remember operating a computer that logged into the Internet without having
Anti-virus software has been part of the network security plan seemingly forever (at least, I never remember operating a computer that logged into the Internet without having AV software installed, and that's going on close to 20 years).
Of course, AV isn't always 100 percent malware proof. As security vendors have told me many times, new malware and toolkits are let into the wild before there is a fix, and if users don't regularly upgrade their AV software, the fixes aren't going to do much good.
Malware developers try to stay one step ahead of AV software development. However, it isn't often that you hear of a toolkit that is written specifically to bypass AV software altogether. But that's what M86 Security Labs recently discovered.
The Siberia Exploit Kit has been upgraded and is now able to circumvent AV software and URL filtering services. According to M86's blog, the toolkit works this way:
The administrator of the toolkit can perform an Anti-Virus scan of the malware and exploit pages. Moreover, the scan results of each Anti-Virus company are viewable.
It is well known that once uploading malware to a VirusTotal service, the Anti-Virus companies can re-analyze suspicious files. As such, it's a good guess that the Siberia Exploit's Kit doesn't use the VirusTotal service. In this particular case, the files are sent to an underground Anti-Virus checker called "scan4you.biz”
No report on any fix to this problem yet.
