Security Response

The authors of the Storm worm (also know asTrojan.Peacomm) have shown an uncanny knack of changing or shedding keycomponents of the threat in order to enhance its persistence andspread. This week saw the latest incarnation of the threat, Trojan.Peacomm.D,reveal itself as halloween.exe or sony.exe. What is most interestingabout this latest variant of the Storm worm is that its authors haveremoved some key functionality that was present in the previousvariant, Trojan.Peacomm.C. Specifically, the threat no longer;
1. infects other legitimate drivers on the system. Previous variantsinfected drivers such as Tcpip.sys and Kbdclass.sys. This was astealth-like feature used by the threat to start early with theoperating system and without...

Recent reports have shown thatTrojan.Bayrob is scamming people again. The latest victim lost over€5,000 to the scam but luckily was able to track down where the moneyhad been sent. Unfortunately the final destination for the money was aWestern Union outlet in Greece, after having been first sent through amoney mule in the US.

Once Trojan.Bayrob is executed on a user’s system it can interceptall traffic to eBay. It can then show the infected user any contentthat it chooses instead of the real pages and it can also alterinformation that is shown to the user from the real pages.Trojan.Bayrob is used to scam people who are trying to buy cars oneBay.

The attack is a targeted attack and as such it is difficult toestablish the exact methods that are used to distribute the Trojan;however, from evidence gathered thus far the attack works in a mannersimilar to the following:
• The attacker posts an auction on eBay.
• This auction is used to gain...

I recently attended a pair of conferences in Las Vegas (yes, lovely Las Vegas). Not only was it hot, but because I was staying in one hotel and the conferences were in two other hotels, I had a long hike between where I was sleeping and where I was attending. Needless to say, walking through the desert heat I had lots of time to think about why I was dumb enough not to bring water with me, think about where the nearest air conditioning was, and also to think about things that I’ve said in front of crowds or things I’ve heard other people say. One of the most common phrases I heard at the conferences was “risk mitigation.” Well really, what does that mean?

I hear a lot of vendors talk about how they help clients mitigate their risks and how they use technical infrastructure to do so. But, should we mitigate risks? Well, let’s start with reminding ourselves what “mitigate” means. Dictionary.com defines “mitigate” as: to lessen in force or intensity, as...

Welcome back. In my previous blog I was telling you about Kohno et al discovering how we can manipulate a Windows machine into starting to timestamp in the middleof a non-Tsopt enabled flow. If we have control of a machine that aWindows client connects to or we act in a man-in-the-middle (MiTM)capacity on a flow involving Windows hosts, we can perform a simpletrick. The “attacker” must actively modify a TCP SYN/ACK packet halfwaythrough the regular TCP handshake with a Windows host (server toclient) to incorrectly contain Tsval in violation of thetimestamp standard. If RFC 1323 guidance was adhered to in thissituation, a Windows system facing such an unexpected Tsopt in SYN/ACKwould not begin to timestamp its packets. However, it was discoveredthat if we introduce such a Tsopt-enabled SYN/ACK we can trick...