VB Blog

VB2017 paper: Nine circles of Cerber

Posted by   Martijn Grooten on   Dec 15, 2017

Cerber is one of the major names in the world of ransomware, and last year, Check Point released a decryption service for the malware. Today, we publish a VB2017 paper by Check Point's Stanislav Skuratovich describing how the Cerber decryption tool worked; we have also uploaded the video of the presentation of this paper, by Or Eshed and Yaniv Balmas.

Read more  

Attack on Fox-IT shows how a DNS hijack can break multiple layers of security

Posted by   Martijn Grooten on   Dec 14, 2017

Dutch security firm Fox-IT deserves praise for being open about an attack on its client network. There are some important lessons to be learned about DNS security from its post-mortem.

Read more  

Throwback Thursday: BGP - from route hijacking to RPKI: how vulnerable is the Internet?

Posted by   Martijn Grooten on   Dec 14, 2017

For this week's Throwback Thursday, we look back at the video of a talk Level 3's Mike Benjamin gave at VB2016 in Denver, on BGP and BGP hijacks.

Read more  

Security Planner gives security advice based on your threat model

Posted by   Martijn Grooten on   Dec 13, 2017

Citizen Lab's Security Planner helps you improve your online safety, based on the specific threats you are facing.

Read more  

VB2017 video: Spora: the saga continues a.k.a. how to ruin your research in a week

Posted by   Martijn Grooten on   Dec 11, 2017

Today, we publish the video of the VB2017 presentation by Avast researcher Jakub Kroustek and his former colleague Előd Kironský, now at ESET, who told the story of Spora, one of of the most prominent ransomware families of 2017.

Read more  

VB2017 paper: Modern reconnaissance phase on APT – protection layer

Posted by   Martijn Grooten on   Dec 7, 2017

During recent research, Cisco Talos researchers observed the ways in which APT actors are evolving and how a reconnaissance phase is included in the infection vector in order to protect valuable zero-day exploits or malware frameworks. At VB2017 in Madrid, two of those researchers, Paul Rascagneres and Warren Mercer, presented a paper detailing five case studies that demonstrate how the infection vector is evolving. Today we publish both Paul and Warren's paper and the recording of their presentation.

Read more  

VB2017 paper: Peering into spam botnets

Posted by   Martijn Grooten on   Dec 1, 2017

At VB2017 in Madrid, CERT Poland researchers Maciej Kotowicz and Jarosław Jedynak presented a paper detailing their low-level analysis of five spam botnets. Today we publish their full paper.

Read more  

Throwback Thursday: Anti-malware testing undercover

Posted by   Martijn Grooten on   Nov 30, 2017

We look back at the VB2016 presentation by Righard Zwienenberg (ESET) and Luis Corrons (Panda Security), in which they discussed various issues relating to anti-malware testing.

Read more  

Virus Bulletin relaunches VB Security Jobs Market for both employers and job seekers

Posted by   Martijn Grooten on   Nov 30, 2017

As an independent body in the IT security industry, Virus Bulletin is in an ideal position to act as a global source of information both about jobs currently available in the field and about those candidates currently seeking to start or progress their career in the industry - which is why we have relaunched the VB Security Jobs Market.

Read more  

VB2017 paper: Offensive malware analysis: dissecting OSX/FruitFly.B via a custom C&C server

Posted by   Martijn Grooten on   Nov 29, 2017

At VB2017 in Madrid, macOS malware researcher Patrick Wardle presented the details of a specific piece of Mac malware, FruitFly, which he analysed through a custom C&C server - a technique that will also be of interest for researchers of malware on other platforms. Today we publish both Patrick's paper and the recording of his presentation.

Read more  

Search blog

VB2019 paper: Different ways to cook a crab: GandCrab Ransomware-as-a-Service (RaaS) analysed in depth

Though active for not much longer than a year, GandCrab had been one of the most successful ransomware operations. In a paper presented at VB2019 in London, McAfee researchers John Fokker and Alexandre Mundo looked at the malware code, its evolution and t…
Different ways to cook a crab: GandCrab ransomware-as-a-service (RaaS) analysed in depth Read the paper (HTML) Download the paper (PDF)       Though active for not… https://www.virusbulletin.com/blog/2019/11/vb2019-paper-different-ways-cook-crab-gandcrab-ransomware-service-raas-analysed-depth/

VB2016 paper: Diving into Pinkslipbot's latest campaign

Qakbot or Qbot, is a banking trojan that makes the news every once in a while and was the subject of a VB2016 paper by Intel Security researchers Sanchit Karve, Guilherme Venere and Mark Olea. In it, they provided a detailed analysis of the Pinkslipbot/Qa…
Pinkslipbot, also known as Qakbot or Qbot, is a banking trojan that makes the news every once in a while, yet never seems to get the attention of the world's Zbots and Dridexes. I… https://www.virusbulletin.com/blog/2017/06/vb2016-paper-diving-pinkslipbots-latest-campaign/

Vulnerability turns McAfee's anti-malware solution into open relay

Flaw allows for spam to be sent through customers' PCs.
Flaw allows for spam to be sent through customers' PCs. A vulnerability discovered in McAfee's SaaS for Total Protection, the company's hosted anti-malware solution, effectively… https://www.virusbulletin.com/blog/2012/01/vulnerability-turns-mcafee-s-anti-malware-solution-open-relay/

AV-Test.org unveils latest results

Trend Micro achieves pass; Microsoft and McAfee fail to reach certification standards.
Trend Micro achieves pass; Microsoft and McAfee fail to reach certification standards. Independent testing body AV-Test.org has released its latest set of quarterly test results,… https://www.virusbulletin.com/blog/2010/11/av-test-org-unveils-latest-results/

Computer chip giant buys AV giant

Intel becomes new owner of McAfee for the princely sum of $7.8bn
Intel becomes new owner of McAfee for the princely sum of $7.8bnIntel, the world's biggest manufacturer of computer chips, is poised to acquire security giant McAfee - one of the… https://www.virusbulletin.com/blog/2010/08/computer-chip-giant-buys-av-giant/

AV-Test.org issues latest round of testing results

Symantec and Microsoft outdo Trend and McAfee in live tests.
Symantec and Microsoft outdo Trend and McAfee in live tests. Independent testing organisation AV-Test.org has released its latest round of test results in a simplified format,… https://www.virusbulletin.com/blog/2010/08/av-test-org-issues-latest-round-testing-results/

McAfee offers payments to cover FP cleanup costs

Compensation for faulty update victims could set precedent.
Compensation for faulty update victims could set precedent. Victims of the erroneous McAfee DAT update last month are being offered cash payments to cover costs incurred in fixing… https://www.virusbulletin.com/blog/2010/05/mcafee-offers-payments-cover-fp-cleanup-costs/

Botnets becoming more robust

Zeus botnet used Amazon's in-the-cloud service to control bots.
Zeus botnet used Amazon's in-the-cloud service to control bots. New reports by MessageLabs and McAfee show that botherders have learned a lesson following the take-down of McColo… https://www.virusbulletin.com/blog/2009/12/botnets-becoming-more-robust/

Anti-spam products do well in VB testing

VB announces anti-spam certification results.
VB announces anti-spam certification results.Virus Bulletin has announced that 12 products earned VBSpam awards in its latest round of comparative anti-spam testing. A total of 14… https://www.virusbulletin.com/blog/2009/11/anti-spam-products-do-well-vb-testing/

Serious false positive hits users of old McAfee engines

Batch of system files wrongly flagged as malware, current versions not affected.
Batch of system files wrongly flagged as malware, current versions not affected. An update released by McAfee last week resulted in problems around the world, as some vital system… https://www.virusbulletin.com/blog/2009/07/serious-false-positive-hits-users-old-mcafee-engines/

McAfee to acquire Solidcore

Whitelisting firm to be assimilated by security giant.
Whitelisting firm to be assimilated by security giant.McAfee has announced the acquisition of whitelisting firm Solidcore in a deal reported to be worth a base rate of $33 million,… https://www.virusbulletin.com/blog/2009/05/mcafee-acquire-solidcore/

Security holes trouble vendors

Vulnerabilities fixed in McAfee website and Google Chrome; patch expected for Adobe Reader.
Vulnerabilities fixed in McAfee website and Google Chrome; patch expected for Adobe Reader. A range of vulnerabilities have been causing headaches recently for companies… https://www.virusbulletin.com/blog/2009/05/security-holes-trouble-vendors/

Banking sector confuses users over online safety

Leftfield AV detection scores used to promote ID theft tool.
Leftfield AV detection scores used to promote ID theft tool. With online banking an increasingly important way of interacting with our banks, the security of online transactions is… https://www.virusbulletin.com/blog/2009/04/banking-sector-confuses-users-over-online-safety/

AV-Comparatives releases latest detection figures

Large collection test shows major improvement from AV giants.
Large collection test shows major improvement from AV giants. Independent testing organisation AV-Comparatives has released its latest bi-annual detection test figures, with 17… https://www.virusbulletin.com/blog/2009/03/av-comparatives-releases-latest-detection-figures/

McAfee false positive flags Vista component

Innocent file labelled trojan.
Innocent file labelled trojan.McAfee has updated one of its detections after a faulty update led to an integral component of the Windows Vista operating system being falsely… https://www.virusbulletin.com/blog/2008/10/mcafee-false-positive-flags-vista-component/

McAfee to buy Secure Computing

Acquisition deal valued at $465m.
Acquisition deal valued at $465m.McAfee has announced its official agreement to purchase network security firm Secure Computing Corp. in a deal worth a whopping $465 million. The… https://www.virusbulletin.com/blog/2008/09/mcafee-buy-secure-computing/

McAfee buys data loss firm Reconnex

$46 million acquisition announced as strong profit report released.
$46 million acquisition announced as strong profit report released.McAfee has announced its official agreement to purchase privately owned data loss prevention firm Reconnex, in a… https://www.virusbulletin.com/blog/2008/08/mcafee-buys-data-loss-firm-reconnex/

Yahoo! searchers to get McAfee site advice

SiteAdvisor data to help check security of search results.
SiteAdvisor data to help check security of search results. Search engine giant Yahoo! has announced a deal with McAfee to incorporate site security ratings from the firm's… https://www.virusbulletin.com/blog/2008/05/yahoo-searchers-get-mcafee-site-advice/

Malware going local

Report sees trend toward greater localisation of threats.
Report sees trend toward greater localisation of threats.McAfee's latest Sage report focuses on increased localisation in malware, with spam, phishing and malcode all showing great… https://www.virusbulletin.com/blog/2008/02/malware-going-local/

Botnet roasting on an open fire

FBI reports successes of operation Bot Roast; McAfee predicts cyber espionage for 2008.
FBI reports successes of operation Bot Roast; McAfee predicts cyber espionage for 2008. The FBI has revealed that eight individuals have been indicted, pled guilty or been… https://www.virusbulletin.com/blog/2007/12/botnet-roasting-open-fire/

« Previous 12 Next »

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.