[This blog was primarily written by Xiaoning Li of Intel Labs, with assistance from Peter Szor of McAfee Labs.] In February 2013, the Adobe Product Security Incident Response Team (PSIRT) released security advisory APSA13-02. In that report they listed two vulnerabilities (CVE-2013-0640 and CVE-2013-0641) that were widely exploited. At Intel Labs and McAfee Labs we Read more…
Tags: Adobe, Adobe Reader, APSA13-02, ASLR, CVE-2013-0640, CVE-2013-0641, DEP, PDF, return-oriented programming, ROP, stack pivoting
Microsoft has issued Security Advisory 2718704, in which the company disclosed that it recently became aware of the Flamer/Skywiper threat, which uses certificates derived from the Microsoft Certificate Authority. The actual certificate in question was used to sign at least one of the attack components associated with the module in the Skywiper framework. This is Read more…
Tags: CA, certificate authority, Flame, Flamer, SkyWiper, worm
There has been quite a bit of analysis and speculation about the Flamer/Skywiper threat. As we started to analyze this threat, we knew from the very beginning that this was going to be a giant undertaking and potentially very long term. Now we want to pause to help the people we protect visualize the kind Read more…
Tags: advanced persistent threats, antivirus, APT, critical infrastructure, Cybercrime, Data Protection, enterprise, Flamer, global threat intelligence, Identity thieves and cybercriminals, labs, malware, McAfee, McAfee Labs, Mobile, mobile security, Network Security, SkyWiper, social networking
A few weeks ago, Iran reported intensified cyberattacks on its energy sector that they observed as a direct continuation of the Stuxnet and Duqu attacks. Over the weekend, the IR Cert (Iran’s emergency response team) published a new report that describes this attack as Flame and/or Flamer. Some other news agencies also called the attack Read more…
Tags: Advanced Persistent Threat, antivirus, APT, Cybercrime, cyberespionage, cyberwarfare, espionage, global threat intelligence, malware, McAfee Labs, targeted attack
In September, I had the pleasure of giving the keynote speech at “Hacktivity 2011″ in Budapest, Hungary. I was very excited to see the large audience, about 1,000 visitors, among them very serious and well-known security professionals, instructors, and security enthusiasts. It was also exciting for me because I made the presentation in my native Read more…
Tags: conference, fake anti-virus software, hacking, Hacktivity, ICS, industrial control systems, malware, Rootkits, Stuxnet
Digital certificates and certificate authorities have been much in the news recently. Attacks–such as those used by Stuxnet, Duqu, and other malware–involving stolen certificates show an increasingly worrisome new security trend. Certificate authorities have been targeted several times in the recent past with some success. There is a large chunk of known malware signed by Read more…
Tags: Adobe, Digital Certificates, Duqu, Rogue Certificates, rootkit, RootkitRemover, Stuxnet, ZeroAccess
We discussed much of the unfolding Duqu attack in our previous post. Some new light has recently illuminated some missing pieces to this interesting attack. Researchers at CrySys Labs in Hungary have disclosed information about a Word document that is purported to be the installer file for the Duqu attacks. The document loads a kernel Read more…
Tags: Duqu, Kernel 0day vulnerability, Stuxnet, Zero-Day
Stuxnet was possibly the most complex attack of this decade, and we expected that similar attacks would appear in the near future. One thing for sure is that the Stuxnet team is still active–as recent evidence has revealed. McAfee Labs received a kit from an independent team of researchers that is closely related to the Read more…
Tags: Cybercrime, data breach, global threat intelligence, Identity thieves and cybercriminals, malware
Hi, everyone. I am very excited to announce that I recently joined McAfee Labs. As many of you know, I have spent more than 20 years doing anti-virus (AV) development and research. Needless to say, I am not happy to see the new developments in fake AV software. Fake AV developments began only a few Read more…
Tags: Apple, Cybercrime, Data Protection, Endpoint Protection, Fake AntiVirus, Family Safety, global threat intelligence, identity protection, identity theft, malware, OS/X
Posts by Peter Szor