Virtual machines being used to obfuscate malware

Security experts at the e-Crime Congress event in London this week warned of an increase in incidents of criminals using virtual technology to obfuscate malicious code, thereby making it harder to unravel.

Rik Howard, director of intelligence at iDefense, the managed security arm of VeriSign, argued that virtual machine obfuscation software is beginning to appear on the radar of researchers.

He explained that the tool is being employed by cyber criminals to create a different bytecode every time a binary is run through it, making it harder to crack.

"This makes it very difficult for our guys to pull it apart," he added. "It's a much slower process than standard reverse engineering. We expect to see it more and more in the next year or two."

Howard highlighted the worrying appearance of VM obfuscation tools readily available on the market, such as VM Protect, which is being marketed legitimately as IP protection software.

"This helps the criminals - they don't even need to build an obfuscation system," he argued.