Blog keyword search

VB2018 paper: Lazarus Group: a mahjong game played with different sets of tiles

The Lazarus Group, generally linked to the North Korean government, is one of the most notorious threat groups seen in recent years. At VB2018 ESET researchers Peter Kálnai and Michal Poslušný presented a paper looking at the group's various campaigns. To…
Lazarus Group: a mahjong game played with different sets of tiles Read the paper (HTML) Download the paper (PDF)       At VB2019 in London, Peter and Michal will… https://virusbulletin.com/blog/2019/06/vb2018-paper-lazarus-group-mahjong-game-played-different-sets-tiles/

VB2018 paper: Under the hood - the automotive challenge

Car hacking has become a hot subject in recent years, and at VB2018 in Montreal, Argus Cyber Security's Inbar Raz presented a paper that provides an introduction to the subject, looking at the complex problem, examples of car hacks, and the challenges ahe…
Under the hood - the automotive challenge Read the paper (HTML) Download the paper (PDF)     During last week's Pwn2Own 2019 hacking contest, a Senegalese-Chinese duo… https://virusbulletin.com/blog/2019/03/vb2018-paper-under-hood-automotive-challenge/

VB2018 paper: Fake News, Inc.

A former reporter by profession, Andrew Brandt's curiosity was piqued when he came across what appeared at first glance to be the website of a small-town newspaper based in Illinois, but under scrutiny, things didn’t add up. At VB2018 he presented a paper…
    Andrew Brandt will also speak at VB2019 in London. This time, in a Small Talk session, he will share his experience of analysing "retromalware" – some of the oldest… https://virusbulletin.com/blog/2019/04/vb2018-paper-fake-news-inc/

VB2018 paper and video: Android app deobfuscation using static-dynamic cooperation

Static analysis and dynamic analysis each have their shortcomings as methods for analysing potentially malicious files. Today, we publish a VB2018 paper by Check Point researchers Yoni Moses and Yaniv Mordekhay, in which they describe a method that combin…
Android app deobfuscation using static-dynamic cooperation Read the paper (HTML) Download the paper (PDF)   The two most common methods for analysing potentially malicious… https://virusbulletin.com/blog/2019/03/vb2018-paper-and-video-android-app-deobfuscation-using-static-dynamic-cooperation/

VB2018 video: Adware is just malware with a legal department - how we reverse engineered OSX/Pirrit, received legal threats, and survived

Amit Serper first analysed the OSX/Pirrit adware in 2016, highlighting some of its malware-like techniques, and soon afterwards started receiving legal threats from the company behind it. At VB2018 Amit gave a presentation in which he discussed both the a…
OSX/Pirrit was first analysed in 2016 by Cybereason's Amit Serper in a guest blog post for the Objective See blog. It is an interesting and technically thorough analysis of a… https://virusbulletin.com/blog/2019/03/vb2018-video-adware-just-malware-legal-department-how-we-reverse-engineered-osxpirrit-received-legal-threats-and-survived/

VB2018 paper: Anatomy of an attack: detecting and defeating CRASHOVERRIDE

In December 2016, the CRASHOVERRIDE malware framework was used to cause a blackout in Ukraine. At VB2018 in Montreal, Dragos researcher Joe Slowik presented a detailed paper on the framework, explaining how the malware works and how it targets various pro…
Anatomy of an attack: detecting and defeating CRASHOVERRIDE Read the paper (HTML) Download the paper (PDF)       If you're going to be at the RSA Conference in San… https://virusbulletin.com/blog/2019/03/vb2018-paper-anatomy-attack-detecting-and-defeating-crashoverride/

VB2018 presentation: Levelling up: why sharing threat intelligence makes you more competitive

In a presentation at VB2018, Michael Daniel, President and CEO of the Cyber Threat Alliance, outlined exactly how threat sharing strengthens a company's competitive advantage. Today we release the recording of his presentation.
Here at VB we often talk about the importance of sharing intelligence, and many of us coming into the industry for the first time have been genuinely surprised by the willingness… https://virusbulletin.com/blog/2019/03/vb2018-presentation-levelling-why-sharing-threat-intelligence-makes-you-more-competitive/

VB2018 paper: The modality of mortality in domain names

Domains play a crucial role in most cyber attacks, from the very advanced to the very mundane. Today, we publish a VB2018 paper by Paul Vixie (Farsight Security) who undertook the first systematic study into the lifetimes of newly registered domains.
The modality of mortality in domain names Read the paper (HTML) Download the paper (PDF)       Have you carried out research that furthers our understanding of… https://virusbulletin.com/blog/2019/02/vb2018-paper-modality-mortality-domain-names/

VB2018 paper: Analysing compiled binaries using logic

Constraint programming is a lesser-known technique that is becoming increasingly popular among malware analysts. In a paper presented at VB2018 Thaís Moreira Hamasaki presented an overview of the technique and explained how it can be applied to the analys…
Analysing compiled binaries using logic Read the paper (HTML) Download the paper (PDF)   Static analysis of malware is usually "done by a person (a security analyst) who… https://virusbulletin.com/blog/2019/02/vb2018-paper-analysing-compiled-binaries-using-logic/

VB2018 paper: Internet balkanization: why are we raising borders online?

At VB2018 in Montreal, Ixia researcher Stefan Tanase presented a thought-provoking paper on the current state of the Internet and the worrying tendency towards raising borders and restricting the flow of information. Today we publish both his paper and th…
Sir Tim Berners-Lee, inventor of the world wide web, said "I hope we use the Net to cross barriers and connect cultures". Yet increasingly we are seeing barriers being raised not… https://virusbulletin.com/blog/2019/02/vb2018-paper-internet-balkanization-why-are-we-raising-borders-online/

VB2018 paper: Where have all the good hires gone?

The cybersecurity skills gap has been described as one of the biggest challenges facing IT leaders today. At VB2018 in Montreal, ESET's Lysa Myers outlined some of the things the industry can do to help address the problem. Today we publish Lysa's paper a…
    Did you see we have opened the Call for Papers for VB2019 in London? Submit your abstract before 17 March for a chance to make it onto the programme of one of the… https://virusbulletin.com/blog/2019/02/vb2018-paper-where-have-all-good-hires-gone/

VB2018 paper: Little Brother is watching – we know all your secrets!

At VB2018 in Montreal, researchers from Fraunhofer SIT looked at privacy vulnerabilities in legitimate Android family-tracking apps that leaked location data. Today, we publish both their paper and the video of their presentation.
The use of mobile spyware to spy on (ex-)partners is an underreported problem, despite the prevalence of such apps and their use in cases of domestic violence. At VB2017 in… https://virusbulletin.com/blog/2019/02/vb2018-paper-little-brother-watching-we-know-all-your-secrets/

VB2018 paper: Inside Formbook infostealer

The Formbook information-stealing trojan may not be APT-grade malware, but its continuing spread means it can still be effective. At VB2018 in Montreal, Gabriela Nicolao, a researcher from Deloitte in Argentina, presented a short paper in which she looked…
The Formbook information-stealing trojan has been spread by a number of recent spam campaigns. The malware was advertised in hacking forums as long ago as January 2016, but wasn't… https://virusbulletin.com/blog/2019/01/vb2018-paper-inside-formbook-infostealer/

VB2018 paper: From Hacking Team to hacked team to…?

Today we publish the VB2018 paper and video by ESET researcher Filip Kafka, who looked at the new malware by Hacking Team, after the company had recovered from the 2015 breach.
It is good practice not to mock or laugh at hacking victims. But when the victim is a company that itself is in the business of hacking and has a habit of selling its products and… https://virusbulletin.com/blog/2019/01/vb2018-paper-hacking-team-hacked-team/

VB2018 paper: Unpacking the packed unpacker: reversing an Android anti-analysis library

Today, we publish a VB2018 paper by Google researcher Maddie Stone in which she looks at one of the most interesting anti-analysis native libraries in the Android ecosystem. We also release the recording of Maddie's presentation.
Though still relatively new (the first VB conference paper on Android malware was presented in 2011), malware targeting the Android mobile operating system has evolved quickly, in… https://virusbulletin.com/blog/2019/01/vb2018-paper-unpacking-packed-unpacker-reversing-android-anti-analysis-library/

VB2018 paper: Draw me like one of your French APTs – expanding our descriptive palette for cyber threat actors

Today, we publish the VB2018 paper by Chronicle researcher Juan Andres Guerrero-Saade, who argues we should change the way we talk about APT actors.
IT security research stumbled into the world of nation-state intelligence operations more or less by accident. In a now classic VB2015 paper, Juan Andres Guerrero-Saade discussed… https://virusbulletin.com/blog/2019/01/vb2018-paper-draw-me-one-your-french-apts-expanding-our-descriptive-palette-cyber-threat-actors/

VB2018 paper: Office bugs on the rise

At VB2018 Sophos researcher Gábor Szappanos provided a detailed overview of Office exploit builders, and looked in particular at the widely exploited CVE-2017-0199. Today we publish his paper and release the video of his presentation.
A large portion of today's malware infections use malicious Office documents as a first-stage payload. Typically, the user is tricked into enabling macros or disabling some… https://virusbulletin.com/blog/2018/12/vb2018-paper-office-bugs-rise/

VB2018 video: The Big Bang Theory by APT-C-23

Today, we release the video of the VB2018 presentation by Check Point researcher Aseel Kayal, who connected the various dots relating to campaigns by the APT-C-23 threat group.
The APT-C-23 group, which targets users in the Middle East and in particular in the State of Palestine, was named and first reported on by 360 in a Chinese language blog post in… https://virusbulletin.com/blog/2018/12/vb2018-video-big-bang-theory-apt-c-23/

VB2018 paper: Tracking Mirai variants

Today, we publish the VB2018 paper by Qihoo 360 researchers Ya Liu and Hui Wang, on extracting data from variants of the Mirai botnet to classify and track variants.
The leaking or publishing of malware source code often leads to multiple spin-off families based on the code. Never has this been more clear than in the case of the Mirai Internet… https://virusbulletin.com/blog/2018/12/vb2018-paper-tracking-mirai-variants/

VB2018 paper: Hide'n'Seek: an adaptive peer-to-peer IoT botnet

2018 has seen an increase in the variety of botnets living on the Internet of Things - such as Hide'N'Seek, which is notable for its use of peer-to-peer for command-and-control communication. Today, we publish the VB2018 paper by Bitdefender researchers A…
Until recently IoT botnets mostly consisted of Mirai and its many descendants. However, during 2018 we have seen an increase in the variety of botnets living on the Internet of… https://virusbulletin.com/blog/2018/12/vb2018-paper-hidenseek-adaptive-peer-peer-iot-botnet/

« Previous 1234 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.