Hiding In Plain Sight - Advances In Malware Covert Communication Channels
summary
Analysis documents three real malware families using covert channels: Stegoloader, Vawtrak, Lurk all embed data via LSB steganography in ICO, BMP and PNG files (Gozi downloads favicon over Tor2web, strips LSBs and RC4-decrypts backup C2s; Steloader extracts x86 code from PNG and executes from memory; Lurk hides download URLs in white BMPs). Botnets and APTs also use DNS TXT with base64 chunks, CRC32 and rotating RC4 keys for staged C2; steganography serves mainly as a unidirectional fallback, not a panacea.
AI-written summary · about
chapters (4)
related talks
16mBeyond the surface: uncovering hidden threats in online ads
52mFlying Under the Radar - New Security Evasion Techniques
41mWhen Cybersecurity Is More Than Just Vulnerabilities
44mAnatomy and Defense of LOTL Fileless Intrusions
31mCommSec D1 - Steganography Ante Portas
42mDriven Response to UNC5174
29mThe Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
43mMalicious Payloads vs Deep Visibility: A PowerShell Story