During the course of investigating an open incident ticket with a customer, we uncovered what is a common occurrence on the web – legitimate sites linking in third-party content (often advertisements or banners) that ultimately drives the victim browser to an exploit kit. Here is the chain of events that we observed: User browsed to: [...]

Looking back on traffic from this week, I noticed a large spike in the number of companies accessing free TLD / Dynamic DNS related sites.  Digging deeper it appears that a malware campaign tied to massive WordPress compromises was the culprit.  This is a very widespread malware campaign that remains live / on-going and is [...]

We, like most in the security community, have been following the latest developments with the Mac OS X Flashback Trojan and it’s exploitation of the recently patched Java vulnerability (CVE-2012-0507).  This story has a lot of interesting twists and turns: The Flashback Trojan is a relatively new Trojan family, appearing on the scene late last summer/early September [...]

In 2011, Blackhat SEO links were pretty much absent from the most popular searches in Google. Instead, Blackhat SEO was used to target more specific searches. The technique heavily used to poison the searches for buying software online with hundreds of fake online stores. Blackhat SEO Things are starting to change in 2012. I ran [...]

PDF exploits have been targeted by Blackhole exploit kits for some time now. The Blackhole exploit kit will deliver various malicious PDF files to a user if the victim is running a potentially vulnerable version of Adobe Reader. When these PDFs are opened through Adobe Reader, a known vulnerability is exploited which will then compromise [...]

As I mentioned last week, more Fake AV pages are once again showing up in popular Google searches. Although these malicious pages look the same as they did 2 years ago, the source code is different. The first thing you notice in the source code is that there is no obfuscation at all. The attacker [...]

Google Chrome has recently added an API to modify HTTP headers. This in turns, made it possible to port Zscaler’s Search Engine Security add-on from Firefox and Firefox Mobile to Google Chrome. Search Engine Security on the Chrome Web Store Most hijacked websites used for Blackhat SEO check the Referer header and the User-Agent, to decide [...]

We’ve seen an increase in hijacked websites in recent months, redirecting users to Fake AV pages, Blackhole exploit kits and other malware. While most websites hacked are personal sites, or University websites, some are more high profile. http://www.performance-publique.budget.gouv.fr/ hijacked The website of the French Minister of Budget (www.performance-publique.budget.gouv.fr) is an example of a high profile [...]

3/26 Update: I was approached and asked to run stats to do a bit of comparison and contrast with Sports traffic from last year – with the goal in mind to identify if there was a noticeable percentage increase in Sports (March Madness) this year compared to last year. There was a two day difference [...]

I’ve released my first add-on for Internet Explorer and I’ve almost finished a second one. Developing for Internet Explorer was a very different experience than developing for the other browsers I’ve worked with before – Firefox, Firefox Mobile, Google Chrome, Safari and Opera. Overall Architecture Internet Explorer extensions are called Browser Helper Objects (BHO). They [...]