SEARCH RESULTS
 
Showing 1-10 of 92 records
 
Expand article

All You Need is Storm Worm's Love

The Article has images
2008-05-20 07:46:40 by Dancho Danchev in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...Storm Worm malware launched yet another spam campaign promoting links to malware serving hosts, in between a SQL injection related to Storm Worm These are Storm Worm's latest domains where the infected hosts try to phone back cadeaux-avenue.cn (active polkerdesign.cn (active tellicolakerealty.cn (active and SQL injected at vulnerable sites...
 
 
 
 
 
Expand article

Storm Worm Hosting Pharmaceutical Scams

The Article has images
2008-05-30 14:50:06 by Dancho Danchev in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...Storm's recent SQL injection and introduction of several new domains within, the very latest additions to their domain portfolio are the following domains (naturally in a fast-flux provided by already infected hosts) hosting pharmaceutical scams producemorning.com pressrose.com posestory.com picturewe st.com lowsmell.com catsharp.com...
 
 
 
 
 
Expand article

Riders on the Storm Worm

The Article has images
2007-12-28 11:35:58 by HASH0x89eeda4 in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...Storm Worm have started using several new, and highly descriptive domains. It seems they've also changed the layout as well, and despite that the exploit IFRAME is now gone, automatically registered Blogspot accounts are also disseminating links to the domains. Some of these have been registered as of recently, others have been around in a...
 
 
 
 
 
Expand article

The Cyber Storm II Cyber Exercise

The Article has images
2008-04-03 12:29:03 by HASH0x8b6d0a8 in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...Storm" Cyber Exercise aiming to evaluate the preparedness for cyber attacks of several governments two years ago, and pointed out that Frontal attacks could rarely occur, as cyberterrorism by itself wouldn't need to interact with the critical infrastructure, it would abuse it, use it as platform. However, building confidence within the...
 
 
 
 
 
Expand article

Visualized Storm fireworks for your 4th of July

The Article has images
2008-07-03 20:54:00 by Russ McRee in HolisticInfoSec.org
...Storm botnet maestros have queued up some pwnage for your 4th of July See the SANS diary for all the details Upon receipt of my first fireworks.exe sample this evening, I went through the standard routine and ran it through the analysis mill. Like the ISC said, not much new here, but if you'd like the nitty-gritty, I've put the analysis...
 
 
 
 
 
Expand article

Storm Worm delivering coal this Christmas

2007-12-26 16:30:06 by Editor in Digg / Security
 
Less than a day until Christmas, the Storm worm has appeared with a little holiday joy for all. The Storm botnet is on the prowl for new users to infect, and has a new set of holiday-themed messages
 
 
 
 
 
Expand article

FBI Knows Identity of Storm Worm Writers

2008-01-31 06:16:40 by schneier in Schneier on Security
 
...Storm worm network, but that U.S. authorities have thus far been prevented from bringing those responsible to justice due to a lack of cooperation from officials in St. Petersburg, Russia, where the Storm worm authors are thought to reside
 
 
 
 
 
Expand article

Cyber Storm Details

2008-02-07 14:30:23 by schneier in Schneier on Security
 
...Storm " exercise. Most interesting is the part where the participants attacked the game computers and pissed the referees off: However, the government's files hint at a tantalizing mystery: In the middle of the war game, someone quietly attacked the very computers used to conduct the exercise. Perplexed organizers traced the incident to...
 
 
 
 
 
Expand article

Holiday Storm Part 3

2007-12-26 23:43:00 by Russ McRee in HolisticInfoSec.org
 
...Storm friends have changed the game a bit for the third round, as discussed on the ISC Diary , in particular Update 3. The changed domain and binary name led me to ponder what else has changed. So 1) New hash: BE22F894AC662C905C37CEFDE66DE065 2) Better hiding skills, no visible running processes, nastiness all hidden from the API (can you say...