Security Center White Papers

Symantec Security Response offers white papers on a range of issues relating to Internet security.

2017

• A guide to the security of voice-activated smart speakers
• ISTR Email Threats 2017
• ISTR Ransomware 2017
• ISTR Financial Threats Review 2017
• ISTR Living off the land and fileless attack technique

2016

• The Increased Use of PowerShell in Attacks
• Ransomware and businesses
• Financial threats 2015
• Dridex financial Trojan
• The Waterbug attack group
• The Apple threat landscape

2015

• The evolution of ransomware
• The Black Vine cyberespionage group
• Butterfly: Corporate spies out for financial gain
• Dyre: Emerging threat on financial fraud landscape
• The evolution of the fileless click-fraud malware Poweliks
• Mistakes in the IaaS cloud could put your data at risk
• Uncovering a persistent diet spam operation on Twitter
• Insecurity in the Internet of Things
• Analysis of malware targeting the Boleto payment system
• The state of financial Trojans 2014
• W32.Ramnit analysis

2014

• Regin: Top-tier espionage tool enables stealthy surveillance
• Attacks on point-of-sales systems
• The continued rise of DDoS attacks
• Threats to virtual environments
• How safe is your quantified self?
• Dragonfly
• Targeted attacks against the energy sector

2013

• The State of Financial Trojans 2013
• Mobile Adware and Malware Analysis
• ZeroAccess Indepth
• Hidden Lynx: Professional Hackers for Hire
• Stuxnet 0.5: The Missing Link
• Trojan.Bamital
• The World of Financial Trojans

2012

• Crisis: The Advanced Malware
• Ransomware: A Growing Menace
• State of Information Global Results Report
• State of Information Global Results Infograph
• State of Information Canada Results Report
• State of Information Canada Results Infograph
• Analysis of Flamer C&C Servers
• The Elderwood Project
• W32.Changeup: How the Worm was Created
• Trojan.Neloweg: Bank Robbing Bot in the Browser
• Android.Opfake In-Depth
• Scams and Spam to Avoid on Facebook
• Trojan.Taidoor: Targeting Think Tanks
• Trojan.Zeroaccess Infection Analysis
• The Luckycat Hackers
• Rootkits

2011

• December - Windows 8 Security
• October - The Nitro Attacks: Stealing Secrets from the Chemical Industry
• October - W32.Duqu: The precursor to the next Stuxnet
• October - Motivations of Recent Android Malware
• August - W32.Xpaj.B: Making Easy Money from Complex Code
• July - Sality: Story of a Peer-to-Peer Viral Network
• June - A Window into Mobile Device Security
• May - W32.Qakbot in Detail
• W32 Stuxnet Dossier

White Papers Archive 2010 - 1996

2010

• Portable Document Format Malware
• Reputation-based Security
• The Risks of Social Networking
• The Rise of PDF Malware
• Pay-Per-Install: The New Malware Distribution Network

2009

• Brightmail™ Anti Phishing
• A False Positive Prevention Framework for Non-Heuristic Anti-Virus Signatures
• Zeus: King of Bots
• A Museum of API Obfuscation on Win32
• Inside the Jaws of Trojan.Clampi
• Firefox and Malware
• The Bredolab Files
• W32.Waledac
• Containing An Outbreak
• The Downadup Codex, Edition 2.0
• The Downadup Codex, Edition 1.0
• Web Based Attacks
• Your Computer is Now Stoned

2008

• Clean Data Profiling
• Symantec Spam Report - February 2008
  
• Symantec Spam Report - January 2008

2007

• Symantec Spam Report - December 2007
• Symantec Spam Report - November 2007
• A Testing Methodology for Antispyware Product’s Removal Effectiveness
• A Testing Methodology for Rootkit Removal Effectiveness
• Symantec Spam Report - October 2007
• Symantec Spam Report - September 2007
• Symantec Spam Report - August 2007
• Symantec Spam Report - July 2007
• Symantec Spam Report - June 2007
• Symantec Spam Report - May 2007
• Peerbot: Catch me if you can
• What next? Trojan.Linkoptimizer
• Symantec Spam Report - April 2007
• Windows Vista Network Attack Surface Analysis
• The Panda Outlaw: W32.Fujacks
• Stealing Virtual Assets from a Virtual World
• Symantec Spam Report - March 2007
• Symantec Spam Report - February 2007
• Symantec Spam Report - January 2007
• Attacks on Virtual Machine Emulators

2006

• Evolving Shell Code
• Phishing Attacks In and Around April through September 2006
• The Teredo Protocol: Tunneling Past Network Security
• Me Code Write Good: The l33t skillz of the virus writer
• Windows Vista Kernel Mode Security
• Malicious Yahooligans
• Windows Vista Security Model Analysis
• Regional Threats
• Inside the Windows Meta File Format
• Criss Cross
• Stories from the DRM World: The Settec Case
• Drive-By Pharming

2005

• When Malware Meets Rootkits
• The Evolution of Malicious IRC Bots
• Techniques of Adware and Spyware
• Threats to Online Banking
• Symantec Security Update, July 2005, Worldwide and Japan
• Symantec Security Update, July 2005, Worldwide and EMEA
• Symantec Security Update, July 2005, Worldwide and APAC
• Symantec Security Update, July 2005, Worldwide and Americas
• Symantec Security Update, June 2005, Worldwide and Japan
• Symantec Security Update, June 2005, Worldwide and EMEA
• Symantec Security Update, June 2005, Worldwide and APAC
• Windows Rootkit Overview
• IM_a nuisance – W32.Imav.A
• IME as a Possible Keylogger
• "Phishing In The Middle Of The Stream" Today’s Threats To Online Banking

2004

• A Short Course in Antivirus Software Testing: Seven Simple Rules for Evaluating Tests

2003

• Privacy: A Study of Attitudes and Behaviors in US, UK and EU Information Security Professionals
• Malicious Threats and Vulnerabilities in Instant Messaging
• An Analysis of the Slapper Worm Exploit
• Cyberterrorism
• Virus and Vulnerability Classification Schemes: Standards and Integration
• Cyberterrorism and the Home User
• Striking Similarities: W32/Simile and metamorphic virus code
• Malicious Threats of Peer-to-Peer Networking
• Hunting for Metamorphic

2002

• Managing Security Incidents in the Enterprise
• 32-Bit Virus Threats on 64-Bit Windows
• What's In a Name?
• Secure Instant Messaging
• Blended Attacks Exploits, Vulnerabilities and Buffer Overflow Techniques in Computer Viruses
• Wireless LAN Security: Enabling and Protecting the Enterprise

2001

• Responding to the Nimda worm: Recommendations for addressing blended threats
• Assets, Threats and Vulnerabilities: Discovery and Analysis
• Symantec's Digital Immune System
• The Economics of Information Warfare

2000

• Threats to WAP Enabled Devices
• Malicious Threats to PDAs
• Attacks on Win32 Platforms: II
• NTFS Streams: A Primer
• Virus Bulletin: Palm [Pilot] Breach
• Script-based Mobile Threats
• Internet Security for the Web

1999

• Learn More About Viruses and Worms
• Memory Scanning Under Windows NT
• Understanding and Managing Polymorphic Viruses
• Lower IT Costs Through Better Anti-Virus Management
• Office 2000 Vulnerability

1998

• Bloodhound Technology

1997

• Understanding Virus Behavior in 32-bit Operating Environments
• Understanding Virus Behavior in the Windows NT Environment
• Understanding Symantec's Anti-Virus Strategy for Internet Gateways

1996

• Understanding and Managing Polymorphic Viruses

Other Resources

Monthly Threat Report

ISTR

Archived Publications