Jason Geffner on Tortilla
Dennis Fisher talks with Jason Geffner of CrowdStrike about the new tool he released at Black Hat called Tortilla and his research on malware that uses domain-generating algorithms.
Malware
CrowdSource Tool Aims to Improve Automated Malware Analysis
When a new piece of malware surfaces, it’s typically analyzed eight ways from Sunday by a long list of antimalware and other security companies, government agencies, CERTs and other organizations who try to break it down and classify its capabilities. There’s a lot of duplicated effort there, and a group of researchers is building a new tool called CrowdSource that is designed to take advantage of the existing analysis capabilities in the community and perform automated malware analysis to provide rich reports on each new sample.
Malware Evasion Techniques Dissected at Black Hat
Researchers use file-level sandboxes to analyze the behavior of malware samples as well as techniques malicious code uses to detect and evade analysis.
Nearly two months after the company was part of an operation to disrupt a large number of Citadel botnets, Microsoft said that 88 percent of the botnets spawned by that malware have been taken down.
Everyone loves babies, especially magical royal ones who are destined to pull a sword from a stone. As it turns out, the baby admiring demographic also includes spammers, who are using the current frenzy over the birth of Prince William and Duchess Kate’s baby boy to direct victims to a site serving the Black Hole exploit kit.
A new strain of banking malware called KINS has been discovered for sale on a closed Russian underground forum.
The FBI alerted users about a strain of ransomware targeting Mac OS X machines.
A security researcher is expected to unveil Tortilla, an open source tool that anonymously routes TCP and DNS traffic through Tor, at the same time bridging a gap in Windows-based tools for security researchers who use Tor.
Attacks involving the njRAT remote access Trojan have spiked in the last 30 days against high-value targets in the Middle East.
The Microsoft Malware Protection Center reports of unusual behavior from the Vobfus and Beebone malware families where each malware variant continuously downloads a version of the other.
