New Attack Tricks Antivirus Software

Abstract

Traditionally, antivirus products stop malicious software by recognizing code signatures unique to different types of malware. When the applications encounter a file with a code string that matches one in their database for a known virus, they block its access to the intended victim's computer. However, with the advent of Web 2.0, in which Web sites make it easy for users to add content, hackers have found a new way to spread malicious code and short-circuit the pattern-matching antivirus approach. DCO employs algorithms to change and disguise JavaScript-based malware code without making it less harmful, thereby keeping pattern-matching antivirus software from recognizing exploits.