Threat Level: green Handler on Duty: Pasquale Stirparo

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2010-05-10 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

New paper on using kernel hooking to bypass AV

Published: 2010-05-10
Last Updated: 2010-05-10 23:00:16 UTC
by Toby Kohlenberg (Version: 1)
2 comment(s)

Matousec has released a new paper (http://www.matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php)detailing their proof of concept for using kernel hooking (specifically what they are calling an "argument switch attack") to bypass antivirus software. The concept isn't new, as they acknowledge but the paper is nicely detailed and the use of a race condition of sorts to bypass security checks made when a kernel hook is requested/handled is cool. It should be noted that PatchGuard should provide some protection against this attack though how much is uncertain.

Keywords:
2 comment(s)

Another round of WordPress Attacks

Published: 2010-05-10
Last Updated: 2010-05-10 19:18:13 UTC
by Toby Kohlenberg (Version: 1)
1 comment(s)

H-Security has published an article (http://www.h-online.com/security/news/item/Large-scale-attack-on-WordPress-996628.html) discussing a new series of attacks against WordPress-based sites.

Multiple ISPs have been hit including GoDaddy, Bluehost, Dreamhost, Network Solutions and Media Temple. There is one report that even sites built with the most current version of WordPress have been compromised.

We will update as we have more information, at this point I recommend reading the H-Security article for the summary of the scripts being added and contacting your hosting provider if you have concerns about your site.

Keywords: wordpress
1 comment(s)
Diary Archives