Research | WeLiveSecurity

Research

Expert content, for researchers by researchers

Research

Community Driven Privacy and Facebook: PC / Mac / iPhone Dependent?

Is online privacy with Facebook technologically agnostic or can different rules apply if you post with your iPhone or other Smartphone? Are early adopters somehow compromised with their mobile device usage? Can a social media company make money while adopting user-driven privacy which impacts their revenue potential and shareholder value?

McAfee FP news misused for more SEO poisoning

We're now seeing a fiercely concentrated Blackhat SEO campaigns exploiting the McAfee False Positive (FP) problem. Juraj Malcho, our Head of Lab in Bratislava, reports that in a Google search like the one I've screendumped above, he got three malicious hits in the top ten (the same ones captured here: of course, the malicious domain

McAfee and SEO poisoning: there but for the grace…

ESET is not going to try to capitalize on McAfee's unfortunate false positive problem (and nor, I'm sure, is any other reputable vendor). Such problems can arise for any AV vendor: it's an inevitable risk when you're trying to walk the line between the best possible detection of threats and avoidance of false detections (someone please

Top 10 signs your computer may be part of a Botnet

There are few signs that indicate your computer is part of a botnet that might not be indicating something else. Any malware can cause almost all of the same symptoms that a bot can. Sometimes conflicts between programs or corrupted files can cause the same symptoms as well, but still, there are some signs that

The IRS Has a Message for You

Well, assuming you are a US taxpayer, and don’t expect to see the message in an email. Tax day is past and now it is time for the fake IRS emails and scams. What of you didn’t pay enough taxes or are owed a refund? The IRS isn’t going to send you an email about

Another Look at Koobface: How It Infects Facebook Users

Earlier this month, we reported on the massive new Koobface campaign making the rounds through Facebook and how it tricked users into downloading and running it through that tenet of social engineering, the fake codec. We now have a video showing how the Koobface worm tricks users into running it: NOTE: The audio is not

Kinetic Warfare vs. Cyberwarfare

Coaches in competitive sports often play to their team’s strengths in order to win. Does this apply to warfare, specifically cyberwar versus traditional war, or kinetic warfare? In a well articulated article Terry Zink talks about the current Cyberwarfare debate on the Hill:   The rules of engagement for offensive counter strikes [in cyberwarfare] are

There’s Nothing of Value on My Computer

From time to time I hear people who don’t use antivirus software claim that it doesn’t matter, there isn’t anything of value on their computer. To begin with, just controlling your computer is of value to some criminals. If I can control your computer I can get paid to send spam from it, to install

Google Hack: No Comment

UPDATE: Kurt Wismer has just reminded me of a very apposite blog he posted in 2007: http://anti-virus-rants.blogspot.com/search/label/single%20sign-on.] A little more information further to my earlier blog. The H (Heise) gives us a number of links to its earlier stories about the Google compromise and tells us that Google have declined to comment on the New

Cybercrime and Cyberwarfare: Warnings Unheeded?

Last week Al Quaeda cyberterrorism attack information was declassified and made public. Today’s New York Times had an applicable editorial to whether cybersecurity issues are over-blown or under-believed: Predictions of disaster have always been ignored — that is why there is a Cassandra myth — but it is hard to think of a time when

Google: Single Sign‑On, Single Point of Failure?

Spoof or SPOF? IT Security reportage veteran John Markoff reports in the New York Times that the attack on Google's intellectual property reported in January was even more interesting (and disquieting) than most of us realized. According to an unnamed source, some of the information stolen related to the company's password system, Gaia. Gaia is a

Gmail spam: an inside job?

Aleksandr Matrosov, Senior Virus Researcher at ESET Russia, has brought to our attention an avalanche of reports of hacked Gmail accounts. While the exact nature of the hack isn't confirmed, it appears that spammers were able to access the victim's address books in order to send junk mail from the compromised accounts to their owner's

Some possibly interesting links and a very old new paper

If you regularly follow my blogs, you'll know that while this my primary blogspot, it isn't the only site to which I post (see signature for full details). Here are a few recent blogs and microblogs that may be of possible interest. @Mophiee asked me about the ICPP Trojan on Twitter (where I'm @ESETblog or

SEO poisoning, Londoning and Icelanding

I was asked whether I'd seen SEO (Search Engine Optimization) poisoning relating to the Icelandic eruption and the very widespread grounding of aircraft in Europe. Well, there were certainly attempts in March to exploit the earlier Eyjafjallajokull eruption in order to drive googlers interested in finding out more towards malicious web sites. So it would be naive

Smells Like Teen Spirit

I've just read a news item about a nine year old boy who has been accused of hacking into his school's computer system. It seems police claim the nine year old hacked into the Blackboard Learning System used by his school to change teacher's and staff member's passwords, change and delete course content and change

Good Password Practice: Not the Golden Globe Award

The Boston Globe suggested  that changing passwords is a waste of time, based on their interpretation of an article by Herley Cormac. Cormac's paper – well worth reading, by the way – reinforces a point that has been made many times both by me and by the "user education doesn't work" lobby. While I don't believe that education is useless,

Please do not change your password – The Boston Globe

I find it hard to not be shocked at a headline like this… Then I remembered the recent top cybercrime city survey conducted by one of our competing software vendors which had Boston ranked the SECOND HIGHEST risk city in the entire United States. I’m also not one to simply lie down and let cybercriminals

Java 0‑Day: who’s brewing the coffee?

Further to Pierre-Marc's blog yesterday about in-the-wild exploitation of the Java Development Kit vulnerability publicised by Tavis Ormandy, David Kennedy has brought to our attention a comprehensive article on the same topic published yesterday by FireEye's Atif Mushtaq.  You may remember that Atif exchanged thoughts and info with us a while ago in relation to

Cyberwarfare and Music: It’s All Tempo

Old joke: how can you tell a lousy drummer is at your front door? The knocks keep slowing down. Tempo of operations are similar in that if you can keep a fast, sustained rhythm outpacing the adversary, you’ll keep the initiative. If your side knows when the tempo is supposed to speed up or slow