MRA Consultants has been trading for over 20 years, during this time I have built up a reputation for service, reliability and value for money. A small sample of local business I serve include  Maryport Bodyworks Centre, ABI Motor body Repairs, Taylors Joinery And Plastics, West Cumbria domestic Violence, Distington Community Centre, Macs Removals Ltd .Engineering Pipework Services Ltd, Distington club for young people, Ewanrigg Community Centre, CMS, Robin Dargavel Ltd, Lake District Coast Aquarium as well as countless numbers of individuals. Over 99% of my business comes from referrals. I was the first in the area to pioneer no fix no fee and no call out charges.

Virus Bulletin news

Paper: Invading the core: iWorm's infection vector and persistence mechanism

Malware spreads through infected torrent, then maintains persistence on the system.

A month ago, security firm Dr.Web reported it had discovered a new malware variant targeting Mac OS X, that was subsequently dubbed 'iWorm'.

Apart from the fact that malware for OS X, though becoming more common, is still a bit of a novelty, most reports focused on iWorm's unique way of obtaining a list of command and control servers: the malware performed a search on Reddit for a particular string, which was used by the owners of the botnet to post C&C addresses and ports.

Today, we publish a paper by Patrick Wardle, Director of Research at Synack, in which he performs a tactical study of iWorm, focusing on both the infection vector and the way the malware maintains persistence on an infected system.

Despite its name, iWorm is a backdoor and not a worm, and thus didn't spread automatically. Patrick explains how torrents of pirated versions of Adobe Photoshop and Microsoft Office were spread - which, apart from the promised program, also installed iWorm on the side.

Read more (6 paragraphs)

New IcoScript variant uses Gmail drafts for C&C communication

Switch likely to make modular malware even stealthier.

Researchers at Shape Security have found a new variant of the IcoScript RAT that makes use of draft emails stored in Gmail, Wired writes.

This summer, we published a paper by G Data researcher Paul Rascagnères, who had discovered the malware, which was most notable for using a Yahoo! Mail box for command and control communication.

We have not seen many details on this new variant, but the fact that IcoScript switched to a new C&C method isn't surprising: the malware is very modular and, as Paul predicted, "it would be easy to switch to another webmail such as Gmail".

Read more (2 paragraphs)

VB2014 paper: Hiding the network behind the network. Botnet proxy business model

Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.

Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added 'Hiding the network behind the network. Botnet proxy business model' by Bitdefender researchers Alexandru Maximciuc, Razvan Benchea and Cristina Vatamanu.

One of the most difficult parts of running a botnet is how to hide the command and control (C&C) servers. Early botnets used fixed IP addresses or fixed domain names, but that made them very vulnerable to takedowns by law enforcement or security researchers.

Modern botnets use more advanced techniques, such as domain generation algorithms (DGAs), Tor, or even fancy techniques such as Yahoo! Mail , but each of these has its own set of problems.

However, there seems to be no problem in cybercrime for which there aren't other cybercriminals who can provide a solution. In their paper, which was presented by Cristina Vatamanu in Seattle, Alexandru Maximciuc, Razvan Benchea and Cristina Vatamanu describe a proxy network that is rented to botnet owners for C&C communication.

Read more (7 paragraphs)

VB2014 paper: Methods of malware persistence on Mac OS X

'KnockKnock' tool made available to the public.

Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added 'Methods of malware persistence on Mac OS X' by Synack researcher Patrick Wardle.

It has been a while since Apple used the scarcity of Mac viruses as part of its marketing strategy. Malware targeting OS X is fairly common these days, and it is likely to be here to stay.

In his presentation (which we previewed on our blog two months ago), Patrick Wardle showed various ways in which Mac malware manages to persist on a machine it has infected, thus making sure it runs even after a reboot. He also showed how many recent families of OS X malware maintained persistence.

Read more (5 paragraphs)

Tor exit node found to turn downloaded binaries into malware

Tor provides anonymity, not security, hence using HTTPS is essential.

A security researcher has discovered a Tor exit node that was modifying binaries downloaded through it on the fly.

The researcher, Josh Pitts of Leviathan Security, has previously shown how easy it is to modify binaries downloaded over HTTP in transit, thus turning them into malware. He emphasised the importance of using HTTPS when downloading executables from a remote server.

Of course, there are other ways to protect the integrity of downloaded binaries, such as digital signatures. But whether those are verified, and what is done upon finding an invalid signature, is up to the entity executing the binary, which could be an end-user, but also Windows Update.

Read more (7 paragraphs)

Telephone 01900516363
Visitors to this page : 7,190

Digital Solutions  for Cumbria

 

 

Mobile 07944982166