New Gpcode (encryption) ransomware speading via botnet

Wednesday, August 13th, 2008

There are confirmed reports on a new version of the Gpcode ransomware being spread via a botnet.According to Vitaly Kamluk of Kaspersky Lab (my employer), the Trojan encrypts files on an infected machine (AES-256) and leaves a text file named crypted.txt with a ransom note demanding $10 to decrypt the ...

Malicious Botnet Stole Bank, Credit Union Credentials

Wednesday, August 6th, 2008

The researcher who first discovered a motherlode of stolen enterprise user names and passwords in June has found that nearly 9,000 of them are bank and credit-card account credentials from around the world that were grabbed by an old but crafty botnet. And it turns out the initial 50 gigabytes' ...

The Real Dirt on Whitelisting

Wednesday, July 30th, 2008

It’s déjà vu all over again. Whitelisting technology has enjoyed a resurgence of interest lately, with antivirus companies such as Symantec, McAfee, and Microsoft planning to add it to their blacklisting-based malware detection tools and some enterprises even dropping AV altogether in favor of whitelisting alone. All thanks to the ...

Relay server attack tactic dupes auto-reporting

Monday, July 21st, 2008

Sysadmins have begun noticing a coordinated attack on servers with open SSH ports that tries to stay under the radar by only attempting to guess a password three times from any compromised machine. Instead of mounting an attack form a single compromised host, hackers have worked out a means to ...

Researcher Offers Malware Analysis Tool

Friday, July 18th, 2008

The problem with hunting for malware is that most currently available analysis tools tip off the attacker that you're doing it. But at next month's Black Hat conference, a researcher will release a tool that is harder to detect -- and harder to avoid -- than the malware analyzers currently ...