QuestionQ319

Detecting Evasive and Post-Exploitation Techniques

How does a worm make use of the Warhol/Flash technique?

  • A Flash movies are used to infect clients unknowingly and send links to everyone in the client's email address book.
  • B Prescanning is omitted so the worm can spread directly to every system in a block of IP addresses, infecting just those that are vulnerable.
  • C Large numbers of potentially vulnerable hosts are identified first and then exploited in groups, infecting more hosts in a short amount of time.
  • D The technique is meant to enable a worm to specifically evade all anti-virus and intrusion detection signatures.
Explanation

The Warhol/Flash approach builds a large hit list of potentially vulnerable hosts before release, enabling coordinated parallel exploitation and a much faster infection rate than random scanning. USENIX technical paper

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!