Technical paper: Journey inside the Blackhole exploit kit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

One of the most common questions we receive at SophosLabs is "How are users most likely to get infected with malware?".

As regulars readers will be aware, the answer is through the web. More specifically, computers are most likely to be infected through compromised legitimate websites redirecting user traffic to malicious websites that are hosting some exploit kit.

The most active of these exploit kits in recent times is one known as Blackhole.

Properly understanding how the Blackhole exploit kit works and why it has become the most popular of the various exploit kits available is important in order to provide the best protection to our customers.

Previous research focused on early versions of the Blackhole exploit kit, and the tricks used by the attackers in evading detection.

More recently, SophosLabs expert Gabor Szappanos has been delving deeper into the internal workings of the Blackhole exploit kit, to get a more thorough understanding of how it works.

Gabor's technical paper, entitled "Inside a Black hole", is now available, and I would encourage all readers to download it and learn more about the Blackhole exploit kit.

http://twitter.com/SophosLabs

Plug hole image from Shutterstock.

View the original article here

Technical paper - Fake anti-virus: The journey from Trojan to a persistent threat

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Fake anti-virus (also known as scareware) has grown over the years into a persistent and prevalent threat and is now one of the largest families of malware that we've seen in recent history.

In this new technical paper from SophosLabs, threat researcher Jagadeesh Chandraiah studies the evolution of fake anti-virus over the last three and a half years.

He looks at the major fake anti-virus events, infection vectors and some important anti-emulation/anti-reverse engineering (RE) tricks used by fake anti-virus packers.

He also analyses how exploit kits are used to infect users with fake anti-virus and studies how a polymorphic packer found in underground internet forums is used to encrypt and compress the malware binary.

Read: Fake anti-virus: The journey from Trojan to a persistent threat

http://twitter.com/SophosLabs

Fake stamp image, courtesy of Shutterstock

View the original article here

Technical paper: The ZeroAccess rootkit under the microscope

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

ZeroAccess is a sophisticated kernel-mode rootkit that is quickly becoming one of the most widespread malware threats.

In a new technical paper from SophosLabs, malware researcher James Wyke explores the ZeroAccess threat, examines how it works and looks at what the malware's ultimate goal is.

ZeroAccess has a resilient peer-to-peer command and control infrastructure, runs on both 32-bit and 64-bit versions of Windows, and has been constantly updated with new functionality, allowing it to thrive on modern networks and operating systems.

From the distribution mechanisms used to spread it, through the installation procedure, memory residence and payload, the technical paper offers a deep insight into how ZeroAccess works.

Because people have asked - Yes, Sophos Anti-Virus can detect, block and remediate this rootkit and the various malware which uses it:

1. Infected files will be detected and blocked as Mal/ZAccess-x, Troj/ZAccess-x, Mal/Sirefef-x or Troj/Sirefef-x , where x denotes an alphabetic suffix (e.g. -A, -B). On a properly-protected system, this should prevent infection in the first place.

2. Active processes will be reported and blocked by the Sophos run-time HIPS (Host Intrusion Detection System) as HPmal/ZAccess-A. This gives an extra layer of safety by providing proactive detection and prevention even of samples which evade detection in (1) above.

3. The Zero Access rootkit itself will be detected in kernel memory, and can be cleaned up, as Troj/ZAKmem-A. This means that the malware can be remediated even on systems where the rootkit is already active and stealthing.

Follow @SophosLabs

Computer and virus images, courtesy of Shutterstock

View the original article here

Technical paper: Learn about the Blackhole exploit kit

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

The Blackhole exploit kit first reared its head in late 2010. Since then it's grown to be one of the most notorious exploit kits ever seen.

In this technical paper, "Exploring the Blackhole Exploit Kit", SophosLabs' Fraser Howard lifts the lid on Blackhole.

He describes in detail how it works and the various files used to exploit machines and infect them with malware.

Fraser discusses how the kit has become so successful by uncovering and explaining the tricks used by Blackhole.

From how a user's web traffic is controlled to how the attackers attempt to evade detection, the paper offers a great insight into how Blackhole works.

Blackhole image, courtesy of Shutterstock

View the original article here