AV Killer Analysis Report

09.28.2007 - 4:33 PM
AV Killer Analysis Report AV Killer is currently the king of viruses in China. In the first half of this year, 3 Chinese anti-virus companies published this virus as their top-level virus alert. Most virus writers have the same dream: to disable anti-virus software so the virus can run itself on a computer without any limitation. Therefore, many virus authors try many different methods to disable anti-virus software. AV Killer is this kind of virus, and uses the IFEO method. What is IFEO? IFEO stands for "image file execution options". This technology can redirect execution of a file...
Read more »

Storm Worm Chronology

09.26.2007 - 1:16 PM
The notorious "Storm Worm" series of spam attacks is interesting for several reasons. One, of course, is its simplicity as a social engineering attack. The lures are presented as very short, simple emails, enticing the victim to click the links proferred, and run the downloaded file.
Read more »

K.I.S.S. Principle

09.24.2007 - 4:32 PM
Keep it Simple Stupid: KISS principle states that design simplicity should be a key goal and unnecessary complexity avoided. The K.I.S.S. principle also applies to information security attacks in many ways. The most recent example is something we picked up on this month. It is a very simple malicious code attack that is very simple, yet is very affective.
Read more »

Tapping into the Opera JavaScript Interpreter

09.21.2007 - 2:28 PM
In our last blog we saw a neat way to decode javascript obfuscation by hooking mshtml!docuemnt.write of IE 7. If you didnt read our last blog here you can find it at http://www.websense.com/securitylabs/blog/blog.php?BlogID=142. This week we're going to do the same thing for the Opera web browser, and yes we going to do the same thing to Opera.
Read more »

The Malware That Keeps On Giving

09.19.2007 - 3:37 PM
The industry is faced with more malware than ever before. And it's a big challenge to analyze everything each day. The next day is not going to be any easier, so you need to keep going with a quick pace.
Read more »

Phast Phlux Phishing

09.13.2007 - 2:34 PM
Some time back in April of this year, MySpace founder Tom made an announcement to fellow MySpacitizens that links to sites outside of MySpace on their profiles would appear on their profile...
Read more »

Tapping into the IE 7 JavaScript Interpreter

09.05.2007 - 11:18 AM
Obfuscation in JavaScript is certainly nothing new to malicious code authors, who typically use various obfuscation techniques to get around intrusion detection systems (IDS) that primarily rely on signatures for detection.
Read more »