Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

A generic silhouette of a person.

ThreatLabz

Emerging security threats
Insights and Research
4 Min read

Insight from the Front Lines: Zscaler ThreatLabZ to Give Keynote at Zenith Live

We’re excited to announce that Zscaler ThreatLabZ will be a part of our keynote lineup at this year’s Zenith Live on June 15 and 16. Backed by the world’s largest security cloud, Zscaler ThreatLabZ is our internal resear...
Music-themed Malvertising Lead To Angler
Insights and Research
5 Min read

Music-themed Malvertising Lead To Angler

Overview Malvertising, or "malicious advertising," is not a new threat, and just a few weeks into 2016 ThreatLabZ has observed a malvertising campaign injecting iframes into banner advertisements that lead to Angler E...
Chinese Government Website Compromised, Leads To Angler
Insights and Research
5 Min read

Chinese Government Website Compromised, Leads To Angler

Introduction Despite a recent takedown targeting the Angler Exploit Kit (EK), it's back to business as usual for kit operators. On 30-October-2015, ThreatLabZ noticed a compromised Chinese government website that le...
Neutrino Campaign Leveraging WordPress, Flash For CryptoWall
Insights and Research
6 Min read

Neutrino Campaign Leveraging WordPress, Flash For CryptoWall

Overview Neutrino Exploit Kit (EK) appeared on the scene around March of 2013 and continues to remain active and incorporate new exploits. In the beginning of July, Neutrino reportedly incorporated the HackingTeam 0da...
RIG Exploit Kit Infection Cycle Analysis
Insights and Research
6 Min read

RIG Exploit Kit Infection Cycle Analysis

Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spur...
Angler Exploit Kit Utilizing 302 Cushioning And Domain Shadowing
Insights and Research
6 Min read

Angler Exploit Kit Utilizing 302 Cushioning And Domain Shadowing

Overview Angler Exploit Kit is one of the most prevalent and advanced exploit kits in use today and is continually evolving. Angler continues to utilize malvertising to push landing pages and malicious actors are stil...
Ongoing Angler Exploit Kit And Bedep Fraud Campaign
Insights and Research
4 Min read

Ongoing Angler Exploit Kit And Bedep Fraud Campaign

In our recent post covering CVE-2015-0311, two of the Command and Control (C&C) domains used in the Domain Generation Algorithm (DGA), mapped back to the same Server IP address - 46.105.251.1. They were also using th...
Chanitor Downloader Actively Installing Vawtrak
Insights and Research
4 Min read

Chanitor Downloader Actively Installing Vawtrak

We at ThreatLabZ are keeping an eye on a fairly active downloader called Chanitor. This malware is being delivered via phishing emails purporting to be "important" documents, for example, voicemails, invoices, and faxe...
Zscaler Wins Glassdoor Employees' Choice Award
Culture
2 Min read

Zscaler Wins Glassdoor Employees' Choice Award

Zscaler is proud to be honored today as one of the top 50 best places to work in 2015 by Glassdoor in its Annual Employees’ Choice Award. Unlike other awards there was no self-nomination process, instead it’s entirely...
Nuclear Exploit Kit - Complete Infection Cycle
Insights and Research
3 Min read

Nuclear Exploit Kit - Complete Infection Cycle

Zscaler ThreatLabZ has been seeing a steady increase in the Nuclear Exploit Kit (EK) traffic over the past few weeks. The detection of malicious activity performed by this EK remains low, due to usage of dynamic content ...
RIG EK Outbreak Continues
Insights and Research
3 Min read

RIG EK Outbreak Continues

During daily data mining activities, we observe continual outbreaks of many exploit kits (EK) such as RIG EK. Logs are monitored and analyzed to come up with new protections, which are eventually deployed in the Zscaler ...
De-obfuscating The DOM Based JavaScript Obfuscation Found In EK’s Such As Fiesta And Rig
Insights and Research
5 Min read

De-obfuscating The DOM Based JavaScript Obfuscation Found In EK’s Such As Fiesta And Rig

There is little doubt that exploit kit (EK) developers are continuing to improve their techniques and are making exploit kits harder to detect. They have heavily leveraged obfuscation techniques for JavaScript and are ut...
Backdoor Xtrat Continues To Evade Detection
Insights and Research
3 Min read

Backdoor Xtrat Continues To Evade Detection

While reviewing recent reports scanned by ZULU, we came across a malicious report that drew our attention. It was notable as the final redirection downloaded ZIP content by accessing a PHP file on the domain 'www.stisa...
Probing Into The Flash Zero Day Exploit (CVE-2014-0502)
Insights and Research
3 Min read

Probing Into The Flash Zero Day Exploit (CVE-2014-0502)

Yesterday, a targeted campaign leveraging a Flash zero day exploit hit the news. Adobe has now released a security bulletin regarding this vulnerability. Based on the attack vector mentioned in prior research, we have co...
Analysis Of A VBScript Bot
Insights and Research
3 Min read

Analysis Of A VBScript Bot

Introduction: In the long list of complex threats that we see daily, it is interesting to see malware that is rather simple but effective in terms of the payload that it carries. At Zscaler ThreatLabZ...
The Story Of A Trojan Dropper III
Insights and Research
5 Min read

The Story Of A Trojan Dropper III

Introduction: In previous posts (story of Trojan dropper part I, II) we performed both static and dynamic analysis on the threat and also developed a broad idea of what the malware was doing in it’s initial stages. ...
The Story Of A Trojan Dropper I
Insights and Research
2 Min read

The Story Of A Trojan Dropper I

Introduction: Recently, Zscaler ThreatlabZ received a suspicious file from one of our customers, which was named “OrderDetails.zip”. After extracting the executable file from the archive I have performed...
The Story Of A Trojan Dropper II
Insights and Research
4 Min read

The Story Of A Trojan Dropper II

Analysis: Lets analyze the PE file in detail and see what it’s up to. Like most malware, this sample was packed and in order to properly analyze it, we must begin by unpacking the binary. Keeping this in min...
Infection Found On ‘feedburner.com’
Insights and Research
3 Min read

Infection Found On ‘feedburner.com’

Recently, we have seen the websites of MySQL and PHP.net being compromised. We have also blogged about Google Code being used as a drop site for holding malicious code. These instances clearly suggest that attackers are...
Aurora Exploit Still Floating ...
Insights and Research
2 Min read

Aurora Exploit Still Floating ...

It's been around two years since Microsoft released a patch for the IE 0day famously known as the Aurora exploit (CVE-2010-0249). We had blogged about this in the past when it was first seen in the wild on the 'GOV.CN'...
Nuclear Exploit Pack Getting More Aggresive
Insights and Research
4 Min read

Nuclear Exploit Pack Getting More Aggresive

Churning through our logs, we recently observed a significant rise in the number of transactions involving the Nuclear Exploit Pack, which has been in the news for quite some time now. In the past week, we stumbled upon ...
Bangalore Metro Rail Site "bmrc.co.in" Compromised
Insights and Research
2 Min read

Bangalore Metro Rail Site "bmrc.co.in" Compromised

Bangalore's Metro Rail project website (Bangalore Metro Rail Corporation Limited), "bmrc.co.in" is compromised. Malicious obfuscated JavaScript has been injected into several pages. The obfuscated code contains an ...
Expack Continues Exploiting Java Vulnerability
Insights and Research
3 Min read

Expack Continues Exploiting Java Vulnerability

Exploit kits available in the wild tend to follow a trend by exploiting vulnerabilities reported in various browser components which are commonly deployed. Recently, we have seen an increase in exploitation of a year old...
Malicious .jar Files Hosted On Google Code
Insights and Research
2 Min read

Malicious .jar Files Hosted On Google Code

Recently we blogged about Google Code hosting malware. Within a month we have observed a second instance where malicious .jar files are being hosted on Google Code. Using Google code to distribute malware seems to incr...
Anatomy Of An Ongoing Drive-by-Download Campaign
Insights and Research
2 Min read

Anatomy Of An Ongoing Drive-by-Download Campaign

While doing a weekly review of our logs, we stumbled upon thousands of transactions that seem to be a part of an ongoing malware campaign. We found compromised websites that redirect the browser to an exploit kit, fu...
Rise In Red Kit Exploit Kit Activity
Insights and Research
2 Min read

Rise In Red Kit Exploit Kit Activity

This week, a malicious pattern of activity was observed in websites being compromised, which in turn redirected to a Red Kit exploit kit (EK) landing page. Some infected websites that were seen: neptunebenson[dot]com...
Darkleech Attack Continues To Grow
Insights and Research
3 Min read

Darkleech Attack Continues To Grow

The Apache Darkleech attack has been in the news for quite some time now. The first compromise that we identified in our transactions dates back to mid-March. This Darkleech exploit (aka Linux.Cdorked) injects malicious...
Scanning Binaries For PE Format Anomalies
Insights and Research
1 Min read

Scanning Binaries For PE Format Anomalies

After processing tons of malicous binaries, I would like to share my findings about anomalies found in PE binaries. These anomaly information will be helpful for security researchers on suspicious sample validation and...
Guess Who Am I? PE Or APK
Insights and Research
1 Min read

Guess Who Am I? PE Or APK

Update: I happened to find this sample. However, it was corrupted. So I made a demo file by myself. Notepad.exe was used as PE stub, and I embedded a MALICIOUS APK sample into it. So the magic number was ...
Hey AndroGuard, I Will Crash You Or Your Python Buddy!
Insights and Research
2 Min read

Hey AndroGuard, I Will Crash You Or Your Python Buddy!

AndroGuard is a popular tool to be used to analyze android APK files by security professionals. Quite a few APK analysis tools have been built based on it. They usually call Python library to unzip APK files before reve...
Android Application Obfuscation
Insights and Research
2 Min read

Android Application Obfuscation

I had the opportunity to attend 2013 RSA last week. Compared with less than five vendors last year, there were more than 20 vendors focusing on mobile security. I found something interesting on android application obfusc...
“Say Cheese!” Let’s Take A Picture For You Guys, Packer Families.
Insights and Research
1 Min read

“Say Cheese!” Let’s Take A Picture For You Guys, Packer Families.

Gong Xi Fa Cai!恭喜发财 It’s the last weekend of the Chinese New Year, Year of Snake. from http://www.divinecaroline.com The Chinese New Year is the most important Chinese holiday. Tradit...
Is Your Windows 8 Packed?
Insights and Research
3 Min read

Is Your Windows 8 Packed?

Windows 8 is HOT! Security researchers are busy finding Windows 8 vulnerabilities while users are figuring out how to find the restart button in the new interface UI. Windows 8 is definitely one of the big ...
Twins Born In Different Years With Even Different Faces? PC-AV-in-cloud And Mobile-AV-in-cloud
Insights and Research
2 Min read

Twins Born In Different Years With Even Different Faces? PC-AV-in-cloud And Mobile-AV-in-cloud

It is rare for twins to have different birthdays. But thanks to the increasing mobile malware, a set of twins have shown up with birth year 2007 and 2013 respectively. Their names are PC-AV-in-cloud and Mobile-AV-in-clou...
Monster Is Lurking….Beware!!!!
Insights and Research
2 Min read

Monster Is Lurking….Beware!!!!

Monsterindia.com is a very popular Indian job search website and a subsidiary of Monster Worldwide. If you are using Monster job search app for Android then you need to be aware of the fact that it’s le...
Creating A Basic Configuration Profile For An IPhone Or IPad.
Insights and Research
2 Min read

Creating A Basic Configuration Profile For An IPhone Or IPad.

Apple provides a free enterprise configuration tool for streamlining the process of configuring iOS devices known as the (iPCU). This article will provide a quick overview of what a configuration profile ...
Enterprise Traffic Decrease In Wake Of Hurricane Sandy
Insights and Research
2 Min read

Enterprise Traffic Decrease In Wake Of Hurricane Sandy

We have received several requests inquiring as to the changes in enterprise Internet activity in the regions impacted by Hurricane Sandy. There is no question that the hurricane impacted the US in a variety of ways....
Blackhole Exploit Kit V2 On The Rise
Insights and Research
3 Min read

Blackhole Exploit Kit V2 On The Rise

It should come as no surprise that attackers are upgrading their Blackhole exploit kits to a new and more powerful version. An update is now available, thanks to the launch of Blackhole Exploit Kit v2 and we are starti...
Beware Of IPhone5 Scams
Insights and Research
1 Min read

Beware Of IPhone5 Scams

Following Apple's announcement of the iPhone 5 yesterday, we have certainly seen a large number of web transactions to domains/URLs related to this subject. While you may covet the latest and greatest gadget, this is ju...
London Olympics Email Scams (updates)
Insights and Research
2 Min read

London Olympics Email Scams (updates)

In light of the popularity of the Olympics knowing that scammers will come out of the woodwork to take advantage of the event – we're continually monitoring for Olympic scams and maliciousness, no matter how unsophistica...
London Olympics: Stay Away From Scams, Data Theft And Phishing
Insights and Research
2 Min read

London Olympics: Stay Away From Scams, Data Theft And Phishing

The Summer Olympics in London have kicked off and cyber criminals, spammers and data thieves are wasting no time, capitalizing on Olympic related scams. Currently, the volume of websites selling bogus Olympic tickets ar...
London Olympics 2012: Prime Time For Spammers
Insights and Research
7 Min read

London Olympics 2012: Prime Time For Spammers

Spammers love major events as they present an opportunity to social engineer victims with content that they’re likely to be interested in. The Olympics represent a golden opportunity for spammers – the world’s largest ...
Mass Compromise Includes ComputerWorld MX
Insights and Research
1 Min read

Mass Compromise Includes ComputerWorld MX

We were alerted to this from a customer reporting that Zscaler was blocking pages on www.computerworldmexico.mx And as evidence of this, was our Zulu report - which when we looked at it showed that the p...
Cleartrip.com Infected with Blackhole Exploit Kit
Insights and Research
2 Min read

Cleartrip.com Infected with Blackhole Exploit Kit

Cleartrip is used for booking flights, hotels and IRCTC Indian Railways tickets in India. It is a leading online booking portal. Recently, I was searching flight information on www.cleartrip.com, and my desktop antivi...
PDF Exploits Targeted Through Blackhole Exploit Kits.
Insights and Research
2 Min read

PDF Exploits Targeted Through Blackhole Exploit Kits.

PDF exploits have been targeted by Blackhole exploit kits for some time now. The Blackhole exploit kit will deliver various malicious PDF files to a user if the victim is running a potentially vulnerable version of Adobe...
Mac OSX Flashback Confusion And Hype
Insights and Research
4 Min read

Mac OSX Flashback Confusion And Hype

We, like most in the security community, have been following the latest developments with the Mac OS X Flashback Trojan and it's exploitation of the recently patched Java vulnerability (CVE-2012-0507). This story has a ...
On-Going Dynamic FakeAV Campaign
Insights and Research
4 Min read

On-Going Dynamic FakeAV Campaign

Looking back on traffic from this week, I noticed a large spike in the number of companies accessing free TLD / Dynamic DNS related sites. Digging deeper it appears that a malware campaign tied to massive WordPress compr...
"Super Bowl" And "March Madness" In The Enterprise
Insights and Research
2 Min read

"Super Bowl" And "March Madness" In The Enterprise

3/26 Update: I was approached and asked to run stats to do a bit of comparison and contrast with Sports traffic from last year - with the goal in mind to identify if there was a noticeable percentage increase in Sports (...
MSUpdater Trojan And Link To Targeted Attacks
Insights and Research
1 Min read

MSUpdater Trojan And Link To Targeted Attacks

This blog post is based on a joint report by Zscaler and Seculert. Researchers from both companies separately identified attacks which used a remote access tool (RAT) malware that apparently targeted defense-related orga...
SOPA Protest: Wikipedia Traffic Trend (updated)
Insights and Research
2 Min read

SOPA Protest: Wikipedia Traffic Trend (updated)

Updated 1/19: we have updated charts and the narrative to reflect all of 1/18 (protest timeframe) data and the first 10 hours of today. The last graph shows about a 365% increase in visits to their SOPA Initiative page a...
Popularity Of Exploit Kits Leading To An Increase In Compromised Websites
Insights and Research
2 Min read

Popularity Of Exploit Kits Leading To An Increase In Compromised Websites

The dominance of exploit kits like Blackhole, Incognito and others, continues to be seen in the wild. Attackers continue to use these exploit kits to generate malicious webpages and host them on various domains...
Java Drive By Download Attack
Insights and Research
1 Min read

Java Drive By Download Attack

Recently I blogged about how attackers are forcing users to download fake codecs to spread malicious content. I’ve also encountered across another drive by download attack vector, which uses Java applets to execute downl...
Fake Video Codecs Still Going Strong
Insights and Research
1 Min read

Fake Video Codecs Still Going Strong

Convincing users to download malicious software using fake AV pages is not a new attack vector, but has been a very successful one. Julien has previosuly blogged about how fake codecs are starting to replace fake AV page...
Cyber Monday Transactions - Indication Of Economy?
Insights and Research
1 Min read

Cyber Monday Transactions - Indication Of Economy?

Last year I did a post on the transactions that we saw related to online shopping on Cyber Monday - as I indicated in the past, yes there is a spike. And looking at the transactions this year, again we notice a spike: ...
Facebook: Anatomy Of Self-Inflicted Javascript Injection
Insights and Research
4 Min read

Facebook: Anatomy Of Self-Inflicted Javascript Injection

Many are already familiar with "likejacking" (a form of "clickjacking") in which a user is tricked into clicking on and interacting with the Facebook "like" button -- this has been one of the most common vectors of abusi...
Adobe Flash “SWF” Exploit Still In The Wild.
Insights and Research
1 Min read

Adobe Flash “SWF” Exploit Still In The Wild.

A vulnerability reported in Adobe Flash in April 2011 (CVE-2011-0611) continues to be targeted. When first reported, the vulnerability was widely exploited by embedding a “.swf” file into Microsoft Office documents/html ...
Analyzing Malicious Files For Writing Network Signatures
Insights and Research
4 Min read

Analyzing Malicious Files For Writing Network Signatures

Attackers continually modify malware in order to evade antivirus software. Attackers will pack or encrypt malicious files using various packers. Blocking each and every malicious executable is a challenging task for anti...
Siam Commercial Bank Phish In The Wild
Insights and Research
1 Min read

Siam Commercial Bank Phish In The Wild

Targeted Phishing attacks for banking and financial domains are a popular way for attackers to steal sensitive data from customers. To counter these attacks, banks and other financial institutions are driving various cam...
Now “ce.ms” Free Domains Are Being Used To Host Malicious Code
Insights and Research
1 Min read

Now “ce.ms” Free Domains Are Being Used To Host Malicious Code

A few months back, I posted a blog on “co.tv” domains being used by attackers to host malicious code . We had identified number of different domains being used to carry out attacks using heavily obfuscated JavaScript. No...
IPAbuseCheck Stats
Insights and Research
3 Min read

IPAbuseCheck Stats

Last week, we announced our IPAbuseCheck lookup tool. We see lots of infected/abusive hosts on the Internet attempting to proxy abusive web transactions through our proxies. Rather than just ignoring these transactions, ...
IPAbuseCheck: Clients Abusing Web Proxies
Events
2 Min read

IPAbuseCheck: Clients Abusing Web Proxies

IPAbuseCheck was designed to provide a simple, free web interface to query your IP addresses against a database that we have built containing unauthenticated IP addresses that have attempted to forward abusive or unwante...
Beware Of Fake Websites Stealing Credit Card Information
Events
1 Min read

Beware Of Fake Websites Stealing Credit Card Information

People often uses credit cards online to purchase products but many people fail to validate the site address and proceed with submitting sensitive information such as card numbers. Attackers can then steal credit card in...
"1.php" Group Intrusion Set Paper
Insights and Research
2 Min read

"1.php" Group Intrusion Set Paper

Update: report links now go straight to the paper versus the general Whitepaper page. ThreatLabZ has just released a report that provides a summary of incident information related to the "1.php" Group. Historically, t...
Facebook Free T-shirt Scams Take Advantage Of Email Upload
Insights and Research
2 Min read

Facebook Free T-shirt Scams Take Advantage Of Email Upload

Attackers on Facebook are continually taking advantage of new ways to get their content onto a user’s wallpost, in order to further propagate their scams. Recently, we came across yet another interesting scam, this one o...
DNS Changes Lead To W32/Rorpian
Insights and Research
2 Min read

DNS Changes Lead To W32/Rorpian

Update: Upon receiving additional file-system information from an infected host, the malware that resulted in being dropped was a TDSS variant, which corresponds to the earlier statement about Rorpian being used as a ...
Be Aware Of Gmail Phishing Pages
Insights and Research
1 Min read

Be Aware Of Gmail Phishing Pages

Phishing is certainly not a new attack vector but attackers are constantly using it to fool victims into entering sensitive information like authentication credentials. As I mentioned in a blog post a couple of years bac...
Bitcoin Mining Malware
Insights and Research
3 Min read

Bitcoin Mining Malware

For those unfamiliar, Bitcoin is a digital P2P currency (here's a more detailed video explanation if interested) - people interact with it using locally or hosted "wallet" software. It should not come as much of a surpri...
The Pastebin Trend (cont.)
Insights and Research
3 Min read

The Pastebin Trend (cont.)

In June during some of the LulzSec pastes, I published a brief blog post on our sister blog (Scrapbook). In that post, I discussed a spike in Pastebin web transactions due to the LulzSec information drops and other contr...
Blackhole Exploit Kit Continues It’s Dominance
Insights and Research
1 Min read

Blackhole Exploit Kit Continues It’s Dominance

Today, I was investigating a block that had been triggered on a webpage due to detection of the Blackhole exploit kit. We previously posted a blog about the rise in Blackhole exploit kit detections back in February, 2011...
Malicious URL’s Using DWORD Formatted IP Addresses
Insights and Research
2 Min read

Malicious URL’s Using DWORD Formatted IP Addresses

IP stands for Internet Protocol. An IP address is numerical label assigned to each device on the network and every website has a unique IP addresses to identify the site on the Internet. As an IP address is difficult...
Current Trojan Ambler Activity
Insights and Research
3 Min read

Current Trojan Ambler Activity

Update with sinkhole results: About 24 hrs later from registering the one Trojan Ambler .net domain mentioned below and monitoring the sinkhole, I only saw about a dozen infected unique client IPs "correctly" check-in...
Malware Distribution Using Fake YouTube Pages
Insights and Research
1 Min read

Malware Distribution Using Fake YouTube Pages

Attackers often create fake YouTube pages in an effort to lure a victim into downloading malicious binaries. During our research, we recently found an example of such a site. When a victim visits the page, a security war...
Manually De-obfuscating Malicious Content
Insights and Research
2 Min read

Manually De-obfuscating Malicious Content

Most of the time, malicious obfuscated JavaScript is injected at the bottom of a webpage. Obfuscation is leveraged both to hide the true purpose of the code from prying human eyes and in an attempt to bypass security sca...
Obfuscated Exploits Continue To Target CVE-2010-0806 And CVE-2010-3962
Insights and Research
1 Min read

Obfuscated Exploits Continue To Target CVE-2010-0806 And CVE-2010-3962

A pair of “use-after-free” aka “uninitialized memory corruption” vulnerabilities (CVE-2010-0806 and CVE-2010-3962) in Internet Explorer were reported in November 2010 and remain among the favored client-side attack ...
IRS, NACHA, Etc. Mal-spam
Insights and Research
2 Min read

IRS, NACHA, Etc. Mal-spam

I posted a few of these mal-spam incidents on our Scrapbook blog ... this sort of mal-spam has been on-going, but there has been a recent uptick since early June. The NACHA, Federal Reserve, and now IRS mal-spam sites ha...
Patching Flash - CVE-2011-2110 Post-mortem
Insights and Research
1 Min read

Patching Flash - CVE-2011-2110 Post-mortem

Last week I blogged about the CVE-2011-2110 Adobe Flash vulnerability being actively exploited in the wild. Adobe released its patch exactly a week ago (Tuesday, June 14) ... I wanted to do a follow up to identify the pa...
Oh Flash! CVE-2011-2110 0-Day
Insights and Research
1 Min read

Oh Flash! CVE-2011-2110 0-Day

This past Tuesday, June 14, a vulnerability (CVE-2011-2110) in the Adobe Flash Player was patched. This vulnerability is actively being exploited in the wild - prior to the patch, the earliest exploitation that we have s...
Incognito Exploit Kit
Insights and Research
2 Min read

Incognito Exploit Kit

Exploit kits are becoming an increasingly popular means of spreading attacks. Umesh recently blogged about seeing a spike in the usage of the Blackhole exploit kit. This exploit kit targets multiple known vulnerabilities...
.co.tv Domains Serving Heavily Obfuscated Malicious Code
Insights and Research
1 Min read

.co.tv Domains Serving Heavily Obfuscated Malicious Code

Following a previous post on a malicious Google News search, we identified additional domains related to this attack, also serving malicious code. The method of infection remains the same by injecting a malicious script,...
Zscaler Analyst Scrapbook
Insights and Research
1 Min read

Zscaler Analyst Scrapbook

Introducing our sister blog: Zscaler Analyst Scrapbook Very often while we're conducting log analysis across our cloud in order to add security protections (signatures, black listing, reputation scoring, etc.) we find...
Google News Search Results For Laurence Fishburne Leading To Malicious Sites
Insights and Research
2 Min read

Google News Search Results For Laurence Fishburne Leading To Malicious Sites

One of our blog readers, Mr. Jon Leathery informed me yesterday about a link in a Google News search leading to a malicious website. “Laurence Fishburne leaving CSI”, was a popular topic recently and was being taken adva...
Cashing In On ‘ScamBook’
Insights and Research
2 Min read

Cashing In On ‘ScamBook’

Last week, Umesh blogged extensively about the Facebook Scams. The previous scams have demonstrated that Facebook is struggling to contain these attacks. While some attacks seek to spread malicious code, many that we see...
Is 360.CN Evil?
Insights and Research
2 Min read

Is 360.CN Evil?

... a tough and controversial question to answer (I'm sure there will comments on this). 360.cn is a Chinese provider of "free security software", more specifically: "360.cn is a Chinese anti virus program th...
Facebook Under Attack By Scammers
Insights and Research
2 Min read

Facebook Under Attack By Scammers

Facebook is facing no shortage of attacks from scammers. Yesterday, I posted a blog about a recent scam being circulated on the Facebook network and only a few hours later, we uncovered yet another one. The goal of this ...
Yet Another Facebook Scam – You Look So Stupid In This Video
Insights and Research
2 Min read

Yet Another Facebook Scam – You Look So Stupid In This Video

Today, we have come across yet another rapidly spreading Facebook scam. The ultimate aim of this scam is to coerce Facebook users into completing various surveys which in turn generate money for the scammer. The messages...
India’s DNA E-newspaper Website Infected With Fake Antivirus Campaign
Insights and Research
1 Min read

India’s DNA E-newspaper Website Infected With Fake Antivirus Campaign

DNA (Daily News and Analysis) is an Indian daily English language newspaper. According to Wikipedia, DNA ranks 8th among the top ten English dailies in India. Recently, the Zscaler solution was blocking access to this si...
Geek.com Hacked With An Exploit Kit
Insights and Research
2 Min read

Geek.com Hacked With An Exploit Kit

Update 15/04/11 @ 3.40pm IST: With further research, it has come to our attention that many different pages like main homepage, about us page are infected with malicious Iframe pointing to different malicious sites. ...
Rajasthan State Marketing Site Infected With Malicious Code
Insights and Research
1 Min read

Rajasthan State Marketing Site Infected With Malicious Code

India’s Rajasthan State Co-operative Marketing Federation Ltd has been infected with a malicious script tag. This government site promotes the objectives of procuring agricultural produce from farmers through the member ...
Help Center URL Validation Vulnerability (CVE-2010-1885) Campaign
Insights and Research
3 Min read

Help Center URL Validation Vulnerability (CVE-2010-1885) Campaign

I've recently noticed a number of transactions to: vvvvvv.dyndns-mail.com/ 46.254.16.61 (PTR: www.asl-s.com) Update: we're now seeing this attack hosted as well on: blog.dyndns-blog.com googlepics.dyndns....
Another Trojan Bamital Pattern
Insights and Research
3 Min read

Another Trojan Bamital Pattern

The other day I detected a handful of Bamital infected clients beaconing out with a different pattern than that listed in EmergingThreats, and thought I'd post something for the masses to consume and be on the lookout fo...
Koobface Worm Still Spreading Using Social Engineering Attack Vectors
Insights and Research
2 Min read

Koobface Worm Still Spreading Using Social Engineering Attack Vectors

The Koobface worm is not new to Internet users, but remains very active and continues spreading through different mediums using a variety of techniques. Last year, we have blogged about Koobface worm activity. We are sti...
Latest Victim Of An Exploit Kit - Lenovo, India
Insights and Research
2 Min read

Latest Victim Of An Exploit Kit - Lenovo, India

Update 05/04/11 @ 7.49pm IST: Thanks to feedback from an Anonymous blog poster, I've done some further investigation and this attack actually appears to be tied to the Incognito Exploit kit as opposed to the...
30 Days Of Cycbot
Insights and Research
3 Min read

30 Days Of Cycbot

Introduction: I started doing some analysis on a beaconing pattern that I observed this past week. Initially the pattern and domains that I observed had little open-source information available for my searches, bu...
Worldfest, Houston Website Compromised Before The Start Of The Event
Insights and Research
2 Min read

Worldfest, Houston Website Compromised Before The Start Of The Event

Today, one of our blog readers, Mr. Steve Kennedy posted a comment saying his antivirus alerted on “http://www.worldfest.com”. It appeared to be related to the Blackhole exploit kit, which I’d discussed in a previous blo...
Randomization Of Code And Binaries Used By A Fake Antivirus Website
Insights and Research
2 Min read

Randomization Of Code And Binaries Used By A Fake Antivirus Website

Last week, I talked about heavy obfuscation being used by attackers to hide their HTML source code from detection. This time we came across an interesting fake antivirus website, which not only continually changes the so...
Heavy Obfuscation Used By Fake Antivirus Websites
Insights and Research
3 Min read

Heavy Obfuscation Used By Fake Antivirus Websites

Just a few days back, I published a post discussing the popularity of fake antivirus websites in 2011. As I mentioned in the blog, attackers are continually creating new domains and websites promoting their fake software...
Analyzing PDF Exploits For Finding Payloads Used
Insights and Research
3 Min read

Analyzing PDF Exploits For Finding Payloads Used

We have written a couple of previous blogs which focus on an in-depth analysis of PDF exploits as this is yet another techniques used by attackers to package malicious code and avoid antivirus detection. We have also wri...
Fake Security Software Websites – Still Popular In 2011
Insights and Research
2 Min read

Fake Security Software Websites – Still Popular In 2011

Fake security software is a form of computer malware that misleads users into installing and potentially paying for fake security software. The sites convince users to download the malicious software by displaying fake s...
Trojan Infection Through Facebook
Insights and Research
1 Min read

Trojan Infection Through Facebook

It’s no surprise to see Facebook becoming a primary focus for spreading malware. Attackers are leveraging Facebook as a means of reaching end users, delivering links in order to convince victims to click on them. The lin...
WebFusion “nosferatu” SEO/FakeAV Campaign
Insights and Research
2 Min read

WebFusion “nosferatu” SEO/FakeAV Campaign

This afternoon, we received a report that a number of websites, especially those tied to WebFusion were compromised and were being leveraged in an SEO campaign to redirect victims to FakeAV malware. For example, most of ...
BSNL, Bangalore Website Yet Another Victim Of Malicious Code Injection
Insights and Research
2 Min read

BSNL, Bangalore Website Yet Another Victim Of Malicious Code Injection

BSNL, Bangalore telecom district has become yet another victim of poor website security and has been infected with malicious JavaScript code. This time, the code points to a malicious domain used by the popular Gumblar b...
Injecting Malicious HTML IFrames – Still A Popular Attack Vector
Insights and Research
2 Min read

Injecting Malicious HTML IFrames – Still A Popular Attack Vector

Injecting malicious HTML IFrames into the legitimate web pages has become a commonplace technique in web based attacks. We recently came across another website that is infected with a malicious IFrame. Further research s...
ICWAI Site Infected
Insights and Research
1 Min read

ICWAI Site Infected

After KVGBANK, now ICWAI has also been found to be the victim of an iFrame injection attack. My previous blog post reveals how famous sites from India like UPSC and KVGBANK have been compromised. These are reputable site...
KVGBANK Affected With Malicious JavaScript
Insights and Research
1 Min read

KVGBANK Affected With Malicious JavaScript

Karanataka Vikas Grameena Bank is victim of an attack. The site is comprised by the injection of malicious obfuscated JavaScript. Home page of kvgbank.com : Obfuscated JavaScript : Multilevel obfuscated ...
Blackhole Exploits Kit Attack Growing
Insights and Research
2 Min read

Blackhole Exploits Kit Attack Growing

Recently, we have seen an increase in Blackhole exploit kit attacks. Blackhole is yet another web exploit kit developed by Russian hackers. According to one forum, the author indicates that the kit will cost $1,500 annua...
In Depth Analysis - Decoding HTML Style Tag Based Malicious Iframes
Insights and Research
5 Min read

In Depth Analysis - Decoding HTML Style Tag Based Malicious Iframes

Injecting clear text or obfuscated malicious Iframes has become a common attack vector. By taking advantage of known/unknown vulnerabilities in web servers or applications, an attacker can inject a malicious Iframe which...
Facebook And The HTTPS/Security Paradox
Insights and Research
2 Min read

Facebook And The HTTPS/Security Paradox

Last month, Michael published his 2011 security predictions. His second prediction in his list of 10 discussed SSL Only Sites: In 2011, expect a handful of major vendors to finally tackle this challenge head on and depl...
Egyptian Revolution ... Back Online
Insights and Research
1 Min read

Egyptian Revolution ... Back Online

In the days during the Egyptian Internet outage, a number of Egyptian's circumvented the outage through a variety of methods. Speak2tweet is one example of a work-around in which Egyptians could phone in their tweets usi...
Egypt ... Now Just Gyped
Insights and Research
3 Min read

Egypt ... Now Just Gyped

There are a number of good references discussing the recent events in Egypt and the subsequent Egyptian-government ordered Internet shutdown (ISPs in Egypt have withdrawn their routes via BGP- timeline). This shutdown in...
Web Transactions Per User Per Day
Insights and Research
3 Min read

Web Transactions Per User Per Day

I searched the web recently looking for statistics on the average number of web transactions that end-users make per day, and equations for estimating end-user web transactions. I couldn't find anything that was worth re...
Alexa Illustrates Web Security Risks (part 2)
Insights and Research
1 Min read

Alexa Illustrates Web Security Risks (part 2)

I wanted to circle back and close the loop from my original post on this. First- not surprisingly I’m not the only one to have taken note at malicious sites landing in Alexa (reference sucuri.net blog). I wrote some s...
Using TheBrain To Visualize Web Transaction Logs
Insights and Research
3 Min read

Using TheBrain To Visualize Web Transaction Logs

For those unfamiliar with TheBrain - it is a highly interactive mind-mapping software, which includes a free edition called the PersonalBrain. I have used this software on-and-off for a few years, and really like it for ...
Exploit In The Wild For MS06-014 – A Five Year Old Vulnerability
Insights and Research
1 Min read

Exploit In The Wild For MS06-014 – A Five Year Old Vulnerability

Although 0day vulnerabilities receive all the attention, it’s not unusual to see attackers still taking advantage of old vulnerabilities to attack end users. Here's such an example where the vulnerability used was MS06...
Alexa Illustrates Web Security Risks (part 1)
Insights and Research
2 Min read

Alexa Illustrates Web Security Risks (part 1)

I recently needed to look at some Alexa data related to their tracking of the top web domains visited for a side project that I was working on. During my investigation of their data, I found it interesting to see a ...
Top Abuses Of Open Web Proxies
Insights and Research
6 Min read

Top Abuses Of Open Web Proxies

While there is nothing new or Earth-shattering in this post, I thought I'd share what I have seen as the top abuses of open web proxies - as this is an everyday occurrence involving a large volume of web transactions and...
Amazon Profiles Used For Spam
Insights and Research
1 Min read

Amazon Profiles Used For Spam

Amazon's online store-front has a social networking component to it, where people with accounts can create user and seller profiles to share their interests, what they are reading, listening to, selling, etc. For the mos...
Cyber Monday In Review
Insights and Research
1 Min read

Cyber Monday In Review

Cyber Monday is hyped every year as the largest online shopping / deals day of the year. How was your Cyber Monday? This is a short post on some of what we saw. Our perspective is from the corporate end user (i.e., peopl...
Lethic Botnet Returns, Uses "Realtek" Identifier
Insights and Research
3 Min read

Lethic Botnet Returns, Uses "Realtek" Identifier

Remember Stuxnet? Chances are you do- a few months back there was a worm that spread over USB using the 0-day .LNK vulnerability (CVE-2010-2568) and targeted Siemens SCADA systems. Additionally the rootkit package that i...
Detecting Firesheep
Insights and Research
4 Min read

Detecting Firesheep

Firesheep, a Firefox plugin to do session hijacking ("sidejacking") by snooping on a LAN/WLAN and identifying session cookies passed in the clear over HTTP, was released last week at Toorcon. To my surprise, this tool re...
Halloween Likejacking Campaign
Insights and Research
1 Min read

Halloween Likejacking Campaign

I've already described (Facebook) "likejacking" in a past blog post, and we mentioned a likejacking campaign in early October here. The latest one going around has the title:"OMFG!! The 10 Most WEIRD Facts About HALLOWE...
Exploitation Using Publicly Available Base64 Encode/decode Code
Insights and Research
2 Min read

Exploitation Using Publicly Available Base64 Encode/decode Code

Earlier, I blogged about malicious hidden Iframes using publicly available Base64 encode/decode scripts. Recently, we have seen additional malicious JavaScript hosted on one website, using another publicly available Base...
New Orkut Worm: “Bom Sabado!” – Good Saturday For Orkut Users
Insights and Research
2 Min read

New Orkut Worm: “Bom Sabado!” – Good Saturday For Orkut Users

Today, on 25th September 2010, a new worm affecting Orkut emerged. I received several calls from friends asking about this new Orkut worm. They told me that their scrapbook was flooded with text messages called “Bom Saba...
Twitter ReTweet Spam (XSS)
Insights and Research
1 Min read

Twitter ReTweet Spam (XSS)

This morning before I even logged into my system, I was receiving inquiries about the Twitter Spam going around. The source looks like: And appears in Twitter as: For those unfamiliar with t.co, it is Twitter's l...
New PPI Campaign
Insights and Research
1 Min read

New PPI Campaign

PPI being pay-per-install ...This morning I saw some interesting transactions to:hxxp://promoupdate.info/setup###.exewhere ### are numbers, for example, "519".MD5: 1568edcd29629f577207d7396646b741VirusTotal results 8/43 ...
Google Code Hosting Website Used To Spread Malware Again
Insights and Research
2 Min read

Google Code Hosting Website Used To Spread Malware Again

Last year, there was discussion of Google Code, a site which allows developers to host their projects, being used to spread malware. We have now found yet another case where Google Code is being used to spread malware. A...
Beaconing Leads To Swarft Trojan & Suspicious Netblock
Insights and Research
2 Min read

Beaconing Leads To Swarft Trojan & Suspicious Netblock

Often, open-source information helps to confirm our suspicion about certain web transactions being tied to an infection or download of something malicious. While conducting analysis on the results from some of my script...
66.220.17.200 A Haven For Swizzor
Insights and Research
3 Min read

66.220.17.200 A Haven For Swizzor

Update:Based on a comment, I modified the title to be 66.220.17.200 versus DNSMADEEASY. Let me explain:DNSMADEEASY provides the resolution / name services for the domains in questionHurricane Electric / C2 Media provide...
Union Public Service Commission Website Of India Compromised
Insights and Research
1 Min read

Union Public Service Commission Website Of India Compromised

My previous blog discussed the injection of malicious JavaScript into the html/JS pages of a Red Cross website. This time victim of similar attack is an Indian government website, namely http://upsc.gov.in/ . Screen-s...
Red Cross Hacked Again!!!
Insights and Research
1 Min read

Red Cross Hacked Again!!!

It seems as though attackers are fond of Red Cross sites as this isn’t the first time that we’ve blogged about a compromised Red Cross site. The victim this time was the Red Cross of Serbia. Previously, they hacked the s...
Analysis Of Recent "Trojan Tacorti" Malware Run
Insights and Research
2 Min read

Analysis Of Recent "Trojan Tacorti" Malware Run

The past few weeks I noticed a handful of "free access" / "open for free access" malware binary executables. There was some information in the open source about this, but not much piecing the entire picture together - in...
PDF Exploit: Number Of Pages Is The Key
Insights and Research
3 Min read

PDF Exploit: Number Of Pages Is The Key

PDF exploits targeting a number of recent Adobe vulnerabilities exist in the wild. In the past, we have seen number of different obfuscation and decoding techniques being used by the exploits to avoid anti-virus detectio...
.LNK (CVE-2010-2568) / Stuxnet Incident
Insights and Research
2 Min read

.LNK (CVE-2010-2568) / Stuxnet Incident

We’ve had a number of inquiries regarding the .LNK (CVE-2010-2568) vulnerability and related Stuxnet malware. There are a number of stories (for example, CNET) that detail the timeline of events and the SCADA angle to th...
Placeblogger And Others Lead To Imgwebsearch Spam
Insights and Research
3 Min read

Placeblogger And Others Lead To Imgwebsearch Spam

Over the weekend I was playing around with the iPad application SkyGrid to read the latest news stories on particular subjects. In one of my feeds that I setup for mobile security I saw a story with the title "GvHpMqAVt....
Exploit Targeting A 7 Year Old Vulnerability? Really?
Insights and Research
1 Min read

Exploit Targeting A 7 Year Old Vulnerability? Really?

We’ve actually spotted in-the-wild exploitation of “Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness” (Bugtraq ID 10514), a vulnerability first released in 2003. The exploit does get a little mo...
ATECH-SAGADE Badness - Malicious .IN Campaign
Insights and Research
2 Min read

ATECH-SAGADE Badness - Malicious .IN Campaign

I'm working on generating our Q2 2010 Stats and Trends report, and I noticed a large number of blocked exploit kit activity from domains registered with the .IN TLD. These were not hacked sites but domains registered for...
'LikeJacking' - What Is It?
Insights and Research
2 Min read

'LikeJacking' - What Is It?

In the past few days I've had a number of people send me URLs that they received from friends on Facebook that seemed unusual and asked me what is this? In each of these cases, the answer was 'LikeJacking' - while this h...
Zeus C&C (Avalanche)
Insights and Research
1 Min read

Zeus C&C (Avalanche)

Recent Zeus C&C activity has been observed from: mnbvicdij4uhdjb5421knnkd.com At the time of posting, the domain is not present in ZeusTracker. The domain is currently fluxing (Fast-Flux), notice short TTLs and n...
IPad Beta-Testing Scam
Insights and Research
1 Min read

IPad Beta-Testing Scam

I saw this being spam advertised on Facebook: Tammi Tyler appears to be a throw-away, spam profile used for this campaign. The bit.ly link takes the follower to: hxxp://www.theigadget.com/?80af9787 Site advertis...
Robint.us SideNote: "CuteQQ"
Insights and Research
1 Min read

Robint.us SideNote: "CuteQQ"

A report of the malicious JavaScript on robint.us can be seen in this Wepawet report. I noticed that within the JS, the variable name "cuteqq" was used for evaluating the payload - this sounded really familiar. Google "c...
Robint.us – Case Study In Mass Website Infection
Insights and Research
1 Min read

Robint.us – Case Study In Mass Website Infection

There have been numerous reports about the IIS/ASP SQL injection compromises that redirected users to ww.robint.us. See below for reading on this incident: http://blog.sucuri.net/2010/06/mass-infection-of-iisasp-si...
A Brief Gumblar Infrastructure Analysis
Insights and Research
2 Min read

A Brief Gumblar Infrastructure Analysis

Earlier this week, I had a request to analyze and describe why we were blocking customer access to: hxxp://www.fdotfirstcoastouterbeltway.com/index.asp (note: this page has since been cleaned) Analysis of the page...
Banking Malware Uses PAC File
Insights and Research
1 Min read

Banking Malware Uses PAC File

There have been a few recent posts (1, 2) of malware that set and use proxy auto-config (PAC) files to steal victim banking credentials. I thought this was interesting and decided to write a quick post on this. PAC files...
Adobe Groups Abused
Insights and Research
1 Min read

Adobe Groups Abused

We've seen Google Groups and a host of other sites that permit user driven content to redirect to malware or other nonsense. This morning I saw a rash of Adobe Groups posts redirecting to fake pharmacy sites (pharms / p...
300% Increase In Malicious JARs
Insights and Research
1 Min read

300% Increase In Malicious JARs

While doing some stats & trends on our data, I noticed that there has been a steady rise in the number of malicious Java Archive (JAR) files that we are blocking (pulling data from both within our logs and denylists)...
Inline Detection Of Evil JavaScript
Insights and Research
5 Min read

Inline Detection Of Evil JavaScript

Exploit kits are a much more common threat on the web than they used to be. In order to evade detection, the kits frequently contain logic to obfuscate, or hide, the meaning behind the content that they serve to the vict...
More And More Obfuscation Being Used In The Malicious Scripts
Events
3 Min read

More And More Obfuscation Being Used In The Malicious Scripts

As we saw in a previous blog post, malicious, obfuscated JavaScript is being injected into legitimate webpages. Attackers not only use simple obfuscation techniques, but also leverage rather complex approaches to hide th...
China’s NCGA Government Site Infected With Hidden Malicious Iframe
Insights and Research
1 Min read

China’s NCGA Government Site Infected With Hidden Malicious Iframe

Today, we discovered that NingBo SME Credit Guarantee Association (NCGA), a Chinese government web site, is infected with a malicious hidden IFRAME. Of the infected page, is one where member registration is required. Her...
Malicious Hidden Iframes Using Publicly Available Base64 Encode/decode Script
Insights and Research
2 Min read

Malicious Hidden Iframes Using Publicly Available Base64 Encode/decode Script

As we have seen, many websites are infected with malicious IFRAMES. The IFRAMES are either injected as plain text or they are heavily obfuscated using JavaScript. Obfuscation is intentionally used by attackers to bypass ...
Storm Worm 2.0
Insights and Research
1 Min read

Storm Worm 2.0

A detailed analysis was provided, here, on the new version of the Storm Worm making it's rounds this week. I went looking in our logs for HTTP POSTs to three and four character GIF and JPG files with relatively small req...
Following Recent QQ Phishes
Insights and Research
2 Min read

Following Recent QQ Phishes

QQ is a popular email and instant messaging service within China. In yesterday's logs I saw entries for: aq.qq.com.cn-inddex.com qq.com.cn.indexx-cn.com Following the pages, the display looks identical to the qq...
Fun With N-gram Analysis
Insights and Research
2 Min read

Fun With N-gram Analysis

A former colleague and I had discussed character based analysis of domains to provide indications of suspicious / malicious usage. For example, the Avalanche botnet has a domain registration and fast-flux infrastructure ...
CVE-2010-0806 Exploit In The Wild
Insights and Research
2 Min read

CVE-2010-0806 Exploit In The Wild

CVE-2010-0806, a use-after-free vulnerability in the Peer Objects component, was announced in mid-March 2010. The vulnerability impacts Internet Explorer 6, 6 SP1, and 7 - a patch was made available by Microsoft in the M...
Whitepaper: Botnet Analysis Leveraging Domain Ratio Analysis
Insights and Research
2 Min read

Whitepaper: Botnet Analysis Leveraging Domain Ratio Analysis

While conducting stats and trends for last Quarter's "State of the Web" report, I found an interesting way of analyzing top-level domains (TLDs). I added the total number of web transactions involving a TLD for the mont...
Trojan Monkif Is Still An Active And Consistent Botnet Threat
Insights and Research
4 Min read

Trojan Monkif Is Still An Active And Consistent Botnet Threat

While we have seen in a recent Koobface blog post showing sudden rise and fall in Koobface network activity, the Trojan Monkif’s C&C requests are still being consistently seen. According to the data, the Trojan Monki...
Koobface Worm Hits On Weekend – Increase In New C&C Servers
Insights and Research
6 Min read

Koobface Worm Hits On Weekend – Increase In New C&C Servers

On Sunday 14th 2010, Zscaler detected a large number of Koobface worm transactions over the Internet. Koobface is a computer worm, which was first found in December 2008 and is still spreading heavily. The Koobface worm ...
In The Wild PDF Exploits Using A Combination Of “ASCIIHexDecode” And” ASCII85Decode” Filters
Insights and Research
3 Min read

In The Wild PDF Exploits Using A Combination Of “ASCIIHexDecode” And” ASCII85Decode” Filters

In the last few months, we have seen many blogs on PDF exploits related to filters like “ASCIIHexDecode”, “FlateDecode”, etc., being used to avoid Antivirus detection. The idea employed by attacker’s leverages differen...
Redcross Site Hacked
Insights and Research
1 Min read

Redcross Site Hacked

In this morning's logs I noticed that Zscaler detected malicious content within redcross-esc.org web-pages. Turns out that the site was a victim of a malicious iFrame injection, and I thought a short post on this would b...
Are You A Victim Of An Injected Malicious Hidden Iframe?
Insights and Research
3 Min read

Are You A Victim Of An Injected Malicious Hidden Iframe?

People surf to a number of web pages throughout the day - online shopping, banking, social networking, search engines, etc. But do they know when something bad is happening behind the web page visible in their browser? A...
Google Buzz For Spammers
Insights and Research
3 Min read

Google Buzz For Spammers

The Google Buzz sign-up is being advertised to users when logging into Gmail, and is a fairly transparent process to users with an existing Gmail account. Clicking on “Sweet! Check out Buzz” brings you to yo...
Indian Gov't Site Victim Of Ad Campaign
Insights and Research
1 Min read

Indian Gov't Site Victim Of Ad Campaign

I noticed an Inidan Gov't site in Zscaler's blocked logs from yesterday: hxxp://www.hil.gov.in Hindustan Insecticides Limited: A Government of India Enterprise (I'm sure you can appreciate the irony here, as ins...
Blackhat SEO Is New Spam
Insights and Research
1 Min read

Blackhat SEO Is New Spam

It used to be that when you checked your email and/or email spam folder there would be a slew of messages with links or attachments that would have titles related to the popular subjects of the time, and would be used to...
IE 0-Day On GOV.CN
Insights and Research
2 Min read

IE 0-Day On GOV.CN

A few days back, there was a post on a forum about malware warnings displayed when visiting: www[dot]latax[dot]gov[dot]cnTranslates:Upon analysis of the page, it appears that this GOV.CN page is hosting a page exploiting...
Haiti Earthquake Also Rocks Internet (Update)
Insights and Research
1 Min read

Haiti Earthquake Also Rocks Internet (Update)

Following my previous post, I had lots of questions about what we are seeing in terms of malware and fraud taking advantage of the Haiti earthquake. Not surprisingly we have seen an increase of web transactions to cha...
Haiti Earthquake Also Rocks Internet
Insights and Research
1 Min read

Haiti Earthquake Also Rocks Internet

The magnitude 7.0 earthquake rocked Port-Au-Prince and its surrounding area on Tuesday, January 12, 2010 at 13:53:09 PST (21:53:09 UTC) according to USGS. Within the hour, the shock resonated on the Internet. The securit...
Malware Attacks On Winter Solstice - Shortest Day Of The Year 2009
Insights and Research
2 Min read

Malware Attacks On Winter Solstice - Shortest Day Of The Year 2009

Yesterday, December 21st 2009 was the Winter Solstice, meaning that it was the shortest day of the year. Malware authors did not miss this opportunity to push their malicious binaries using SEO (search-engine optimizatio...
Beware Of SEO Attacks
Insights and Research
2 Min read

Beware Of SEO Attacks

On Sunday, Tom Stuker, a United Global Services member that flew about 700,000 miles this year, was interviewed on Fox News. Not long after that, the top Google search results for Tom Stuker were all poisoned to have lin...
1 Week 'til XMAS... Avoid Shopping Woes
Insights and Research
1 Min read

1 Week 'til XMAS... Avoid Shopping Woes

Many folks are familiar with fake goods sites (e.g., replica watches and fake pharm / pill sites). These sites either peddle shoddy goods, or just flat out steal your payment credentials. In case you needed to be remi...
Don't Watch-familyguyonline.com
Insights and Research
2 Min read

Don't Watch-familyguyonline.com

... or at least be careful if you do. Who doesn't like a good episode of Family Guy? Well even if you don't, that isn't the point of this post. There are dangers visiting and trusting sites that link to and embed conten...
New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 2
Insights and Research
2 Min read

New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 2

Earlier, in the first blog of this series we talked about a malicious PDF file and extracted the malicious script. Now, we have a malicious script in readable format and want to know if this successfully runs or not. I a...
New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 1
Insights and Research
3 Min read

New Zero Day Adobe Acrobat Reader Vulnerability Analysis – Part 1

On December 14th, Symantec and Shadowserver reported a new zero day vulnerability in the wild affecting Adobe reader. This is now identified as CVE-2009-4324. Adobe acknowledged the same on their website saying they are ...
Case Study: Fake Codec Leveraging LastFM
Insights and Research
4 Min read

Case Study: Fake Codec Leveraging LastFM

The Fake Codec / Fake Anti-Virus malware campaign, historically led by the Russian Business Network (RBN), has been going on for some time (here's a blog post dating back to 2006). Dancho Danchev's blog often details...
XSS Embedded IFrames
Insights and Research
1 Min read

XSS Embedded IFrames

Today we saw a variety of pages being advertised that have search.htm and other pages vulnerable to cross-site scripting (XSS) being used to inject an iframe to a malicious webpage redirector. To an unknowing user follow...
In The Wild Flash Exploit Analysis – Part 2
Insights and Research
3 Min read

In The Wild Flash Exploit Analysis – Part 2

In the first blog, we talked about how a recent Flash exploit works using heap spraying. In this blog, we will see how the shellcode functions and how it downloads malicious binaries to an infected system. If you remembe...
In The Wild Flash Exploit Analysis – Part 1
Insights and Research
4 Min read

In The Wild Flash Exploit Analysis – Part 1

Today, one of my colleagues requested that I provide additional details about a web page that we had blocked for a customer. The blocked URL was ‘hxxp://www.39sys39.cn/htm/ie.html’. He wanted details about the threat pre...
Cloud Transparency During A Crisis
Insights and Research
2 Min read

Cloud Transparency During A Crisis

The beginning of July was a big week for data center outages with some notable Internet impact. I've written before about cloud resiliency and uptime in my 'Changing a tire while going 60mph' and 'Big, white puffy clouds...
Patches, Auto-updating, And Convenience
Insights and Research
3 Min read

Patches, Auto-updating, And Convenience

June has been a busy month for web-centric security patches. Microsoft fixed 31 different vulnerabilities (many affecting IE and Office), Adobe patches critical vulnerabilities in Adobe Acrobat and QuickTime, Google plug...
Page Is Loading… Please Wait
Insights and Research
2 Min read

Page Is Loading… Please Wait

Web access is a critical activity for virtually all jobs, but how many employees recognize the risks that can be encountered simply by viewing a web page? How many times have you encountered web pages with a title such...
ActiveX Vulnerabilities – Threat To Web Security
Insights and Research
3 Min read

ActiveX Vulnerabilities – Threat To Web Security

As I mentioned in my earlier blog, phishing is a never-ending threat for web security. Another threat for web users is the rise in the ActiveX vulnerabilities. These are very easy to exploit as there is a great ...
Those Who Know Where And When You Surf
Insights and Research
6 Min read

Those Who Know Where And When You Surf

Nobody likes the idea of a big brother watching over them as they surf. Yet as browser technology evolves, we are starting to have some privacy-violating "byproducts" of innocuous features. Now, we already generally acce...
Public Service Announcement: EFF Coder's Rights Project
Insights and Research
2 Min read

Public Service Announcement: EFF Coder's Rights Project

I ran across this today, and thought it was just too valuable to not make mention of. The EFF has a "Coder's Rights Project" that includes FAQs and guides related to the legalities of security disclosure, reverse enginee...
Spoofing Caller-ID: The New Hacking Inroad
Insights and Research
2 Min read

Spoofing Caller-ID: The New Hacking Inroad

It is amazing to see the number of bridged services that rely upon the source telephone address of an incoming call (supplied via caller-ID) or SMS message as a form of authentication. Maybe this made sense in the 90's w...
Antivirus: Can't Live With It, Can't Live Without It
Insights and Research
6 Min read

Antivirus: Can't Live With It, Can't Live Without It

Like you and many other responsible Internet users, I run antivirus software on my desktop. Even leaving the performance issues out of it, I find it very frustrating to configure and use. I get that it's complicated behi...
Changing A Tire While Going 60mph
Insights and Research
3 Min read

Changing A Tire While Going 60mph

In my previous post Big, white, puffy clouds can still evaporate, I mentioned the Google Gmail outage from February and pointed out the implied resiliency (or lack there-of) of cloud-based platforms. Rich Miller over at ...
New Browser Security Model Needed For SaaS?
Insights and Research
3 Min read

New Browser Security Model Needed For SaaS?

As the age of Software as a Service (SaaS) becomes realized, we are finding that this new way of doing business can sometimes be at odds with previous methodologies and processes. Note that this is not particularly insig...
Patch To Get Some New Holes
Insights and Research
4 Min read

Patch To Get Some New Holes

According to many news outlets (but interestingly, not Panda Labs' blog, which most of the reports cite), a couple of days ago, Panda Labs said MS09-008 doesn't fix one of the vulnerabilities it set out to fix. This comp...
Botnets For Everybody!
Insights and Research
2 Min read

Botnets For Everybody!

BBC's Click technology program decided to demonstrate the SPAM power of botnets by directing 22,000 zombies in their own personal botnet. Sure, a lot of people are questioning the legality of this stunt, but that's not w...
Vulnerable By Design...no, Really
Insights and Research
3 Min read

Vulnerable By Design...no, Really

Part of my responsibilities at Zscaler is to look through our log files in order to spot strange and unusual requests (new malware, botnets, etc.), questionable surfing trends, and other sorts of data-mining security goo...
Big, White, Puffy Clouds Can Still Evaporate
Insights and Research
2 Min read

Big, White, Puffy Clouds Can Still Evaporate

If you haven't heard by now, Google GMail had a 2.5 hour outage on Tuesday. Acacio Cruz, Gmail’s Site Reliability Manager, explained in a little more detail regarding the outage. My interpretation of his explanation is t...
EV-SSL, SSL, And Who’s Not Using It
Insights and Research
6 Min read

EV-SSL, SSL, And Who’s Not Using It

It seems I've been picking on EV-SSL lately. It's not intentional; I just have encountered a lot of questionable marketing fluff lately and wanted to talk about it. Today is no different. Tim Callan's recent blog post go...
What Did You Do On Data Privacy Day?
Insights and Research
1 Min read

What Did You Do On Data Privacy Day?

January 28th is officially international Data Privacy Day. Apparently this was established in 2008 to raise awareness for data privacy issues, provide education (particularly to teenagers) regarding data privacy concerns...
EV-SSL's Reported Successes, Maybe
Insights and Research
4 Min read

EV-SSL's Reported Successes, Maybe

In a previous post I included a blurb mentioning that Verisign reported 7000 EV-SSL certificates were issued in the past two years, which seems fairly low. Recently I was referred to a spot on Verisign’s website where th...
SANS/CWE Top 25 Programming Errors
Insights and Research
4 Min read

SANS/CWE Top 25 Programming Errors

Recently Mitre and SANS teamed up to produce a list of the top 25 security errors that programmers should focus on. The errors were selected from the Common Weakness Enumeration (CWE) collection, which looks to enumerate...
Microsoft Internet Explorer Dips Below 70% Market Share
Insights and Research
3 Min read

Microsoft Internet Explorer Dips Below 70% Market Share

I ran across article by Net Applications that shows their recent browser tracking data. According to their stats, Microsoft Internet Explorer (MSIE) browser has finally dropped below 70% of the overall browser market sha...
Money Magazine's Take On Phishing
Insights and Research
3 Min read

Money Magazine's Take On Phishing

The January 2009 issue of Money magazine published a quiz entitled "Are you Phish Food?" The purpose of the quiz was to gauge your knowledge on whether you are being targeted for a phishing attack. If you don’t get the p...
Final Encounters With A Web Comment Spammer
Insights and Research
4 Min read

Final Encounters With A Web Comment Spammer

In the last part of my series on web comment spamming applications, I want to pass along a few things I noticed that were effective at separating the spam apps from the humans. Many of these have been publicly discu...
Third Encounters With A Web Comment Spammer
Insights and Research
4 Min read

Third Encounters With A Web Comment Spammer

In my previous two posts, I wrote about a web comment spam application that has been hitting one of my personal web sites. I set up a bit of an agility test for the bots to figure out what they were, and were not, capabl...
Second Encounters With A Web Comment Spammer
Insights and Research
3 Min read

Second Encounters With A Web Comment Spammer

Earlier I wrote my First Encounters with a Web Comment Spammer piece. In that piece I devised a plan to lay a trap of sorts for the web comment spamming application, in order to test the depth of the application's functi...
Technical Quickie: Building SpiderMonkey On FreeBSD 6.2 AMD64
Insights and Research
1 Min read

Technical Quickie: Building SpiderMonkey On FreeBSD 6.2 AMD64

I wanted to get Didier Stevens modified SpiderMonkey Javascript engine compiled and running on a FreeBSD 6.2 AMD64 box. It turns out the config files shipped with his 1.7.0 version do not include FreeBSD support, so I wo...
Hiding Web 2.0 Malware in Plain Sight
Insights and Research
3 Min read

Hiding Web 2.0 Malware in Plain Sight

Hello everyone, Jeff Forristal here. I thought I'd take a moment to discuss a trend we're seeing in attacker tactics, and predict how it may evolve into what will become commonplace tomorrow. Recently we ran across a ...
Trust Two Times Removed
Insights and Research
4 Min read

Trust Two Times Removed

Hello everyone, Jeff Forristal here. I thought I'd take a moment to discuss a real-life security incident that I recently reviewed in post-mortem fashion. The plot is simple: while the person was surfing the web, their b...
First Encounters With A Web Comment Spammer
Insights and Research
4 Min read

First Encounters With A Web Comment Spammer

Jeff Forristal here. I run a couple of personal web sites that host the usual gamut of material found on personal web sites (pictures of my kids and family, my latest favorite LOLcat graphic, etc.). Recently I updated on...
The Obfuscated TCP Project
Insights and Research
4 Min read

The Obfuscated TCP Project

Hello, Jeff Forristal here. In my last post I talked about the desire of some folks to use SSL for encryption purposes but forego the authentication components (via the use of self-signed SSL certificates). Overall it’s ...
The ‘SSL Encryption Without Authentication’ Debate
Insights and Research
8 Min read

The ‘SSL Encryption Without Authentication’ Debate

Every so often I encounter a debate where an individual is making a case for the value of supporting/accepting self-signed SSL certificates in browsers. Basically their argument is “I do not care about authentication of ...

Explore More Topics