2 ms·
The only thing you can truly do is look for anomalies in network traffic, processes, files, etc. This malware is not immune to that unless it has features speci
by chelmzy 5y ago
The only thing you can truly do is look for anomalies in network traffic, processes, files, etc. This malware is not immune to that unless it has features specifically to hide from monitoring tools.
Even then there will almost always be evidence if you log network traffic. But obviously this is very difficult.
- MauranKilom 5y ago> Even then there will almost always be evidence if you log network traffic. You'd need to know what to look for though. It was shown that the CIA can hide its communication in metadata of legitimate traffic which is then recovered at intermediate hops to the target. So, do you know precisely what an innocent DNS packet looks like to detect this anomaly?
- hnarn 5y ago>do you know precisely what an innocent DNS packet looks like to detect this anomaly Wouldn't an abnormal amount of DNS data also stand out? I assume for this to work they'd still have to send a lot of data unless they're willing to wait for half an eternity. Just curious, since I hadn't heard of this before.
- didericis 5y agoI’d imagine it depends on what you’re trying to send out and the size of it.