Storm Blogs

Monday, April 7th, 2008

Storm has once again turned its eye to the blogging community, specifically the Blogspot.com community. Several blogger sites with random or very quirky names have been sporting a love theme, Storm style. These sites appear to have been created solely for Storm's purposes and no legitimate blogger site has of yet ...

Top 15 Malicious Spyware Actions

Sunday, April 6th, 2008

Spyware authors have ramped up their malicious code to invade users' privacy at unprecedented levels. The following list describes some of the most malicious activities of today's spyware, illustrating the need for solid antispyware defenses. Changing network settings: To prevent signature updates for antivirus and antispyware tools, some spyware alters the ...

Heads-up: Dangerous new customized IRS scam steals data

Saturday, April 5th, 2008

This afternoon, we got a highly customized email purporting to come from the IRS, which of course, does nothing more than load malware. The email is made out to a key financial contact here at Sunbelt (name obfuscated for this post). As you can see, it’s quite convincing. (Incidentally, “Sunbelt Software Distribution, ...

Analysis of a Win32.Delf Variant

Friday, April 4th, 2008

We have been noticing quite a few malware samples having references to or communicating with Google's SMTP servers. This post dissects one of these samples and in the process attempts to illustrate to the reader some reversing techniques and information gathering techniques, while explaining the behavior and impact of this ...

Snort 2.8.1 Released

Thursday, April 3rd, 2008

New Additions Target-Based support to allow rules to use an attribute table describing services running on various hosts on the network. Eliminates reliance on port-based rules. Support for GRE encapsulation for both IPv4 & IPv6. Support for IP over IP tunneling for both IPv4 & IPv6. SSL preprocessor to allow ability to not inspect ...