Cybercrooks who rig Web sites to break into PCs are getting better at hiding their malicious code, a security expert said Wednesday. Increasingly the actual code, often JavaScript, used to attack PCs is hidden in Flash animations or scrambled so that anyone who examines the source of a page can’t easily identify it, said Jose Nazario, a senior software engineer at Arbor Networks, in a presentation at the CanSecWest security confab here.

“Their obfuscation tools are primitive but effective,” Nazario said. “They use obfuscation to avoid simple signatures,” he said, referring to security techniques based on signatures to detect malicious Web sites. Signatures are fingerprints of known attacks.

continued @