2

http://resources.infosecinstitute.com/data-exfiltration-techniques/

I am teaching myself to identify exfiltration of sensitive data with malicious binaries. One thing I have noticed, is in most examples a rather easy spot system call to some sort of http related function is made.

Is this true in all cases, or do some malware have a way of hiding their network access routines? How would you spot this? or do malware authors simply not bother?

closed as off-topic by Jason Geffner, 0xC0000022L, jvoisin, 0xea, peter ferrie Jun 27 '14 at 15:55

  • This question does not appear to be about reverse engineering within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    This question is off-topic because it is about computer security / data security. Try security.stackexchange.com – Jason Geffner Jun 24 '14 at 14:43
  • But it also involves analysis of binaries... Might I rephrase my question "How would you hide network data transfer from a reverse engineer"? – baordog Jun 24 '14 at 14:46
  • Why should they bother as 99% of the users are not even aware of the implication of allowing such a behavior... My point is that malware creators are always trying to do the less possible and yet reach a good chance of success. – perror Jun 24 '14 at 14:59
  • That's certainly a good point. I would imagine someone trying to cover their tracks might try to avoid revealing exact how/where the data is being sent away, but it could just not be a concern. – baordog Jun 24 '14 at 15:06
2

One common method of data exfiltration is having seemingly arbitrary data depend upon the data to be leaked; a sneaky program may thus not send data outside a machine itself, but rather cause the data to be stored within information which would be legitimately exchanged via other means.

One example I remember reading about was a program which included a function to print a registration form, but before printing the form it would scan the computer for other software produced by the same company and slightly adjust the placement of a few items on the form based upon what it found. Scanning the form and measuring the exact placement of those items would then allow the company to ascertain which of its other programs a user had installed, without requiring the company to have any sort of network or modem connectivity to the machine in question.

Realistically speaking, the only way to ensure that an untrusted program won't share information inappropriately is to not allow any untrusted programs to have access to information that shouldn't be shared. Once programs have access to information, there are so many ways they can hind it that it would be hard to ensure one found them all.

Not the answer you're looking for? Browse other questions tagged or ask your own question.