Beware with video codec downloads….

Monday, September 11th, 2006

Some time back I remember an article I had on vcodec not being a legitimate video codec. At the time there was some malware claiming to be vcodec and “required” to view some content…. well, posing as a codec download is a good way to trick people into downloading it seems and there are more […]

Beware visiting Samsung’s site

Friday, September 8th, 2006

Betanews is reporting that Samsung’s site has been hacked and is currently serving up malware in some areas. user intervention is required for it to run on the users pc, but be cautious. Samsung has been notified, but as of Friday morning (according to the report) the trojan horse is still there. I really wonder […]

Being cautious with web links

Friday, September 8th, 2006

Once upon a time the bad payload of a malicious email was it’s attachment, that still happens, but in many cases the links are the real lure – like a worm dangled in the water in front of a hungry fish…. the links though hide a danger on the other side…. the hook in our […]

Hiding malware may evade antivirus

Wednesday, August 23rd, 2006

Sans had an interesting malware analysis this morning about a blob that appeared to be ascii text (gibberish) that was retrieved by a piece of malware. It turns out that the ascii text was a cleverly encoded exe file (windows executable or program file.) It took several iterations of their analysis to uncover the actual […]

Google trying to warn about dangerous pages

Friday, August 4th, 2006

SunbeltBlog is talking about a new sign that Google is stepping up to try to protect users against potentially malicious sites. They have a screenshot, which I was able to verify, that gives a warning before allowing a user to proceed to a page that “Warning – the site you are about to visit may […]

Targetting the OS is old hat….

Friday, August 4th, 2006

The Register sums up the Black Hat briefings pretty well. The Operating System level has received a lot of scrutiny in recent years for security flaws and as a result there has been a good deal of improvement there and so now, researchers are heading to the low hanging fruit of the REST of the […]

Bleeding Snort caution

Monday, July 31st, 2006

For those of you that aren’t aware…. Bleeding Snort is a collection of “bleeding edge” snort signatures. Snort is an intrusion detection framework. This note is by way of SARC that the bleedingsnort.org domain is now no longer under their control. bleedingsnort.com is and continues to be their official domain. Unfortunately it appears as though […]

Google search for malware accessible to all…

Tuesday, July 18th, 2006

The metasploit project is now hosting a malware search that uses Google. It essentially uses a binary google search technique that was referenced last week to find malicious files hosted on the web. Of course, this will be partly limited by Google’s indexing which recently has not been quite as thorough as before, but… all […]

Anonymized Botnet?

Wednesday, July 12th, 2006

Sans has a story on botnet traffic spotted coming from the TOR network. Now, I had to refresh my memory on what TOR is, but it’s an anonymizing network, essentially a computer running TOR, would collect a list of TOR client machines on the internet and then connections to other pcs are routed through encrypted […]

Sophos suggests…. for more safety – get a Mac

Wednesday, July 5th, 2006

Analyzing the state of the computer world…. Sophos Antivirus has suggested that consumers consider a Mac for their next PC if they’re concerned about the increasing swarm of malware targetting Windows PC’s. The main point being there are no ACTIVE malware threats against Mac systems and Windows still seems to be increasingly targetted. Mac will […]

Google
 
Web www.averyjparker.com