October 18th, 2011
A great intro to the next big security threat can be found here—ripped from the pages of Mefi as always. The architecture of this is just phenomenal. I wish I was half as good as the folks who put Stux/Duqu together.
Then again, I’d probably be rabitting for the NSA or somesuch and that’s not desirable. Because, like, if this isn’t a state-sponsored effort I’ll eat my hat.
March 5th, 2008
After just over a year, Storm has become an intractable part of the Internet environment. Over Valentine’s Day it accounted for up to 5% of all Internet traffic, coming to life after months of relative idleness. Read more in this accessible article:
January 3rd, 2008
Dark Reading—CMP Technology’s offering for the occasional suit who thinks about security issues—runs down the three biggest bot-nets currently out there. Not a lot of technical analysis going on but interesting in a big picture sort of way. I’m still amazed that Rbot is still alive and kicking to the degree it is.
December 23rd, 2007
I was a bit intrigued by a certain referrer in my log file who has been drifting at the bottom for the past week+ but suddenly shot up into the top 5 yesterday. The link ostensibly goes to http://tvsetmp3.com/ but gets redirected to http://ismymovies.com/. The page is constructed to look like it throws a system dialog box—if one were running XP in the default blue theme.
The dialog box asks you to download a codec to view the movie. The image is dressed up like a dialog box even going so far as to enabling you to drag it around. The ultimate clue being you cannot drag it outside the browser window’s boundaries. Clicking the “Cancel” area on the image map throws a Javascript dialog asking you to click “OK” to download the exe file. Clicking “Cancel” here throws another dialog that insists you click “OK” to download the exe file. Clicking “OK” brings you back to the previous “Click OK to download the codec” pop-up.
Clever. I never did go so far as to try to view the embedded Flash Video file underneath. I mean, it’s likely that there has to be a video file to cover the social engineering that just occurred if they did manage to get the fake codec installed on you machine. Still, they steer really hard to get you to the place where you download that putative codec.
Like I said. Clever. The social engineering continues to get better.
November 26th, 2007
Storm takes on a new guise aimed at the paranoid set. This stuff is just incredibly genius…
Private Detective Scare is Storm Trojan
November 24th, 2007
I’ve been following the ever-increasing Storm Worm phenomena since it’s arrival almost a year ago. I was originally impressed by the relative polish of its social engineering aspects. It has always seemed to me that all manner of phishing, social engineering, and general spam vectors have had some very obvious clues. It’s like the individual crafting the vector was dropping these signs as warnings to their clued-in brethren—as if it were all a practical joke on the n00bs.
Read the rest of this entry »
Deep Thoughts .:|:. Millionaire's Holiday .:|:. Nick Hansen .:|:. On the Web .:|:. Rants and Stories
Deep Thoughts .:|:. Millionaire's Holiday .:|:. Nick Hansen .:|:. On the Web .:|:. Rants and Stories
The Same River. Twice. is a Black Fez Production. Content protected by Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License. Preferred means of attribution credits Nick Hansen and provides the permanent URL to the content.