VB Blog

VB2016 video: Nymaim: the Untold Story

Posted by   Martijn Grooten on   Feb 8, 2017

Until very recently, the Nymaim banking trojan was a serious problem in Poland. Today, we publish the video of the VB2016 presentation by CERT Polska researchers Jarosław Jedynak and Maciej Kotowicz, in which they analyse this malware-dropper-turned-banking-trojan.

Read more  

The Living Dead Anti-Virus

Posted by   Virus Bulletin on   Feb 2, 2017

Should users uninstall their anti-virus products, as was recently suggested by a security expert in a widely shared article? In a guest post, security consultant Hendrik Pilz explains why he doesn't think this is a good idea.

Read more  

Paper: The journey and evolution of God Mode in 2016: CVE-2016-0189

Posted by   Martijn Grooten on   Jan 31, 2017

In a new paper published by Virus Bulletin, FireEye researchers Ankit Anubhav and Manish Sardiwal analyse the 'God Mode' vulnerability CVE-2016-0189 in Microsoft Internet Explorer.

Read more  

VB2016 video: Neverquest: Crime as a Service and On the Hunt for the Big Bucks

Posted by   Martijn Grooten on   Jan 30, 2017

At VB2016, Peter Kruse gave a presentation detailing the Neverquest trojan, the alleged author of which was arrested in Spain earlier this month. Today, we publish the recording of Peter's presentation.

Read more  

VB2016 paper: Great crypto failures

Posted by   Martijn Grooten on   Jan 24, 2017

Crypto is hard, and malware authors often make mistakes. At VB2016, Check Point researchers Yaniv Balmas and Ben Herzog discussed the whys and hows of some of the crypto blunders made by malware authors. Today, we publish their paper and the recording of their presentation.

Read more  

Call for Papers: VB2017

Posted by   Martijn Grooten on   Jan 19, 2017

We have opened the Call for Papers for VB2017. We are particularly interested in receiving submissions from those working outside the security industry itself.

Read more  

Ransomware not a problem for half of businesses

Posted by   Martijn Grooten on   Jan 11, 2017

According to a report by IBM Security, 70 per cent of businesses that are the victim of a ransomware attack end up paying the ransom. However, the report also suggests that a little over half of businesses manage to avoid getting infected at all, showing they must be doing something right.

Read more  

Ransomware would be much worse if it wasn't for email security solutions

Posted by   Martijn Grooten on   Jan 5, 2017

The latest VBSpam test brings good news: at least 199 out of every 200 emails containing a malicious attachment were blocked by email security solutions. All of the full solutions tested achieved a VBSpam award, with five earning a VBSpam+ award.

Read more  

Throwback Thursday: The malware battle: reflections and forecasts

Posted by   Helen Martin on   Jan 5, 2017

"Another year has come to its end and the malware battle still rages on." In January 2004, Jamz Yaneza reflected on the year just ended and pondered what the coming year would have in store for the AV industry.

Read more  

VB2016 paper: Open Source Malware Lab

Posted by   Martijn Grooten on   Jan 4, 2017

At VB2016, ThreatConnect Director of Research Innovation Robert Simmons presented a paper on setting up an open source malware lab. Today, we share the accompanying paper and video.

Read more  

Search blog

VB2018 paper: The dark side of WebAssembly

Today, we publish the VB2018 paper by Symantec researchers Aishwarya Lonkar and Siddhesh Chandrayan on the security risks that come with WebAssembly.
With this year's very successful Virus Bulletin Conference (VB2018) now behind us, we plan to continue the tradition of publishing most of the papers and videos of the… https://www.virusbulletin.com/blog/2018/10/vb2018-paper-dark-side-webassembly/

VB2017 video: Turning Trickbot: decoding an encrypted command-and-control channel

Trickbot, a banking trojan which appeared this year, seems to be a new, more modular, and more extensible malware descendant of the notorious Dyre botnet trojan. At VB2017, Symantec researcher Andrew Brandt presented a walkthrough of a typical Trickbot in…
Trickbot, first reported a year ago by Malwarebytes researcher Jérôme Segura as the successor of Dyre/Dyreza, has become perhaps the most important banking trojan of 2017. It is… https://www.virusbulletin.com/blog/2017/11/vb2017-video-turning-trickbot-decoding-encrypted-command-and-control-channel/

VB2016 paper: One-Click Fileless Infection

Symantec researchers Himanshu Anand and Chastine Menrige explain how a single click can lead to a compromised machine, without malware ever being stored on disk.
Over the last few years, we have seen a sharp increase in 'fileless' infections, where a machine is compromised without a malicious file ever being written to disk. Though not… https://www.virusbulletin.com/blog/2017/03/vb2016-paper-one-click-fileless-infection/

Symantec quietly retires PC Tools security product lines

Sales of Spyware Doctor and other security products end, support to continue for existing users.
Sales of Spyware Doctor and other security products end, support to continue for existing users.Symantec has quietly announced the end of life the of PC Tools security product… https://www.virusbulletin.com/blog/2013/05/symantec-quietly-retires-pc-tools-security-product-lines/

From spear phishing to watering holes

Symantec reports increase in 'watering hole attacks'.
Symantec reports increase in 'watering hole attacks'. Imagine that for some reason you wanted to gain access to my computer. One thing you could do is send me an email with some… https://www.virusbulletin.com/blog/2012/09/spear-phishing-watering-holes/

'Nitro attacks' continue

PoisonIvy trojan sent attached to email warning about the same trojan.
PoisonIvy trojan sent attached to email warning about the same trojan. Researchers at Symantec report that the 'Nitro attacks', which target a number of large companies, many of… https://www.virusbulletin.com/blog/2011/12/nitro-attacks-continue/

Spammers exploit internationalized domain names

Non-Latin characters in URLs used to trick filters.
Non-Latin characters in URLs used to trick filters. By using internationalized domain names (IDN), spammers manage to avoid detection of URLs in their messages. IDNs were… https://www.virusbulletin.com/blog/2011/03/spammers-exploit-internationalized-domain-names/

Welsh 419 scam

Email from Welsh-speaking Kuwaiti widow indicative of more targeted spam.
Email from Welsh-speaking Kuwaiti widow indicative of more targeted spam. Email users in Wales who received a recent 419 scam will have been surprised to find the message -… https://www.virusbulletin.com/blog/2011/02/welsh-419-scam/

AV-Test.org issues latest round of testing results

Symantec and Microsoft outdo Trend and McAfee in live tests.
Symantec and Microsoft outdo Trend and McAfee in live tests. Independent testing organisation AV-Test.org has released its latest round of test results in a simplified format,… https://www.virusbulletin.com/blog/2010/08/av-test-org-issues-latest-round-testing-results/

Symantec to acquire VeriSign business

Vendor splashes out more cash on authentication.
Vendor splashes out more cash on authentication.Symantec, the AV vendor with a reputation for snapping up other companies, has announced its purchase of VeriSign's authentication… https://www.virusbulletin.com/blog/2010/05/symantec-acquire-verisign-business/

Symantec buys key pair of encryption firms

PGP and GuardianEdge snapped up in surprise dual acquisition.
PGP and GuardianEdge snapped up in surprise dual acquisition.Symantec has announced the acquisition of two separate firms specialising in encryption and email security. The deals… https://www.virusbulletin.com/blog/2010/05/symantec-buys-key-pair-encryption-firms/

Microsoft steps into free AV market

Security Essentials release creates expected storm of words.
Security Essentials release creates expected storm of words.Microsoft's release of its free Security Essentials product this week sparked the expected barrage of views and opinions… https://www.virusbulletin.com/blog/2009/10/microsoft-steps-free-av-market/

Banking sector confuses users over online safety

Leftfield AV detection scores used to promote ID theft tool.
Leftfield AV detection scores used to promote ID theft tool. With online banking an increasingly important way of interacting with our banks, the security of online transactions is… https://www.virusbulletin.com/blog/2009/04/banking-sector-confuses-users-over-online-safety/

AV-Comparatives releases latest detection figures

Large collection test shows major improvement from AV giants.
Large collection test shows major improvement from AV giants. Independent testing organisation AV-Comparatives has released its latest bi-annual detection test figures, with 17… https://www.virusbulletin.com/blog/2009/03/av-comparatives-releases-latest-detection-figures/

Symantec slip sparks suspicion, spam

Update error leads to conspiracy theories and exploitation of fears.
Update error leads to conspiracy theories and exploitation of fears. A faulty update issued to some users of Symantec's Norton product line yesterday has led to an explosion of… https://www.virusbulletin.com/blog/2009/03/symantec-slip-sparks-suspicion-spam/

MessageLabs acquired by Symantec

Acquisition deal valued at $695m.
Acquisition deal valued at $695m. Security industry heavyweight Symantec has announced a definitive agreement to acquire software-as-a-service security specialist MessageLabs.… https://www.virusbulletin.com/blog/2008/10/messagelabs-acquired-symantec/

Symantec to acquire PC Tools

Industry giant adds spyware specialist to growing portfolio.
Industry giant adds spyware specialist to growing portfolio. Security industry behemoth Symantec has announced the planned acquisition of PC Tools, the Australia-based company… https://www.virusbulletin.com/blog/2008/08/symantec-acquire-pc-tools/

QuickTime flaw could open Windows PCs to hackers

Firefox users most vulnerable; Internet Explorer users should be wary too.
Firefox users most vulnerable; Internet Explorer users should be wary too. Polish security researcher Krystian Kloskowski has published a proof-of-concept exploit for a… https://www.virusbulletin.com/blog/2007/11/quicktime-flaw-could-open-windows-pcs-hackers/

Symantec joins data leak frenzy

Vontu purchase latest move in data protection trend.
Vontu purchase latest move in data protection trend.Symantec has announced the $350 million purchase of data leak prevention firm Vontu, following several similar moves by major… https://www.virusbulletin.com/blog/2007/11/symantec-joins-data-leak-frenzy/

Word for Mac exploit spotted

Patch Tuesday flaw targeted by vulnerability.
Patch Tuesday flaw targeted by vulnerability. A vulnerability in the Apple Mac version of Microsoft Word, covered by a patch in this month's Patch Tuesday security update, has been… https://www.virusbulletin.com/blog/2007/10/word-mac-exploit-spotted/

« Previous 12 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.