Alureon trojan uses steganography to receive commands

Messages hidden inside images create extra layer of redundancy.

Researchers at

Microsoft

have discovered a new variant of the ‘Alureon’ trojan that uses steganography to make itself invincible against the takedown of botherders’ domains.

Steganography

, sometimes referred to as ‘hiding in plain sight’, is the art and science of writing messages in such a way that no one but the intended recipient would even suspect that a message is present. Images are often used for this purpose: the sender uses an existing image and modifies the least significant bit(s) of the colour components of each pixel to contain the message. The difference between the old and the new image will be barely noticeable, but the intended recipient can easily extract the message from it.

Alureon (which also goes by the name of TDSS or TDL) is an oft-researched malware family that uses a number of advanced techniques to avoid detection and increase redundancy. Steganography is the latest such technique: the malware is capable of downloading innocent-looking images from free hosting sites. These images contain an updated configuration file and thus provide an extra layer of redundancy against the domains used by the malware becoming unavailable.

With malware researchers and law enforcement agencies becoming increasingly successful in taking down malicious domains and command and control centres used by botherders, the latter are constantly looking for new ways to control their bots. The use of steganography, as well as for instance the use of DNS TXT records by the

Morto worm

, show that malware researchers should keep their eyes wide open and may find control commands to be hidden in places where they might least expect them.

More on the

Microsoft Malware Protection Center

blog

here

, while

here

is a blog post by

Symantec

that shows another way in which crooks could use steganography.

Posted on 26 September 2011 by

Virus Bulletin