Custom Search

The rise in the exploitation of old PDF vulnerabilities

Exploitation of software vulnerabilities continues to be a  common way to infect computers with malware. Leveraging exploits allows malware authors to infect, disrupt, or take control of a computer without the user’s consent and typically without their knowledge. Exploits target vulnerabilities in operating systems, web browsers, applications, or software components that are installed on the …

NBC.com infected with malware for more than 24 hours?

Updated: February, 22. 3:00AM GMT.

Another high profile website has been hacked to redirect visitors to malicious URLs, websites that seek to infect visitors for further scamming and cyber fraud. Last week it was Facebook, this time it is the website of the National Broadcasting Company (NBC). The major American television network’s site at NBC.com …

The Citadel crimeware kit – under the microscope

Ever since the source code of the Zeus crimeware kit, also known as Zbot, was leaked onto the internet in May 2011, many new variants have appeared. These have typically added new features and improved on the old code.

One particularly prevalent example is Citadel.

At its core, Citadel works like the original Zbot. It comes as …

KSN: An Analysis of Web Browsers

Today, cybercriminals are quick to exploit vulnerabilities in Adobe Reader, Flash and Java to infect users’ computers. There is a simple reason for this popularity: exploits of vulnerabilities found in these products can infect computers regardless of which operating systems and browsers are used on the attacked machines. We assumed that the threats posed to …

MSRT thwarts rogues with just one scan

Most rogue antivirus software displays an interface that is predominantly in English, with some presenting a few other European languages as well. However, this month one of the families added by MSRT is Win32/Onescan, a Korean fake antivirus scanner that is the most prevalent of the Asian language-based rogues.

 

Recently we noticed that …

AVG Threat Watch: Week 31

UBISOFT Patch Uplay vulnerability

Games developer Ubisoft announced a security patch this week for their Uplay software after admitting that a technical vulnerability has been discovered with the browser plug-in feature.

The vulnerability could allow a third party to exploit Uplay service to run arbitrary and potentially malicious applications.

Uplay comes bundled with a number of Ubisoft titles, …

Cybercriminals Kick Off UEFA Euro 2012

The ongoing 2012 UEFA European Championship is the latest sporting event used by cybercriminals to lure users into their malicious schemes. So far, we have uncovered a malicious site with a domain name that copies the official UEFA Euro 2012 site and web pages leading to survey scam pages and ad tracking sites.

Malicious Domain Hosts …

How to stop Twitter tracking you and keep private the websites you visit

Like Facebook, Twitter wants to know which websites you visit and so it has a system for tracking you as you click from site to site, a fact that leads to a pair of interesting questions: "Did you know that?" and "Are you okay with that?" As we will see in a moment, this system …

Details of a “new” Fake AV page

As I mentioned last week, more Fake AV pages are once again showing up in popular Google searches. Although these malicious pages look the same as they did 2 years ago, the source code is different.

The first thing you notice in the source code is that there is no obfuscation at all. The …

Mac OS X Threat Flashback is Back!

OSX/Imuler is not the only Mac OS X threat that has resurfaced this year. OSX/Flashback has been making its rounds again.

As you can remember, OSX/Flashback has appeared last year and disguised as Adobe Flash Player Installer. The previous variants connects to remote host to download its component files and installing backdoor that injects to …

Are you having a (Mac) Flashback?

On Monday, I provided steps on how to avoid your Mac being compromised by the Flashback trojan. Today I will provide information on how to locate a Flashback infection.

To better understand the steps below, it is better to also know a bit about Flashback. It’s an OS X malware family that modifies the content …

Are You Ready For Some Football?

Contributor: Masaki Suenaga

We certainly are! It is American football season and the Super Bowl is right around the corner. Apparently, so are the malware authors. It would not be the first time they took advantage of this sporting event. Back in 2007, the Dolphins (hosts for Super Bowl XLI) had their website compromised by …

Apple release security fix

What has been fixed?

Apple has published Java updates for Mac OS X 10.6 Snow Leopard and 10.7 Lion which bring the Mac version of Java in line with the current Oracle release. The updates improve compatibility and close several security holes found in previous versions.

According to Apple, some of the vulnerabilities could allow …

Deobfuscating malicious code layer by layer

Article written by David Sanchez Lavado

This post explains how to analyze the malicious code used in current Exploit Kits.

There are many ways to analyze this type of code, and you can find tools that do most of the job automatically. However, as researchers who like to understand how things work, …