category
Research

Hundreds of thousands of Facebook likes can certainly be wrong

Issues with malware are always with us. There may or may not be a current media storm, or companies hoping for a slice of the anti-malware pie by proclaiming the death of antivirus in a press release, but AV labs continue to slog their way every day through tens of thousands of potentially malicious samples.

Caphaw attacking major European banks using webinject plugin

Analysis of malicious code dubbed Win32/Caphaw (a.k.a. Shylock) attacking major European banks, with ability to automatically steal money when the user is actively accessing his banking account.

Code certificate laissez-faire leads to banking Trojans

Technical analysis of malware that abuses code signing certificates normally used to positively identify a software publisher and to guarantee code is unchanged.

Free AV and relying on the luck of the Irish

ESET Ireland’s Urban Schrott has blogged recently that “Research reveals nearly half of all Irish computers depend on free antivirus for protection”.

It’s a wonderful hoax

In a world where nothing seems to be constant but change, it’s good to know that there are, in fact, some things that change fairly slowly. Unfortunately, readiness to believe and spread hoaxes is one of them.

ComboFix fixed: popular utility safe to use

ESET’s threat researchers received a surprise earlier this week when they began receiving reports from ESET LiveGrid that downloads of ComboFix, a tool popular with advanced users for removing malware, were detected as being infected by a variant of the Sality virus, Win32/Sality.NBA.

Scandal video of Justin Bieber: just don’t click here!

I received a “shared” messages from a friend about “a leaked scandal video of Justin Bieber and Selana Gomez” promising a “naked Justin Bieber”, with a Photoshopped picture, which we – for family-friendliness – censored a bit.

What do Win32/Redyms and TDL4 have in common?

At the beginning of January 2013, we started tracking the interesting Win32/Redyms trojan family. Redyms is notable for changing search results from popular search engines on infected machines.

Combofix: a cocktail of infective factors

In various blog-posts, users have been encouraged by ESET experts to download applications from the official website for that application, as you never know what might have happened to the software when you download it from a mirror site or a download site.

Straight facts about Mac malware, threats and responses

Does your Apple Mac need antivirus software, or any other kind of security software? This question has been asked repeatedly over the years and I think the “correct’ answer has changed over time.

PokerAgent botnet stealing over 16,000 Facebook credentials

The ‘PokerAgent’ botnet, which we have tracked in 2012, was designed to harvest Facebook log-on credentials, also collecting information on credit card details linked to the Facebook account and Zynga Poker player stats, presumably with the intention to mug the victims.

Your Apple Mac made even safer: Part 3 of securing new devices

If you recently acquired an Apple Mac computer there are several simple steps you can take to protect your new machine, and all of the valuable information you will be storing on it.

Linux/SSHDoor.A Backdoored SSH daemon that steals passwords

In his summary of New Year predictions by security researchers here at ESET, Stephen Cobb pointed to expanded efforts by malware authors to target the Linux operating system. Looks like that might be right: A blog post published by Sucuri yesterday describes a backdoored version of the SSH daemon discovered on compromised servers. Interestingly, this

Walking through Win32/Jabberbot.A

Malware authors have a solid track record in regards to creative Command and Control protocols. We’ve seen peer-to-peer protocols, some custom (Sality), some standard (Win32/Storm uses the eDonkey P2P protocol). We’ve seen binary protocols (Win32/Peerfrag, aka Palevo). We’ve seen other custom protocols that leverage other standard protocols such as HTTP (Win32/Georbot), DNS (Morto)and IRC (Win32/AutoRun.IRCBot.AK),

5 physical security tips for protecting your digital devices

As we read earlier this week, the chances that one or more of your digital devices may get stolen are uncomfortably high. So what would happen if your mobile device falls into the wrong hands? Here are a few tips that will help minimize the damage if it happens to you.

Mystery shopper scam: misery shopping

Money for nothing? Don’t believe it: a variation on the Mystery Shopper scam that misuses the Pinecone Research brand.

Are fears of digital device theft justified? Survey says yes

Everybody knows that laptop computers, tablets and smartphones get stolen, and everybody reading this probably owns at least one of these digital devices, so should you be concerned about yours being pinched, pilfered, peculated, purloined, or in other words, stolen?

More on that Java vulnerability

  [Update 2: a note for Mac users in Turn off that Java Lamp. And Brian Krebs notes that Oracle Ships Critical Security Update for Java] [Update to a link at java.com offering more information on disabling Java in web browsers.] This is a quick pointer to blogs posted by our colleagues in Spain and in

Java 0-Day Exploit CVE-2013-0422

The infamous exploit packs Blackhole and Nuclear Pack now feature a new zero-day Java exploit that exploits the Java vulnerability CVE-2013-0422. The latest version of Java 7 Update 10 is affected. Malware spreading through drive-by-downloads often utilizes exploit packs, which are able to serve malware variants without any user interaction, as opposed to other techniques

Imperva, VirusTotal, and whether AV is useful

Offending the AV industry is one thing, but do you want to base a security strategy (at home or work) on a PR exercise based on a statistical misunderstanding? (Yes, I’m being diplomatic here…)

Follow us

Copyright © 2018 ESET, All Rights Reserved.