Binary patching on the fly

Binary patching is a cool notion (not the first time I've said that), but this is the first time I've considered that it might be done on the fly as a binary comes down over the wire. That's pretty freaking radical, actually.

Open malware

A database of malware, apparently.

Sleuthing back doors in routers

This stuff is so cool. Guy in Holland finds a Linksys back door (blow-by-blow courtesy HNN) and figures marvy stuff out using magic. Here's another one for another situation. I freaking love this stuff.

badBIOS

Ars Technica has the story of Dragos Ruiu, whose Mac seems to have contracted a virus that jumps airgaps by sound. Through the microphone.  Seriously.

Malware stored in EXIF headers of JPEG files

This is an unexpected way of providing the payload for a malware attack...

PHP encoded malware

Here's a cool one: a single (long) line of injected PHP that unpacks to a little porn server that retrieves its porn from elsewhere.  Neat attack.  How it gets injected I don't know, but in that discussion this other thing came up: an Apache exploit that doesn't change the filesystem at all - it patches the live httpd process. That's freaking cool!  It would be pretty brittle, though; recompile with some minor changes and it's not going to work. Monocropping is a bad thing.

Understanding scam victims

Nice article about looking at security flaws from the victim's point of view.

Spam aping workflow

Here's an oddly evocative spam I got today (but without any attachment, rendering it moot):

This message is for the designated recipient only and may contain privileged, proprietary, or otherwise private information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the email by you is prohibited.

Hello,

Please find enclosed a record of invoice that could not be processed. We would like to ask you to assist us in resolving the noted rejection reasons

Pretty fascinating.  Clearly a delivery mechanism for some sort of PDF exploit, but de-fanged along the way.

Metasploit

What a cool idea.

Doxing a Russian hacker

This is a neat procedural.

Skype IM worm

I got a Skype IM from a friend the other day that turned out to be a worm malware vector.  The cool thing was that the IM was in Hungarian (the friend is also Hungarian).  Impressive social engineering indeed!  Here's a CNET article on it.

Botnet operator AMA on Reddit

So here's a German guy operating a small botnet in his spare time, writing his own code (and making it polymorphic by shuffling the source code using Perl, then recompiling, which I find pretty fascinating).  Interesting stuff here.

Conficker

Well, now I know when I was laying down these old bookmarks: ReadWriteWeb wrote about the Conficker virus in 2009. I toss this in here because malware is fun.

Self-adaptive honeypots

Neat thesis about a system for self-adapting honeypots that analyze attacker behavior and try to learn more about the attacker.

Malware deobfuscation

I'm always a sucker for this. A good article here.