Papers published in May 2015


Editor: Martijn Grooten

 VBSpam comparative review May 2015

Martijn Grooten warns against reading too much into a drop in the average spam catch rate of products in this month's VBSpam review - which may be caused by the natural volatility of spam.

Martijn Grooten - Virus Bulletin, UK

On the beat

Over the years, investigations undertaken by the UK's Police Central eCrime Unit (PCeU) have led to the arrest of several individuals involved in computer crime and, as part of international operations involving security firms and foreign law enforcement agencies, the takedown of a number of botnets. Kevin Williams looks back at a number of successes of the PCeU, which he helped set up in 2008.

Kevin Williams - TC-UK Internet Security, UK

Throwback Thursday: Research and Other Hobbies (April 1996)

Professor Klaus Brunnstein was one of the biggest names in anti-virus research, a pioneer in the field whose career was never short of either controversy or success. In April 1996, VB spoke to the man himself about his background, his career, his views on the industry and his home life.

Prof. Klaus Brunnstein -

Throwback Thursday: Dichotomy: Double Trouble (December 1994)

The first 'multicellular' virus, Dichotomy, had ‘odd’ and ‘even’ components. When a file infected with the ‘odd’ component was executed, the virus looked for a file infected with ‘even’ code, installing itself into memory only if that part was found. Eugene Kaspersky - who believed this was only an experimental virus, which could never become prevalent in the wild - provided a full analysis.

Eugene Kaspersky - KAMI Associates

Throwback Thursday: RMNS - The Perfect Couple (May 1995)

RMNS was the second known ‘multicellular’ virus. Its code was divided into two parts (‘male’ and ‘female’). The two parts of RMNS installed themselves into memory independently of each other, but infection could only take place if both sections of the code were resident in memory at the same time and on the same computer. Eugene Kaspersky brought us the details of this ‘electronic creature’, which at the time, he believed would begin the era of viruses of a specific sex.

Eugene Kaspersky - KAMI Associates

Throwback Thursday: Denial of (Anti-Virus) Service (June 2000)

On 4 May 2000, VBS/LoveLetter.A, also known as LovLet, ILOVEYOU and Love Bug, wreaked havoc across the globe and pushed the anti-virus industry to new limits. Joe Wells reflects on the day the industry failed to protect many of those who depended on it.

Joe Wells - WarLab, USA

 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.