VB Blog

VB2019 paper: Fantastic Information and Where to Find it: A guidebook to open-source OT reconnaissance

Posted by   Martijn Grooten on   Nov 22, 2019

A VB2019 paper by FireEye researcher Daniel Kapellmann Zafra explained how open source intelligence (OSINT) can be used to learn crucial details of the inner workings of many a system. Today we publish Daniel's paper and the recording of his presentation.

Read more  

VB2019 paper: Different ways to cook a crab: GandCrab Ransomware-as-a-Service (RaaS) analysed in depth

Posted by   Martijn Grooten on   Nov 21, 2019

Though active for not much longer than a year, GandCrab had been one of the most successful ransomware operations. In a paper presented at VB2019 in London, McAfee researchers John Fokker and Alexandre Mundo looked at the malware code, its evolution and the affiliate scheme behind it. Today we publish both their paper and the recording of their presentation.

Read more  

VB2019 paper: Domestic Kitten: an Iranian surveillance program

Posted by   Martijn Grooten on   Nov 18, 2019

At VB2019 in London, Check Point researchers Aseel Kayal and Lotem Finkelstein presented a paper detailing an Iranian operation they named 'Domestic Kitten' that used Android apps for targeted surveillance. Today we publish their paper and the video of their presentation.

Read more  

VB2019 video: Discretion in APT: recent APT attack on crypto exchange employees

Posted by   Martijn Grooten on   Nov 18, 2019

At VB2019 in London, LINE's HeungSoo Kang explained how cryptocurrency exchanges had been attacked using Firefox zero-days. Today, we publish the video of his presentation.

Read more  

VB2019 paper: DNS on fire

Posted by   Martijn Grooten on   Nov 7, 2019

In a paper presented at VB2019, Cisco Talos researchers Warren Mercer and Paul Rascagneres looked at two recent attacks against DNS infrastructure: DNSpionage and Sea Turtle. Today we publish their paper and the recording of their presentation.

Read more  

German Dridex spam campaign is unfashionably large

Posted by   Martijn Grooten on   Nov 6, 2019

VB has analysed a malicious spam campaign targeting German-speaking users with obfuscated Excel malware that would likely download Dridex but that mostly stood out through its size.

Read more  

Paper: Dexofuzzy: Android malware similarity clustering method using opcode sequence

Posted by   Martijn Grooten on   Nov 5, 2019

We publish a paper by researchers from ESTsecurity in South Korea, who describe a fuzzy hashing algorithm for clustering Android malware datasets.

Read more  

Emotet continues to bypass many email security products

Posted by   Martijn Grooten on   Nov 4, 2019

Having returned from a summer hiatus, Emotet is back targeting inboxes and, as seen in the VBSpam test lab, doing a better job than most other malicious campaigns at bypassing email security products.

Read more  

VB2019 paper: We need to talk - opening a discussion about ethics in infosec

Posted by   Martijn Grooten on   Nov 1, 2019

Those working in the field of infosec are often faced with ethical dilemmas that are impossible to avoid. Today, we publish a VB2019 paper by Kaspersky researcher Ivan Kwiatkowski looking at ethics in infosec as well as the recording of Ivan's presentation.

Read more  

Stalkerware poses particular challenges to anti-virus products

Posted by   Martijn Grooten on   Oct 31, 2019

Malware used in domestic abuse situations is a growing threat, and the standard way for anti-virus products to handle such malware may not be good enough. But that doesn't mean there isn't an important role for anti-virus to play.

Read more  

Search blog

Meta-phishing

Phishing warning contains link to... phishing site.
Phishing warning contains link to... phishing site. The anti-malware industry can congratulate itself for there being an increasing awareness among users about phishing. Users are… https://www.virusbulletin.com/blog/2008/02/meta-phishing/

M&S joins high-street AV retail crowd

Upmarket store to match rivals in security software selling.
Upmarket store to match rivals in security software selling. Leading UK retailer Marks & Spencer (M&S) has joined fellow high-street chain Woolworths and supermarket leviathan… https://www.virusbulletin.com/blog/2008/02/m-amp-s-joins-high-street-av-retail-crowd/

Bumper Patch Tuesday short of one patch

Excel remains vulnerable as expected fix is dropped.
Excel remains vulnerable as expected fix is dropped.Microsoft has issued its monthly 'Patch Tuesday' set of security updates, with a larger than usual crop of patches for a variety… https://www.virusbulletin.com/blog/2008/02/bumper-patch-tuesday-short-one-patch/

Trend vs. ClamAV patent row hots up

Free software advocates call for boycott of Trend.
Free software advocates call for boycott of Trend. With legal proceedings ongoing between Trend Micro and gateway appliance specialist Barracuda Networks, concerning Barracuda's… https://www.virusbulletin.com/blog/2008/02/trend-vs-clamav-patent-row-hots/

Over 1 per cent of search results include malicious sites

Google research paper confirms significant increase in number of malware-serving websites.
Google research paper confirms significant increase in number of malware-serving websites. Recent reports of increasing numbers of websites serving malicious content have been… https://www.virusbulletin.com/blog/2008/02/over-1-cent-search-results-include-malicious-sites/

Storm Valentines run under way

Seasonal spam and malware barrage gets going.
Seasonal spam and malware barrage gets going. The expected run of 'Storm' spams, pushing links to their latest line of malware disguised as Valentine's messages, has begun, with… https://www.virusbulletin.com/blog/2008/02/storm-valentines-run-under-way/

More PDF exploits seen in wild

Adobe Reader and Acrobat flaws open way for further document attacks.
Adobe Reader and Acrobat flaws open way for further document attacks. A string of vulnerabilities in Adobe's PDF viewing and editing software, disclosed late last week by Adobe and… https://www.virusbulletin.com/blog/2008/02/more-pdf-exploits-seen-wild/

Live Mail CAPTCHA system bypassed

Spammers use botnet to register accounts on popular free webmail service.
Spammers use botnet to register accounts on popular free webmail service.Spammers have written a program that cracks the CAPTCHAS used by the Windows Live Mail registration system.… https://www.virusbulletin.com/blog/2008/02/live-mail-captcha-system-bypassed/

Complex attack targets Better Business Bureau

Sophisticated scam uses personalised mails, real site redirects.
Sophisticated scam uses personalised mails, real site redirects. A highly sophisticated email phishing scam is using a redirection flaw in the website of the Better Business Bureau… https://www.virusbulletin.com/blog/2008/02/complex-attack-targets-better-business-bureau/

Yahoo! jukebox flaw exploits in wild

Zero day vulnerability in music system rapidly targeted.
Zero day vulnerability in music system rapidly targeted.Vulnerabilities in Yahoo! Jukebox, a free music-management system provided by Yahoo!, have been exploited by in-the-wild… https://www.virusbulletin.com/blog/2008/02/yahoo-jukebox-flaw-exploits-wild/

FTC fines spammers over $2.5 million

Drug pushers busted for phony claims and CAN-SPAM breaches.
Drug pushers busted for phony claims and CAN-SPAM breaches. After a successful case brought by the US Federal Trade Commission (FTC), a pharmaceuticals firm and its head have been… https://www.virusbulletin.com/blog/2008/02/ftc-fines-spammers-over-2-5-million/

419 scammers plead guilty in US

African trio admit attempts to defraud via spam.
African trio admit attempts to defraud via spam. Three men, two from Nigeria and a third from Senegal, entered guilty pleas in a Brooklyn, New York, courtroom last week after being… https://www.virusbulletin.com/blog/2008/02/419-scammers-plead-guilty-us/

Fake security blogs lead to malware

Blogger sites play on fears to draw victims to porn, trojans.
Blogger sites play on fears to draw victims to porn, trojans. According to a report from Aladdin, numerous fake security blogs have been set up on the Google-owned Blogger blogging… https://www.virusbulletin.com/blog/2008/02/fake-security-blogs-lead-malware/

New security software testing standards body formed

AMTSO to promote cross-industry debate and higher standards in testing.
AMTSO to promote cross-industry debate and higher standards in testing. A collaborative group from across the security industry has officially been founded this week, aiming to… https://www.virusbulletin.com/blog/2008/02/new-security-software-testing-standards-body-formed/

February issue of VB published

The February issue of Virus Bulletin is now available for subscribers to download.
The February issue of Virus Bulletin is now available for subscribers to download. The February 2008 issue of Virus Bulletin is now available for subscribers to browse online or… https://www.virusbulletin.com/blog/2008/02/february-issue-vb-published/

February

Anti-virus and security related news provided by independent anti-virus advisors, Virus Bulletin
https://www.virusbulletin.com/blog/2008/02/

Barracuda battles Trend Micro patent claims

Trend demands licensing for gateway virus scanning idea.
Trend demands licensing for gateway virus scanning idea.Barracuda Networks has announced it is fighting a legal battle against Trend Micro, who has claimed US patent rights to the… https://www.virusbulletin.com/blog/2008/01/barracuda-battles-trend-micro-patent-claims/

First virus-writing arrests in Japan

Winny worm authors brought to book - for copyright violation.
Winny worm authors brought to book - for copyright violation. Japan has seen its first ever arrests of virus writers, with three men taken into custody in Kyoto last week and… https://www.virusbulletin.com/blog/2008/01/first-virus-writing-arrests-japan/

Ledger poisons Google

Actor's death exploited by malware writers to infect computers.
Actor's death exploited by malware writers to infect computers. The death of actor Heath Ledger on Tuesday had barely been confirmed a few hours when malicious websites started… https://www.virusbulletin.com/blog/2008/01/ledger-poisons-google/

Polyglot worm spreads through MSN

Worm changes language to target wide audience.
Worm changes language to target wide audience. A new worm has been discovered that spreads through MSN Messenger. Once active, the worm opens random TCP ports to connect to an IRC… https://www.virusbulletin.com/blog/2008/01/polyglot-worm-spreads-through-msn/

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.