Federico Biancuzzi: Virtualized rootkits - Part 1
35985
Virtualized rootkits - Part 1 &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
644327
How do you protect a home network against a hackerÂs attack?
223591
Security researcher demonstrates a way to use cross-site scripting to remotely spam an internal network printer.
316177
An attack combining malicious codes on Web sites and end-user laziness could compromise millions of routers still configured with their out-of-the-box defaults.
345138
Chapter 14: Kernel Debugging Techniques, reprinted with permission from Embedded Linux Primer: A Practical Real-World Approach By Christopher Hallinan, Published by Prentice Hall
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
612223
Thin-client computing has been around for a decade, but the rising costs of updating software and installing security patches on networked personal computers is sparking renewed interest
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
127123
Safend, an international provider of endpoint i
236872
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.The malware, called Trojan.Mebroot by Symantec, installs itself on the first part of the computer&#39;s hard drive to be read on startup, then makes changes to the Windows kernel, making it hard for security software to detect it.Criminals have been installing Trojan.Mebroot, known as a master boot record rootkit, since mid-December, and were able to infect nearly 5,000 users in two separate attacks, staged on Dec. 12 and Dec. 19, according to Verisign&#39;s iDefense Intelligence Team. In order to install the software on a victim&#39;s computer, attackers first lure them to a compromised Web site, which then launches a variety of attacks against the victim&#39;s computer in hopes of finding a way to run the rootkit code on the PC.Once installed, the malware gives attackers control over the victim&#39;s machine.The group behind this latest rootkit is the same one responsible for the Torpig Trojan, and it is believed to have already installed more than 250,000 Trojan programs, iDefense said in a report on the rootkit published Monday.The interesting thing about Trojan.Mebroot is that it installs itself on the master boot record (MBR). This is the first sector of the computer&#39;s hard drive and it is the place the computer goes to first whenever it wants to boot up the operating system. &quot;Basically, if you can control the MBR, you can control the operating system and therefore the computer it resides on,&quot; wrote Symantec researcher Elia Florio in a blog posting on Trojan.Mebroot.The criminals are using several different versions of this attack code, some of which are not currently being detected by some antivirus products, iDefense said.&quot;At the moment the AV detection is hit and miss across the board, however in the last day a number of vendors have added detection for it already,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;As for penetration, so far many people are showing it as having a low overall distribution. The concern is that the group which may be preparing to distribute the rootkit is well-prepared.&quot;Malicious software that infected the master boot record was common during the MS-DOS era, but it has not been used much in attacks in recent years.In 2005, however, researchers at eEye Digital Security gave a talk at the Black Hat security conference, showing how a rootkit could hide itself on the MBR. This Trojan.Mebroot software is derived from that code, iDefense said.Getting this kind of malicious software to work reliably is a technical challenge, and there have generally been easier ways for the bad guys to take over PCs in recent years, said Marc Maiffret, an independent security researcher who was chief technology officer at eEye when the code was first developed.Attackers were given a hand last year, however, when researchers at NV Labs published a proof of concept MBR rootkit.Maiffret said that while we may soon see more of these MBR rootkits, &quot;it won&#39;t take long for all the antivirus companies to react.&quot;&quot;It&#39;s not some new attack vector that&#39;s going to be hard to prevent,&quot; he said. &quot;It&#39;s just something that people haven&#39;t really paid attention to.&quot;
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
541857
A new device capable of detecting and throttling encrypted BitTorrent traffic hits the shelves. The game of cat and mouse between ISPs and BitTorrent users continues. In Monkey Bites.
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
141736
(Source: Webroot)  Rootkits are the latest IT security threat to make the headlines. Anyone who has heard of rootkits knows their nasty reputation: They cannot be removed, they can live on a computer for years without being discovered, and they can wreak havoc with the operating system. This Podcast Briefing gives computer users a clear explanation of what a rootkit is, separates the facts from the myths, and provides recommendations on how users can defend against rootkit infections, and detect and remove them from their systems.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
762961
Linux programmer Rusty Russell offers software that could unify some virtualization programming chores.
632672
Bad guys looking for shiny new botnets, Trojans, rootkits, and spyware this holiday season have plenty to choose from.