Kraken Reverts to HTTP

Tuesday, April 22nd, 2008

Following a friendly heads up from someone yesterday morning, I re-loaded the following Kraken samples into my honeypot: 1d51463150db06bc098fef335bc64971 65b958bf6f5eddca3d9455354af08b6f 6ec7d67d5553cbec2a99c7fbe385a729 7ecef2f126e66e7270afa7b803f715bc 8fd8c67103ec073d9303a7fbc702f89a and began monitoring them. Each sample proceeded to update itself; the updated binary is around 160KB, given a random name and placed in the system32 directory, and no longer has an imagefile icon. The names/MD5 values of ...

Infected Web Pages Nearly Triple

Tuesday, April 22nd, 2008

The rate at which Internet security company Sophos detected infected Web pages nearly tripled in the first quarter of 2008, the company said. In its Q1 08 threat report released Monday, Sophos says that it discovered a new infected Web page every 5 seconds. In 2007, the company says, it saw ...

Malicious Flash on LiveJournal.com

Tuesday, April 22nd, 2008

Sounds more of an annoyance than it does "malicious" but the folks over at Spyware Sucks has an interesting post about a bad flash banner being posted on Livejournal.com.  I just thought I'd share.

Microsoft sees huge rise in Web attacks

Tuesday, April 22nd, 2008

Criminals changed tactics in the last six months of 2007, dropping malicious email in favour of Web-based attacks, according to data reported to Microsoft by Windows users. The company saw the number of Trojan downloader programs it removed from Windows machines jump by 300 percent, according to Jimmy Kuo, principal architect ...

Find all encrypted files

Monday, April 21st, 2008

You can use the EFSINFO tool to find all encrypted files on a volume. This tool is found in the Windows Server 2003 Support Tools on your product CD. To use this tool to find encrypted files, run the following from a command prompt: efsinfo /s:c: | find ": Encrypted" Why would ...