A technical intelligence report on the Pobelka botnet operation. January 11, 2013 This technical report describes the Pobelka botnet and puts it in the context of global malware operations. Fox-IT’s InTELL unit provides reports like this on a continuous basis to customers in the financial sector so they know who’s targeting their online banking systems … Continue reading Demystifying Pobelka
Author: Fox IT
Fox-IT discovers security bugs in Oracle Software
In its latest quarterly Critical Patch Update, Oracle has acknowledged and repaired two security bugs identified by Sjoerd Resink, Senior IT Security Expert at Fox-IT. The bugs were discovered during one of Fox-IT's penetration testing assignments in version 10.1.4.3 of Oracle Application Server's Single Sign-On component. The first security issue, numbered CVE-2012-3175 by the Common … Continue reading Fox-IT discovers security bugs in Oracle Software
Mogen we terugslaan?
Nederlandse overheid komt met cyberwetgeving Terughacken als wapen tegen cybercrime kan niet zonder wettelijke basis. Het werkt wel, mits met de juiste voorwaarden omkleed en alleen als uiterst middel gebruikt, om burgers tegen cybercriminelen te beschermen. Nu is hét moment voor de politiek om problemen en oplossingen in cyberspace in kaart te brengen en zich … Continue reading Mogen we terugslaan?
Observations on the recent Java 0-day exploits in the wild
Recently the Internet has been abuzz with news of an unpatched (0-day) exploit for the latest version of Java. The vulnerability is critical because it can exploit a fully patched version of Windows, Linux or Mac OS X. Also, it can do all this without users knowledge or consent. All that is needed is have … Continue reading Observations on the recent Java 0-day exploits in the wild
How to find malicious communication leaving your network
Most Zeus trojan infections use HTTP for communication. There are however versions of Zeus that use P2P technology, but they are the exception. Once a computer is infected, Zeus must connect to the command and control (CnC) server for settings and instructions. The usual way of doing this is to use a HTTP POST. When … Continue reading How to find malicious communication leaving your network
MIME Sniffing: feature or vulnerability?
In this blog post I will describe how we turned uploading a .zip file into a Cross-Site Scripting (XSS) attack during a penetration test on a customer’s web application, by leveraging a feature of Internet Explorer (IE) called MIME Sniffing. Before I go into the details of this attack, let’s start by looking at the … Continue reading MIME Sniffing: feature or vulnerability?
Critical analysis of Microsoft Operation B71
A little over 2 weeks ago Microsoft announced operation B71. It was being brought as the biggest blow to ZeuS botnets in history, and was picked up in the media globally. A released movie showed Microsoft personnel executing a preliminary injunction in a civil case and seizing a server in Scranton, PA. In their words: … Continue reading Critical analysis of Microsoft Operation B71
Post mortem report on the sinowal/nu.nl incident
March 14th 2012, another normal day in the office, I looked at my massive to-do list and had planned quite some work for the day. And like every normal day my planning of the day is rudely interrupted by another incident. Our network analysts at the Security Operations Center looked very busy, and they were … Continue reading Post mortem report on the sinowal/nu.nl incident
RSA-512 Certificates abused in the wild
During recent weeks we have observed several interesting publications which have a direct relation to an investigation we worked on recently. On one hand there was a Certificate Authority being revoked by Mozilla, Microsoft and Google (Chrome), on the other hand there was the disclosure of a malware attack by Mikko Hypponen (FSecure) using a … Continue reading RSA-512 Certificates abused in the wild
Presentatie Fox-IT op Infosecurity NL 2011
Op 2 en 3 November 2011 heeft Eward Driehuis een seminar gegeven op de Infosecurity beurs. Onderwerp van het seminar is “Spotten van fraude in online bankieren via analyse netwerkverkeer”. Hieronder vind je de videoregistratie en de slides:
Fox-IT International blog 