Bots may get cloak of encryption
In their quest to retain control over hijacked PCs, cybercriminals will add encryption to their malicious software to avoid detection and removal, one expert predicted Monday.
In the near future, bots will include encryption to hide their presence from security and network sniffing tools often used to detect their presence, said Adam Meyers, an information assurance engineer at SRA International speaking at the Computer Security Institute conference here.
"We will see encrypted sessions, and as things become encrypted, we'll have a more difficult time investigating botnets," Meyers said.
Once it is installed on a PC, bot software typically connects to Internet Relay Chat to listen for commands. The IRC traffic can be a giveaway to the presence of bot software on a PC and can be spotted by security software such as intrusion detection systems (IDS) or protocol analyzers, for example Ethereal.
