ACAD/Medre.A 10000's of AutoCAD files leaked in suspected industrial espionage
Award-winning news, views, and insight from the ESET security community The malware news today is all about new targeted, high-tech, military grade malicious code such as Stuxnet, Duqu and Flamer that have grabbed headlines. So imagine our surprise when an AutoCAD worm, written in AutoLISP, the scripting language that AutoCAD uses, suddenly showed a big spike in one country on ESET’s LiveGrid® two
持続的標的型攻撃「IXESHE」の全貌 – リサーチペーパー公開 |
トレンドマイクロは、2012年3月末に公開した、インドや日本を狙う持続的標的型攻撃「Luckycat」に関するリサーチレポートに引き続き、持続的標的型攻撃「IXESHE（アイスシ）」のリサーチレポートを公開しました。 キャンペーン「IXESHE」の注目すべき特徴は、攻撃者が標的となった組織のネットワーク内部にある感染サーバを乗っ取りコマンド＆コントロール（C&C）サーバとして悪用していたことです。こうした手口を用いることで、彼ら自身の不正活動を組織内の個人が行う通信と混同させ、自身の存在を隠ぺいすることを可能にしました。この特徴を備えた一例として、トレンドマイクロでは、東アジア圏の政府機関に標的型攻撃を仕掛けやすいように、同国内のネットワーク内部に設置された C&Cサーバを確認しています。また、別の事例では、C&Cサーバからのエラーメッセージを受信。このエラーメッセージにより、本来の C&
Android Malware Genome Project
Yajin Zhou Xuxian Jiang Department of Computer Science North Carolina State University Contact: (2015/12/21) Due to limited resources and the situation that students involving in this project have graduated, we decide to stop the efforts of malware dataset sharing. The popularity and adoption of smartphones has greatly stimulated the spread of mobile malware, especially on the popular platforms su
Bootkit Threat Evolution in 2011
Award-winning news, views, and insight from the ESET security community Bootkit Threat Evolution in 2011 ESET researchers examine the evolution of bootkit threats targeting 64-bit Windows over 2011. The year 2011 could be referred to as a year of growth in complex threats. Over the course of this year we witnessed an increase in the number of threats targeting the Microsoft Windows 64-bit platform
The Mystery of Duqu: Part One
First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here (at a minimum) – the main module and a keylogger. All that has been mentioned in last 24 hours about connections between Duqu and Stuxnet is re
Deobfuscating malicious code layer by layer - Panda Security Mediacenter
Article written by David Sánchez Lavado This post explains how to analyze the malicious code used in current Exploit Kits. There are many ways to analyze this type of code, and you can find tools that do most of the job automatically. However, as researchers who like to understand how things work, we are going to analyze it with no other tools than a text editor and a Web browser. My goal is to la
CCC | Chaos Computer Club analyzes government malware
The largest European hacker club, "Chaos Computer Club" (CCC), has reverse engineered and analyzed a "lawful interception" malware program used by German police forces. It has been found in the wild and submitted to the CCC anonymously. The malware can not only siphon away intimate data but also offers a remote control or backdoor functionality for uploading and executing arbitrary other programs.
標的型攻撃に関する調査結果：IPA 独立行政法人 情報処理推進機構
※本報告書の「震災マルウェア」検体について、ファイル形式、CVE番号に誤りがあったため修正しております。 IPA（独立行政法人情報処理推進機構、理事長：藤江 一正）は、脆弱（ぜいじゃく）性を利用した新たなる脅威の実態把握と対策促進のための調査レポートとして「東日本大震災に乗じた標的型攻撃メールによるサイバー攻撃の分析・調査報告書」を9月29日（木）からIPAのウェブサイトで公開しました。 近年、コンピューターウイルスの持つ機能が複雑化しつつありますが、それだけではなく、人間の心理・行動の隙を突くことで情報を不正に取得する手段（ソーシャルエンジニアリング）等を利用した技術面以外の手口も巧妙化してきています。中でも標的型攻撃メールにおいては、ソフトウェア等の脆弱性を狙った攻撃も多く、情報漏えいなどの被害の発生原因となっています。昨今では、金融業や重工業を狙った攻撃が顕在化しています。 IPAセ
Defeating x64: Modern Trends of Kernel-Mode Rootkits
Versions of Microsoft Windows 64 bits were considered resistant against kernel mode rootkits because integrity checks performed by the system code. However, today there are examples of malware that use methods to bypass the security mechanisms Implemented. This presentation focuses on issues x64 acquitectura security, specifically in the signature policies kernel mode code and the techniques used
What is a Trojan Horse? Is it Malware or Virus?
Unlike viruses, Trojans do not self-replicate by infecting other files or computers. Rather, a Trojan is the decoy horse, ushering in other malicious software (malware), giftwrapped to hide its nefarious intent. Trojans survive by going unnoticed. They may sit quietly in your computer, collecting information or setting up holes in your security, or they may just take over your computer and lock yo
Stuxnet Malware Analysis Paper
This article will focus on Stuxnet’s windows infection methods and spreading methods. The tricks were used by stuxnet and the evidences behind the criminals of stuxnet. Download the Article in PDF - 2.17 MB Table Of Contents 1. Introduction: 2. Payload: 3. Suspects: 4. Technical Details: 4.1.Stuxnet Live Cycle 4.2. Main Dropper (~WTR4132.TMP) 4.3. Main Stuxnet DLL 4.3.1. Escalating the Privilege
Home - Broadcom Community - Discussion Forums, Technical Docs, Ideas and Blogs
VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.. View Community Sessions VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.. View Community Sessions VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.
Four Years of Web Malware
The latest news and insights from Google on security and safety on the Internet Meg said... Thanks so much for all you do. I had no idea about the behind-the-scenes work that is done to secure my internet usage. What is malware, anyway? September 1, 2011 at 12:57 AM ryan said... Is there a such thing as a "safe browsing badge" that someone can put on their website which would link to the google sa
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Understanding the Data: How To Think About Mobile Malware Encounter Rates
Win32/Duqu: It’s A Date | ESET ThreatBlog
Android Malware Eavesdrops on Users, Uses Google+ as Disguise
マカフィー株式会社 | McAfee Blog - 偽セキュリティソフト、再び拡大の恐れ
Android Malware Eavesdrops on Users, Uses Google+ as Disguise
[PDF] W32.Xpaj.B: Making Easy Money from Complex Code
Endpoint Protection - Symantec Enterprise