background preloader

Malware Intelligence Lab:More Flame/sKyWIper CNC Behavior Uncovered

Malware Intelligence Lab:More Flame/sKyWIper CNC Behavior Uncovered
Today, NSS Labs released a report detailing the performance of several vendors’ ability to detect advanced attacks. We declined to participate in this test because we believe the NSS methodology is severely flawed. In fact, the FireEye product they used was not even fully functional, leveraged an old version of our software and didn’t have access to our threat intelligence (unlike our customers). We did participate in the BDS test in 2013 and at that time we also commented on the flaws of the testing methodology. In fact, we insisted that the only way to properly test was to run in a REAL environment. 11 were non-malicious.19 were corrupted (as to why other vendors detected these because some vendors scored higher – close to 100% – means that their detection engines are based on hashes which will match regardless of whether the sample is malicious).117 were duplicates (as to why FireEye didn’t receive credit for detecting these, we never received a response from NSS).

Iran says detected massive cyber attack: state TV World Industrial Rubber Products to 2016 World Industrial Rubber Products to 2016 This study analyzes the world industrial rubber product industry. It presents historical demand data for the years 2001, 2006 and 2011, and forecasts for 2016 and 2021 by market (e.g., industrial equipment, motor vehicles, construction), product (e.g., mechanical goods, hose, belt, roofing), world region and 27 countries. The study also considers market environment factors, details industry structure, evaluates company market shares and profiles 39 global industry players including Continental, Freudenberg and Tokai Rubber. World demand to rise 5.8% annually through 2016 The global market for industrial rubber products is projected to increase 5.8 percent per year to $139.8 billion in 2016, accelerating from the growth rate during the 2006-2011 period. The motor vehicle market is forecast to post the strongest gains through 2016, reflecting a turnaround in light vehicle production, bolstering OEM sales of industrial rubber products. II. III. IV.

Flame authors order infected computers to remove all traces of the malware The creators of the Flame cyber-espionage threat ordered infected computers still under their control to download and execute a component designed to remove all traces of the malware and prevent forensic analysis, security researchers from Symantec said on Wednesday. Flame has a built-in feature called SUICIDE that can be used to uninstall the malware from infected computers. However, late last week, Flame's creators decided to distribute a different self-removal module to infected computers that connected to servers still under their control, Symantec's security response team said in a blog post . The module is called browse32.ocx and its most recent version was created on May 9, 2012. "It is unknown why the malware authors decided not to use the SUICIDE functionality, and instead make Flamer perform explicit actions based on a new module," the Symantec researchers said. Deleting a file in Windows does not remove its actual data from the physical hard disk.

Overview Flame malware hijacks Windows Update to spread from PC to PC The Flame espionage malware targeting Iranian computers contains code that can completely hijack the Windows update mechanism that Microsoft uses to distribute security patches to hundreds of millions of its users, security researchers said Monday. Flame components known as "Gadget" and "Munch" allow Flame operators to mount a man-in-the-middle attack against computers connected to a local network that hosts at least one machine already infected by the malware, Kaspersky Lab expert Alexander Gostev wrote in a blog post published Monday. By exploiting weaknesses in Microsoft's Terminal Server product—and poor key-management decisions made by Microsoft engineers—the Flame architects were able produce cryptographic seals falsely certifying that their malicious wares had been produced by Microsoft. According to Kaspersky's Gostev, Flame attackers have been using the same fraudulent Microsoft certificates to spoof the company's widely used Windows update mechanism.

Global and China 1,4-Butanediol (BDO) Industry Report, 2011-2012 United Nations views Flame as cybersecurity opportunity | Security & Privacy The United Nations has seized on the appearance of the Flame worm, which targeted computers in the Middle East, to argue that it should have more authority to deal with cybersecurity threats on the Internet. Last week, the United Nations' International Telecommunication Union circulated a statement about Flame saying the malware "reinforces the need for a coordinated response" that could come from "building a global coalition." It took credit for Flame's discovery, saying Kaspersky Lab identified it "following a technical analysis requested by the ITU." ITU spokesman Paul Conneally told CNET this morning that "the mandate that ITU has with regard to cybersecurity goes back to the World Summit on the Information Society, where world leaders gave ITU the mandate as sole facilitator for 'building confidence and security in the use of information and communication technologies.'" A U.S. "If we are not vigilant," warned Rep. "But nobody trusts the ITU," Lewis says.

Essential Oils - Top 10 Global Markets This market research report package offers an in-depth perspective on the actual market situation, trends and future outlook for essential oils in top 10 global markets. The analyses provide essential market information for decision-makers including: United States, China, Japan, Germany, France, United Kingdom, Italy, Russia, India and Canada Overall market value for essential oils by countryOverall market volume for essential oils by countryMarket value and volume for essential oils by type (bergamot, lemon, lime, orange, other citrus fruits, geranium, jasmin, lavender and lavandin, peppermint, other mints, resinoids, vetiver, other essential oils)Product pricesForecasts and future outlook of the marketCountry overview, macroeconomic indicators and indicators of doing business This market analysis package answers to questions such as: What is the size of the essential oil market in different countries?

A Massive Web of Fake Identities and Websites Controlled Flame Malware | Threat Level Map showing the number and geographical location of Flame infections on Kaspersky customer machines. Courtesy of Kaspersky Lab The attackers behind the complex Flame cyberespionage toolkit, believed to be a state-sponsored operation, used an extensive list of fake identities to register at least 86 domains, which they used as part of their command-and-control center, according to researchers at Russia-based antivirus firm Kaspersky Lab. Kaspersky says the size of the command-and-control infrastructure, which appears to have been still partially active a few days ago even after the operation was publicly exposed, exceeds anything they’ve seen before. “The huge amount of fake domains and fake identities used to run this infrastructure is pretty much unprecedented and unlike any other malware that we have seen before,” said Roel Schouwenberg, senior antivirus researcher at Kaspersky Lab. Chart showing the domains the attackers registered for Flame and the registration dates.

Related: