Question

8. (10p) Modern virus scanners can detect viruses by their signatures. One technique used by some viruses to avoid detection is called the Swiss cheese infection. Explain this technique.

Answer 1

The swiss cheese infection technique encrypts virus code after which the decryption engine is divided into different pieces and these pieces are injected through the infected program. The following attached image clearly explains the concept.ogram code.

Swiss Cheese Infection (Figure 2-2) Jump Decrypt Part 1 Decrypt Part 2 Decrypt Part 3 Decrypt Part 4 Decrypt Part 5 Program Code Virus Code (Encrypted) Figure 2-2 Swiss cheese infection Security+ Guide to Network Security Fundamentals, Fifth Edition

Answer 2

Swiss cheese infection

Swiss cheese Infection I Blocki Blocka f Decrypty Decrypt Block3 & Block Dearest Source code Virus code ( It is fully encrypted) Swiss cheese infection working

• The Swiss cheese infection is a virus infection method.
• Detection of this virus is difficult because of encryption and it is lengthy.
• Because the virus is designed in a way it is difficult to decrypt .
• Such viruses are coded in a way that is difficult to find the exact location.
• Then the virus code gets decrypted into blocks and those blocks spreads throughout the source code which is infected.
• Later the source code gets executed and the blocks gets combined to decrypt the code with virus.
• Because of these different blocks the virus gets spread throughout and finally decrypted.
• So,Here the virus detection is very difficult to detect .
• Now a days there are many modern techniques available to tackle this Swiss cheese infection.