The Anti-virus Times

Wednesday, October 11, 2017

WikiLeaks published another batch of information about some CIA tools (i.e., malware) used to harvest data on machines running Windows XP and 7. A couple of these “helpers” look quite interesting.

Some may wonder why malicious programs would need a file system of their own when they can always write data into an ordinary file or transmit it over the Internet.

It's because of the preventive protection component: even if a malicious program manages to launch (e.g., because a user added an entire disk drive or all the traffic of certain applications to a list of scanning exceptions), its process will be scrutinized by this anti-virus component. The new program's activity will most certainly be monitored by the preventive protection. And the CIA found a way around that.

They created only one file containing a file system of its own. Under Linux, standard disk utilities can be used to format the disk space within one file. Creating a virtual disk under Windows is more difficult, but the utilities exist to do that.

As a result, preventive protection routines won't detect anything suspicious because most actions will be performed inside the file and will be regarded as standard file operations.

Storages of this kind can conceal malware components and stolen data.

Furthermore, attackers can encrypt the file system so that any attempts to extract information from its storage will be in vain. The malware program Regin, which creates its own encrypted virtual file system (EVFS), does the same thing. To encrypt EVFS, the malware uses the block cipher RC5. Alternately, it can place a storage outside the file system by moving a disk partition’s border. For example, TDL 3/4 rootkits created their TDLFS file system in sectors at the disk's end.