Speaking at the IT Security in Government Conference in Canberra on Friday, Brian Denehy, security assurance engineer at CyberTrust, told delegates that the vast majority of new malware uses "some type of stealth" or anti-forensic technology in an attempt to remain undetected before, during and after an attack.
According to Denehy, techniques used not only include 'the obvious ones' such as encryption and rootkits but also "compression bombs"--which are compressed files that try to make life difficult for forensic tools by attempting to expand to an infinite size when executed.
"Generally these techniques are seen in about 65 percent of all forensic investigation these days.
"Some just do a complete wipe on the disk--equivalent to a low level format--to make sure that some of the remnant magnetization is not left behind. Most of you may well appreciate that just writing on a hard disk still leaves evidence there that can be recovered with the right tools.
"People also use the slack space at the end of files or introduce extras in the bad sectors list to hide their data … it makes life more difficult," said Denehey.
When conducting investigations, it's always Deheney's hope that these techniques haven't been used by hackers."It is pleasing to find an inexperienced hacker that has not used these things and has made it easy to analyze," he said.
