DOCSLIB.ORG

Contents in This Issue

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Contents in This Issue FEBRUARY 2006 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT WMF IN THE SPOTLIGHT What threats may come The Windows Meta File (WMF) format has received a lot of attention over recent weeks. Peter 3 NEWS Ferrie finds out a bit more about it, and then Neighbourhood Watch to fight ‘badware’ explains why it has been in the spotlight. VB2006 call for papers page 5 Addendum: The false positive disaster AV UNDER THE MICROSCOPE 3 VIRUS PREVALENCE TABLE Dan Kaminsky takes a long, hard look at the reaction of the AV industry (or lack thereof) to the Sony rootkit incident and assesses the 4 VIRUS ANALYSIS consequences. Not worthy page 8 5 TECHNICAL FEATURE WINDOWS NT ON TEST Inside the Windows Meta File format Matt Ham fully expected a bumper harvest of VB 100% awards this 8 OPINION month, simply due to the familiarity Learning from Sony: an external perspective of the Windows NT platform to developers. Find out whether his 11 FEATURE expectations were met in his NT comparative review. page 12 Signature updates vs BCP 12 COMPARATIVE REVIEW Windows NT 4 Workstation 20 END NOTES & NEWS This month: anti-spam news & events; John Graham-Cumming investigates whether Bayesian poisoning really exists. ISSN 1749-7027 COMMENT ‘A serious threat in in the US. A Trojan operator needs access to a compromised system for just hours or even minutes to 2006 will be steal vital information. Since most attacks are unique, it multi-stage, is rare to see more than a handful of copies of each individual Trojan and traditional signature-based targeted phishing solutions are usually unable to block these threats. We attacks.’ are likely to witness more incidents of this nature in 2006. Or rather, we’ll be lucky if we can spot them before they get to us, carry out their payload and disappear. Tomer Honen A serious threat in 2006 will be multi-stage, targeted Aladdin Knowledge Systems phishing attacks. According to the Anti-Phishing Working Group (http://antiphishing.org/), thousands of WHAT THREATS MAY COME phishing attacks are reported every month, but the attack It is said that money makes the world go round – well it methods are changing. Instead of luring victims to certainly drives the malware community. Over the last spoofed websites where they are fooled into entering year, we’ve seen a sharp increase in the number of confidential information such as their passwords, backdoor attacks employed by various in-the-wild financial details etc., the latest trend is to use threats. Taking over computers is apparently quite a password-stealing malicious code in the phishing profitable endeavour, and there are many buyers for the websites themselves. Even if the user does not enter the scores of backdoor-infected PCs out there. It is safe to confidential information, they may be infected by say that 2006 will be just as malware-filled as 2005 was, malicious code that will extract it forcefully. and probably even worse. The number of malicious code phishing sites more than Mobile phone threats will make a few headlines this year quadrupled in 2005, to over 1,000 reported sites. as the number of smartphone users grows. We are likely Money-driven attackers will exploit this obvious Achilles’ to see new mobile phone threats, which may be able to heel by employing multi-stage targeted phishing attacks: spread to other platforms and infect them. Since the • Certain users will receive an email intended communication channels employed by mobile phones specifically for them. This will display content that are often insecure, it will be easy to use these devices to is of interest to the recipient, trying to get them to implant remotely controlled Trojans in a corporate click on a link to a site. environment. In this way, hackers won’t even need to • The website will contain malicious code that drops make the initial contact with the infected PC; all they and executes a backdoor Trojan on the victim’s need to do is infect a mobile device and let the PCs come system with little or no user interaction. And voilà! to them. Somewhere in the world a hacker obtains a new More disturbing than common spyware or worms are remote controlled system. This turns phishing invisible targeted spyware and Trojans. Last year we attacks into a serious corporate threat. witnessed several Trojan-related incidents that made Many content security solutions scan malicious content headlines around the world – from corporate attacks in received by mail but neglect to analyse content Israel and the UK, to major credit card information theft downloaded from the web. By neglecting to inspect web traffic, users become exposed. Also, many users do not realize that email messages can execute content downloaded from the web as the message is viewed. Editor: Helen Martin According to Gartner, ‘Through 2010, each new Technical Consultant: Matt Ham technology transition point will result in 30 per cent Technical Editor: Morton Swimmer more newly opened attack paths than old paths that are Consulting Editors: closed.’ In layman’s terms this means that the more Nick FitzGerald, Independent consultant, NZ advanced we become, the bigger the threat. It is a grim Ian Whalley, IBM Research, USA prediction, and there’s little that can be done to make the Richard Ford, Florida Institute of Technology, USA Edward Wilding, Data Genetics, UK world behind our firewall, anti-virus, anti-spyware and anti-spam products more hospitable. However, with the right protection, some of us should hopefully have a relatively quiet year. 2 FEBRUARY 2006 VIRUS BULLETIN www.virusbtn.com NEWS NEIGHBOURHOOD WATCH TO FIGHT ‘BADWARE’ Prevalence Table – December 2005 Google, Lenovo and Sun Microsystems have pledged their support for a new initiative aimed at fighting spyware, Virus Type Incidents Reports malware and deceptive adware. The Neighbourhood Watch-style campaign Stopbadware.org is being led by Win32/Sober File 11,597,547 98.16% Harvard Law School’s Berkman Center for Internet & Win32/Mytob File 96,390 0.82% Society in the US, and Oxford University’s Oxford Internet Win32/Netsky File 84,022 0.71% Institute in the UK. Win32/Mydoom File 11,540 0.10% The effort aims to provide clear and objective information Win32/Bagle File 7,854 0.07% about downloadable applications so that consumers can Win32/Sdbot File 4,889 0.04% make informed choices about what they download onto their systems. Stopbadware.org will gather stories and data Win32/Lovgate File 3,648 0.03% from users, and use that data to inform its research efforts. Win32/Zafi File 2,426 0.02% The Stopbadware.org website invites less technical users to Win32/Funlove File 1,993 0.02% submit stories about their experiences with ‘badware’, as Win95/Spaces File 1,166 0.01% well as appealing to those who are more technically-aware to submit technical data reports. Those behind the campaign Win32/Bagz File 358 0.00% also plan to write standards and testing procedures to define Win32/Mimail File 333 0.00% ‘badware’, and spotlight the worst offenders with the help Win32/Bugbear File 311 0.00% of the anti-malware community. Full details of the project Win32/Pate File 270 0.00% can be found at http://www.stopbadware.org/. Win32/Klez File 222 0.00% Win32/Mabutu File 207 0.00% VB2006 CALL FOR PAPERS Win32/Gibe File 183 0.00% The deadline for submitting paper proposals for VB2006 is Win32/Dumaru File 181 0.00% fast approaching. Abstracts of approximately 200 words must be sent as plain text files to [email protected], to Win32/Valla File 163 0.00% arrive no later than Thursday 9 March 2006. Win32/Maslan File 152 0.00% Submissions are invited on all subjects relevant to Win32/Reatle File 120 0.00% anti-malware and anti-spam. A list of topics suggested by Win95/Tenrobot File 100 0.00% the attendees of VB2005 can be found (along with further Win32/Elkern File 79 0.00% details of the paper submission and selection process) at http://www.virusbtn.com/conference/vb2006/2006call.xml. Win32/Kriz File 76 0.00% VB2006, the Sixteenth Virus Bulletin International Win32/Brepibot File 72 0.00% Conference, will take place 11–13 October 2006 at the Win32/MyWife File 72 0.00% Fairmont The Queen Elizabeth, Montréal, Canada. Win32/Bobax File 55 0.00% Win32/Mota File 55 0.00% ADDENDUM: THE FALSE POSITIVE Redlof Script 52 0.00% DISASTER Win32/Swen File 51 0.00% Some concerns have arisen over the version of ClamAV Win32/Fizzer File 42 0.00% tested for the article ‘The false positive disaster’, published Win32/Chir File 38 0.00% Virus Bulletin VB in in November 2005 (see , November Others[1] 406 0.00% 2005, p.11). Rather than the product being compiled on the test machine directly from the source code, as is the Total 11,815,073 100% developers’ recommendation, a precompiled developer version of the product was downloaded from a third party’s [1]The Prevalence Table includes a total of 406 reports across website (in good faith, since a link was provided on the 65 further viruses. Readers are reminded that a complete listing is posted at http://www.virusbtn.com/Prevalence/. ClamAV website). Therefore, the results obtained cannot be assumed to apply to the ‘official’ version of the product. FEBRUARY 2006 3 VIRUS BULLETIN www.virusbtn.com VIRUS ANALYSIS NOT WORTHY If the registry value ‘Idoneus’ exists, the virus reads it and deletes the file to which the registry value points, then copies Peter Ferrie itself to another randomly chosen directory, and rewrites the Symantec Security Response, USA registry value with the newly chosen directory name.
Load more

Recommended publications
  • Computer Viruses, in Order to Detect Them
    Behaviour-based Virus Analysis and Detection PhD Thesis Sulaiman Amro Al amro This thesis is submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Software Technology Research Laboratory Faculty of Technology De Montfort University May 2013 DEDICATION To my beloved parents This thesis is dedicated to my Father who has been my supportive, motivated, inspired guide throughout my life, and who has spent every minute of his life teaching and guiding me and my brothers and sisters how to live and be successful. To my Mother for her support and endless love, daily prayers, and for her encouragement and everything she has sacrificed for us. To my Sisters and Brothers for their support, prayers and encouragements throughout my entire life. To my beloved Family, My Wife for her support and patience throughout my PhD, and my little boy Amro who has changed my life and relieves my tiredness and stress every single day. I | P a g e ABSTRACT Every day, the growing number of viruses causes major damage to computer systems, which many antivirus products have been developed to protect. Regrettably, existing antivirus products do not provide a full solution to the problems associated with viruses. One of the main reasons for this is that these products typically use signature-based detection, so that the rapid growth in the number of viruses means that many signatures have to be added to their signature databases each day. These signatures then have to be stored in the computer system, where they consume increasing memory space. Moreover, the large database will also affect the speed of searching for signatures, and, hence, affect the performance of the system.
    [Show full text]
  • Contents in This Issue
    NOVEMBER 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Virus Bulletin WHEN IRISH EYES ARE thanks the sponsors Is the boot on the other foot? SMILING of VB2005: A busy conference schedule, 3 NEWS combined with the famous warmth Microsoft assists Nigeria in fight against and hospitality of the Irish and a high-tech crime drop or two of the local ‘water’ were Errata – Windows 2003 Server a recipe for success for VB2005 in comparative review Dublin last month. page 14 3 VIRUS PREVALENCE TABLE LANGUAGE LOGGING 4 VIRUS ANALYSIS Using components of Windows multilingual Criss-cross support, it is possible to create a file that will capture keystrokes on a target system while using FEATURES the OS to protect that file from removal or deletion. Masaki Suenaga explains how an IME could be 6 IME as a possible keylogger used as a keylogger. 11 The false positive disaster: anti-virus vs. page 6 WinRar & co. THE TROUBLE WITH WINRAR 13 LETTERS Andreas Marx reports on his extensive false positive testing of anti-virus software. 14 CONFERENCE REPORT page 11 In Dublin’s fair city 16 PRODUCT REVIEW NOD32 for Windows NT/2000/XP/2003/x64 with centralized management This month: anti-spam news and events and 20 END NOTES & NEWS John Graham-Cumming looks at measuring and marketing spam filter accuracy. ISSN 0956-9979 COMMENT ‘It adds insult to the voices of those of us on the systems administrators’ side, which was equal in its representation on the panel.) injury when the So, putting aside the reporting of the subject, I’d like to major media outlets touch again on why accurate reporting is an issue for misrepresent the those of us on the administration side.
    [Show full text]
  • Contents in This Issue
    FEBRUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT A NEW TREND IN Are your networks secure? VIRUS WRITING? Following in the footsteps 3 NEWS of W32/Bugbear.A, VB2004 call for papers W32/Mimail.I and .J took Divine intervention the concern of identity theft Waiting, reflecting and removing to another level, producing a plausible-looking popup and web page and asking questions that are favoured security checks of many 3 VIRUS PREVALENCE TABLE banks. Stuart Taylor asks: is there a criminal element entering virus writing? 4 FEATURE page 11 Outbreak response times: putting AV to the test TESTING TIMES It’s not just a product’s ability to detect malware 7 TUTORIAL that is of vital importance to the user, but the speed Mission impossible: the Messenger with which the developer produces an update in and others outbreak situations. Andreas Marx puts AV response times to the test. 11 OPINION page 4 Misguided or malevolent? New trends in virus writing COMPARATIVE REVIEW Matt Ham lines up the AV products for 12 COMPARATIVE REVIEW Windows NT. page 12 Windows NT 4.0 20 END NOTES & NEWS This month: Anti-spam news and events, Habeas delivering the goods, ASRG summary. ISSN 0956-9979 COMMENT ‘Until now, most who are not located in the same office, who may be travelling on business or may be working from home. business use of Managers from any location can respond to instant instant messaging messages with quick decisions. Presence-awareness allows each user to see the online status and availability has been of the of other colleagues on the system.
    [Show full text]
  • Progress Made, Trends Observed a White Paper from the Microsoft Antimalware Team Msrwindows Malicious Software Removalt Tool
    Progress Made, Trends Observed A White Paper from the Microsoft Antimalware Team MSRWindows Malicious Software RemovalT Tool Matthew Braverman Program Manager Microsoft Antimalware Team Acknowledgements I would like to thank the following individuals for their contribution to this paper: Mike Chan, Brendan Foley, Jason Garms, Robert Hensing, Ziv Mador, Mady Marinescu, Michael Mitchell, Adam Overton, Matt Thomlinson, and Jeff Williams The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photo- copying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Copyright © 2006 Microsoft Corporation. All rights reserved.
    [Show full text]
  • U Slucaju Da Vam Je Racunar Zarazen Virusom Mozete Koristiti Sledece Alate Za Njegovo Odstranjivanje ....Alati Su Poredjani Po Abecednom Redu
    U slucaju da vam je racunar zarazen virusom mozete koristiti sledece alate za njegovo odstranjivanje ....alati su poredjani po abecednom redu.... A AOL.Trojan.32512 Symantec http://www.symantec.com/avcenter/ven...dyremoval.html Apost.A Trend Micro http://www.trendmicro.com/ftp/products/tsc/tsc.zip Autoupder Symantec http://securityresponse.symantec.com...oval.tool.html Avril Sophos http://www.sophos.com/support/disinfection/avril.html Avron Kaspersky http://www.thunderstore.com/clean.htm B BadTrans Panda http://www.pandasoftware.es/library/...rans@mm_en.htm Bad Trans.b Symantec http://securityresponse.symantec.com...r/FixBadtr.exe Panda http://www.pandasoftware.es/library/W32BadtransB_en.htm Sophos http://www.sophos.com/support/disinf...badtransb.html Bagle.A@mm Panda http://www.pandasoftware.com/download/utilities Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=182 Symantec http://securityresponse.symantec.com...oval.tool.html Sophos http://www.sophos.com/support/disinfection/baglea.html AntiVir http://www.antivir.de/download/remov...%2BBedingungen F-Secure http://www.f-secure.com/v-descs/bagle.shtml Norman http://www.norman.com/virus_info/vir...es.shtml#bagle McAfee http://vil.nai.com/vil/stinger Bagle.B@mm Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=193 Panda http://www.pandasoftware.com/virus_i...?idvirus=44777 Symantec http://securityresponse.symantec.com...oval.tool.html McAfee http://vil.nai.com/vil/stinger Bagle.C@mm McAfee http://vil.nai.com/vil/stinger Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=205
    [Show full text]
  • 4GT Tuning Switch (13GB), 146, 334–335 Active/Passive Cluster Model Compared with Active/Active, 349–350 a Defined, 336 a (Host) Records, 356 Activesync
    30323 99 pp. 539-570 r1ah.ps 2/19/04 11:15 AM Page 539 Index 4GT tuning switch (13GB), 146, 334–335 Active/Passive cluster model compared with Active/Active, 349–350 A defined, 336 A (Host) records, 356 ActiveSync. See Exchange ActiveSync Accept/Deny lists, 309–312, 320 ActiveX, S/MIME control, 286–287 Access control lists (ACLs), 295 ADC (Active Directory Connector), 29–31 Access control, information privacy, 294–295 components, 154–155 Access properties, SMTP virtual servers, connection agreements, 31 231–232 installing, 165 Accessibility requirements, e-mail systems, 6 name resolution and, 30–31 ACLs (access control lists), 295 overview, 29–30 Active Directory. See also Registry schema changes and, 86–87 compatibility issues, 63–64 service account restrictions, 30 domain functional levels, 63–64 setup permissions, 31 DOMAINPREP and, 29 ADC management snap-in, 165–166 DSAccess (Directory Service Access), ADC servers, upgrading, 184 475–476 ADC Tools Exchange 2000 integration with, 8–9 automating connection agreements, 166–167 Exchange 2003 deployment and, 26–27 launching, 165–166 forest functional levels, 64 log files, 156–157, 173 FORESTPREP and, 27–29 running, 155–156 InetOrgPerson object, 65 ADCObjectCheck, 133 LDAP and, 288–290 ADCUserCheck, 133 linked value replication, 64 AdditionalPoolThreadsPerProc, 474 preparing for Exchange Server 2003, 154 Address Rewrite (EXARCFG), 498–499 RSG integration with, 399–404 ADDROOTCERT.EXE (Add Root Certificate), Active Directory Account Cleanup 497–498 Wizard, 17 ADMIN.EXE (Exchange Server 5.5 Active Directory Connector. See ADC Administrator), 16 (Active Directory Connector) Administration. See also ESM (Exchange System Active Directory Services Interface (ADSI), Manager); QDGs (query-based distribution 111 groups) Active/Active cluster model components, 15–16 compared with Active/Passive, 349–350 improvements to, 92–93 defined, 336 productivity enhancements, 195–196 limitations of, 353 Administrative Groups containers, ESM, 211–212 539 30323 99 pp.
    [Show full text]
  • Contents in This Issue
    APRIL 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT 1 NEW WORM RECEIVED Outbreak detection from the trenches SymbOS/Commwarrior.A is the first worm to use MMS technology to spread on mobile phones. Will MMS 3 NEWS become the replication method of US anti-spyware bill approved choice among malware for mobile phones? Peter Ferrie and Frédéric IT security ‘more stressful than divorce’ Perriot fear that this might be the case. Anti-hype site going for a song page 4 WHAT’S UP DOC? 3 VIRUS PREVALENCE TABLE Static analysis is a critical component of anti-virus strategies, but obfuscation techniques make it 4 VIRUS ANALYSIS difficult to identify the calls made by malicious programs. Eric Uday Kumar, Aditya Kapoor and Paradise lost Arun Lakhotia present DOC, a tool for detecting obfuscated calls and returns in binaries. page 7 7 TECHNICAL FEATURE DOC – answering the hidden ‘call’ of a virus HATS OFF As Linux makes gradual headway in the operating system battleground, VB BOOK REVIEWS continues to see a rise in the number of 11 The art of defence products submitted for Linux 12 Dummies’ guide to viruses comparative reviews. This time there are 17. page 13 13 COMPARATIVE REVIEW Red Hat Linux 9 20 END NOTES & NEWS This month: anti-spam news & events; Bayesian Noise Reduction; ASRG summary. ISSN 0956-9979 COMMENT ‘Ironically it is the wait! The virus does not yet ‘exist’ for your customers because it is still only in Japan. Once it moves across the simplest malware borders it appears on the radar; detection kicks in and that takes 10 copies customers are protected.
    [Show full text]
  • Contents in This Issue
    MAY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Survey responses by no. and % No of responses Percentage THE 40 37.1 35.48 Keeping pace in a war of worms 35 ELUSIVE 30 25 23 UNICORN 22 3 NEWS 20 15 The results of 11.29 10 9.68 7 NAI reverts to McAfee 6 6.45 Andrew Lee’s 5 4 0 malware naming Symantec vulnerabilities Researchers Vendors Corporate Indy Other survey indicate Call for papers: AVAR 2004 that the anti-virus industry’s UNICORN is as elusive as the shy mythical creature itself. 3 VIRUS PREVALENCE TABLE page 13 VIRUS ANALYSES CHIBA WITTY BLUES 4 Netsky: conflict starter? W32/Witty shows a number of similarities to 9 Chiba Witty blues W32/Slammer: it is short, its sending rate is limited only by available bandwidth, and it selects random target IP addresses. Unlike Slammer, however, FEATURES this worm features a very destructive payload. 11 Password-protected viruses Frédéric Perriot, Péter Ször and Peter Ferrie provide 13 Hunting the UNICORN the witty comments. page 9 17 PRODUCT REVIEW BitDefender for Samba Linux Fileservers 1.5.6-1 20 END NOTES & NEWS This month: anti-spam news and events; closing loopholes in the mail flow with MTA Mark and SPF; and a summary of the month’s posting to the ASRG mailing list. ISSN 0956-9979 COMMENT “When it comes to malware doing very little except being a nuisance through propagation techniques, their method of gaining access protection, overconfidence is our to computers in the first place is usually the tried and own worst enemy.” true strategy of social engineering.
    [Show full text]
  • Virus Bulletin March 2004
    MARCH 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT ALL IN THE MIX Outsourcing: the future of anti-malware Take a little piece of W32/Mimail, a dash of social support? engineering, a pinch of W2K/Stream and share the code freely. Peter Ferrie describes the gaggle of 3 NEWS variants that make up the Dumaru family. Plans, acquisitions and royalty page 4 Gigabyte arrested DOOM AND GLOOM 3 VIRUS PREVALENCE TABLE When a daily sports paper compares a national soccer crisis with the spread of an Internet worm, you know that the worm has had an enormous VIRUS ANALYSES impact on everyday life. Gabor Szappanos tracks 4 How Dumaru? the rise of W32/Mydoom. 9 We’re all doomed page 9 14 FEATURE RESCUE ME Rescue me 2: disinfection with With new malware becoming increasingly complex bootable rescue media and a developing trend towards malware that prevents AV software from functioning, good rescue 16 CALL FOR PAPERS solutions have become vital. Andreas Marx looks at a range of end-user products. page 14 17 PRODUCT REVIEW Grisoft AVG 7.0 19 ERRATA 20 END NOTES & NEWS This month: John Graham-Cumming reports on different ways to say ‘Viagra’ and Pete Sergeant presents his monthly summary of postings to the ASRG mailing list. ISSN 0956-9979 COMMENT ‘The future of employee would have, they do not need access to ‘the keys to the kingdom’ if sample handling is configured corporate malware correctly. In the rare case that the consultant needs to support may visit a machine, non-disclosure agreements, and supervision by a member of staff will meet the trust very well lie in requirements of the client.
    [Show full text]
  • VB January 2004, P.14
    JANUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Malware Distribution (type) TRENDS 2.00% Drawing the lines 1.50% script AND 1.00% binary macro 0.50% 0.00% FORECASTS ItW %growth (VirusBulletin) %growth ItW ch April May June July 3 NEWS Mar August January February October September Once again the 2003 (January~October) Number crunching time has come to ponder what might be in store for SAS – the SysAdmin Service? the coming year. Jamz Yaneza looks at malware data collected over the past year and attempts some 3 VIRUS PREVALENCE TABLE predictions for 2004. page 14 4 VIRUS ANALYSIS ALL-ROUNDER Who? What? Where? Swen? Swen has something for everyone, one might say. Peter Ferrie has the nitty gritty details of this 11 LETTERS all-action virus. page 4 11 CALL FOR PAPERS HARDWARE SOLUTIONS Recent reports of a ‘new’ anti-virus solution based 12 FEATURE on quick pattern matching of network traffic Hardware anti-virus solutions? without a significant reduction in network speed seem tantalising. However, Matthew Wagner has 14 OPINION reservations about such a hardware solution. The malware battle: page 12 reflections and forecasts 17 PRODUCT REVIEW Authentium Command AntiVirus for Windows Enterprise 4.90.2 In this month’s VB Spam Supplement ASRG founder Paul Judge explains the aims and objectives 20 END NOTES & NEWS of the ASRG, and Pete Sergeant looks at economic and legal solutions to spam. ISSN 0956-9979 COMMENT ‘Being online is between anti-virus, anti-spam and general security, but their basic functions have little in common.
    [Show full text]
  • Network Security- Virus Attacks and Defence Using Antivirus Software Trupti Shah Research Scholar of JJT-University, Rajasthan, India
    ISSN : 2347 - 8446 (Online) International Journal of Advanced Research in ISSN : 2347 - 9817 (Print) Vol. 2, Issue 4 (O ct. - Dec. 2014) Computer Science & Technology (IJARCST 2014) Network Security- Virus Attacks and Defence using Antivirus Software Trupti Shah Research Scholar of JJT-University, Rajasthan, India Abstract Network security is important in every field of today’s world such as government offices, educational institutions, any business organization etc. So data security is the extreme critical factor in ensuring the safe transmission of information through the network. Threats to data privacy are powerful tools in the hands of attackers that could use the vulnerabilities of a network to corrupt, destroy and steal the sensitive information. There are many network security measures to protect the data from the hands of the attackers like antivirus software, firewalls, cryptography etc. In this paper an attempt has been made to study different viruses which can harm the computer. It outlines about antivirus software which can detect viruses; worms etc. and warn the user of their presence in computer and deactivate then clean up the computer of malicious software. Keywords Vulnerabilities, Threats, Network Security Measures, Antivirus Software, Firewalls and cryptography. I. Introduction II. Digital Threats Now-a-days, there are so many unethical practices in the form Virus (Vital Information Resource Under Siege): Computer of digital attacks which are causing problems in the field of viruses are the malicious programs having the ability to replicate Information Technology. These attacks are sometimes in the and execute themselves. They can attach themselves to the other form of malicious software which enter in the system by themself program, files or data stored in the system automatically without without the knowledge of the user and sometimes in the form of any instructions from the user.
    [Show full text]
  • Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families
    Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Lars Strande Grini Master’s Thesis Master of Science in Information Security 30 ECTS Department of Computer Science and Media Technology Gjøvik University College, 2015 Avdeling for informatikk og medieteknikk Høgskolen i Gjøvik Postboks 191 2802 Gjøvik Department of Computer Science and Media Technology Gjøvik University College Box 191 N-2802 Gjøvik Norway Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Lars Strande Grini 15/12/2015 Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Abstract There exist different methods of identifying malware, and widespread method is the one found in almost every antivirus solution on the market today; the signature based ap- proach. This approach uses a one-way cryptographic function to generate a unique hash of each file. Afterwards, each hash is checked against a database of hashes of known mal- ware. This method provides close to none false positives, but this does also mean that this approach can only detect previously known malware, and will in many cases also provide a number of false negatives. Malware authors exploit this weakness in the way that they change a small part of the malicious code, and thereby changes the entire hash of the file, which then leaves the malicious code undetectable until the sample is discovered, analyzed and updated in the vendors database(s). In the light of this relatively easy mit- igation for malware authors, it is clear that we need other ways to identify malware.
    [Show full text]