VB Blog

Vulnerabilities play only a tiny role in the security risks that come with mobile phones

Posted by Martijn Grooten on Nov 9, 2017

Both bad news (all devices were pwnd) and good news (pwning is increasingly difficult) came from the most recent mobile Pwn2Own competition. But the practical security risks that come with using mobile phones have little to do with vulnerabilities.

Posted by Martijn Grooten on Nov 8, 2017

At VB2017 in Madrid, industry veteran and ESET Senior Research Fellow David Harley presented a paper on the state of security software testing. Today we publish David's paper in both HTML and PDF format.

Posted by Martijn Grooten on Nov 3, 2017

Trickbot, a banking trojan which appeared this year, seems to be a new, more modular, and more extensible malware descendant of the notorious Dyre botnet trojan. At VB2017, Symantec researcher Andrew Brandt presented a walkthrough of a typical Trickbot infection process, and its aftermath, as seen through the lens of a tool used to perform man-in-the-middle decryption. Today, we publish both Andrew's slides and the recording of his presentation.

Posted by Martijn Grooten on Nov 2, 2017

Today, we publish a short paper in which CERT Société Générale presents FAME, its open source malware analysis framework.

Posted by Martijn Grooten on Oct 31, 2017

Ebury and Mayhem, two families of Linux server malware, about which VB published papers back in 2014, are still active and have received recent updates.

Posted by Martijn Grooten on Oct 27, 2017

Crypton, a tool developed by F5 Networks researchers Julia Karpin and Anna Dorfman, aims to speed up the reverse engineering process by decrypting encrypted content found in a (malicious) binary. The researchers described the tool in a paper which they presented at VB2017 in Madrid. Today, we publish both the paper and the recording of their presentation.

Posted by Martijn Grooten on Oct 25, 2017

For many people, the threat of an abusive partner or ex-partner is very real - and the market for consumer spyware worryingly large. Today, we publish the recording of a presentation on the subject of consumer spyware given at VB2017 by The Daily Beast reporter Joseph Cox.

Posted by Martijn Grooten on Oct 23, 2017

At the VB2017 gala dinner, the fourth Péter Szőr Award was presented to Sophos researcher Gábor Szappanos for his paper "AKBuilder – the crowdsourced exploit kit".

Posted by Martijn Grooten on Oct 20, 2017

We publish the VB2017 paper and video by Kaspersky Lab researchers Juan Andres Guerrero-Saade and Costin Raiu, in which they look at fourth-party collection (spies spying on other spies' campaigns) and its implications for attribution.

Posted by Martijn Grooten on Oct 11, 2017

Virus Bulletin is a company - and a conference - with a mission: to further the research in and facilitate the fight against digital threats. To help us in this mission, we want to hear from those who didn't come to Madrid. What is your impression of the VB Conference? What did you think of this year's programme? And why couldn't you come to Madrid?

Previous1...2829303132...215Next

Search blog

New paper: Detection of vulnerabilities in web applications by validating parameter integrity and data flow graphs

In a follow-up to a paper presented at VB2019, Prismo Systems researchers Abhishek Singh and Ramesh Mani detail algorithms that can be used to detect SQL injection in stored procedures, persistent cross-site scripting (XSS), and server‑side request forger…
VB2019 paper: Catch me if you can: detection of injection exploitation by validating query and API integrity Read the paper (HTML) Download the paper (PDF) VB2019 paper:… https://www.virusbulletin.com/blog/2020/04/new-paper-detection-vulnerabilities-web-applications-validating-parameter-integrity-and-data-flow-graphs/

VB2020 programme announced

VB is pleased to reveal the details of an interesting and diverse programme for VB2020, the 30th Virus Bulletin International Conference.
While VB is keeping a careful eye on the global situation surrounding the COVID-19 pandemic and the various travel and health advice, the planning and arrangements for VB2020 are… https://www.virusbulletin.com/blog/2020/04/vb2020-programme-announced/

VB2019 paper: Cyber espionage in the Middle East: unravelling OSX.WindTail

At VB2019 in London, Jamf's Patrick Wardle analysed the WindTail macOS malware used by the WindShift APT group, active in the Middle East. Today we publish both Patrick's paper and the recording of his presentation.
Cyber espionage in the Middle East: unravelling OSX.WindTail Read the paper (HTML) Download the paper (PDF) The Middle East continues to be a hotbed of APT activity. The… https://www.virusbulletin.com/blog/2020/04/vb2019-paper-cyber-espionage-middle-east-unravelling-osxwindtail/

April

https://www.virusbulletin.com/blog/2020/04/

VB2019 paper: 2,000 reactions to a malware attack – accidental study

At VB2019 cybercrime journalist and researcher Adam Haertlé presented an analysis of almost 2000 unsolicited responses sent by victims of a malicious email campaign. Today we publish both his paper and the recording of his presentation.
2,000 reactions to a malware attack – accidental study Read the paper (HTML) Download the paper (PDF) In an illuminating study – possible thanks to a unique perspective on… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-2000-reactions-malware-attack-accidental-study/

VB2019 paper: Why companies need to focus on a problem they do not know they have

Often unbeknownst to network administrators, many company networks are used to download child sexual abuse material. In a paper presented at VB2019 in London, NetClean’s Richard Matti and Anna Creutz looked at this problem and what companies can do, ultim…
Why companies need to focus on a problem they do not know they have Read the paper (HTML) Download the paper (PDF) It is one of the worst things on the Internet: child… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-why-companies-need-focus/

VB2020 update - currently business as usual

Here at VB we are keeping a close eye on the global situation regarding the COVID-19 outbreak and the various travel restrictions and health advice, but in the meantime planning and arrangements for VB2020 are going ahead as usual, including the selection…
Like everyone around the world, we at Virus Bulletin have been closely following the news about the COVID-19 outbreak. Our team is spread throughout Europe (UK, Italy, Hungary and… https://www.virusbulletin.com/blog/2020/03/vb2020-current-situation/

VB2019 paper: Defeating APT10 compiler-level obfuscations

At VB2019 in London, Carbon Black researcher Takahiro Haruyama presented a paper on defeating compiler-level obfuscations used by the APT10 group. Today we publish both Takahiro's paper and the recording of his presentation.
Defeating APT10 compiler-level obfuscations Read the paper (HTML) Download the paper (PDF) Obfuscation in malware has long frustrated analysis, and obfuscation at the… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-defeating-apt10-compiler-level-obfuscations/

VB2019 paper: Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers

At VB2019 in London Michael Raggi (Proofpoint) and Ghareeb Saad (Anomali) presented a paper on the 'Royal Road' exploit builder (or weaponizer) and how the properties of RTF files can be used to track weaponizers and their users. Today we publish both the…
Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers Read the paper (HTML) Download the paper (PDF) Malicious RTF files, exploiting… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/

VB2019 presentation: Nexus between OT and IT threat intelligence

Operational technology, the mission critical IT in ICS, shares many similarities with traditional IT systems, but also some crucial differences. During the Threat Intelligence Practitioners’ Summit at VB2019, Dragos cyber threat intelligence analyst Selen…
Cyber attacks on industrial control systems (ICS) include the well-known stories of Stuxnet and BlackEnergy and such attacks appear to be getting more prevalent. Late last year, a… https://www.virusbulletin.com/blog/2020/03/vb2019-presentation-nexus-between-ot-and-it-threat-intelligence/

VB2019 paper: Kimsuky group: tracking the king of the spear-phishing

In a paper presented at VB2019 in London, researchers fron the Financial Security Institute detailed the tools and activities used by the APT group 'Kimsuky', some of which they were able to analyse through OpSec failures by the group. Today, we publish t…
Are you tracking an APT group? Have you fought their targeting of your organisation? Why not submit a paper for VB2020 in Dublin, Ireland, the deadline for which is Sunday 15… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-kimsuky-group-tracking-king-spear-phishing/

VB2019 paper: Play fuzzing machine - hunting iOS and macOS kernel vulnerabilities automatically and smartly

In a paper presented at VB2019 in London, Trend Micro researchers Lilang Wu and Moony Li explained how the hunt for vulnerabilities in MacOS and iOS operating systems can be made both smarter and more automatic. Today we publish both their paper and the r…
Apple’s MacOS and iOS operating systems are often praised for their security. Yet vulnerabilities in both operating systems are regularly being found and exploited, especially by… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-play-fuzzing-machine-hunting-ios-and-macos-kernel-vulnerabilities-automatically-and-smartly/

VB2019 paper: Finding drive-by rookies using an automated active observation platform

In a last-minute paper presented at VB2019 in London, Rintaro Koike (NTT Security) and Yosuke Chubachi (Active Defense Institute, Ltd) discussed the platform they have built to automatically detect and analyse exploit kits. Today we publish the recording …
Exploit kits made a bit of a comeback in 2019, something we have also seen in our test lab. Detecting these kits isn’t trivial though, given the various anti-analysis measures… https://www.virusbulletin.com/blog/2020/03/vb2019-paper-finding-drive-rookies-using-automated-active-observation-platform/

March

https://www.virusbulletin.com/blog/2020/03/

VB2019 paper: Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of a Chinese nation state adversary

The activities of China-based threat actor PKPLUG were detailed in a VB2019 paper by Palo Alto Networks researcher Alex Hinchliffe, who described the playbook of this long-standing adversary. Today we publish both Alex's paper and the recording of his pre…
Pulling the PKPLUG: the adversary playbook for the long-standing espionage activity of a Chinese nation-state adversary Read the paper (HTML) Download the paper (PDF) … https://www.virusbulletin.com/blog/2020/03/vb2019-paper-pulling-pkplug-adversary-playbook-long-standing-espionage-activity-chinese-nation-state-adversary/

VB2019 paper: Static analysis methods for detection of Microsoft Office exploits

Today we publish the VB2019 paper and presentation by McAfee researcher Chintan Shah in which he described static analysis methods for the detection of Microsoft Office exploits.
Have you carried out research that furthers our understanding of the threat landscape? Have you discovered a technique that helps in the analysis of malware? The… https://www.virusbulletin.com/blog/2020/02/vb2019-paper-static-analysis-methods-detection-microsoft-office-exploits/

New paper: LokiBot: dissecting the C&C panel deployments

First advertised as an information stealer and keylogger when it appeared in underground forums in 2015, LokiBot has added various capabilities over the years and has affected many users worldwide. In a new paper researcher Aditya Sood analyses the URL st…
If you have some research you'd like to share with the security community, we'd love to hear from you: the call for papers for VB2020 (Dublin, 30 Sept to 2 Oct 2020) remains open… https://www.virusbulletin.com/blog/2020/02/new-paper-lokibot-dissecting-cc-panel-deployments/

VB2019 presentation: Building secure sharing systems that treat humans as features not bugs

In a presentation at VB2019 in London, Virtru's Andrea Limbago described how, by exploring data sharing challenges through a socio-technical lens, it is possible to make significant gains toward the secure sharing systems and processes that are vital for …
There are certain paradigms that continue to permeate information security: Humans are the weakest link in security. Always assume breach. Privacy is dead. And along with these… https://www.virusbulletin.com/blog/2020/02/vb2019-presentation-building-secure-sharing-systems-treat-humans-features-not-bugs/

VB2019 presentation: Attor: spy platform with curious GSM fingerprinting

Attor is a newly discovered cyber-espionage platform, use of which dates back to at least 2014 and which focuses on diplomatic missions and governmental institutions. Details of Attor were presented at VB2019 in London by ESET researcher Zuzana Hromcová. …
Attor is a newly discovered cyber-espionage platform, use of which dates back to at least 2014 and which focuses on diplomatic missions and governmental institutions. The modular… https://www.virusbulletin.com/blog/2020/02/vb2019-presentation-attor-spy-platform-curious-gsm-fingerprinting/

February

https://www.virusbulletin.com/blog/2020/02/

« Previous 1234567...121 Next »