Malicious Code Hidden in Rich Content Files Tough To Detect, According to Finjan Report -- Campus Technology

Cybersecurity

Malicious Code Hidden in Rich Content Files Tough To Detect, According to Finjan Report

By Dian Schaffhauser
09/26/08

Finjan, a company that sells security products, said it has uncovered examples of obfuscated code embedded in rich-content files, and not just in HTML-based Web pages on legitimate Web sites. According to the vendor, code obfuscation remains the preferred technique for cybercriminals for their attacks.

Since JavaScript is the most-used scripting language for communication with Web browsers, third-party applications such as Flash player, PDF readers and other multimedia applications add support for JavaScript writing as part of their application, the company reported in its September 2008 "Malicious Page of the Month." This offers "crimeware" authors the opportunity to inject malicious code into rich-content files used by ads and user-generated content on Web 2.0 Web sites.

According to the report, only three of 36 virus-scanning products tested were able to detect the presence of that type of malicious code, which is dynamically embedded in the JavaScript.

Online ads and user-generated content on Web 2.0 Web sites are becoming more popular in directing users unwittingly to malware-infected content files. A recent survey by the company found that 46 percent of respondents stated that their organization didn't have a Web 2.0 security policy in place.

The company said real-time content inspection is the optimal way to detect and block dynamically obfuscated code, since it analyzes and understands the code embedded within Web content or files in real time--before it reaches users, who may unintentionally execute the Trojan on their machines.

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

E-Mail this page

Printable Format

Featured

OneDrive Update Adds AI Agents, Copilot Interactions

Microsoft has announced new enterprise capabilities in its OneDrive cloud storage service, many of which leverage the company's Copilot AI technologies.
Digital Leadership Must-Haves for 2025: A CDO's Picks

Now that he's more than a year and a half into his chief digital officer role at NJIT, we've asked Ed Wozencroft to reflect on his areas of concentration: What work must digital leaders "own" in 2025?
Report Highlights Security Risks of Open Source AI

In these days of rampant ransomware and other cybersecurity exploits, security is paramount to both proprietary and open source AI approaches — and here the open source movement might be susceptible to some inherent drawbacks, such as use of possibly insecure code from unknown sources.
Boosting Student Engagement with Interactive and Practical Teaching Methods

Traditional teaching methods like slide-to-slide PowerPoint presentations no longer engage students in the way they used to. Here's how one educator developed engaging, interactive methods to help students grasp complex concepts.