VB Blog

VB2017 paper: Nine circles of Cerber

Posted by Martijn Grooten on Dec 15, 2017

Cerber is one of the major names in the world of ransomware, and last year, Check Point released a decryption service for the malware. Today, we publish a VB2017 paper by Check Point's Stanislav Skuratovich describing how the Cerber decryption tool worked; we have also uploaded the video of the presentation of this paper, by Or Eshed and Yaniv Balmas.

Posted by Martijn Grooten on Dec 14, 2017

Dutch security firm Fox-IT deserves praise for being open about an attack on its client network. There are some important lessons to be learned about DNS security from its post-mortem.

Posted by Martijn Grooten on Dec 14, 2017

For this week's Throwback Thursday, we look back at the video of a talk Level 3's Mike Benjamin gave at VB2016 in Denver, on BGP and BGP hijacks.

Posted by Martijn Grooten on Dec 13, 2017

Citizen Lab's Security Planner helps you improve your online safety, based on the specific threats you are facing.

Posted by Martijn Grooten on Dec 11, 2017

Today, we publish the video of the VB2017 presentation by Avast researcher Jakub Kroustek and his former colleague Előd Kironský, now at ESET, who told the story of Spora, one of of the most prominent ransomware families of 2017.

Posted by Martijn Grooten on Dec 7, 2017

During recent research, Cisco Talos researchers observed the ways in which APT actors are evolving and how a reconnaissance phase is included in the infection vector in order to protect valuable zero-day exploits or malware frameworks. At VB2017 in Madrid, two of those researchers, Paul Rascagneres and Warren Mercer, presented a paper detailing five case studies that demonstrate how the infection vector is evolving. Today we publish both Paul and Warren's paper and the recording of their presentation.

Posted by Martijn Grooten on Dec 1, 2017

At VB2017 in Madrid, CERT Poland researchers Maciej Kotowicz and Jarosław Jedynak presented a paper detailing their low-level analysis of five spam botnets. Today we publish their full paper.

Posted by Martijn Grooten on Nov 30, 2017

We look back at the VB2016 presentation by Righard Zwienenberg (ESET) and Luis Corrons (Panda Security), in which they discussed various issues relating to anti-malware testing.

Posted by Martijn Grooten on Nov 30, 2017

As an independent body in the IT security industry, Virus Bulletin is in an ideal position to act as a global source of information both about jobs currently available in the field and about those candidates currently seeking to start or progress their career in the industry - which is why we have relaunched the VB Security Jobs Market.

Posted by Martijn Grooten on Nov 29, 2017

At VB2017 in Madrid, macOS malware researcher Patrick Wardle presented the details of a specific piece of Mac malware, FruitFly, which he analysed through a custom C&C server - a technique that will also be of interest for researchers of malware on other platforms. Today we publish both Patrick's paper and the recording of his presentation.

Previous1...2627282930...215Next

Search blog

ROPEMAKER email exploit is of limited practical use

Researchers at Mimecast have published a paper about the 'ROPEMAKER' exploit, which allows an email sender with malicious intentions to change the visial appearance of an email after it has been delivered.
Researchers at Mimecast have published details (pdf) of an email exploit they call 'ROPEMAKER' (short for 'Remotely Originated Post-delivery Email Manipulation Attacks Keeping… https://www.virusbulletin.com/blog/2017/08/ropemaker-email-exploit-limited-practical-use/

VB2017 preview: Mariachis and jackpotting: ATM malware from Latin America

We preview the VB2017 presentation by Kaspersky Lab researchers Thiago Marques and Fabio Assolini in which they look at malware targeting ATMs in Latin America.
A few years ago, I saw an ATM being opened for the first time. "Hold on," I thought, "this is really just a Windows XP PC!" Suddenly, I realised that, to attack an ATM,… https://www.virusbulletin.com/blog/2017/08/vb2017-preview-mariachis-and-jackpotting-atm-malware-latin-america/

VB2017 preview: Stuck between a ROC and a hard place

We preview the VB2017 paper by Microsoft's Holly Stewart and Joe Blackbird, which uses data about users switching anti-virus provider to decide whether machine-learning models should favour avoiding false positives over false negatives.
Authors of security software in general, and anti-virus software in particular, have always needed to find the right balance between a high detection rate and a low false positive… https://www.virusbulletin.com/blog/2017/08/vb2017-preview-stuck-between-roc-and-hard-place/

VB2017 preview: Consequences of bad security in health care

We preview the VB2017 presentation by Jelena Milosevic, an ICU nurse by profession, who will provide the audience with an inside view of security in hospitals.
Earlier this month, at the SHA2017 hacking camp, among the professional hackers and security experts, there was one speaker with a rather unconventional CV: Jelena Milosevic's day… https://www.virusbulletin.com/blog/2017/08/vb2017-preview-consequences-bad-security-health-care/

VB2017 Small Talk: The encryption vs. inspection debate

At VB2017, Cloudflare's Head of Cryptography Nick Sullivan will give a Small Talk on the intercepting of HTTPS connections by proxies and anti-virus software.
We all know that security often gets in the way of convenience, but sometimes security even gets in the way of security. This is the case, for example, when a decision needs to be… https://www.virusbulletin.com/blog/2017/08/vb2017-small-talk-encryption-vs-inspection-debate/

Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 2

In the second part of this two-part blog series, we look at five more memorable Virus Bulletin conference presentations.
With an excellent conference programme featuring some of the top experts in the IT security industry and covering some of the most important topics, we have much to look forward… https://www.virusbulletin.com/blog/2017/08/throwback-thursday-ten-memorable-virus-bulletin-conference-presentations-part-2/

Five tips for submitting to Calls for Papers

With the VB2017 Call for Papers out, here are five tips to increase your chances of getting your submission accepted.
Two weeks ago, we opened the call for last-minute papers for VB2017. Like most CPFs, the number of submissions will far exceed the number of available slots. There is no golden… https://www.virusbulletin.com/blog/2017/08/five-tips-submitting-calls-papers/

The WannaCry kill switch wasn't inserted to make someone a hero

Following the arrest of WannaCry hero Marcus Hutchings, suggestions have been made that he was behind the WannaCry malware itself, and that he inserted the kill switch to make himself a hero. This seems highly unlikely.
Almost three months after its damaging outbreak, the WannaCry malware remains shrouded in mystery. Last week's arrest of security researcher Marcus Hutchings, better known and… https://www.virusbulletin.com/blog/2017/08/wannacry-kill-switch-wasnt-inserted-make-someone-hero/

Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1

In a two-part blog post series, we look back at ten memorable VB conference presentations from the past ten years.
With an excellent conference programme (and still some gaps to fill!), we have much to look forward to when it comes to VB2017, the 27th Virus Bulletin conference. But we also… https://www.virusbulletin.com/blog/2017/08/throwback-thursday-ten-memorable-virus-bulletin-conference-presentations-part-1/

Worms wiggling inside your networks are a lot harder to stop

The authors of the Trickbot banking trojan seem to have taken note of the use of SMB by WannaCry and (Not)Petya and have added an (experimental) module that uses SMB for lateral movement.
Damaging though they were, the recent WannaCry and (Not)Petya outbreaks taught security practitioners many valuable lessons. Unfortunately, they taught important lessons to… https://www.virusbulletin.com/blog/2017/08/worms-wiggling-inside-your-networks-are-lot-harder-stop/

August

https://www.virusbulletin.com/blog/2017/08/

VB2017 drinks reception to be hosted in Madrid's unique Geographic Club

To give those attending VB2017 Madrid a chance to experience a little bit of the host city, the VB2017 drinks reception will be held at the unique and fascinating Geographic Club.
When, at the end of VB2016, we announced Madrid as the location for VB2017, the cheering from the audience suggested that it was a popular choice. This is understandable of… https://www.virusbulletin.com/blog/2017/08/vb2017-drinks-reception-be-hosted-geographic-club/

By removing VPNs from its Chinese App Store, Apple turns its biggest security asset against its users

To comply with Chinese laws, Apple has removed all iOS VPN apps from its Chinese app store. This means that the company uses iOS's strongest security asset, its tightly controlled App Store, against its own users.
A little over a month ago, Apple's iPhone celebrated its tenth birthday. The iPhone has been one of the biggest commercial success stories ever, but it has also been a great… https://www.virusbulletin.com/blog/2017/08/removing-vpns-its-chinese-app-store-apple-turns-its-biggest-security-asset-aggasnt-its-users/

VB2017 Small Talks and reserve papers announced

Today we announce the first two Small Talks for the VB2017 programme: ENISA will provide its perspective on the WannaCry outbreak and the lessons learned from it, while David Harley will talk about the past and present of security product testing.
Today, we are pleased to announce the first two Small Talks for the VB2017 programme. The 'Small Talks' were first introduced as a third stream at the VB Conference in 2015,… https://www.virusbulletin.com/blog/2017/07/small-talks-and-reserve-papers-announced-vb2017-programme/

NoMoreRansom's first birthday demonstrates importance of collaboration

This week the NoMoreRansom project celebrated its first birthday. It has already helped many victims of ransomware with advice and tools and is an excellent example of collaboration between private and public partners in IT security.
This week, the NoMoreRansom project celebrates its first anniversary and can look back to subtle but important successes in the fight against ransomware. The advice from… https://www.virusbulletin.com/blog/2017/07/nomoreransoms-first-birthday-shows-importance-collaboration/

VB2017 call for last-minute papers opened

Today, we open the call for last-minute papers for VB2017. Submit before 3 September to have your abstract considered for one of the ten slots reserved for 'hot' research.
UPDATE 4 Sept 2017: Please note that the call for last-minute papers for VB2017 has now closed. Virus Bulletin has opened the call for last-minute papers for VB2017. The… https://www.virusbulletin.com/blog/2017/07/vb2017-call-last-minute-papers-opened/

Five reasons to come to VB2017 in Madrid

We're not ones to make bold claims about our conference, and we suggest you ask past attendees for their opinion, but here are five reasons why we think you should come to VB2017 in Madrid.
I regularly use this blog to add nuance to bold claims about dangerous vulnerabilities or impressive claims about security solutions – something that I think befits an independent… https://www.virusbulletin.com/blog/2017/07/five-reasons-come-vb2017-madrid/

DMARC: an imperfect solution that can make a big difference

US Senator Ron Wyden has asked the Department of Homeland Security to implement DMARC. Martijn Grooten looks at what difference this could make for phishing attacks impersonating the US federal governent.
US Senator Ron Wyden has written a letter (pdf) to the Department of Homeland Security, urging the US government to implement DMARC to "ensure hackers cannot send emails that… https://www.virusbulletin.com/blog/2017/07/dmarc-imperfect-solution-can-make-big-difference/

Advanced and inept persistent threats to be discussed at VB2017

Unsurprisingly given today's threat landscape, the VB2017 programme contains several talks on various advanced persistent threats - but also a talk on what may be the polar opposite of such threats: an inept persistent threat.
Only a few years ago, "APT" (advanced persistent threat) was a buzzword mostly heard being bandied around at security exhibitions to sell even more advanced technology to prevent,… https://www.virusbulletin.com/blog/2017/07/advanced-and-inept-persistent-threats-be-discussed-vb2017/

Password security is 1% choosing a half-decent password, 99% not using it anywhere else

Password security advice focuses too much on password strength and too little on avoiding password reuse, Martijn Grooten argues.
It is a truth generally acknowledged that there is no such thing as absolute security. Security is always a compromise with usability, and good security is about finding the right… https://www.virusbulletin.com/blog/2017/07/password-security-1-choosing-half-decent-password-99-not-using-it-anywhere-else/

« Previous 1...1819202122...120 Next »