Cloud Antivirus Security Threatened By Bohu Trojan

By CIOinsight  |  Posted 01-20-2011 Print


EUC with HCI: Why It Matters

The Bohu Trojan blocks connections from Windows machines to cloud anti-virus technologies to disable users' defenses.

Enterprises are not the only ones interested in cloud security products.

Malware authors have their eyes on them too -- something exemplified by the Bohu Trojan, which blocks connections from Windows machines to cloud anti-virus technologies to disable users' defenses.

The malware was first spotted by Microsoft researchers in China targeting popular anti-virus products there. According to Microsoft, the Trojan typically masquerades as a video player to trick users into downloading. Once on a computer, the malware intercepts and blocks traffic going to a number of anti-virus sites, including rsup10.rising.com.cn and down.360safe.com, Symantec found.

"Cloud-based virus detection generally works by client sending important threat data to the server for backend analysis, and subsequently acquiring further detection and removal instruction," Microsoft researchers Jingli Li and Zhitao Zhou explained in a blog post. "The process can take seconds to minutes, and is designed to remove malware not handled by the traditional on-the-box signature approach. Bohu tries to sever the communication between cloud client and server, and constantly modify file content of its components, in order to evade detection from cloud-based scanning."

After compromising a system, the Trojan creates and installs a number of files. It also installs a Network Driver Interface Specification (NDIS) filter, modifies the registry and writes random junk data into the end of its key payload components to dodge hash-based detection used by cloud-based anti-virus technologies.

For more, read the eWeek article: Trojan Blocks Cloud Anti-virus Security Technology.


Submit a Comment

Loading Comments...
eWeek eWeek

Have the latest technology news and resources emailed to you everyday.

By submitting your information, you agree that cioinsight.com may send you cioinsight offers via email, phone and text message, as well as email offers about other products and services that cioinsight believes may be of interest to you. cioinsight will process your information in accordance with the Quinstreet Privacy Policy.

Click for a full list of Newsletterssubmit