Papers published in October 2014


Editor: Martijn Grooten

The Hulk

Raul Alvarez takes a close look at cavity file infector W32/Huhk, which - thanks to its infection criteria - only infects a handful of executable files, thus unintentionally creating a stealth technique.

Raul Alvarez - Fortinet, Canada

VB2014 paper: The evolution of webinjects

In his VB2014 conference paper, Jean-Ian Boutin looks at the current webinject scene and how it has evolved over time, going from simple phishing-like functionalities to automatic transfer system (ATS) and two-factor authentication bypass, along with mobile components and fully fledged web control panels to manage money exfiltration through fraudulent money transfers.

Jean-Ian Boutin - ESET, Canada

VB2014 paper: DNSSEC: how far have we come?

In his VB2014 conference paper, Nick Sullivan explains what DNSSEC does and doesn't do to make DNS responses more trustworthy.

Nick Sullivan - CloudFlare, USA

VB2014 paper: Exposing Android white collar criminals

One of the main ways for cybercriminals to make money easily with the use of malware is through SMS premium services – using trojans to turn mobile devices into slot machines and causing victims' monthly phone bills to skyrocket. In his VB2014 paper, Luis Corrons looks at two different attack vectors used by two different Spanish criminal gangs. He shows what social engineering techniques are used to gain permission to activate the premium SMS services.

Luis Corrons - Panda Security, Spain

VB2014 paper: Methods of malware persistence on Mac OS X

As Mac OS X continues to increase in popularity, OS X malware is becoming more common than ever. In his VB2014 paper, Patrick Wardle presents a detailed analysis of Apple’s anti-malware mechanisms (revealing several significant weaknesses), before diving into the bowels of the Mac startup process and detailing points of persistence. He also examines examples of OS X malware to illustrate how code may abuse the OS in order to achieve reboot persistence. Finally, he discusses a novel open-source tool that can enumerate and display persistent OS X binaries that are set to execute automatically upon reboot.

Patrick Wardle - Synack, USA

VB2014 paper: Hiding the network behind the network. Botnet proxy business model

Since hiding a C&C means that a botnet will remain running for longer, specialized hosting services that are able to hide a server behind many proxies have appeared. In their VB2014 paper, Alexandru Maximciuc, Cristina Vatamanu and Razvan Benchea describe a proxy network with two types of redirection: one on the HTTP standard port (protecting the C&C servers) and the other on the UDP standard port (protecting a dedicated server that handles the DNS resolution for domains generated by Domain Generation Algorithms or chosen at will).

Alexandru Maximciuc - Bitdefender, Romania, Razvan Benchea - Bitdefender, Romania & Cristina Vatamanu - Bitdefender, Romania

Invading the core: iWorm's infection vector and persistence mechanism

iWorm is a recently discovered OS X backdoor that affords an attacker complete control of an infected host. In this paper, Patrick Wardle builds upon the latest analyses, and provides a comprehensive technical analysis of iWorm's infection vector and persistence mechanism.

Patrick Wardle - Synack, USA

VB100 comparative review on Windows Server 2008 R2 SP1

The VB test team put 29 products through their paces on Windows Server 2008 and, for the first time ever on a Windows platform, all products achieved VB100-certified status - John Hawes has the details.

John Hawes - Virus Bulletin

 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.