Detecting viruses can be very complicated, let alone disinfecting them. Our modern day AV software is actually quite a joke and is very ineffective. Standard AV software uses scan strings, which are signatures, to detect a virus. In other words, if a known virus always had the string h4h4.infect.1+ at a given offset within the binary, then the AV software would see that it is present in its database and flag it as infected. This is very ineffective in the long run, especially since viruses are constantly mutating into new strains.

Some AV products are known to use emulation for dynamic analysis that can feed the heuristics analyzer with information about an executable's conduct during runtime. Dynamic analysis can be powerful, but it is known to be slow. Some breakthroughs in dynamic malware unpacking and classification have been made by Silvio Cesare, but I am not certain whether this technology is being used in the mainstream.

Currently, there exists a very limited amount of software for detecting and disinfecting ELF binary infections. This is probably because a more mainstream market doesn't exist and because a lot of these attacks are somehow still so underground. There is no doubt, though, that hackers are using these techniques to hide backdoors and maintain a stealthy residence on compromised systems. Currently, I am working on a project called Arcana, which can detect and disinfect many types of ELF binary infections, including executables, shared libraries, and kernel drivers, and it is also capable of using ECFS snapshots (described in Chapter 8, ECFS – Extended Core File Snapshot Technology) which greatly improves process-memory forensics. In the meantime, you can read about or download one of the following projects, which are prototypes I designed years ago:

Most viruses in a Unix environment are implanted after a system compromise and used to maintain residency on the system by logging useful information (such as usernames/passwords) or by hooking daemons with backdoors. The software that I have designed in this area is most likely to be used as host intrusion detection software or for automated forensics analysis of binaries and process memory. Keep following the http://bitlackeys.org/ site to see any updates pertaining to the release of Arcana, my latest ELF binary analysis software, which is going to be the first real production software that is equipped for complete analysis and disinfection of ELF binary infections.

I have decided not to write an entire section in this chapter on heuristics and the detection of viruses, because we will be discussing most of these techniques in Chapter 6, ELF Binary Forensics in Linux, where will examine the methods and heuristics used in detecting binary infections.