1. Dr. Richard Ford rford@fit.edu

2.  Szor 5.2.5  A.k.a. Stealth Viruses  “How viruses hide”

3.  Loosely, it’s trying to hide from your attacker  In the same way as we use in “normal” language  http://www.youtube.com/watch?v=Do6hTwZ6Un 8 http://www.youtube.com/watch?v=Do6hTwZ6Un 8

4.  Passive stealth might be not changing external attributes  Active stealth requires the virus to take an “active” role in the process

5.  Hiding in plain sight  Basically, Windows has so many different places to hide code, sometimes you don’t need to hide it, just bury it

7.  Semi-stealth: just hide the changes to the file length  Quite easy – look at the power of the DOS and Windows API  Requires a virus to be memory-resident

8.  Can use code like Detours to hook the IAT  Very flexible technique, which can be used completely transparently!

9.  Return the “real” body of the file on reads/seeks  Requires the virus to intercept calls to reads and can cause problems on writes

10.  FRODO  Problem: if the stealth is perfect…  Can even go to Cluster and Sector-level stealth

11.  Drawback of hooking Int 13h?  Right!  So… can hook Int 76h instead. Sneaky, eh?  Also, could play with microcode

12.  Polymorphism