January issue of VB published

Posted by   Virus Bulletin on   Jan 1, 2014

The January issue of Virus Bulletin is now available for subscribers to download.

The January 2014 issue of Virus Bulletin is now available for subscribers to browse online or download in PDF or PRC (Kindle) format.

Some of the things this month's issue has in store are:

• The AV industry in the post-Snowden era: 'We should expect to see governments creating their own anti-malware products.' Fabio Assolini, Kaspersky Lab.

• Medfos - an all-purpose redirector: Medfos is a heavily obfuscated trojan family which downloads modules capable of redirecting search engine results in the most popular browsers. Benjamin Chang and Neo Tan dissect the way the Medfos downloader deploys its downloaded modules, and the function of each.

• Salted algorithm - part 1: Sality has been around for many years, yet it is still one of today's most prevalent pieces of malware. In this two-part article, Raul Alvarez takes a close look at a variant of Sality that not only infects executables but also has some trojan-like attributes.

• Inside W32.Xpaj.B's infection - part 1: Xpaj.B is one of the most complex and sophisticated file infectors in the world. It is difficult to detect, disinfect and analyse. In a two-part article, Liang Yuan provides a deep analysis of its infection.

• Greetz from academe: Ringing in the new: In the latest of his 'Greetz from Academe' series, highlighting some of the work going on in academic circles, John Aycock focuses on computer science surveys, looking in particular at one on binary code obfuscations in packer tools.

• SGX: the good, the bad and the downright ugly: A brand new instruction set coming to Intel's processors in the near future has tremendous potential implications both for malware authors and for defenders. Shaun Davenport and Richard Ford describe the SGX technology and how people might use it.

• Effusion - a new sophisticated injector for Nginx web servers: At VB2013 Evgeny Sidorov spoke about three modern approaches used by attackers to embed malicious code into HTTP responses. One such approach was the use of web-server modules for malware distribution. Here, Evgeny and his colleagues describe 'Effusion', a new piece of malware that uses malicious modules for an Nginx web server, and which was used in a massive infection campaign in the third quarter of 2013.

Note: The January 2014 VBSpam comparative review will be published as standalone article later in the month. As with all new VB100 and VBSpam reviews, the report will be available for non-subscribers to purchase as a standalone item (Virus Bulletin subscribers will be notified by email when the comparative is available to download). Non-subscribers can purchase VB100 reports here and VBSpam reports here.

Subscribers click here to access the issue.

If you are not already a subscriber why not take the chance to subscribe now.

Posted on 08 January 2014 by Virus Bulletin

Latest posts: