VB Blog

VB2019 presentation: Building secure sharing systems that treat humans as features not bugs

Posted by Helen Martin on Feb 14, 2020

In a presentation at VB2019 in London, Virtru's Andrea Limbago described how, by exploring data sharing challenges through a socio-technical lens, it is possible to make significant gains toward the secure sharing systems and processes that are vital for innovation and collaboration. Today we release the recording of her presentation.

Posted by Virus Bulletin on Feb 11, 2020

Attor is a newly discovered cyber-espionage platform, use of which dates back to at least 2014 and which focuses on diplomatic missions and governmental institutions. Details of Attor were presented at VB2019 in London by ESET researcher Zuzana Hromcová. Today we release the recording of Zuzana's presentation.

Posted by Virus Bulletin on Feb 6, 2020

With the call for papers for VB2020 currently open, we explain why, whether you've never presented before or you're a conference circuit veteran, if you have some interesting research to share with the community we want to hear from you!

Posted by Helen Martin on Feb 5, 2020

At VB2019 in London, Kaspersky researcher Santiago Pontiroli presented a paper on the growing illegal economy around video game cheats and its parallels with the malware industry. Today we publish both Santiago's paper and the recording of his presentation.

Posted by Virus Bulletin on Jan 31, 2020

In a paper presented at VB2019 in London, ESET researchers Peter Kálnai and Michal Poslušný discussed the subject of rich headers and how it can be useful in malware research. Today we publish both their paper and the recording of their presentation.

Posted by Helen Martin on Jan 28, 2020

At VB2019 in London, Fortinet researcher Axelle Apvrille presented a paper co-written with Aamir Lakhani that looked at the threats faced by those who use medical IoT devices to help manage their diabetes. Today we publish the researchers' paper, as well as the recording of Axelle's presentation.

Posted by Virus Bulletin on Jan 24, 2020

In a VB2019 paper Avast researchers Jan Sirmer, Luigino Camastra and Adolf Středa revealed full details of the Rietspoof malware. Today we publish their paper and the recording of the presentation given by Jan and Luigino in London.

Posted by Helen Martin on Jan 20, 2020

The GandCrab ransomware regularly updated itself to newer versions to stay ahead of decryptors released by security researchers, and regularly included taunts, jokes and references to security organizations in its code. In a new paper, the AhnLab Security Analysis Team reveal the full details of the battle that went on between GandCrab and AhnLab.

Posted by Virus Bulletin on Jan 16, 2020

At VB2019 Juan Andres Guerrero-Saade looked at nation-state actors using threat intelligence for victim deconfliction. Today we publish both his paper and the recording of his presentation.

Posted by Virus Bulletin on Jan 14, 2020

With the VB2020 Call for Papers now open, we explain how the selection procedure works, which may help you during your abstract submission.

Previous1...45678...215Next

Search blog

WireX DDoS botnet takedown shows the best side of the security industry

Collaboration between a number of security companies has led to the takedown of the WireX Android DDoS botnet. Efforts like these, and the fact that the companies involved all decided to publish the very same blog post, show the best side of the security …
It is easy to be cynical about the security industry and its tendency to make ever bigger mountains out of molehills, but behind a thin layer of marketing, there are a great many… https://www.virusbulletin.com/blog/2017/08/wirex-ddos-botnet-takedown-shows-best-side-security-industry/

Mostly blocked, but still good enough: Necurs sending pump-and-dump spam

The Necurs botnet has started sending pump-and-dump spam. Almost all of these emails are blocked by spam filters, yet the stock price still increased.
Over the past few days, the Necurs spam botnet has increased its activity, sending large amounts of pump-and-dump spam, in which a cheap stock is pushed with the aim of making a… https://www.virusbulletin.com/blog/2017/03/mostly-blocked-still-good-enough-necurs-sending-pump-and-dump-spam/

Conference review: Botconf 2016

Three members of the Virus Bulletin team attended the Botconf 2016 conference in Lyon, France last month, enjoying talks on subjects that ranged from state-sponsored attacks to exploit kits, and from banking trojans to cyber insurance.
This review was written by Martijn Grooten, Adrian Luca and Ionuț Răileanu. Though still only in its fourth year, Botconf has become one of the Virus Bulletin team's favourite… https://www.virusbulletin.com/blog/2016/december/conference-review-botconf-2016/

More on the Moose botnet at Botconf

At Botconf 2016 this week, GoSecure researchers Masarah Paquet-Clouston and Olivier Bilodeau presented their research on the Moose botnet - something Olivier Bilodeau previously spoke about at VB2015.
This week, several members of the Virus Bulletin team are attending Botconf 2016 in Lyon, France. Security conferences provide good opportunities to meet fellow researchers and to… https://www.virusbulletin.com/blog/2016/december/more-moose-botnet-botconf/

Paper: a timeline of mobile botnets

Ruchna Nigam provides an overview of more than 60 mobile malware families.
Ruchna Nigam provides an overview of more than 60 mobile malware families. The rise of mobile malware is still a relatively recent thing, with the first actual mobile botnets not… https://www.virusbulletin.com/blog/2015/03/paper-timeline-mobile-botnets/

VB2014 paper: Caphaw - the advanced persistent pluginer

Micky Pun and Neo Tan analyse the banking trojan that is best known for spreading through Skype.
Micky Pun and Neo Tan analyse the banking trojan that is best known for spreading through Skype.Since the close of the VB2014 conference in Seattle in October, we have been sharing… https://www.virusbulletin.com/blog/2015/02/paper-caphaw-advanced-persistent-pluginer/

Coordinated action takes down Ramnit botnet infrastructure

Malware remains present on infected machines; 2012 Virus Bulletin paper worth studying.
Malware remains present on infected machines; 2012 Virus Bulletin paper worth studying. A coordinated action from Anubisnetworks, Microsoft and Symantec, together with Europol has… https://www.virusbulletin.com/blog/2015/02/coordinated-action-takes-down-ramnit-botnet-infrastructure/

VB2014 paper: Hiding the network behind the network. Botnet proxy business model

Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.
Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.Over the next few months, we will be sharing VB2014 conference papers as well as video… https://www.virusbulletin.com/blog/2014/10/paper-hiding-network-behind-network-botnet-proxy-business-model/

Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part two

Aditya K. Sood and Rohit Bansal study the malware's behaviour when ran on a physical machine.
Aditya K. Sood and Rohit Bansal study the malware's behaviour when ran on a physical machine. Last week, we published the first part of the paper 'Prosecting the Citadel botnet -… https://www.virusbulletin.com/blog/2014/09/paper-prosecting-citadel-botnet-revealing-dominance-zeus-descendent-part-two/

Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part one

Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud.
Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud. It is unlikely that anyone still thinks that cybercrime is performed by 16-year-old kids who… https://www.virusbulletin.com/blog/2014/09/paper-prosecting-citadel-botnet-revealing-dominance-zeus-descendent-part-one/

Game over for GameOver Zeus botnet?

Coordinated effort against gang that's also behind CryptoLocker ransomware.
Coordinated effort against gang that's also behind CryptoLocker ransomware. A large, coordinated effort involving law enforcement, security vendors and various security… https://www.virusbulletin.com/blog/2014/06/game-over-gameover-zeus-botnet/

Updated botnet likely cause of surge in Tor traffic

New Tor version should help the network deal with increased traffic.
New Tor version should help the network deal with increased traffic. Sometimes a picture says more than a thousand words: The graph shows the daily number of users of the Tor… https://www.virusbulletin.com/blog/2013/09/updated-botnet-likely-cause-surge-tor-traffic/

Kelihos checks machines' IP addresses against DNS blacklists

Role of node in a botnet dependent on whether the IP address is blacklisted.
Role of node in a botnet dependent on whether the IP address is blacklisted. Whenever I look at the results of the VBSpam tests, it always amazes me how large a percentage of spam… https://www.virusbulletin.com/blog/2013/08/kelihos-checks-machines-ip-addresses-against-dns-blacklists/

VB2013 speaker spotlight

We speak to James Wyke about his research interests and what he aims to bring to VB2013.
We speak to James Wyke about his research interests and what he aims to bring to VB2013.The VB2013 conference takes place this autumn (2-4 October) in Berlin, with an exciting… https://www.virusbulletin.com/blog/2013/07/speaker-spotlight-wyke/

Latest VBSpam tests show web host spam harder to block

Most filters see a small increase in their catch rates overall.
Most filters see a small increase in their catch rates overall. The results of VB's latest spam filter test show that the spam sent from web hosts is significantly harder to block… https://www.virusbulletin.com/blog/2013/06/latest-vbspam-tests-show-web-host-spam-harder-block/

Ruby on Rails vulnerability exploited in the wild

Code executed on web servers to cause them to join IRC botnet.
Code executed on web servers to cause them to join IRC botnet. A critical vulnerability in Ruby on Rails is currently being exploited to make web servers join an IRC botnet, Ars… https://www.virusbulletin.com/blog/2013/05/ruby-rails-vulnerability-exploited-wild/

German anti-botnet advisory recommends the use of ad blockers for security

'If websites want to include ads, they must make sure they are secure.'
'If websites want to include ads, they must make sure they are secure.' In an open letter to several prominent German websites, Botfrei, the German anti-botnet advisory centre, has… https://www.virusbulletin.com/blog/2013/05/german-anti-botnet-advisory-recommends-use-ad-blockers-security/

Grum botnet's command-and-control servers shut down

Spam-sending botnet believed to be third largest in the world.
Spam-sending botnet believed to be third largest in the world. International co-operation between a number of parties has led to all command-and-control servers of the 'Grum'… https://www.virusbulletin.com/blog/2012/07/grum-botnet-s-command-and-control-servers-shut-down/

New Zeus/SpyEye botnet does away with command-and-control servers

Increasing use of UDP to avoid communication tracking.
Increasing use of UDP to avoid communication tracking. Researchers at Symantec have discovered a new parallel build of Zeus (also known as Zbot) and SpyEye that appears to be… https://www.virusbulletin.com/blog/2012/02/new-zeus-spyeye-botnet-does-away-command-and-control-servers/

Compromised websites used to mine bitcoins

In-the-browser botnet turns victims' CPU cycles into cash for the attackers.
In-the-browser botnet turns victims' CPU cycles into cash for the attackers. Researchers have discovered a compromised website where a piece of JavaScript has been included that is… https://www.virusbulletin.com/blog/2011/12/compromised-websites-used-mine-bitcoins/

« Previous 12345 Next »