Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
A trojan horse has used the Tor anonymity network to communicate with command and control servers, researchers found.
The Tor communication capability was an addon function to the Bifrost backdoor trojan that allowed the malware to send stolen user data over the encrypted proxy network.
It was believed to be the first instance of malware using Tor, and while development of the Trojan appears to have stopped, researchers say use of the anonymised network was a useful concept.
The Bifrost trojan targeted all Windows operating systems. It established links to command and control servers, once it had infected a host, by launching the Internet Explorer web browser and injecting into its address space.
Compromised machines then remained under the control of remote attackers over the Tor connection.
It specifically used Tor's server-side location-hidden services function that removed the risk of eavesdropping on the network's exit nodes.
Hidden services were hosted on user computers and used internal pseudodomains that could only be routed within the Tor network.
Bifrost's use of Tor to route traffic was a "novel idea", Symantec security response engineer Cathal Mullaney said.
It "adds an extra layer of stealth and security to the trojan," Mullaney said.
"This type of behavior is very useful from a trojan’s perspective as it provides a secure communication method while keeping the remote server anonymous."
Stolen data traversing was further protected by multi-layer encryption used in the Tor network.
"This increases the difficulty of analysing the communications between the compromised computer and the remote server."
Use of Tor also hindered attempts to block Bifrost connections at firewall level because, Mullaney said, it does not use "unusual" remote ports.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.