VB Blog

VB2017 paper: Nine circles of Cerber

Posted by   Martijn Grooten on   Dec 15, 2017

Cerber is one of the major names in the world of ransomware, and last year, Check Point released a decryption service for the malware. Today, we publish a VB2017 paper by Check Point's Stanislav Skuratovich describing how the Cerber decryption tool worked; we have also uploaded the video of the presentation of this paper, by Or Eshed and Yaniv Balmas.

Read more  

Attack on Fox-IT shows how a DNS hijack can break multiple layers of security

Posted by   Martijn Grooten on   Dec 14, 2017

Dutch security firm Fox-IT deserves praise for being open about an attack on its client network. There are some important lessons to be learned about DNS security from its post-mortem.

Read more  

Throwback Thursday: BGP - from route hijacking to RPKI: how vulnerable is the Internet?

Posted by   Martijn Grooten on   Dec 14, 2017

For this week's Throwback Thursday, we look back at the video of a talk Level 3's Mike Benjamin gave at VB2016 in Denver, on BGP and BGP hijacks.

Read more  

Security Planner gives security advice based on your threat model

Posted by   Martijn Grooten on   Dec 13, 2017

Citizen Lab's Security Planner helps you improve your online safety, based on the specific threats you are facing.

Read more  

VB2017 video: Spora: the saga continues a.k.a. how to ruin your research in a week

Posted by   Martijn Grooten on   Dec 11, 2017

Today, we publish the video of the VB2017 presentation by Avast researcher Jakub Kroustek and his former colleague Előd Kironský, now at ESET, who told the story of Spora, one of of the most prominent ransomware families of 2017.

Read more  

VB2017 paper: Modern reconnaissance phase on APT – protection layer

Posted by   Martijn Grooten on   Dec 7, 2017

During recent research, Cisco Talos researchers observed the ways in which APT actors are evolving and how a reconnaissance phase is included in the infection vector in order to protect valuable zero-day exploits or malware frameworks. At VB2017 in Madrid, two of those researchers, Paul Rascagneres and Warren Mercer, presented a paper detailing five case studies that demonstrate how the infection vector is evolving. Today we publish both Paul and Warren's paper and the recording of their presentation.

Read more  

VB2017 paper: Peering into spam botnets

Posted by   Martijn Grooten on   Dec 1, 2017

At VB2017 in Madrid, CERT Poland researchers Maciej Kotowicz and Jarosław Jedynak presented a paper detailing their low-level analysis of five spam botnets. Today we publish their full paper.

Read more  

Throwback Thursday: Anti-malware testing undercover

Posted by   Martijn Grooten on   Nov 30, 2017

We look back at the VB2016 presentation by Righard Zwienenberg (ESET) and Luis Corrons (Panda Security), in which they discussed various issues relating to anti-malware testing.

Read more  

Virus Bulletin relaunches VB Security Jobs Market for both employers and job seekers

Posted by   Martijn Grooten on   Nov 30, 2017

As an independent body in the IT security industry, Virus Bulletin is in an ideal position to act as a global source of information both about jobs currently available in the field and about those candidates currently seeking to start or progress their career in the industry - which is why we have relaunched the VB Security Jobs Market.

Read more  

VB2017 paper: Offensive malware analysis: dissecting OSX/FruitFly.B via a custom C&C server

Posted by   Martijn Grooten on   Nov 29, 2017

At VB2017 in Madrid, macOS malware researcher Patrick Wardle presented the details of a specific piece of Mac malware, FruitFly, which he analysed through a custom C&C server - a technique that will also be of interest for researchers of malware on other platforms. Today we publish both Patrick's paper and the recording of his presentation.

Read more  

Search blog

'Mobile Thursday' at the VB conference

Record number of presentations dedicated to threats affecting smartphones.
Record number of presentations dedicated to threats affecting smartphones. The significant increase in mobile threats is reflected in the VB2013 programme, which includes seven… https://www.virusbulletin.com/blog/2013/09/mobile-thursday-vb-conference/

VB2013 last-minute papers and keynote announced

Hot topics to be covered at VB conference in Berlin.
Hot topics to be covered at VB conference in Berlin. We thought that the 45 previously announced VB2013 papers, together with the panel discussion, already made for a really… https://www.virusbulletin.com/blog/2013/09/last-minute-papers-and-keynote-announced/

VB2013 speaker spotlight

We speak to VB2013 presenter Sergey Golovanov about business-to-government malware.
We speak to VB2013 presenter Sergey Golovanov about business-to-government malware. The VB2013 conference takes place this autumn (2-4 October) in Berlin, with an exciting… https://www.virusbulletin.com/blog/2013/09/speaker-spotlight-golovanov/

Backdoored standards show we desperately need more cryptographers

Too few currently possess the skills to verify standards.
Too few currently possess the skills to verify standards. Recent revelations of the NSA's crypto-breaking capabilities have led to calls for better cryptography. But we need more… https://www.virusbulletin.com/blog/2013/09/backdoored-standards-show-we-desperately-need-more-cryptographers/

Syrian conflict used in pump-and-dump spam

Short campaign could have had desired effect.
Short campaign could have had desired effect.Pump-and-dump spam is almost as old as spam itself: emails are sent out promoting worthless 'penny stocks', which have been purchased… https://www.virusbulletin.com/blog/2013/09/syrian-conflict-used-pump-and-dump-spam/

VB2013 speaker spotlight

We speak to VB2013 presenter Andrei Serbanoiu about Facebook ad spam and scams, and what he aims to bring to VB2013.
We speak to VB2013 presenter Andrei Serbanoiu about Facebook ad spam and scams, and what he aims to bring to VB2013.The VB2013 conference takes place this autumn (2-4 October) in… https://www.virusbulletin.com/blog/2013/09/speaker-spotlight-serbanoiu/

Box-ticking mentality leads to insecurity

Credit card company fails to understand how authentication works.
Credit card company fails to understand how authentication works. Security experts often bemoan a 'box-ticking' mentality and argue that in many cases ticking boxes doesn't address… https://www.virusbulletin.com/blog/2013/09/box-ticking-mentality-leads-insecurity/

Updated botnet likely cause of surge in Tor traffic

New Tor version should help the network deal with increased traffic.
New Tor version should help the network deal with increased traffic. Sometimes a picture says more than a thousand words: The graph shows the daily number of users of the Tor… https://www.virusbulletin.com/blog/2013/09/updated-botnet-likely-cause-surge-tor-traffic/

Malware spoofing HTTP Host header to hide C&C communication

Traffic appears as requests to Google or Yandex.
Traffic appears as requests to Google or Yandex. There have been several recent examples of malware using a spoofed HTTP Host header to hide communucation with its control servers.… https://www.virusbulletin.com/blog/2013/09/malware-spoofing-http-host-header-hide-c-amp-c-communication/

Phone support scams: an old scam with some new tricks

Files in Prefetch directory supposedly show malware infections.
Files in Prefetch directory supposedly show malware infections. Telephone support scams have been going on for quite a long time, and have received a fair amount of publicity,… https://www.virusbulletin.com/blog/2013/09/phone-support-scams-old-scam-some-new-tricks/

September issue of VB published

The September issue of Virus Bulletin is now available for subscribers to download.
The September issue of Virus Bulletin is now available for subscribers to download. The September 2013 issue of Virus Bulletin is now available for subscribers to browse online… https://www.virusbulletin.com/blog/2013/09/september-issue-vb-published/

September

Anti-virus and security related news provided by independent anti-virus advisors, Virus Bulletin
https://www.virusbulletin.com/blog/2013/09/

VB2013 speaker spotlight

We speak to Joe Blackbird and Bill Pfeifer about how anti-malware protection states affect infection rates.
We speak to Joe Blackbird and Bill Pfeifer about how anti-malware protection states affect infection rates. The VB2013 conference takes place this autumn (2-4 October) in Berlin,… https://www.virusbulletin.com/blog/2013/08/speaker-spotlight-blackbirdpfeifer/

Kelihos checks machines' IP addresses against DNS blacklists

Role of node in a botnet dependent on whether the IP address is blacklisted.
Role of node in a botnet dependent on whether the IP address is blacklisted. Whenever I look at the results of the VBSpam tests, it always amazes me how large a percentage of spam… https://www.virusbulletin.com/blog/2013/08/kelihos-checks-machines-ip-addresses-against-dns-blacklists/

New email header attempts to prevent damage of reissued email addresses

Transactional emails not delivered if the account's owner has changed in the meantime.
Transactional emails not delivered if the account's owner has changed in the meantime. When in June, Yahoo announced it would free up inactive user IDs, it received fierce… https://www.virusbulletin.com/blog/2013/08/new-email-header-attempts-prevent-damage-reissued-email-addresses/

VB2013 speaker spotlight

We speak to Gunter Ollmann about the growing need to assess corporate security defences from a hacker's perspective.
We speak to Gunter Ollmann about the growing need to assess corporate security defences from a hacker's perspective. The VB2013 conference takes place this autumn (2-4 October) in… https://www.virusbulletin.com/blog/2013/08/speaker-spotlight-ollmann/

VB2013 speaker spotlight

We speak to Roman Unuchek about malicious redirection of mobile users, his research interests, and what he aims to bring to VB2013.
We speak to Roman Unuchek about malicious redirection of mobile users, his research interests, and what he aims to bring to VB2013. The VB2013 conference takes place this autumn… https://www.virusbulletin.com/blog/2013/08/speaker-spotlight-unuchek/

DNSSEC glitch causes .gov sites to become inaccessible

Name servers unable to distinguish faulty from rogue responses.
Name servers unable to distinguish faulty from rogue responses. A glitch at VeriSign yesterday led to DNSSEC-aware name servers being unable to verify responses on the .gov… https://www.virusbulletin.com/blog/2013/08/dnssec-glitch-causes-gov-sites-become-inaccessible/

Researchers demonstrate how IPv6 can easily be used to perform MitM attacks

Many devices simply waiting for router advertisements, good or evil.
Many devices simply waiting for router advertisements, good or evil. When early last year I was doing research for an article on IPv6 and security, I was surprised to learn how… https://www.virusbulletin.com/blog/2013/08/researchers-demonstrate-how-ipv6-can-easily-be-used-perform-mitm-attacks/

ATM manufacturer pays respects to hacker who broke into its systems

Both Barnaby Jack and Triton showed how white-hat hacking should be done.
Both Barnaby Jack and Triton showed how white-hat hacking should be done. A tribute to the late Barnaby Jack by the company whose systems he hacked shows how hackers can really… https://www.virusbulletin.com/blog/2013/08/atm-manufacturer-pays-respects-hacker-who-broke-its-systems/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.