Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Fraser Howard
Email-delivered MoDi RAT attack pastes PowerShell commands
SophosLabs researchers Fraser Howard and Andrew O’Donnell stumbled upon an unusual reflective loader attack method last month while hunting through threat telemetry. The attack chain started with a malicious email message that contained some hostile VB scripting code, and concluded by delivering a commodity remote access Trojan named MoDi RAT. These kinds of detections often lead to interesting, divergent attacks, which is what the detection teams are looking for.
Blackhole exploit kit confusion. Custom builds or copycats?
The past couple of weeks have been interesting times for anyone following the malicious Blackhole exploit kit that continues to dominate the charts. Don’t get me wrong, we expect changes and updates – the individuals behind the kit work tirelessly to try and evade security products.
EU domain abuse, courtesy of the Blackhole exploit kit
Tracking malicious activity is a crucial part of what SophosLabs do each day. Tracking the threats gives us visibility into how computers are being infected and where threats are actually coming from. The data gathered is used to drive some of the reputation filtering technologies that our products provide in order to keep Sophos’s customers safe. The data also lets enables us to spot new tricks, techniques or tactics being used by attackers.
Protect against latest Java zero-day vulnerability right now: Mal/JavaJar-B
In the past 24 hours, a new zero-day vulnerability for Java has been found, reported to be infecting even those running the latest version (7u10). Unfortunately, it has been found in some of the most prevalent crimeware kits being used to infect users with malware, so it is being targeted NOW. As noted elsewhere, it has already been confirmed to be integrated into Cool EK and NuclearPack exploit kits.
Abuse of .EU domains by malware gangs continues despite Registrar notification
A couple of weeks ago I wrote about how we had been seeing a jump in the number of malicious .EU domain registrations, for the purpose of infecting users via drive-by downloads using an exploit kit. In that post, I raised two important questions: Is there more that Registrars could or should be doing to prevent the bad guys abusing their services? How effectively, once the appropriate people have informed about the abuse, will the activity be stamped out?
Large US hosting provider hit in web attack
Over the past few weeks, we have been seeing a whole mix of legitimate web sites serving up a specific malicious JavaScript. When innocent users browse these sites, the injected JavaScript adds an iframe element to the page in order to load further malicious content from a remote site. As you can see, the injected scripts are polymorphic and heavily obfuscated, one of the common tricks used by hackers in an attempt to evade detection.
Making phishing more complex - on purpose
Earlier this week a colleague pointed out an intriguing phishing sample that he had come across. It was interesting not because of any great sophistication or complexity, but rather that it illustrated the reuse of an old social engineering trick. The brand being targeted in the phish campaign is Poste Italiane, a well known Italian group that includes financial and payment services in its product portfolio.
Zero-day XML Core Services vulnerability included in Blackhole exploit kit
A couple of weeks ago (12 June 2012) we published an advisory for a vulnerability in Microsoft XML Core Services, also known as CVE-2012-1889. The vulnerability is a true zero-day, being exploited in the wild, with no patch yet available from Microsoft. The main concern in such situations is the speed with which we see exploit kits updating to target new vulnerabilities.
Taking a closer look at the Glazunov exploit kit
Following on from my recent articles on the Redkit exploit kit, I thought I would take a look at another exploit kit that is not that well known. The one I have chosen has been quite active of late, and has a few interesting characteristics I wanted to highlight.
Lifting the lid on the Redkit exploit kit
Redkit is one of the lesser known exploit kits that is currently being used to distribute malware. Though not as widely talked about as Blackhole, Redkit has gained some press recently, having been involved in the NBC site hack and the spam campaigns that followed the Boston bombings. In the first of this two-part series, I will give an overview of the exploit kit: how it operates and where it is being hosted.
The four seasons of Glazunov: digging further into Sibhost and Flimkit
In the analysis of the Glazunov exploit kit that I posted early last week, I mentioned two other kits that are very similar – Sibhost and Flimkit. In this post, I am going to take a quick look at these and highlight the similarities and differences between the three kits. Sibhost As is the case with Glazunov, the official name that the author gives to this kit is not known, but Sibhost seems to be the name that has been adopted.
Assessing the impact of the Blackhole arrests
Early yesterday, a ‘breaking news’ tweet grabbed the attention of most security researchers involved with malware today. BREAKING: Blackhole exploit kit author "Paunch" and his partners arrested in Russia Within hours, corroborating support for the arrest was circulating to lend credence to the report.
Technical paper: Deeper inside the Blackhole exploit kit
Readers following the developments of Blackhole, the most prolific exploit kit throughout 2012, will be interested in the second and concluding part of the technical paper which is now published. In part one, SophosLabs expert Gabor Szappanos took us through the server-side code, providing a general understanding of how the Blackhole exploit kit operates.
Technical paper: Journey inside the Blackhole exploit kit
One of the most common questions we receive at SophosLabs is “How are users most likely to get infected with malware?”. As regulars readers will be aware, the answer is through the web. More specifically, computers are most likely to be infected through compromised legitimate websites redirecting user traffic to malicious websites that are hosting some exploit kit. The most active of these exploit kits in recent times is one known as Blackhole.
Hacked Go Daddy sites infecting users with ransomware
Users are getting infected with ransomware thanks to criminals managing to hack the DNS records of Go Daddy hosted websites. That’s not welcome news for the world’s largest domain name registrar. To understand how these attacks work, a short primer on DNS is required. In a nutshell, DNS provides a system where computers on a network (the internet) can be referenced by a user-friendly name. These names are known as hostnames, and DNS translates them into what is known as an IP address.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Fraser
Contact Fraser, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack