In reading recently about the advanced Turla spyware, I'm concerned about how it can go dormant when its controllers...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
sense a possible detection effort. How do attackers do this, and what's the best way to work protect against undetectable malware?
As computing and computer security advance, so do attackers. It shouldn't be a new concern that malicious attackers are adopting professional software development techniques. In fact, it would be more concerning if attackers weren't adopting these techniques, as that would mean they were so far ahead of the defenders that their attacks were undetectable.
The Turla APT campaign has incorporated many cutting-edge techniques used by advanced malware and demonstrates professional disciplined software development practices. The developers appear to have put significant efforts into planning the long-term development and operation of the malware, as well as its recently discovered cousin Epic. It has a modular framework design where the different components of the attack are automated. When a new attack technique is found, the development team can easily incorporate the new functionality into the attack plan and have the malware check into the command-and-control system to get an update.
According to an unnamed source in a Reuter's article, the Turla development team used a technique that is often leveraged by manual attackers. Once a manual attacker sees that one part of the attack is detected, he or she knows the other components of the attack are at a heightened risk of being detected and will change tactics, suspend the attacks, or accelerate the attack to gain access or steal the targeted sensitive data. In Turla, much like other malware, attackers will also remove logs from the local system so they can't be used to identify attacker activities.
The Turla spyware is designed to pause operations if a detection effort is sensed, so an update can be released to reduce the chances of the attack being detected. Turla lowers its odds of getting caught by monitoring the command-and-control infrastructure and, if a central node is detected as going offline, forces the malware to go dormant until further notice.
Enterprises can combat Turla by using an antimalware network appliance, a domain name system malware analysis tool, a network anomaly detection tool, or advanced endpoint security tools.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your questions now via email! (All questions are anonymous.)
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
Conficker malware was found in a German nuclear power plant computer system. Expert Nick Lewis explains the possible impact of malware infections of ...continue reading
OneSoftPerDay, an adware program can install backdoors on PCs, is able to avoid detection from antimalware tools. Expert Nick Lewis explains how to ...continue reading
The hot-patching feature in Windows servers is vulnerable to attacks from APT groups. Expert Nick Lewis explains what hot patching is and how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.