TDSS Rootkit and DNSchanger: An Unholy Alliance

The TDSS rootkit has proven to be more pliable and adaptable than a campaigning politician, and attackers have used it in various forms for the last three or four years for all sorts of different attacks. It shows up in drive-by downloads, targeted attacks and just about everything in between, an...

Blackhole Exploit Kit attack on WampServer & Wordpress sites

Blackhole Exploit Kit attack on WampServer & Wordpress sites Kimberly from Stopmalvertising found Blackhole Exploit Kit on Website of most popular Webserver software site WAMPSERVER. Almost at the bottom of the webpage they notice a Javascript requesting a file from jquery.googlecode.com. The URL...

India Seizes Equipment Linked to Duqu Attack

Officials in India have seized components from a server as part of an investigation into the Duqu Trojan, according to a report. According to Reuters, two workers at Web Werks, a web hosting company based in Mumbai, said the country’s Department of Information Technology took the equipment after...

Stuxnet's Son "Duqu" Removal Tool released by Bitdefender

Stuxnet's Son "Duqu" Removal Tool released by Bitdefender Rootkit.Duqu is a new e-threat that combines the technology of the military-grade Stuxnet with an advanced keylogger and backdoor application. Due to its rootkit technology, the piece of malware can stay hidden from the user, the operating...

Stuxnet's Son "Duqu" Removal Tool released by Bitdefender

Stuxnet's Son "Duqu " Removal Tool released by Bitdefender Rootkit.Duqu is a new e-threat that combines the technology of the military-grade Stuxnet with an advanced keylogger and backdoor application. Due to its rootkit technology, the piece of malware can stay hidden from the user, the operatin...

Jynx Kit (LD_PRELOAD) Userland Rootkit Released

Jynx Kit LDPRELOAD Userland Rootkit Released Jynx Kit is a LDPRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell based on SEQ/ACK numbers in a single packet. Solid building block for further LDPRELOAD rootkits...

Jynx Kit (LD_PRELOAD) Userland Rootkit Released

Jynx Kit LDPRELOAD Userland Rootkit Released Jynx Kit is a LDPRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell based on SEQ/ACK numbers in a single packet. Solid building block for further LDPRELOAD rootkits...

Malicious Ads on Bing Lead to ZeroAccess Trojan

Search-engine poisoning has been the bane of many Internet users’ existence for a long time, and it’s one of many security problems that seems to not be getting any better. In some ways, it may be getting worse, actually. One of the main problems these days is the use of legitimate-looking ads th...

New 'Nice Pack' Exploit Kit Found, Thousands of Owned Sites Redirecting Users to Attack Site

A new exploit pack has appeared on the scene in the last week or so and it already is causing trouble for users, with thousands of compromised Web sites redirecting users to a page that is hosting the pack and exploiting vulnerabilities on their machines to install malware. The attackers behind t...

Alureon Rootkit Morphs Again, Adds Steganography

The Alureon rootkit has become not just a major headache for its victims, with its insidious infection routines and persistence once on a machine. But it also has proved to be a challenge for researchers engaged in trying to identify new versions and unwind its new tactics and techniques. The...

GMER 1.0.15.15641 MFT Overwrite

include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application description GMER is an application...

GMER 1.0.15.15641 - MFT Overwrite

include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : [email protected] //----- Application description GMER is an application...

GMER 1.0.15.15641 MFT Overwrite

Exploit for windows platform in category dos / poc include include include include include / Program : GMER 1.0.15.15641 Homepage : http://www.gmer.net Discovery : 2011/08/01 Author Contacted : 2011/08/09 Status of vuln : 0day Found by : Heurs This Advisory : Heurs Contact : email protected //---...

BIOS based Virus discovered by Chinese Security Firm

BIOS based Virus discovered by Chinese Security Firm A Chinese AV company 360 discovered a new Trojan, the "BMW Virus" also called Mebromi, that can actually infect a computers BIOS: "BMW 360 Security Center virus is the latest catch of a high-risk virus, the virus that infected a chain BIOS...

McAfee DeepSAFE - Anti-rootkit Security Solution

McAfee DeepSAFE - Anti-rootkit Security Solution McAfee previewed its DeepSAFE hardware-assisted security technology for proactively detecting and preventing stealthy advanced persistent threats APTs and malware. The technology, which was co-developed with Intel, sits below the OS, providing the...

McAfee DeepSAFE - Anti-rootkit Security Solution

McAfee DeepSAFE - Anti-rootkit Security Solution McAfee previewed its DeepSAFE hardware-assisted security technology for proactively detecting and preventing stealthy advanced persistent threats APTs and malware. The technology, which was co-developed with Intel, sits below the OS, providing the...

Rootkit Hunter - Rootkit scanning tool

Rootkit Hunter - Rootkit scanning tool Rootkit scanner is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like: - MD5 hash compare - Look for default files used by rootkits - Wrong file...

Rootkit Hunter - Rootkit scanning tool

Rootkit Hunter - Rootkit scanning tool Rootkit scanner is scanning tool to ensure you for about 99.9% you're clean of nasty tools. This tool scans for rootkits, backdoors and local exploits by running tests like: - MD5 hash compare - Look for default files used by rootkits - Wrong file...

Kernel.org Attackers May Have Slipped Up

The attack that compromised some high-value servers belonging to kernel.org–but not the Linux kernel source code–may have been the work of hackers who simply got lucky and didn’t realize the value of the servers that they had gotten their hands on. The attack, in short, could have been far worse...

Kernel.org Server Rooted and 448 users credentials compromised

Kernel.org Server Rooted and 448 users credentials compromised The main kernel.org page is currently carrying a notice that the site has suffered a security breach. "Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we...