QuickTime 0day for Vista and XP

Friday, April 25th, 2008

A remote vulnerability exists in the QuickTime player for Windows XP and Vista (latest service packs). Other versions are believed to be affected as well. For now, no details will be released regarding the method of exploitation. Because we are an information security think tank and because we encounter some very ...

A Look at a Bank Worm

Wednesday, April 23rd, 2008

Malware authors will often have their files display something to the user so that they actually believe the file is legitimate. Many of us have experienced such tricks, including fake errors stating that a specific file could not be found or that the application failed to load properly. Today we ...

Kraken Reverts to HTTP

Tuesday, April 22nd, 2008

Following a friendly heads up from someone yesterday morning, I re-loaded the following Kraken samples into my honeypot: 1d51463150db06bc098fef335bc64971 65b958bf6f5eddca3d9455354af08b6f 6ec7d67d5553cbec2a99c7fbe385a729 7ecef2f126e66e7270afa7b803f715bc 8fd8c67103ec073d9303a7fbc702f89a and began monitoring them. Each sample proceeded to update itself; the updated binary is around 160KB, given a random name and placed in the system32 directory, and no longer has an imagefile icon. The names/MD5 values of ...

Microsoft sees huge rise in Web attacks

Tuesday, April 22nd, 2008

Criminals changed tactics in the last six months of 2007, dropping malicious email in favour of Web-based attacks, according to data reported to Microsoft by Windows users. The company saw the number of Trojan downloader programs it removed from Windows machines jump by 300 percent, according to Jimmy Kuo, principal architect ...

Foxit Reader Malformed PDF Vulnerabilities

Tuesday, April 22nd, 2008

Foxit Reader is "a free PDF document viewer and printer, with incredible small size (only 2.1 M download size), breezing-fast launch speed and rich feature set. Foxit Reader supports Windows 98/Me/2000/XP/2003/Vista". Two security vulnerability in Foxit Reader allow a remote attacker armed with a malformed PDF file to cause the ...