Hacker fingerprints – the future of malware detection?

It has been obvious for a time now that security companies will have to find a new malware detection technique that will complement their heuristic engines searching for generic malware signatures, since anti-malware solutions aren’t blocking enough malicious code.

The solution for this problem is seems to be on the horizon – if the claims of Greg Hoglund, CEO of HBGary, are to be believed.

Hoglund in scheduled to hold a briefing during Black Hat 2010 next week, in which he is going to present the findings of his recent analysis of binaries of malware executables, and explain how his “hacker fingerprints/signatures” approach might just be the thing that will revolutionize the anti-malware market.

We all know that malicious code – like any other – is written in specific environment. He professes that he managed to detect specific tool marks that would help discover which individual or group is behind a specific piece of malware, and through this offer a good guess about the author(s) motive – money, information, fame, politics?

He offers as an example one particular malware executable whose fingerprint can be based on the author’s preference for Back Orifice 2000, Ultra VNC remote desktop support software, and code from a 2002 Microsoft programming guide. Even with slight changes, he claims, this makes for a signature that will last for a long time – longer than the generic ones, in fact.

“The bad guys don’t change their code that often,” Hoglund said for ComputerWorld. Of course, this detection technique is not made to be used by itself, but as an addition to the existing ones. But, it could provide for a new way of ranking potential dangers.

Knowing the ultimate motive behind the malware would allow an individual to give more attention to a banking Trojan than to malware designed to steal intellectual property, while a company would rank the last threat much higher than the first. Also, it would provide vital information to businesses as to the scope of the attack – are they targeted by an organized group or a random attacker?

Hoglund and his team analyzed around 150,000 pieces of malware, and they found that the people behind them are not as numerous as we imagine – hundreds rather than thousands. He will also be presenting Fingerprint, a tool they designed to detect these specific tool marks.