I’ve just returned home from a fantastic and very enjoyable ski vacation, where I had the rare opportunity to spend some relaxing yet quality time with my family. As the old adage goes, time really does fly, and the holiday came and went in the blink of an eye. This might be the last year Read more…
Tags: DeepDefender, EBC, Endpoint Security, Executive Briefing Center, McAfee Network Security Platform, Mobile World Congress, rootkit, RSAC, SIA Partners, ValidEdge sandboxing
Today McAfee Labs published a report on how malware can operate at the kernel level and bypass Microsoft’s security for 64-bit Windows systems. “Defeating PatchGuard: Bypassing Kernel Security Patch Protection in Microsoft Windows” explains the danger of positioning operating system security at the kernel level. Now for a little background: The evolution of malware has Read more…
Tags: Deep Defender, DeepSAFE, kernel, PatchGuard, rootkit
ZeroAccess, a kernel-mode rootkit, recently shifted its infection technique from kernel mode to user mode. (For more on ZeroAccess, which turns infected systems into a peer-to-peer botnet, read these posts from my colleagues Peter Szor and Aditya Kapoor.) Even in user mode, ZeroAccess can maintain its presence on an infected system. ZeroAccess implements what I Read more…
Tags: botnet, kernel mode, rootkit, user mode, ZeroAccess
We have seen many discussions of the MyBios “Bioskit” discovered at the end of 2011. MyBios was the first malware to successfully infect the Award BIOS and survive the reboot. It was first discovered by a Chinese security company; many other security vendors published detailed analyses after that. We have seen a lot of samples Read more…
Tags: award, Bios, Bioskit, bootkit, Flash, malware, master boot record, MBR, Mybios, Niwa, reinfect mbr, rootkit, survive reboot, windows malware
Darkmegi was in the news a couple of months back; it was the first known threat to be delivered through the Microsoft vulnerability CVE-2012-0003 (MIDI Remote Code Execution Vulnerability) exploitation. More recently Darkmegi has been seen in CVE-2011-3544 (Java Runtime Remote Code Execution) drive-by attacks as part of the Gong Da Pack exploit kit. Darkmegi uses Read more…
Tags: Deep Defender, DeepSAFE, rootkit, Stealth
Digital certificates and certificate authorities have been much in the news recently. Attacks–such as those used by Stuxnet, Duqu, and other malware–involving stolen certificates show an increasingly worrisome new security trend. Certificate authorities have been targeted several times in the recent past with some success. There is a large chunk of known malware signed by Read more…
Tags: Adobe, Digital Certificates, Duqu, Rogue Certificates, rootkit, RootkitRemover, Stuxnet, ZeroAccess
Anyone who has been in information security recently knows that it has gotten easier for cybercriminals to build stealth crimeware. The malware we deal with on a regular basis grows ever more difficult to find, while high-end targeted attacks such as Stuxnet and other advanced persistent threats (APTs, the abbreviation I hate) are using ever Read more…
Tags: advanced persistent threats, APT, crimeware, Cybercrime, Data Protection, Endpoint Protection, identity protection, malware, Network Security, Operation Aurora, rootkit, Rootkits, security, Stuxnet
Posts tagged under rootkit