The Anti-virus Times

Wednesday, August 3, 2016

It’s no secret that criminals need Trojans that are “invisible” to anti-viruses. Constantly having to come up with some new disguise to escape the all-seeing eye of an anti-virus—is not only unprofitable, but also slows the industrial workflow related to developing and releasing malware. Anti-virus companies are quick to add the definitions of new Trojans into their virus databases, which is why cybercriminals have to endlessly keep writing programs that cannot be detected by anti-viruses.

How profitable the cybercriminal business is always equates to the difference between the value of what can be stolen, and how much money (money that goes into developing and distributing malicious programs) needs to be spent on stealing it.

It’s expensive and difficult to develop new Trojans.

That’s why so few people are involved in this—many criminals just purchase ready-made, tested programs on underground virus writer forums. That’s how everyday criminals solve the troublesome task of reducing the cost of developing Trojans that cannot be detected by anti-viruses.

The cheapest solution for intruders is to take previously written malware that anti-virus software can recognise and place it into an archive, sometimes in several archives (the nesting doll principle) in an unknown format (i.e., repack them) or they encrypt it.

Most anti-viruses have to respond to each repacking with a new virus database entry. Because of this, thousands of entries for modifications of the same threat are multiplied. They differ only by the packer. Creating an “invisible” Trojan for a client that uses an anti-virus is not costly because intruders can encrypt and repack the same malicious program at least a hundred times a day.

What in practice threatens such an approach to security? It turns out that until the next database update is carried out—which could be 1-2 hours, but is often far longer—the user’s system remains unprotected against what is alleged to be the newest threat, but in fact is a threat that has long been known to exist.

Dr.Web operates in a different way. Dr.Web FLY-CODE technology allows you to detect known malicious files in archives that have been encrypted and packed in a special way— no matter how hard virus writers try to bypass Dr.Web’s protection by repeatedly repacking and encrypting their malicious files. It’s expensive and unprofitable for cybercriminals to do battle with Dr.Web! And that means our users are much less likely to be targets of attack.