VB Blog

VB2019 presentation: A deep dive into iPhone exploit chains

Posted by Virus Bulletin on Jan 10, 2020

In a last-minute presentation at VB2019 in London, John Bambenek of the University of Illinois at Urbana-Champaign discussed details of campaigns that used advanced iOS and Android exploit chains against China’s Uighur minority. Today we release the recording of John's presentation.

Posted by Helen Martin on Jan 8, 2020

Today we released the Winter 2020 VBWeb report, detailing the performance of web security products against live web threats and looking at the current state of the web-based threat landscape.

Posted by Virus Bulletin on Jan 6, 2020

In a paper presented at VB2019 in London, Prismo Systems researchers Abhishek Singh and Ramesh Mani discussed code injection vulnerabilities and presented a tool that could detect this vulnerability class. Today we publish their paper and the recording of their presentation.

Posted by Helen Martin on Dec 31, 2019

As VB Editor Martijn Grooten steps down from his role to move on to new challenges, the team wish him a fond farewell and the very best of luck in his future endeavours.

Posted by Martijn Grooten on Dec 27, 2019

Today, we publish the VB2019 paper and video by Sophos researcher Sergei Shevchenko in which he analyses a popular yet unnamed piece of macOS ‘bundleware’.

Posted by Martijn Grooten on Dec 23, 2019

In the final of a five-part series of blog posts, departing VB Editor Martijn Grooten argues for more emphasis on the good news in security, especially that which is more subtle.

Posted by Virus Bulletin on Dec 20, 2019

In the fourth of a five-part series of blog posts, departing VB Editor Martijn Grooten explains why security researchers should refer to other people's work.

Posted by Martijn Grooten on Dec 19, 2019

In the third of a five-part series of blog posts, departing VB Editor Martijn Grooten explains why he believes security vendors should take their products' security more seriously.

Posted by Martijn Grooten on Dec 19, 2019

China has long been a hotbed of DDoS activities, and today we publish a VB2019 paper by Intezer researcher Nacho Sanmillan who looked at Chinese threat groups engaged in performing DDoS attacks. We have also uploaded the recording of his presentation.

Posted by Martijn Grooten on Dec 18, 2019

In the second of a five-part series of blog posts, departing VB Editor Martijn Grooten explains why he believes cybersecurity professionals need to educate themselves on the complexities of the real-world situations in which security is applied.

Previous1...56789...215Next

Search blog

New Emotet spam campaign continues to bypass email security products

On Monday, the infamous Emotet malware resumed its spam campaign to spread the latest version of the malware. As before, the malware successfully bypasses many email security products.
Following the resumption of activity by Emotet's C&C servers in August, it was only a matter of time before the botnet started sending out spam again. This did indeed happen on… https://www.virusbulletin.com/blog/2019/09/new-emotet-spam-campaign-continues-bypass-email-security-products/

From Amazon to Emotet: a look at those phishing and malware emails that bypassed email security products

We see a lot of spam in the VBSpam test lab, and we also see how well such emails are being blocked by email security products. Recently some of the emails that bypassed security products included a broken Amazon phishing campaign, a large fake UPS campai…
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. On this blog, we regularly look at those phishing and malware emails… https://www.virusbulletin.com/blog/2019/02/amazon-ups-emotet-formbook-and-lokibot-look-those-phishing-and-malware-emails-bypassed-email-security-products/

From HSBC to product descriptions: the malicious emails bypassing your filters

Using data from our VBSpam lab, we looked at the malicious emails that have been missed recently by a large number of email security products.
Over a one-week period earlier this month, the average email with a malicious attachment was almost three times as likely to bypass email security products than a spam email… https://www.virusbulletin.com/blog/2019/01/hsbc-product-descriptions-malicious-emails-bypassing-your-filters/

The spam that is hardest to block is often the most damaging

We see a lot of spam in the VBSpam test lab, and we also see how well such emails are being blocked by email security products. Worryingly, it is often the emails with a malicious attachment or a phishing link that are most likely to be missed.
This blog post was put together in collaboration with VB test engineers Adrian Luca and Ionuţ Răileanu. In a talk I gave at IRISSCON last year (the video of which you will find… https://www.virusbulletin.com/blog/2019/01/spam-hardest-block-often-most-damaging/

Emotet trojan starts stealing full emails from infected machines

The infamous Emotet trojan has added the capability to steal full email bodies from infected machines, opening the possibilities for more targeted spam and phishing campaigns.
Researchers at Kryptos Logic have discovered that the Emotet banking trojan is exfiltrating entire email bodies as opposed to merely email addresses. Emotet was first discovered… https://www.virusbulletin.com/blog/2018/10/emotet-trojan-starts-stealing-full-emails-infected-machines/

We are more ready for IPv6 email than we may think

Though IPv6 is gradually replacing IPv4 on the Internet's network layer, email is lagging behind, the difficulty in blocking spam sent over IPv6 cited as a reason not to move. But would we really have such a hard time blocking spam sent over IPv6?
In email security circles, IPv6 is the elephant in the room. While the transition from IPv4 to IPv6 is a relatively smooth affair for most of the Internet, and few people will… https://www.virusbulletin.com/blog/2018/06/we-are-more-ready-ipv6-email-we-may-think/

Expired domain led to SpamCannibal's blacklist eating the whole world

The domain of the little-used SpamCannibal DNS blacklist had expired, resulting in it effectively listing every single IP address.
The first line of defence in many a spam filter is to query one or more DNS blacklists to see if the sender's IP address (and sometimes their domain) is listed as a known spammer.… https://www.virusbulletin.com/blog/2018/05/expired-domain-led-spamcannibal-blacklisting-whole-world/

Netflix issue shows email verification really does matter

A clever trick taking advantage of the fact that Gmail ignores dots in email addresses could be used to trick someone into paying for your Netflix subscription - demonstrating the importance of confirmed opt-in.
In the email security community, the use of confirmed opt-in has long been a recommended practice: an email address given to you can't be used until the account owner has… https://www.virusbulletin.com/blog/2018/04/netflix-issue-shows-email-verification-does-matter/

Facebook helps you determine whether emails really came from its servers

On its website, Facebook now shows which emails it has sent you recently, thus helping you to determine which emails are real, and which should be discarded as phishing.
There are many good reasons to criticize Facebook for its collecting of our personal data, but the company also deserves credit for being at the forefront when it comes to online… https://www.virusbulletin.com/blog/2017/12/facebook-helps-you-determine-whether-emails-really-came-them/

ROPEMAKER email exploit is of limited practical use

Researchers at Mimecast have published a paper about the 'ROPEMAKER' exploit, which allows an email sender with malicious intentions to change the visial appearance of an email after it has been delivered.
Researchers at Mimecast have published details (pdf) of an email exploit they call 'ROPEMAKER' (short for 'Remotely Originated Post-delivery Email Manipulation Attacks Keeping… https://www.virusbulletin.com/blog/2017/08/ropemaker-email-exploit-limited-practical-use/

DMARC: an imperfect solution that can make a big difference

US Senator Ron Wyden has asked the Department of Homeland Security to implement DMARC. Martijn Grooten looks at what difference this could make for phishing attacks impersonating the US federal governent.
US Senator Ron Wyden has written a letter (pdf) to the Department of Homeland Security, urging the US government to implement DMARC to "ensure hackers cannot send emails that… https://www.virusbulletin.com/blog/2017/07/dmarc-imperfect-solution-can-make-big-difference/

Ransomware would be much worse if it wasn't for email security solutions

The latest VBSpam test brings good news: at least 199 out of every 200 emails containing a malicious attachment were blocked by email security solutions. All of the full solutions tested achieved a VBSpam award, with five earning a VBSpam+ award.
Many experts believe that ransomware is set to become an even worse problem in 2017 than it was in 2016 — which is rather bad news, given the damage it has already done. Still,… https://www.virusbulletin.com/blog/2017/01/ransomware-would-be-so-much-worse-if-it-wasnt-email-security-solutions/

Will DIME eventually replace email?

Protocol has all the advantages of email, yet is orders of magnitude more secure.
Protocol has all the advantages of email, yet is orders of magnitude more secure. In the current Internet era sometimes referred to as 'post-Snowden', it is often said that email… https://www.virusbulletin.com/blog/2015/03/will-dime-eventually-replace-email/

TorrentLocker spam has DMARC enabled

Use of email authentication technique unlikely to bring any advantage.
Use of email authentication technique unlikely to bring any advantage. Last week, Trend Micro researcher Jon Oliver (who presented a paper on Twitter abuse at VB2014) wrote an… https://www.virusbulletin.com/blog/2015/03/torrentlocker-spam-has-dmarc-enabled/

Praise for the unsung heroes of email

Many decent performances in VB's latest comparative spam filter test.
Many decent performances in VB's latest comparative spam filter test. A decade ago, there were optimists who thought that the spam problem would soon be eradicated. At the same… https://www.virusbulletin.com/blog/2015/02/praise-unsung-heroes-email/

VB2014 paper: DMARC - how to use it to improve your email reputation

Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.
Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.Over the next few months, we will be sharing VB2014 conference papers as well as video… https://www.virusbulletin.com/blog/2014/11/paper-dmarc-how-use-it-improve-your-email-reputation/

DNS cache poisoning used to steal emails

Call to use end-to-end encryption and to deploy DNSSEC.
Call to use end-to-end encryption and to deploy DNSSEC.DNS is sometimes called 'the phone book of the Internet'. If true, then it is a phone book that makes it relatively easy to… https://www.virusbulletin.com/blog/2014/09/dns-cache-poisoning-used-steal-emails/

Yahoo's DMARC policy wreaks havoc among mailing lists

Collateral damage in instruction to reject emails with invalid DKIM signatures.
Collateral damage in instruction to reject emails with invalid DKIM signatures. A change in Yahoo's DMARC policy has caused frustration among operators of many mailing lists and… https://www.virusbulletin.com/blog/2014/04/yahoo-s-dmarc-policy-wreaks-havoc-among-mailing-lists/

At least 99.4% of spam blocked in recent Virus Bulletin test

All solutions on test blocked at least 99.4% of spam, but some struggled with false positive issues; survey also shows few products support DMARC.
All solutions on test blocked at least 99.4% of spam, but some struggled with false positive issues; survey also shows few products support DMARC. The results of the most recent… https://www.virusbulletin.com/blog/2014/02/least-99-4-spam-blocked-recent-test/

New email header attempts to prevent damage of reissued email addresses

Transactional emails not delivered if the account's owner has changed in the meantime.
Transactional emails not delivered if the account's owner has changed in the meantime. When in June, Yahoo announced it would free up inactive user IDs, it received fierce… https://www.virusbulletin.com/blog/2013/08/new-email-header-attempts-prevent-damage-reissued-email-addresses/

« Previous 12 Next »