Shedding (Black)Light on the Master Boot Record

Monday, March 31st, 2008

A while ago we blogged about the MBR rootkit, which has been getting attention from all the security vendors. We're glad to inform you that the latest version of the F-Secure BlackLight standalone rootkit scanner now detects MBR rootkit infections. BlackLight has stood the test of time ever since it was ...

Massive IFRAME SEO Poisoning Attack Continuing

Friday, March 28th, 2008

Last week's massive IFRAME injection attack is slowly turning into a what looks like a large scale web application vulnerabilities audit of high profile sites. Following the timely news coverage, Symantec's rating for the attack as medium risk, StopBadware commenting on XP Antivirus 2008, and US-CERT issuing a warning about ...

Free Honeypot Client Could Sting Malware

Thursday, March 27th, 2008

The Honeynet Project has released a new freebie honeypot client tool that lets security pros and researchers automatically detect and dissect bot infections and other malware attacks on client machines. Capture-HPC v2.1 is an updated and enhanced version of the Honeynet Project’s high-interaction Capture-HPC client honeypot, which the organization last year ...

Guarding the guardians: A story of PGP key ring theft

Thursday, March 27th, 2008

A couple of weeks ago, we received a CHM, or Windows Help file, embedded in e-mail as part of a targeted attack campaign against an NGO. Virus detection was near zero. On Virustotal.com, two solutions actually flagged it as malicious. After decompiling the CHM file, which you can easily do using tools ...

Researchers Discover Rootkit Variation

Thursday, March 27th, 2008

While there might not be new malicious threats under the sun, there are plenty of new ways to spin old virus attacks. Trend Micro researchers discovered last weekend a new variation of a MBR rootkit released in the wild, which contains new technology to prevent detection. When combined with Web ...