VB Blog

VB2017 paper: Nine circles of Cerber

Posted by   Martijn Grooten on   Dec 15, 2017

Cerber is one of the major names in the world of ransomware, and last year, Check Point released a decryption service for the malware. Today, we publish a VB2017 paper by Check Point's Stanislav Skuratovich describing how the Cerber decryption tool worked; we have also uploaded the video of the presentation of this paper, by Or Eshed and Yaniv Balmas.

Read more  

Attack on Fox-IT shows how a DNS hijack can break multiple layers of security

Posted by   Martijn Grooten on   Dec 14, 2017

Dutch security firm Fox-IT deserves praise for being open about an attack on its client network. There are some important lessons to be learned about DNS security from its post-mortem.

Read more  

Throwback Thursday: BGP - from route hijacking to RPKI: how vulnerable is the Internet?

Posted by   Martijn Grooten on   Dec 14, 2017

For this week's Throwback Thursday, we look back at the video of a talk Level 3's Mike Benjamin gave at VB2016 in Denver, on BGP and BGP hijacks.

Read more  

Security Planner gives security advice based on your threat model

Posted by   Martijn Grooten on   Dec 13, 2017

Citizen Lab's Security Planner helps you improve your online safety, based on the specific threats you are facing.

Read more  

VB2017 video: Spora: the saga continues a.k.a. how to ruin your research in a week

Posted by   Martijn Grooten on   Dec 11, 2017

Today, we publish the video of the VB2017 presentation by Avast researcher Jakub Kroustek and his former colleague Előd Kironský, now at ESET, who told the story of Spora, one of of the most prominent ransomware families of 2017.

Read more  

VB2017 paper: Modern reconnaissance phase on APT – protection layer

Posted by   Martijn Grooten on   Dec 7, 2017

During recent research, Cisco Talos researchers observed the ways in which APT actors are evolving and how a reconnaissance phase is included in the infection vector in order to protect valuable zero-day exploits or malware frameworks. At VB2017 in Madrid, two of those researchers, Paul Rascagneres and Warren Mercer, presented a paper detailing five case studies that demonstrate how the infection vector is evolving. Today we publish both Paul and Warren's paper and the recording of their presentation.

Read more  

VB2017 paper: Peering into spam botnets

Posted by   Martijn Grooten on   Dec 1, 2017

At VB2017 in Madrid, CERT Poland researchers Maciej Kotowicz and Jarosław Jedynak presented a paper detailing their low-level analysis of five spam botnets. Today we publish their full paper.

Read more  

Throwback Thursday: Anti-malware testing undercover

Posted by   Martijn Grooten on   Nov 30, 2017

We look back at the VB2016 presentation by Righard Zwienenberg (ESET) and Luis Corrons (Panda Security), in which they discussed various issues relating to anti-malware testing.

Read more  

Virus Bulletin relaunches VB Security Jobs Market for both employers and job seekers

Posted by   Martijn Grooten on   Nov 30, 2017

As an independent body in the IT security industry, Virus Bulletin is in an ideal position to act as a global source of information both about jobs currently available in the field and about those candidates currently seeking to start or progress their career in the industry - which is why we have relaunched the VB Security Jobs Market.

Read more  

VB2017 paper: Offensive malware analysis: dissecting OSX/FruitFly.B via a custom C&C server

Posted by   Martijn Grooten on   Nov 29, 2017

At VB2017 in Madrid, macOS malware researcher Patrick Wardle presented the details of a specific piece of Mac malware, FruitFly, which he analysed through a custom C&C server - a technique that will also be of interest for researchers of malware on other platforms. Today we publish both Patrick's paper and the recording of his presentation.

Read more  

Search blog

AV Test releases Android test data

30 mobile solutions tested for malware protection and speed hit.
30 mobile solutions tested for malware protection and speed hit. Independent test organization AV-Test has released its latest report, covering the Andriod platform. This major… https://www.virusbulletin.com/blog/2013/06/av-test-releases-android-test-data/

Latest VBSpam tests show web host spam harder to block

Most filters see a small increase in their catch rates overall.
Most filters see a small increase in their catch rates overall. The results of VB's latest spam filter test show that the spam sent from web hosts is significantly harder to block… https://www.virusbulletin.com/blog/2013/06/latest-vbspam-tests-show-web-host-spam-harder-block/

AMTSO unveils product setup check tools

Set of checks can show if your security is properly configured and operational.
Set of checks can show if your security is properly configured and operational. Today AMTSO officially released its 'Feature settings check' solutions, a set of simple tools to… https://www.virusbulletin.com/blog/2013/06/amtso-unveils-product-setup-check-tools/

June

Anti-virus and security related news provided by independent anti-virus advisors, Virus Bulletin
https://www.virusbulletin.com/blog/2013/06/

June issue of VB published

The June issue of Virus Bulletin is now available for subscribers to download.
The June issue of Virus Bulletin is now available for subscribers to download. The June 2013 issue of Virus Bulletin is now available for subscribers to browse online or download… https://www.virusbulletin.com/blog/2013/06/june-issue-vb-published/

US lifts ban on anti-virus software for Iran

Eased restrictions welcomed by security experts.
Eased restrictions welcomed by security experts. The United States has announced it has eased export restrictions to Iran, and now allows for the export of mobile phones and… https://www.virusbulletin.com/blog/2013/05/us-lifts-ban-anti-virus-software-iran/

Latest AV-Test results released

New round of figures compare products to Microsoft baselines.
New round of figures compare products to Microsoft baselines. Independent test organization AV-Test has released its latest bimonthly report, covering 26 consumer products and nine… https://www.virusbulletin.com/blog/2013/05/latest-av-test-results-released/

Ruby on Rails vulnerability exploited in the wild

Code executed on web servers to cause them to join IRC botnet.
Code executed on web servers to cause them to join IRC botnet. A critical vulnerability in Ruby on Rails is currently being exploited to make web servers join an IRC botnet, Ars… https://www.virusbulletin.com/blog/2013/05/ruby-rails-vulnerability-exploited-wild/

Symantec quietly retires PC Tools security product lines

Sales of Spyware Doctor and other security products end, support to continue for existing users.
Sales of Spyware Doctor and other security products end, support to continue for existing users.Symantec has quietly announced the end of life the of PC Tools security product… https://www.virusbulletin.com/blog/2013/05/symantec-quietly-retires-pc-tools-security-product-lines/

Dutch citizens keep extra cash at hand following DDoS attacks

Month-long attacks had significant impact.
Month-long attacks had significant impact. 25% of Dutch citizens have followed advice to keep extra cash at home, following a recent spate of DDoS attacks on Dutch banks. At the… https://www.virusbulletin.com/blog/2013/05/dutch-citizens-keep-extra-cash-hand-following-ddos-attacks/

India believed to be source of sophisticated surveillance campaigns

In-depth investigations find widespread worldwide snooping, Pakistan primary target.
In-depth investigations find widespread worldwide snooping, Pakistan primary target. Several reports have emerged recently covering a highly organised campaign of targeted… https://www.virusbulletin.com/blog/2013/05/india-believed-be-source-sophisticated-surveillance-campaigns/

German anti-botnet advisory recommends the use of ad blockers for security

'If websites want to include ads, they must make sure they are secure.'
'If websites want to include ads, they must make sure they are secure.' In an open letter to several prominent German websites, Botfrei, the German anti-botnet advisory centre, has… https://www.virusbulletin.com/blog/2013/05/german-anti-botnet-advisory-recommends-use-ad-blockers-security/

Commoditization increasingly seen in mobile malware

Number of malicious samples and families increase, as Android remains most popular mobile platform.
Number of malicious samples and families increase, as Android remains most popular mobile platform. As the number of mobile malware samples in existence continues to grow faster… https://www.virusbulletin.com/blog/2013/05/commoditization-increasingly-seen-mobile-malware/

Program turns anti-analysis tools against the malware

Users cautioned to be wary of a false sense of security.
Users cautioned to be wary of a false sense of security. Could you defeat VM-aware malware by making your system aware of VM-aware malware? Tricks to frustrate researchers and… https://www.virusbulletin.com/blog/2013/05/program-turns-anti-analysis-tools-against-malware/

Microsoft 'found to make requests' to URLs shared via Skype

HEAD requests likely used to determine landing page.
HEAD requests likely used to determine landing page. Is Microsoft checking all the links you share via Skype? German online magazine Heise thinks so. A reader of security magazine… https://www.virusbulletin.com/blog/2013/05/microsoft-found-make-requests-urls-shared-skype/

Twitter, Facebook accounts used in watering hole campaign

USAID sympathizers targeted with links from 'like-minded people'.
USAID sympathizers targeted with links from 'like-minded people'. Two social networking accounts have been discovered that were used in a recent targeted attack. Opinions on… https://www.virusbulletin.com/blog/2013/05/twitter-facebook-accounts-used-watering-hole-campaign/

Microsoft offers fix-it for IE 8 zero-day

CVE-2013-1347 used in watering hole attacks.
CVE-2013-1347 used in watering hole attacks. Following this weekend's discovery of a new zero-day vulnerability in version 8 of Microsoft's Internet Explorer browser, the company… https://www.virusbulletin.com/blog/2013/05/microsoft-offers-fix-it-ie-8-zero-day/

Vulnerabilities could trigger payload in emails upon receiving or opening

Flaws in IBM Notes and Exim/Dovecot easy to mitigate.
Flaws in IBM Notes and Exim/Dovecot easy to mitigate. Two recently discovered vulnerabilities in mail processing software could give an attacker access to a targeted system without… https://www.virusbulletin.com/blog/2013/05/vulnerabilities-could-trigger-payload-emails-upon-receiving-or-opening/

Opposition activists in Asia and Africa targeted by spyware developed by Western companies

Mozilla angry about use of its brand and logo.
Mozilla angry about use of its brand and logo. A new report has been released on the commercialization of digital spying, which thoroughly analyses a number of pieces of spyware… https://www.virusbulletin.com/blog/2013/05/opposition-activists-asia-and-africa-targeted-spyware-developed-western-companies/

WordPress pingback used for DDoS attacks

Millions of sites could potentially be used in attack.
Millions of sites could potentially be used in attack. Security firm Incapsula reports that it has discovered a DDoS attack on a gaming website using thousands of legitimate… https://www.virusbulletin.com/blog/2013/05/wordpress-pingback-used-ddos-attacks/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.