Company > Blog News and views from the leading voice in secure digital transformation Menu Home Product Insights Security Research Company News Zscaler Life More From This Author ThreatLabz Insights and Research January 19, 2016 5 Min readMusic-themed Malvertising Lead To Angler Overview Malvertising, or "malicious advertising," is not a new threat, and just a few weeks into 2016 ThreatLabZ has observed a malvertising campaign injecting iframes into banner advertisements that lead to Angler E... Insights and Research November 03, 2015 5 Min readChinese Government Website Compromised, Leads To Angler Introduction Despite a recent takedown targeting the Angler Exploit Kit (EK), it's back to business as usual for kit operators. On 30-October-2015, ThreatLabZ noticed a compromised Chinese government website that le... Insights and Research August 20, 2015 6 Min readNeutrino Campaign Leveraging WordPress, Flash For CryptoWall Overview Neutrino Exploit Kit (EK) appeared on the scene around March of 2013 and continues to remain active and incorporate new exploits. In the beginning of July, Neutrino reportedly incorporated the HackingTeam 0da... Insights and Research May 20, 2015 6 Min readRIG Exploit Kit Infection Cycle Analysis Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spur... Insights and Research April 03, 2015 6 Min readAngler Exploit Kit Utilizing 302 Cushioning And Domain Shadowing Overview Angler Exploit Kit is one of the most prevalent and advanced exploit kits in use today and is continually evolving. Angler continues to utilize malvertising to push landing pages and malicious actors are stil... Insights and Research February 11, 2015 4 Min readOngoing Angler Exploit Kit And Bedep Fraud Campaign In our recent post covering CVE-2015-0311, two of the Command and Control (C&C) domains used in the Domain Generation Algorithm (DGA), mapped back to the same Server IP address - 46.105.251.1. They were also using th... Insights and Research January 09, 2015 4 Min readChanitor Downloader Actively Installing Vawtrak We at ThreatLabZ are keeping an eye on a fairly active downloader called Chanitor. This malware is being delivered via phishing emails purporting to be "important" documents, for example, voicemails, invoices, and faxe... Culture December 10, 2014 2 Min readZscaler Wins Glassdoor Employees' Choice Award Zscaler is proud to be honored today as one of the top 50 best places to work in 2015 by Glassdoor in its Annual Employees’ Choice Award. Unlike other awards there was no self-nomination process, instead it’s entirely... Insights and Research September 18, 2014 3 Min readNuclear Exploit Kit - Complete Infection Cycle Zscaler ThreatLabZ has been seeing a steady increase in the Nuclear Exploit Kit (EK) traffic over the past few weeks. The detection of malicious activity performed by this EK remains low, due to usage of dynamic content ... Insights and Research September 08, 2014 3 Min readRIG EK Outbreak Continues During daily data mining activities, we observe continual outbreaks of many exploit kits (EK) such as RIG EK. Logs are monitored and analyzed to come up with new protections, which are eventually deployed in the Zscaler ... Insights and Research July 23, 2014 5 Min readDe-obfuscating The DOM Based JavaScript Obfuscation Found In EK’s Such As Fiesta And Rig There is little doubt that exploit kit (EK) developers are continuing to improve their techniques and are making exploit kits harder to detect. They have heavily leveraged obfuscation techniques for JavaScript and are ut... Insights and Research May 11, 2014 3 Min readBackdoor Xtrat Continues To Evade Detection While reviewing recent reports scanned by ZULU, we came across a malicious report that drew our attention. It was notable as the final redirection downloaded ZIP content by accessing a PHP file on the domain 'www.stisa... Insights and Research February 21, 2014 3 Min readProbing Into The Flash Zero Day Exploit (CVE-2014-0502) Yesterday, a targeted campaign leveraging a Flash zero day exploit hit the news. Adobe has now released a security bulletin regarding this vulnerability. Based on the attack vector mentioned in prior research, we have co... Insights and Research January 24, 2014 3 Min readAnalysis Of A VBScript Bot Introduction: In the long list of complex threats that we see daily, it is interesting to see malware that is rather simple but effective in terms of the payload that it carries. At Zscaler ThreatLabZ... Insights and Research January 09, 2014 5 Min readThe Story Of A Trojan Dropper III Introduction: In previous posts (story of Trojan dropper part I, II) we performed both static and dynamic analysis on the threat and also developed a broad idea of what the malware was doing in it’s initial stages. ... Insights and Research December 29, 2013 2 Min readThe Story Of A Trojan Dropper I Introduction: Recently, Zscaler ThreatlabZ received a suspicious file from one of our customers, which was named “OrderDetails.zip”. After extracting the executable file from the archive I have performed... Insights and Research December 28, 2013 4 Min readThe Story Of A Trojan Dropper II Analysis: Lets analyze the PE file in detail and see what it’s up to. Like most malware, this sample was packed and in order to properly analyze it, we must begin by unpacking the binary. Keeping this in min... Insights and Research December 26, 2013 3 Min readInfection Found On ‘feedburner.com’ Recently, we have seen the websites of MySQL and PHP.net being compromised. We have also blogged about Google Code being used as a drop site for holding malicious code. These instances clearly suggest that attackers are... Insights and Research December 17, 2013 2 Min readAurora Exploit Still Floating ... It's been around two years since Microsoft released a patch for the IE 0day famously known as the Aurora exploit (CVE-2010-0249). We had blogged about this in the past when it was first seen in the wild on the 'GOV.CN'... Insights and Research October 29, 2013 4 Min readNuclear Exploit Pack Getting More Aggresive Churning through our logs, we recently observed a significant rise in the number of transactions involving the Nuclear Exploit Pack, which has been in the news for quite some time now. In the past week, we stumbled upon ... Insights and Research September 18, 2013 2 Min readBangalore Metro Rail Site "bmrc.co.in" Compromised Bangalore's Metro Rail project website (Bangalore Metro Rail Corporation Limited), "bmrc.co.in" is compromised. Malicious obfuscated JavaScript has been injected into several pages. The obfuscated code contains an ... Insights and Research August 26, 2013 3 Min readExpack Continues Exploiting Java Vulnerability Exploit kits available in the wild tend to follow a trend by exploiting vulnerabilities reported in various browser components which are commonly deployed. Recently, we have seen an increase in exploitation of a year old... Insights and Research August 17, 2013 2 Min readMalicious .jar Files Hosted On Google Code Recently we blogged about Google Code hosting malware. Within a month we have observed a second instance where malicious .jar files are being hosted on Google Code. Using Google code to distribute malware seems to incr... Insights and Research August 16, 2013 2 Min readAnatomy Of An Ongoing Drive-by-Download Campaign While doing a weekly review of our logs, we stumbled upon thousands of transactions that seem to be a part of an ongoing malware campaign. We found compromised websites that redirect the browser to an exploit kit, fu... Insights and Research June 01, 2013 2 Min readRise In Red Kit Exploit Kit Activity This week, a malicious pattern of activity was observed in websites being compromised, which in turn redirected to a Red Kit exploit kit (EK) landing page. Some infected websites that were seen: neptunebenson[dot]com... Insights and Research May 21, 2013 3 Min readDarkleech Attack Continues To Grow The Apache Darkleech attack has been in the news for quite some time now. The first compromise that we identified in our transactions dates back to mid-March. This Darkleech exploit (aka Linux.Cdorked) injects malicious... Insights and Research April 26, 2013 1 Min readScanning Binaries For PE Format Anomalies After processing tons of malicous binaries, I would like to share my findings about anomalies found in PE binaries. These anomaly information will be helpful for security researchers on suspicious sample validation and... Insights and Research March 15, 2013 1 Min readGuess Who Am I? PE Or APK Update: I happened to find this sample. However, it was corrupted. So I made a demo file by myself. Notepad.exe was used as PE stub, and I embedded a MALICIOUS APK sample into it. So the magic number was ... Insights and Research March 13, 2013 2 Min readHey AndroGuard, I Will Crash You Or Your Python Buddy! AndroGuard is a popular tool to be used to analyze android APK files by security professionals. Quite a few APK analysis tools have been built based on it. They usually call Python library to unzip APK files before reve... Insights and Research March 07, 2013 2 Min readAndroid Application Obfuscation I had the opportunity to attend 2013 RSA last week. Compared with less than five vendors last year, there were more than 20 vendors focusing on mobile security. I found something interesting on android application obfusc... Insights and Research February 08, 2013 1 Min read“Say Cheese!” Let’s Take A Picture For You Guys, Packer Families. Gong Xi Fa Cai!恭喜发财 It’s the last weekend of the Chinese New Year, Year of Snake. from http://www.divinecaroline.com The Chinese New Year is the most important Chinese holiday. Tradit... Insights and Research February 01, 2013 3 Min readIs Your Windows 8 Packed? Windows 8 is HOT! Security researchers are busy finding Windows 8 vulnerabilities while users are figuring out how to find the restart button in the new interface UI. Windows 8 is definitely one of the big ... Insights and Research January 18, 2013 2 Min readTwins Born In Different Years With Even Different Faces? PC-AV-in-cloud And Mobile-AV-in-cloud It is rare for twins to have different birthdays. But thanks to the increasing mobile malware, a set of twins have shown up with birth year 2007 and 2013 respectively. Their names are PC-AV-in-cloud and Mobile-AV-in-clou... Insights and Research January 03, 2013 2 Min readMonster Is Lurking….Beware!!!! Monsterindia.com is a very popular Indian job search website and a subsidiary of Monster Worldwide. If you are using Monster job search app for Android then you need to be aware of the fact that it’s le... Insights and Research December 31, 2012 2 Min readCreating A Basic Configuration Profile For An IPhone Or IPad. Apple provides a free enterprise configuration tool for streamlining the process of configuring iOS devices known as the (iPCU). This article will provide a quick overview of what a configuration profile ... Insights and Research October 31, 2012 2 Min readEnterprise Traffic Decrease In Wake Of Hurricane Sandy We have received several requests inquiring as to the changes in enterprise Internet activity in the regions impacted by Hurricane Sandy. There is no question that the hurricane impacted the US in a variety of ways.... Insights and Research October 19, 2012 3 Min readBlackhole Exploit Kit V2 On The Rise It should come as no surprise that attackers are upgrading their Blackhole exploit kits to a new and more powerful version. An update is now available, thanks to the launch of Blackhole Exploit Kit v2 and we are starti... Insights and Research September 13, 2012 1 Min readBeware Of IPhone5 Scams Following Apple's announcement of the iPhone 5 yesterday, we have certainly seen a large number of web transactions to domains/URLs related to this subject. While you may covet the latest and greatest gadget, this is ju... Insights and Research July 31, 2012 2 Min readLondon Olympics Email Scams (updates) In light of the popularity of the Olympics knowing that scammers will come out of the woodwork to take advantage of the event – we're continually monitoring for Olympic scams and maliciousness, no matter how unsophistica... Insights and Research July 28, 2012 2 Min readLondon Olympics: Stay Away From Scams, Data Theft And Phishing The Summer Olympics in London have kicked off and cyber criminals, spammers and data thieves are wasting no time, capitalizing on Olympic related scams. Currently, the volume of websites selling bogus Olympic tickets ar... Insights and Research July 27, 2012 7 Min readLondon Olympics 2012: Prime Time For Spammers Spammers love major events as they present an opportunity to social engineer victims with content that they’re likely to be interested in. The Olympics represent a golden opportunity for spammers – the world’s largest ... Insights and Research July 02, 2012 1 Min readMass Compromise Includes ComputerWorld MX We were alerted to this from a customer reporting that Zscaler was blocking pages on www.computerworldmexico.mx And as evidence of this, was our Zulu report - which when we looked at it showed that the p... Insights and Research June 26, 2012 2 Min readCleartrip.com Infected With Blackhole Exploit Kit. Cleartrip is used for booking flights, hotels and IRCTC Indian Railways tickets in India. It is a leading online booking portal. Recently, I was searching flight information on www.cleartrip.comand my desktop antivir... Insights and Research April 09, 2012 2 Min readPDF Exploits Targeted Through Blackhole Exploit Kits. PDF exploits have been targeted by Blackhole exploit kits for some time now. The Blackhole exploit kit will deliver various malicious PDF files to a user if the victim is running a potentially vulnerable version of Adobe... Insights and Research April 06, 2012 4 Min readMac OSX Flashback Confusion And Hype We, like most in the security community, have been following the latest developments with the Mac OS X Flashback Trojan and it's exploitation of the recently patched Java vulnerability (CVE-2012-0507). This story has a ... Insights and Research March 30, 2012 4 Min readOn-Going Dynamic FakeAV Campaign Looking back on traffic from this week, I noticed a large spike in the number of companies accessing free TLD / Dynamic DNS related sites. Digging deeper it appears that a malware campaign tied to massive WordPress comp... Insights and Research March 20, 2012 2 Min read"Super Bowl" And "March Madness" In The Enterprise 3/26 Update: I was approached and asked to run stats to do a bit of comparison and contrast with Sports traffic from last year - with the goal in mind to identify if there was a noticeable percentage increase in Sports (... Insights and Research January 31, 2012 1 Min readMSUpdater Trojan And Link To Targeted Attacks This blog post is based on a joint report by Zscaler and Seculert. Researchers from both companies separately identified attacks which used a remote access tool (RAT) malware that apparently targeted defense-related orga... Insights and Research January 19, 2012 2 Min readSOPA Protest: Wikipedia Traffic Trend (updated) Updated 1/19: we have updated charts and the narrative to reflect all of 1/18 (protest timeframe) data and the first 10 hours of today. The last graph shows about a 365% increase in visits to their SOPA Initiative page a... Insights and Research January 16, 2012 2 Min readPopularity Of Exploit Kits Leading To An Increase In Compromised Websites The dominance of exploit kits like Blackhole, Incognito and others, continues to be seen in the wild. Attackers continue to use these exploit kits to generate malicious webpages and host them on various domains... Insights and Research December 13, 2011 1 Min readJava Drive By Download Attack Recently I blogged about how attackers are forcing users to download fake codecs to spread malicious content. I’ve also encountered across another drive by download attack vector, which uses Java applets to execute downl... Insights and Research December 06, 2011 1 Min readFake Video Codecs Still Going Strong Convincing users to download malicious software using fake AV pages is not a new attack vector, but has been a very successful one. Julien has previosuly blogged about how fake codecs are starting to replace fake AV page... Insights and Research November 29, 2011 1 Min readCyber Monday Transactions - Indication Of Economy? Last year I did a post on the transactions that we saw related to online shopping on Cyber Monday - as I indicated in the past, yes there is a spike. And looking at the transactions this year, again we notice a spike: ... Insights and Research November 16, 2011 4 Min readFacebook: Anatomy Of Self-Inflicted Javascript Injection Many are already familiar with "likejacking" (a form of "clickjacking") in which a user is tricked into clicking on and interacting with the Facebook "like" button -- this has been one of the most common vectors of abusi... Insights and Research November 10, 2011 1 Min readAdobe Flash “SWF” Exploit Still In The Wild. A vulnerability reported in Adobe Flash in April 2011 (CVE-2011-0611) continues to be targeted. When first reported, the vulnerability was widely exploited by embedding a “.swf” file into Microsoft Office documents/html ... Insights and Research November 10, 2011 4 Min readAnalyzing Malicious Files For Writing Network Signatures Attackers continually modify malware in order to evade antivirus software. Attackers will pack or encrypt malicious files using various packers. Blocking each and every malicious executable is a challenging task for anti... Insights and Research October 30, 2011 1 Min readSiam Commercial Bank Phish In The Wild Targeted Phishing attacks for banking and financial domains are a popular way for attackers to steal sensitive data from customers. To counter these attacks, banks and other financial institutions are driving various cam... Insights and Research October 27, 2011 1 Min readNow “ce.ms” Free Domains Are Being Used To Host Malicious Code A few months back, I posted a blog on “co.tv” domains being used by attackers to host malicious code . We had identified number of different domains being used to carry out attacks using heavily obfuscated JavaScript. No... Insights and Research October 26, 2011 3 Min readIPAbuseCheck Stats Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, ... Events October 19, 2011 2 Min readIPAbuseCheck: Clients Abusing Web Proxies IPAbuseCheck was designed to provide a simple, free web interface to query your IP addresses against a database that we have built containing unauthenticated IP addresses that have attempted to forward abusive or unwante... Events October 18, 2011 1 Min readBeware Of Fake Websites Stealing Credit Card Information People often uses credit cards online to purchase products but many people fail to validate the site address and proceed with submitting sensitive information such as card numbers. Attackers can then steal credit card in... Insights and Research October 12, 2011 2 Min read"1.php" Group Intrusion Set Paper Update: report links now go straight to the paper versus the general Whitepaper page. ThreatLabZ has just released a report that provides a summary of incident information related to the "1.php" Group. Historically, t... Insights and Research September 13, 2011 2 Min readFacebook Free T-shirt Scams Take Advantage Of Email Upload Attackers on Facebook are continually taking advantage of new ways to get their content onto a user’s wallpost, in order to further propagate their scams. Recently, we came across yet another interesting scam, this one o... Insights and Research August 23, 2011 2 Min readDNS Changes Lead To W32/Rorpian Update: Upon receiving additional file-system information from an infected host, the malware that resulted in being dropped was a TDSS variant, which corresponds to the earlier statement about Rorpian being used as a ... Insights and Research August 22, 2011 1 Min readBe Aware Of Gmail Phishing Pages Phishing is certainly not a new attack vector but attackers are constantly using it to fool victims into entering sensitive information like authentication credentials. As I mentioned in a blog post a couple of years bac... Insights and Research August 22, 2011 3 Min readBitcoin Mining Malware For those unfamiliar, Bitcoin is a digital P2P currency (here's a more detailed video explanation if interested) - people interact with it using locally or hosted "wallet" software. It should not come as much of a surpri... Insights and Research August 17, 2011 3 Min readThe Pastebin Trend (cont.) In June during some of the LulzSec pastes, I published a brief blog post on our sister blog (Scrapbook). In that post, I discussed a spike in Pastebin web transactions due to the LulzSec information drops and other contr... Insights and Research August 06, 2011 1 Min readBlackhole Exploit Kit Continues It’s Dominance Today, I was investigating a block that had been triggered on a webpage due to detection of the Blackhole exploit kit. We previously posted a blog about the rise in Blackhole exploit kit detections back in February, 2011... Insights and Research August 03, 2011 2 Min readMalicious URL’s Using DWORD Formatted IP Addresses IP stands for Internet Protocol. An IP address is numerical label assigned to each device on the network and every website has a unique IP addresses to identify the site on the Internet. As an IP address is difficult... Insights and Research July 28, 2011 3 Min readCurrent Trojan Ambler Activity Update with sinkhole results: About 24 hrs later from registering the one Trojan Ambler .net domain mentioned below and monitoring the sinkhole, I only saw about a dozen infected unique client IPs "correctly" check-in... Insights and Research July 26, 2011 1 Min readMalware Distribution Using Fake YouTube Pages Attackers often create fake YouTube pages in an effort to lure a victim into downloading malicious binaries. During our research, we recently found an example of such a site. When a victim visits the page, a security war... Insights and Research July 21, 2011 2 Min readManually De-obfuscating Malicious Content Most of the time, malicious obfuscated JavaScript is injected at the bottom of a webpage. Obfuscation is leveraged both to hide the true purpose of the code from prying human eyes and in an attempt to bypass security sca... Insights and Research July 14, 2011 1 Min readObfuscated Exploits Continue To Target CVE-2010-0806 And CVE-2010-3962 A pair of “use-after-free” aka “uninitialized memory corruption” vulnerabilities (CVE-2010-0806 and CVE-2010-3962) in Internet Explorer were reported in November 2010 and remain among the favored client-side attack ... Insights and Research June 29, 2011 2 Min readIRS, NACHA, Etc. Mal-spam I posted a few of these mal-spam incidents on our Scrapbook blog ... this sort of mal-spam has been on-going, but there has been a recent uptick since early June. The NACHA, Federal Reserve, and now IRS mal-spam sites ha... Insights and Research June 21, 2011 1 Min readPatching Flash - CVE-2011-2110 Post-mortem Last week I blogged about the CVE-2011-2110 Adobe Flash vulnerability being actively exploited in the wild. Adobe released its patch exactly a week ago (Tuesday, June 14) ... I wanted to do a follow up to identify the pa... Insights and Research June 17, 2011 1 Min readOh Flash! CVE-2011-2110 0-Day This past Tuesday, June 14, a vulnerability (CVE-2011-2110) in the Adobe Flash Player was patched. This vulnerability is actively being exploited in the wild - prior to the patch, the earliest exploitation that we have s... Insights and Research June 14, 2011 2 Min readIncognito Exploit Kit Exploit kits are becoming an increasingly popular means of spreading attacks. Umesh recently blogged about seeing a spike in the usage of the Blackhole exploit kit. This exploit kit targets multiple known vulnerabilities... Insights and Research June 11, 2011 1 Min read.co.tv Domains Serving Heavily Obfuscated Malicious Code Following a previous post on a malicious Google News search, we identified additional domains related to this attack, also serving malicious code. The method of infection remains the same by injecting a malicious script,... Insights and Research June 10, 2011 1 Min readZscaler Analyst Scrapbook Introducing our sister blog: Zscaler Analyst ScrapbookVery often while we're conducting log analysis across our cloud in order to add security protections (signatures, black listing, reputation scoring, etc.) we find int... Insights and Research June 10, 2011 2 Min readGoogle News Search Results For Laurence Fishburne Leading To Malicious Sites One of our blog readers, Mr. Jon Leathery informed me yesterday about a link in a Google News search leading to a malicious website. “Laurence Fishburne leaving CSI”, was a popular topic recently and was being taken adva... Insights and Research May 23, 2011 2 Min readCashing In On ‘ScamBook’ Last week, Umesh blogged extensively about the Facebook Scams. The previous scams have demonstrated that Facebook is struggling to contain these attacks. While some attacks seek to spread malicious code, many that we see... Insights and Research May 20, 2011 2 Min readIs 360.CN Evil? ... a tough and controversial question to answer (I'm sure there will comments on this). 360.cn is a Chinese provider of "free security software", more specifically: "360.cn is a Chinese anti virus program th... Insights and Research May 17, 2011 2 Min readFacebook Under Attack By Scammers Facebook is facing no shortage of attacks from scammers. Yesterday, I posted a blog about a recent scam being circulated on the Facebook network and only a few hours later, we uncovered yet another one. The goal of this ... Insights and Research May 16, 2011 2 Min readYet Another Facebook Scam – You Look So Stupid In This Video Today, we have come across yet another rapidly spreading Facebook scam. The ultimate aim of this scam is to coerce Facebook users into completing various surveys which in turn generate money for the scammer. The messages... Insights and Research May 15, 2011 1 Min readIndia’s DNA E-newspaper Website Infected With Fake Antivirus Campaign DNA (Daily News and Analysis) is an Indian daily English language newspaper. According to Wikipedia, DNA ranks 8th among the top ten English dailies in India. Recently, the Zscaler solution was blocking access to this si... Insights and Research May 15, 2011 2 Min readGeek.com Hacked With An Exploit Kit Update 15/04/11 @ 3.40pm IST: With further research, it has come to our attention that many different pages like main homepage, about us page are infected with malicious Iframe pointing to different malicious sites. ... Insights and Research May 09, 2011 1 Min readRajasthan State Marketing Site Infected With Malicious Code India’s Rajasthan State Co-operative Marketing Federation Ltd (http://rajfed.gov.in/) has been infected with a malicious script tag. This government site promotes the objectives of procuring agricultural produce from far... Insights and Research May 06, 2011 3 Min readHelp Center URL Validation Vulnerability (CVE-2010-1885) Campaign I've recently noticed a number of transactions to: vvvvvv.dyndns-mail.com/ 46.254.16.61 (PTR: www.asl-s.com) Update: we're now seeing this attack hosted as well on: blog.dyndns-blog.com googlepics.dyndns.... Insights and Research May 06, 2011 3 Min readAnother Trojan Bamital Pattern The other day I detected a handful of Bamital infected clients beaconing out with a different pattern than that listed in EmergingThreats, and thought I'd post something for the masses to consume and be on the lookout fo... Insights and Research May 04, 2011 2 Min readKoobface Worm Still Spreading Using Social Engineering Attack Vectors The Koobface worm is not new to Internet users, but remains very active and continues spreading through different mediums using a variety of techniques. Last year, we have blogged about Koobface worm activity. We are sti... Insights and Research May 03, 2011 2 Min readLatest Victim Of An Exploit Kit - Lenovo, India Update 05/04/11 @ 7.49pm IST: Thanks to feedback from an Anonymous blog poster, I've done some further investigation and this attack actually appears to be tied to the Incognito Exploit kit as opposed to the Blackhole ... Insights and Research April 15, 2011 3 Min read30 Days Of Cycbot Introduction: I started doing some analysis on a beaconing pattern that I observed this past week. Initially the pattern and domains that I observed had little open-source information available for my searches, bu... Insights and Research April 04, 2011 2 Min readWorldfest, Houston Website Compromised Before The Start Of The Event Today, one of our blog readers, Mr. Steve Kennedy posted a comment saying his antivirus alerted on “http://www.worldfest.com”. It appeared to be related to the Blackhole exploit kit, which I’d discussed in a previous blo... Insights and Research March 23, 2011 2 Min readRandomization Of Code And Binaries Used By A Fake Antivirus Website Last week, I talked about heavy obfuscation being used by attackers to hide their HTML source code from detection. This time we came across an interesting fake antivirus website, which not only continually changes the so... Insights and Research March 18, 2011 3 Min readHeavy Obfuscation Used By Fake Antivirus Websites Just a few days back, I published a post discussing the popularity of fake antivirus websites in 2011. As I mentioned in the blog, attackers are continually creating new domains and websites promoting their fake software... Insights and Research March 09, 2011 3 Min readAnalyzing PDF Exploits For Finding Payloads Used We have written a couple of previous blogs which focus on an in-depth analysis of PDF exploits as this is yet another techniques used by attackers to package malicious code and avoid antivirus detection. We have also wri... Insights and Research March 08, 2011 2 Min readFake Security Software Websites – Still Popular In 2011 Fake security software is a form of computer malware that misleads users into installing and potentially paying for fake security software. The sites convince users to download the malicious software by displaying fake s... Insights and Research March 08, 2011 1 Min readTrojan Infection Through Facebook It’s no surprise to see Facebook becoming a primary focus for spreading malware. Attackers are leveraging Facebook as a means of reaching end users, delivering links in order to convince victims to click on them. The lin... Insights and Research March 07, 2011 2 Min readWebFusion “nosferatu” SEO/FakeAV Campaign This afternoon, we received a report that a number of websites, especially those tied to WebFusion were compromised and were being leveraged in an SEO campaign to redirect victims to FakeAV malware. For example, most of ... Insights and Research March 01, 2011 2 Min readBSNL, Bangalore Website Yet Another Victim Of Malicious Code Injection BSNL, Bangalore telecom district has become yet another victim of poor website security and has been infected with malicious JavaScript code. This time, the code points to a malicious domain used by the popular Gumblar b... Insights and Research March 01, 2011 2 Min readInjecting Malicious HTML IFrames – Still A Popular Attack Vector Injecting malicious HTML IFrames into the legitimate web pages has become a commonplace technique in web based attacks. We recently came across another website that is infected with a malicious IFrame. Further research s... Insights and Research February 24, 2011 1 Min readICWAI Site Infected After KVGBANK, now ICWAI has also been found to be the victim of an iFrame injection attack. My previous blog post reveals how famous sites from India like UPSC and KVGBANK have been compromised. These are reputable site... Insights and Research February 13, 2011 1 Min readKVGBANK Affected With Malicious JavaScript Karanataka Vikas Grameena Bank is victim of an attack. The site is comprised by the injection of malicious obfuscated JavaScript. Home page of kvgbank.com : Obfuscated JavaScript : Multilevel obfuscated ... Insights and Research February 11, 2011 2 Min readBlackhole Exploits Kit Attack Growing Recently, we have seen an increase in Blackhole exploit kit attacks. Blackhole is yet another web exploit kit developed by Russian hackers. According to one forum, the author indicates that the kit will cost $1,500 annua... Insights and Research February 11, 2011 5 Min readIn Depth Analysis - Decoding HTML Style Tag Based Malicious Iframes Injecting clear text or obfuscated malicious Iframes has become a common attack vector. By taking advantage of known/unknown vulnerabilities in web servers or applications, an attacker can inject a malicious Iframe which... Insights and Research February 07, 2011 2 Min readFacebook And The HTTPS/Security Paradox Last month, Michael published his 2011 security predictions. His second prediction in his list of 10 discussed SSL Only Sites: In 2011, expect a handful of major vendors to finally tackle this challenge head on and depl... Insights and Research February 02, 2011 1 Min readEgyptian Revolution ... Back Online In the days during the Egyptian Internet outage, a number of Egyptian's circumvented the outage through a variety of methods. Speak2tweet is one example of a work-around in which Egyptians could phone in their tweets usi... Insights and Research January 30, 2011 3 Min readEgypt ... Now Just Gyped There are a number of good references discussing the recent events in Egypt and the subsequent Egyptian-government ordered Internet shutdown (ISPs in Egypt have withdrawn their routes via BGP- timeline). This shutdown in... Insights and Research January 25, 2011 3 Min readWeb Transactions Per User Per Day I searched the web recently looking for statistics on the average number of web transactions that end-users make per day, and equations for estimating end-user web transactions. I couldn't find anything that was worth re... Insights and Research January 24, 2011 1 Min readAlexa Illustrates Web Security Risks (part 2) I wanted to circle back and close the loop from my original post on this. First- not surprisingly I’m not the only one to have taken note at malicious sites landing in Alexa (reference sucuri.net blog). I wrote some s... Insights and Research January 24, 2011 3 Min readUsing TheBrain To Visualize Web Transaction Logs For those unfamiliar with TheBrain - it is a highly interactive mind-mapping software, which includes a free edition called the PersonalBrain. I have used this software on-and-off for a few years, and really like it for ... Insights and Research January 20, 2011 1 Min readExploit In The Wild For MS06-014 – A Five Year Old Vulnerability Although 0day vulnerabilities receive all the attention, it’s not unusual to see attackers still taking advantage of old vulnerabilities to attack end users. Here's such an example where the vulnerability used was MS06... Insights and Research January 11, 2011 2 Min readAlexa Illustrates Web Security Risks (part 1) I recently needed to look at some Alexa data related to their tracking of the top web domains visited for a side project that I was working on.During my investigation of their data, I found it interesting to see a number... Insights and Research December 07, 2010 6 Min readTop Abuses Of Open Web Proxies While there is nothing new or Earth-shattering in this post, I thought I'd share what I have seen as the top abuses of open web proxies - as this is an everyday occurrence involving a large volume of web transactions and... Insights and Research November 30, 2010 1 Min readAmazon Profiles Used For Spam Amazon's online store-front has a social networking component to it, where people with accounts can create user and seller profiles to share their interests, what they are reading, listening to, selling, etc. For the mos... Insights and Research November 30, 2010 1 Min readCyber Monday In Review Cyber Monday is hyped every year as the largest online shopping / deals day of the year. How was your Cyber Monday? This is a short post on some of what we saw. Our perspective is from the corporate end user (i.e., peopl... Insights and Research November 10, 2010 3 Min readLethic Botnet Returns, Uses "Realtek" Identifier Remember Stuxnet? Chances are you do- a few months back there was a worm that spread over USB using the 0-day .LNK vulnerability (CVE-2010-2568) and targeted Siemens SCADA systems. Additionally the rootkit package that i... Insights and Research November 01, 2010 4 Min readDetecting Firesheep Firesheep, a Firefox plugin to do session hijacking ("sidejacking") by snooping on a LAN/WLAN and identifying session cookies passed in the clear over HTTP was released last week at Toorcon. To my surprise, this tool rec... Insights and Research October 29, 2010 1 Min readHalloween Likejacking Campaign I've already described (Facebook) "likejacking" in a past blog post, and we mentioned a likejacking campaign in early October here. The latest one going around has the title:"OMFG!! The 10 Most WEIRD Facts About HALLOWE... Insights and Research October 29, 2010 2 Min readExploitation Using Publicly Available Base64 Encode/decode Code Earlier, I blogged about malicious hidden Iframes using publicly available Base64 encode/decode scripts. Recently, we have seen additional malicious JavaScript hosted on one website, using another publicly available Base... Insights and Research September 25, 2010 2 Min readNew Orkut Worm: “Bom Sabado!” – Good Saturday For Orkut Users Today, on 25th September 2010, a new worm affecting Orkut emerged. I received several calls from friends asking about this new Orkut worm. They told me that their scrapbook was flooded with text messages called “Bom Saba... Insights and Research September 21, 2010 1 Min readTwitter ReTweet Spam (XSS) This morning before I even logged into my system, I was receiving inquiries about the Twitter Spam going around. The source looks like: And appears in Twitter as: For those unfamiliar with t.co, it is Twitter's l... Insights and Research September 01, 2010 1 Min readNew PPI Campaign PPI being pay-per-install ...This morning I saw some interesting transactions to:hxxp://promoupdate.info/setup###.exewhere ### are numbers, for example, "519".MD5: 1568edcd29629f577207d7396646b741VirusTotal results 8/43 ... Insights and Research September 01, 2010 2 Min readGoogle Code Hosting Website Used To Spread Malware Again Last year, there was discussion of Google Code, a site which allows developers to host their projects, being used to spread malware. We have now found yet another case where Google Code is being used to spread malware. A... Insights and Research August 31, 2010 2 Min readBeaconing Leads To Swarft Trojan & Suspicious Netblock Often, open-source information helps to confirm our suspicion about certain web transactions being tied to an infection or download of something malicious. While conducting analysis on the results from some of my script... Insights and Research August 25, 2010 3 Min read66.220.17.200 A Haven For Swizzor Update:Based on a comment, I modified the title to be 66.220.17.200 versus DNSMADEEASY. Let me explain:DNSMADEEASY provides the resolution / name services for the domains in questionHurricane Electric / C2 Media provide... Insights and Research August 19, 2010 1 Min readUnion Public Service Commission Website Of India Compromised My previous blog discussed the injection of malicious JavaScript into the html/JS pages of a Red Cross website. This time victim of similar attack is an Indian government website, namely http://upsc.gov.in/ . Screen-s... Insights and Research August 12, 2010 1 Min readRed Cross Hacked Again!!! It seems as though attackers are fond of Red Cross sites as this isn’t the first time that we’ve blogged about a compromised Red Cross site. The victim this time was the Red Cross of Serbia. Previously, they hacked the s... Insights and Research August 04, 2010 2 Min readAnalysis Of Recent "Trojan Tacorti" Malware Run The past few weeks I noticed a handful of "free access" / "open for free access" malware binary executables. There was some information in the open source about this, but not much piecing the entire picture together - in... Insights and Research August 04, 2010 3 Min readPDF Exploit: Number Of Pages Is The Key PDF exploits targeting a number of recent Adobe vulnerabilities exist in the wild. In the past, we have seen number of different obfuscation and decoding techniques being used by the exploits to avoid anti-virus detectio... Insights and Research July 21, 2010 2 Min read.LNK (CVE-2010-2568) / Stuxnet Incident We’ve had a number of inquiries regarding the .LNK (CVE-2010-2568) vulnerability and related Stuxnet malware. There are a number of stories (for example, CNET) that detail the timeline of events and the SCADA angle to th... Insights and Research July 19, 2010 3 Min readPlaceblogger And Others Lead To Imgwebsearch Spam Over the weekend I was playing around with the iPad application SkyGrid to read the latest news stories on particular subjects. In one of my feeds that I setup for mobile security I saw a story with the title "GvHpMqAVt.... Insights and Research July 16, 2010 1 Min readExploit Targeting A 7 Year Old Vulnerability? Really? We’ve actually spotted in-the-wild exploitation of “Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness” (Bugtraq ID 10514), a vulnerability first released in 2003. The exploit does get a little mo... Insights and Research July 15, 2010 2 Min readATECH-SAGADE Badness - Malicious .IN Campaign I'm working on generating our Q2 2010 Stats and Trends report, and I noticed a large number of blocked exploit kit activity from domains registered with the .IN TLD. These were not hacked sites but domains registered for... Insights and Research June 28, 2010 2 Min read'LikeJacking' - What Is It? In the past few days I've had a number of people send me URLs that they received from friends on Facebook that seemed unusual and asked me what is this? In each of these cases, the answer was 'LikeJacking' - while this h... Insights and Research June 25, 2010 1 Min readZeus C&C (Avalanche) Recent Zeus C&C activity has been observed from: mnbvicdij4uhdjb5421knnkd.com At the time of posting, the domain is not present in ZeusTracker. The domain is currently fluxing (Fast-Flux), notice short TTLs and n... Insights and Research June 25, 2010 1 Min readIPad Beta-Testing Scam I saw this being spam advertised on Facebook: Tammi Tyler appears to be a throw-away, spam profile used for this campaign. The bit.ly link takes the follower to: hxxp://www.theigadget.com/?80af9787 Site advertis... Insights and Research June 10, 2010 1 Min readRobint.us SideNote: "CuteQQ" A report of the malicious JavaScript on robint.us can be seen in this Wepawet report. I noticed that within the JS, the variable name "cuteqq" was used for evaluating the payload - this sounded really familiar. Google "c... Insights and Research June 10, 2010 1 Min readRobint.us – Case Study In Mass Website Infection There have been numerous reports about the IIS/ASP SQL injection compromises that redirected users to ww.robint.us. See below for reading on this incident: http://www.sophos.com http://blog.sucuri.net/2010/06/mas... Insights and Research May 27, 2010 2 Min readA Brief Gumblar Infrastructure Analysis Earlier this week, I had a request to analyze and describe why we were blocking customer access to: hxxp://www.fdotfirstcoastouterbeltway.com/index.asp (note: this page has since been cleaned) Analysis of the page... Insights and Research May 20, 2010 1 Min readBanking Malware Uses PAC File There have been a few recent posts (1, 2) of malware that set and use proxy auto-config (PAC) files to steal victim banking credentials. I thought this was interesting and decided to write a quick post on this. PAC files... Insights and Research May 17, 2010 1 Min readAdobe Groups Abused We've seen Google Groups and a host of other sites that permit user driven content to redirect to malware or other nonsense. This morning I saw a rash of Adobe Groups posts redirecting to fake pharmacy sites (pharms / p... Insights and Research May 14, 2010 1 Min read300% Increase In Malicious JARs While doing some stats & trends on our data, I noticed that there has been a steady rise in the number of malicious Java Archive (JAR) files that we are blocking (pulling data from both within our logs and blacklists... Insights and Research May 11, 2010 5 Min readInline Detection Of Evil JavaScript Exploit kits are a much more common threat on the web than they used to be. In order to evade detection, the kits frequently contain logic to obfuscate, or hide, the meaning behind the content that they serve to the vict... Events May 07, 2010 3 Min readMore And More Obfuscation Being Used In The Malicious Scripts As we saw in a previous blog post, malicious, obfuscated JavaScript is being injected into legitimate webpages. Attackers not only use simple obfuscation techniques, but also leverage rather complex approaches to hide th... Insights and Research May 04, 2010 1 Min readChina’s NCGA Government Site Infected With Hidden Malicious Iframe Today, we discovered that NingBo SME Credit Guarantee Association (NCGA), a Chinese government web site, is infected with a malicious hidden IFRAME. Of the infected page, is one where member registration is required. Her... Insights and Research May 02, 2010 2 Min readMalicious Hidden Iframes Using Publicly Available Base64 Encode/decode Script As we have seen, many websites are infected with malicious IFRAMES. The IFRAMES are either injected as plain text or they are heavily obfuscated using JavaScript. Obfuscation is intentionally used by attackers to bypass ... Insights and Research April 30, 2010 1 Min readStorm Worm 2.0 A detailed analysis was provided, here, on the new version of the Storm Worm making it's rounds this week. I went looking in our logs for HTTP POSTs to three and four character GIF and JPG files with relatively small req... Insights and Research April 28, 2010 2 Min readFollowing Recent QQ Phishes QQ is a popular email and instant messaging service within China. In yesterday's logs I saw entries for:aq.qq.com.cn-inddex.comqq.com.cn.indexx-cn.comFollowing the pages, the display looks identical to the qq.com pages.... Insights and Research April 20, 2010 2 Min readFun With N-gram Analysis A former colleague and I had discussed character based analysis of domains to provide indications of suspicious / malicious usage. For example, the Avalanche botnet has a domain registration and fast-flux infrastructure... Insights and Research April 06, 2010 2 Min readCVE-2010-0806 Exploit In The Wild CVE-2010-0806, a use-after-free vulnerability in the Peer Objects component, was announced in mid-March 2010. The vulnerability impacts Internet Explorer 6, 6 SP1, and 7 - a patch was made available by Microsoft in the M... Insights and Research March 29, 2010 2 Min readWhitepaper: Botnet Analysis Leveraging Domain Ratio Analysis While conducting stats and trends for last Quarter's "State of the Web" report, I found an interesting way of analyzing top-level domains (TLDs). I added the total number of web transactions involving a TLD for the mont... Insights and Research March 18, 2010 4 Min readTrojan Monkif Is Still An Active And Consistent Botnet Threat While we have seen in a recent Koobface blog post showing sudden rise and fall in Koobface network activity, the Trojan Monkif’s C&C requests are still being consistently seen. According to the data, the Trojan Monki... Insights and Research March 15, 2010 6 Min readKoobface Worm Hits On Weekend – Increase In New C&C Servers On Sunday 14th 2010, Zscaler detected a large number of Koobface worm transactions over the Internet. Koobface is a computer worm, which was first found in December 2008 and is still spreading heavily. The Koobface worm ... Insights and Research March 08, 2010 3 Min readIn The Wild PDF Exploits Using A Combination Of “ASCIIHexDecode” And” ASCII85Decode” Filters In the last few months, we have seen many blogs on PDF exploits related to filters like “ASCIIHexDecode”, “FlateDecode”, etc., being used to avoid Antivirus detection. The idea employed by attacker’s leverages differen... Insights and Research March 05, 2010 1 Min readRedcross Site Hacked In this morning's logs I noticed that Zscaler detected malicious content within redcross-esc.org web-pages. Turns out that the site was a victim of a malicious iFrame injection, and I thought a short post on this would b... Insights and Research March 04, 2010 3 Min readAre You A Victim Of An Injected Malicious Hidden Iframe? People surf to a number of web pages throughout the day - online shopping, banking, social networking, search engines, etc. But do they know when something bad is happening behind the web page visible in their browser? A... Insights and Research February 11, 2010 3 Min readGoogle Buzz For Spammers The Google Buzz sign-up is being advertised to users when logging into Gmail, and is a fairly transparent process to users with an existing Gmail account. Clicking on “Sweet! Check out Buzz” brings you to yo... Insights and Research February 05, 2010 1 Min readIndian Gov't Site Victim Of Ad Campaign I noticed an Inidan Gov't site in Zscaler's blocked logs from yesterday: hxxp://www.hil.gov.in Hindustan Insecticides Limited: A Government of India Enterprise (I'm sure you can appreciate the irony here, as ins... Insights and Research January 28, 2010 1 Min readBlackhat SEO Is New Spam It used to be that when you checked your email and/or email spam folder there would be a slew of messages with links or attachments that would have titles related to the popular subjects of the time, and would be used to... Insights and Research January 25, 2010 2 Min readIE 0-Day On GOV.CN A few days back, there was a post on a forum about malware warnings displayed when visiting: www[dot]latax[dot]gov[dot]cnTranslates:Upon analysis of the page, it appears that this GOV.CN page is hosting a page exploiting... Insights and Research January 14, 2010 1 Min readHaiti Earthquake Also Rocks Internet (Update) Following my previous post, I had lots of questions about what we are seeing in terms of malware and fraud taking advantage of the Haiti earthquake. Not surprisingly we have seen an increase of web transactions to cha... Insights and Research January 13, 2010 1 Min readHaiti Earthquake Also Rocks Internet The magnitude 7.0 earthquake rocked Port-Au-Prince and its surrounding area on Tuesday, January 12, 2010 at 13:53:09 PST (21:53:09 UTC) according to USGS. Within the hour, the shock resonated on the Internet. The securit... Insights and Research December 22, 2009 2 Min readMalware Attacks On Winter Solstice - Shortest Day Of The Year 2009 Yesterday, December 21st 2009 was the Winter Solstice, meaning that it was the shortest day of the year. Malware authors did not miss this opportunity to push their malicious binaries using SEO (search-engine optimizatio... Insights and Research December 21, 2009 2 Min readBeware Of SEO Attacks On Sunday, Tom Stuker, a United Global Services member that flew about 700,000 miles this year, was interviewed on Fox News. Not long after that, the top Google search results for Tom Stuker were all poisoned to have lin... Insights and Research December 18, 2009 1 Min read1 Week 'til XMAS... Avoid Shopping Woes Many folks are familiar with fake goods sites (e.g., replica watches and fake pharm / pill sites). These sites either peddle shoddy goods, or just flat out steal your payment credentials. In case you needed to be remi... Insights and Research December 18, 2009 2 Min readDon't Watch-familyguyonline.com ... or at least be careful if you do. Who doesn't like a good episode of Family Guy? Well even if you don't, that isn't the point of this post. There are dangers visiting and trusting sites that link to and embed conten... Insights and Research December 16, 2009 2 Min readNew Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 2 Earlier, in the first blog of this series we talked about a malicious PDF file and extracted the malicious script. Now, we have a malicious script in readable format and want to know if this successfully runs or not. I a... Insights and Research December 16, 2009 3 Min readNew Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 1 On December 14th, Symantec and Shadowserver reported a new zero day vulnerability in the wild affecting Adobe reader. This is now identified as CVE-2009-4324. Adobe acknowledged the same on their website saying they are ... Insights and Research December 14, 2009 4 Min readCase Study: Fake Codec Leveraging LastFM The Fake Codec / Fake Anti-Virus malware campaign, historically led by the Russian Business Network (RBN), has been going on for some time (here's a blog post dating back to 2006). Dancho Danchev's blog often details... Insights and Research December 14, 2009 1 Min readXSS Embedded IFrames Today we saw a variety of pages being advertised that have search.htm and other pages vulnerable to cross-site scripting (XSS) being used to inject an iframe to a malicious webpage redirector. To an unknowing user follow... Insights and Research September 18, 2009 3 Min readIn The Wild Flash Exploit Analysis – Part 2 In the first blog, we talked about how a recent Flash exploit works using heap spraying. In this blog, we will see how the shellcode functions and how it downloads malicious binaries to an infected system. If you remembe... Insights and Research September 10, 2009 4 Min readIn The Wild Flash Exploit Analysis – Part 1 Today, one of my colleagues requested that I provide additional details about a web page that we had blocked for a customer. The blocked URL was ‘hxxp://www.39sys39.cn/htm/ie.html’. He wanted details about the threat pre... Insights and Research July 07, 2009 2 Min readCloud Transparency During A Crisis The beginning of July was a big week for data center outages with some notable Internet impact. I've written before about cloud resiliency and uptime in my 'Changing a tire while going 60mph' and 'Big, white puffy clouds... Insights and Research June 15, 2009 3 Min readPatches, Auto-updating, And Convenience June has been a busy month for web-centric security patches. Microsoft fixed 31 different vulnerabilities (many affecting IE and Office), Adobe patches critical vulnerabilities in Adobe Acrobat and QuickTime, Google plug... Insights and Research June 07, 2009 2 Min readPage Is Loading… Please Wait Web access is a critical activity for virtually all jobs, but how many employees recognize the risks that can be encountered simply by viewing a web page? How many times have you encountered web pages with a title such... Insights and Research May 18, 2009 3 Min readActiveX Vulnerabilities – Threat To Web Security As I mentioned in my earlier blog, phishing is a never-ending threat for web security. Another threat for web users is the rise in the ActiveX vulnerabilities. These are very easy to exploit as there is a great ... Insights and Research May 15, 2009 6 Min readThose Who Know Where And When You Surf Nobody likes the idea of a big brother watching over them as they surf. Yet as browser technology evolves, we are starting to have some privacy-violating "byproducts" of innocuous features. Now, we already generally acce... Insights and Research April 17, 2009 2 Min readPublic Service Announcement: EFF Coder's Rights Project I ran across this today, and thought it was just too valuable to not make mention of. The EFF has a "Coder's Rights Project" that includes FAQs and guides related to the legalities of security disclosure, reverse enginee... Insights and Research April 13, 2009 2 Min readSpoofing Caller-ID: The New Hacking Inroad It is amazing to see the number of bridged services that rely upon the source telephone address of an incoming call (supplied via caller-ID) or SMS message as a form of authentication. Maybe this made sense in the 90's w... Insights and Research March 30, 2009 6 Min readAntivirus: Can't Live With It, Can't Live Without It Like you and many other responsible Internet users, I run antivirus software on my desktop. Even leaving the performance issues out of it, I find it very frustrating to configure and use. I get that it's complicated behi... Insights and Research March 26, 2009 3 Min readChanging A Tire While Going 60mph In my previous post Big, white, puffy clouds can still evaporate, I mentioned the Google Gmail outage from February and pointed out the implied resiliency (or lack there-of) of cloud-based platforms. Rich Miller over at ... Insights and Research March 23, 2009 3 Min readNew Browser Security Model Needed For SaaS? As the age of Software as a Service (SaaS) becomes realized, we are finding that this new way of doing business can sometimes be at odds with previous methodologies and processes. Note that this is not particularly insig... Insights and Research March 13, 2009 4 Min readPatch To Get Some New Holes According to many news outlets (but interestingly, not Panda Labs' blog, which most of the reports cite), a couple of days ago, Panda Labs said MS09-008 doesn't fix one of the vulnerabilities it set out to fix. This comp... Insights and Research March 12, 2009 2 Min readBotnets For Everybody! BBC's Click technology program decided to demonstrate the SPAM power of botnets by directing 22,000 zombies in their own personal botnet. Sure, a lot of people are questioning the legality of this stunt, but that's not w... Insights and Research March 06, 2009 3 Min readVulnerable By Design...no, Really Part of my responsibilities at Zscaler is to look through our log files in order to spot strange and unusual requests (new malware, botnets, etc.), questionable surfing trends, and other sorts of data-mining security goo... Insights and Research February 27, 2009 2 Min readBig, White, Puffy Clouds Can Still Evaporate If you haven't heard by now, Google GMail had a 2.5 hour outage on Tuesday. Acacio Cruz, Gmail’s Site Reliability Manager, explained in a little more detail regarding the outage. My interpretation of his explanation is t... Insights and Research February 19, 2009 6 Min readEV-SSL, SSL, And Who’s Not Using It It seems I've been picking on EV-SSL lately. It's not intentional; I just have encountered a lot of questionable marketing fluff lately and wanted to talk about it. Today is no different. Tim Callan's recent blog post go... Insights and Research January 29, 2009 1 Min readWhat Did You Do On Data Privacy Day? January 28th is officially international Data Privacy Day. Apparently this was established in 2008 to raise awareness for data privacy issues, provide education (particularly to teenagers) regarding data privacy concerns... Insights and Research January 23, 2009 4 Min readEV-SSL's Reported Successes, Maybe In a previous post I included a blurb mentioning that Verisign reported 7000 EV-SSL certificates were issued in the past two years, which seems fairly low. Recently I was referred to a spot on Verisign’s website where th... Insights and Research January 19, 2009 4 Min readSANS/CWE Top 25 Programming Errors Recently Mitre and SANS teamed up to produce a list of the top 25 security errors that programmers should focus on. The errors were selected from the Common Weakness Enumeration (CWE) collection, which looks to enumerate... Insights and Research January 02, 2009 3 Min readMicrosoft Internet Explorer Dips Below 70% Market Share I ran across article by Net Applications that shows their recent browser tracking data. According to their stats, Microsoft Internet Explorer (MSIE) browser has finally dropped below 70% of the overall browser market sha... Insights and Research December 22, 2008 3 Min readMoney Magazine's Take On Phishing The January 2009 issue of Money magazine published a quiz entitled "Are you Phish Food?" The purpose of the quiz was to gauge your knowledge on whether you are being targeted for a phishing attack. If you don’t get the p... Insights and Research December 22, 2008 4 Min readFinal Encounters With A Web Comment Spammer In the last part of my series on web comment spamming applications, I want to pass along a few things I noticed that were effective at separating the spam apps from the humans. Many of these have been publicly discu... Insights and Research December 10, 2008 4 Min readThird Encounters With A Web Comment Spammer In my previous two posts, I wrote about a web comment spam application that has been hitting one of my personal web sites. I set up a bit of an agility test for the bots to figure out what they were, and were not, capabl... Insights and Research December 01, 2008 3 Min readSecond Encounters With A Web Comment Spammer Earlier I wrote my First Encounters with a Web Comment Spammer piece. In that piece I devised a plan to lay a trap of sorts for the web comment spamming application, in order to test the depth of the application's functi... Insights and Research November 26, 2008 1 Min readTechnical Quickie: Building SpiderMonkey On FreeBSD 6.2 AMD64 I wanted to get Didier Stevens modified SpiderMonkey Javascript engine compiled and running on a FreeBSD 6.2 AMD64 box. It turns out the config files shipped with his 1.7.0 version do not include FreeBSD support, so I wo... Insights and Research November 17, 2008 3 Min readHiding Web 2.0 Malware In Plain Sight Hello everyone, Jeff Forristal here. I thought I'd take a moment to discuss a trend we're seeing in attacker tactics, and predict how it may evolve into what will become commonplace tomorrow. Recently we ran across a ... Insights and Research November 07, 2008 4 Min readTrust Two Times Removed Hello everyone, Jeff Forristal here. I thought I'd take a moment to discuss a real-life security incident that I recently reviewed in post-mortem fashion. The plot is simple: while the person was surfing the web, their b... Insights and Research October 31, 2008 4 Min readFirst Encounters With A Web Comment Spammer Jeff Forristal here. I run a couple of personal web sites that host the usual gamut of material found on personal web sites (pictures of my kids and family, my latest favorite LOLcat graphic, etc.). Recently I updated on... Insights and Research October 08, 2008 4 Min readThe Obfuscated TCP Project Hello, Jeff Forristal here. In my last post I talked about the desire of some folks to use SSL for encryption purposes but forego the authentication components (via the use of self-signed SSL certificates). Overall it’s ... Insights and Research October 03, 2008 8 Min readThe ‘SSL Encryption Without Authentication’ Debate Every so often I encounter a debate where an individual is making a case for the value of supporting/accepting self-signed SSL certificates in browsers. Basically their argument is “I do not care about authentication of ...Related Articles Insights and Research 11 Min read Supply Chain Attacks Culture 7 Min read A Day of Service in Honor of MLK Insights and Research 14 Min read New Phishing Trends and Evasion Techniques Culture 2 Min read The Hindsight of 2020 Brings Fresh Perspective for 2021 Culture 3 Min read Zscaler Named a 2021 Glassdoor “Best Place to Work” Insights and Research 4 Min read Ransomware Delivered Using RDP Brute-Force Attack Insights and Research 5 Min read The Hitchhiker’s Guide to SolarWinds Incident Response Insights and Research 5 Min read Cybersecurity Past, Present, and Future: ThreatLabZ Looks at 2020 and the Year Ahead Zscaler Cloud Platform 3 Min read My Highlights from Zenith Live 2020 APJ Day Two Explore More Topics Customer Stories Culture Zscaler Cloud Platform Insights and Research Work from Anywhere CIO Insights Events
