ProFTPd 1.3.3c - Compromised Source Backdoor Remote Code Execution

ProFTPd 1.3.3c - Compromised Source Backdoor Remote Code Execution == ProFTPD Compromise Report == On Sunday, the 28th of November 2010 around 20:00 UTC the main distribution server of the ProFTPD project was compromised. The attackers most likely used an unpatched security issue in the FTP daemo...

SpyDLLRemover v4.0 - New Version Realeased

"SpyDllRemover is the specialized tool for detecting spyware & hidden Rootkit Dlls in the System. It can also detect & remove user-land Rootkit processes as well as other spyware processes using multiple user-land Rootkit detection algorithms coupled with in-house Process heuristics. This makes i...

Week in Security: Scarily Tenacious Rootkits, Stuxnet's Secrets and Cisco Flaws

The news this week revolved around complex and troublesome threats, notably two rootkits, TDL4 and ZeroAccess. Stuxnet reared its head once again as did a new problem with Cisco’s popular videoconferencing software. Read on for the full week in review. In our most popular story of the week, we...

Dissecting the ZeroAccess Rootkit

The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access t...

TDL4 Rootkit Bypasses Windows Code-Signing Protection

In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass...

Image of the Day: Dissecting The ZeroAccess Crimeware

We know a lot about the effects of malicious programs like rootkits and Trojan downloaders. The job of finding out exactly how the programs work, however, is painstaking. That’s because most malware authors worth their salt take steps to make their creations hard to understand. Code obfuscation a...

New Android Bug Allows for Silent Malicious App Installation

There’s a weakness in the Android operating system that could enable an attacker to install a malicious third-party application on Android devices without the user’s knowledge. A researcher has developed a proof-of-concept app that’s in the Android Market now. Jon Oberheide, a security researcher...

iPhone Jailbreak Tool Sets Stage for Mobile Malware

SAN DIEGO–The success of a group of hackers in compromising the security of Apple’s iPhone may set the stage for more malware for the popular handset, including rootkit-style remote monitoring tools and data stealing malware. In a presentation at the ToorCon Hacking Conference here on Saturday,...

Manufacturers, Carriers Look to Defend Devices Against Attackers and Users

As mobile phones have gradually morphed into complete computing devices in the last few years with the advent of the iPhone and Android-based phones, mobile phone manufacturers and wireless carriers have been working to create new protection mechanisms to stop attacks against the increasingly...

Android G2 Phone Can Roll Back Jailbreaks

Since at least the time of the release of the first generation Apple iPhone, sophisticated smartphone users have been working diligently to jailbreak their devices in order to load their own software, install third-party applications and make other modifications. Now, one Android device, the G2...

Stuxnet Analysis Supports Iran-Israel Connections

VANCOUVER – A Symantec researcher filled in more critical details about the Stuxnet worm here, demonstrating the worm’s ability to take control of programmable logic controllers PLCs by Siemens Inc. and disable machinery connected to them. Liam O’Murchu of Symantec, speaking at the Virus Bulletin...

Rootkit Variant Now Targets 64-Bit Windows

Alureon rootkit is back, and has acquired the ability to hijack computers running 64-bit versions of Microsoft Windows, proclaimed security researcher Marco Giuliani. Read the full article. Help Net Security...

ATM Makers Release Fixes for 'Jackpotting' Flaw

Two ATM manufacturers have released software updates to address the remotely exploitable vulnerabilities in their machines’ firmware that IOActive researcher Barnaby Jack demonstrated line on stage at the Black Hat conference last month. In response to the demonstration, in which Jack was able to...

Mobile Devices Drawing More Attackers' Attention

As mobile devices such as iPhones, BlackBerrys, Android phones and others have become more sophisticated and easy to use, many users have made them their main computing and Web-browsing devices. And that evolution naturally has caught the attention of attackers who have begun tailoring more and...

Android Rootkit Demonstrated at DEFCON

IT security researchers Nicholas Percoco and Christian Papathanasiou demonstrated what they claim is the first rootkit for Android. Their aim was to show how slight the obstacles to the development of a such a rootkit are and how powerful the result can be. Read the full article. The H Security...

Persistent, Covert Malware Causing Major Damage

LAS VEGAS–Security technology and practice have advanced quite a bit in the past few years, but one thing that has become clear is that whatever gains have been made are just not keeping pace with the innovation of attackers. The advances being made by malware authors and crimeware gangs are...

Possible New Rootkit Has Drivers Signed by Realtek

Security researchers have identified a new suspicious program that is copying itself to PCs via USB mass storage devices and is digitally signed with the certificate of Realtek Semiconductor, a major manufacturer of computer products based in Taiwan. The program, known as Stuxnet, looks like a...

Android Rootikit To Be Shown at DefCon

Researchers have developed a kernel-level Android rootkit in the form of a loadable kernel module and will demonstrate the proof of concept exploit at the upcoming DefCon conference. Read the demo statement. DefCon.org...

Microsoft Battles Alureon Rootkit

For the second month in a row, Microsoft has tried to eradicate a mutating rootkit that has blocked some Windows users from installing security updates. Read the full article. Computerworld...

MS10-015 Restart Issues Are the Result of Rootkit Infection

Microsoft on Thursday confirmed that the blue screen of death issues that affected a slew of users after the latest batch of Patch Tuesday updates is the result of an existing infection by the Alureon rootkit. There was widespread speculation after the patch release that simply installing the...