Bohu attacks on cloud-based AV prove need for new security approach


Bohu attacks on cloud-based AV prove need for new security approach

Warwick Ashford

Bohu, a new type of malware, is attacking cloud-based Anti-Virus (AV) technology from popular suppliers in China.

Bohu (TrojanDropper:Win32/Bohu.A) attracts user installation by social engineering techniques, according to the Microsoft Malware Protection Center (MMPC).

The techniques include using attractive file names and dropping a fake video player named "Bohu high-definition video player".

Bohu is designed to block cloud-based services now commonly featured in major Chinese antivirus products.

Cloud-based virus detection works using a client to send important threat data to the server for back-end analysis, and subsequently acquiring further detection and removal instructions.

The process is designed to remove malware not handled by the traditional on-the-box signature approach, but Bohu tries to sever the communication between cloud client and server, and constantly modify file content of its components to evade detection.

Bohu is part of the first wave of malware that specifically targets cloud-based antivirus technology, said the MMPC.

Alan Bentley, senior vice-president at security firm Lumension, said the security of information in the cloud has had a question-mark over it for some time.

"This attack will only serve to fuel further concerns regarding the safety of storing information virtually," he said.

According to Bentley, with cyber-criminals now targeting security defences, a different approach to safeguarding data is required.

"Relying on anti-virus solutions has proven ineffective time and time again. A more intelligent approach to security would serve to prevent attacks like Bohu. Only by allowing code that is known to be good to enter a network, can organisations make sure they are truly protected," he said.

Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy