In our last post, we warned of a new Windows local privilege escalation vulnerability being used in the wild. We noted that the Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox. CVE-2013-3346 was exploited to execute the attacker’s code in the sandbox-restricted Reader process, where CVE-2013-5065 was exploited to execute more malicious code in the Windows kernel.In this post, we aim Read more...
Archive for 'December 2013'
MisoSMS: New Android Malware Disguises Itself as a Settings App, Steals SMS Messages
December 16, 2013 5:00 AM By Vinay Pidathala, Hitesh Dharmdasani, Zheng Bu, Jinjian Zhai
FireEye has uncovered and helped weaken one of the largest advanced mobile botnets to date. The botnet, which we are dubbing “MisoSMS,” has been used in at least 64 spyware campaigns, stealing text messages and emailing them to cybercriminals in China. MisoSMS infects Android systems by deploying a class of malicious Android apps. The mobile malware masquerades as an Android settings app used for administrative tasks. When executed, it secretly steals the Read more...
Preparing for Managed Security Services
December 3, 2013 5:36 PM By Wade Woolwine
Threat Actor Tactics and Targeting Predictions for 2014
December 23, 2013 6:41 PM By Intel TeamPredicting security challenges for the upcoming year is often an exercise in educated guesswork. These forecasts are often based on technological trends (e.g., attack surfaces to be exploited by adversaries, such as mobile devices and enterprise services in the cloud), attempts to influence potential customers ("this threat can only be solved by our widget!"), strategic shifts in adversary intents and motivations, red lines (or the absence thereof) for acceptable behavior and myriad other factors.
Read more...OpenIOC Series: Investigating with Indicators of Compromise (IOCs) – Part I
December 16, 2013 3:58 PM By Will GibbWritten by Devon Kerr & Will Gibb
Read more...Taking a Look Back at 2013
December 11, 2013 8:49 PM By Helena BritoAs 2014 draws near, we naturally think back over the past year's events. So much has happened - a royal baby, a government shutdown, and the release of Mandiant's APT1 report, which raised the issue of cybersecurity and the risks that targeted attacks pose to national security.
Read more...Interview Excerpt from "Practical Malware Analysis" Author and Mandiant Technical Director Michael Sikorski
December 4, 2013 5:59 PM By Helena BritoRecently, Mandiant's Technical Director, Michael Sikorski was interviewed for [IN]SECURE magazine. In his interview Mike discusses the inspiration for his book, "Practical Malware Analysis," his process for analyzing malware and offers advice for those interested in entering the field of malware analysis.
Read more...A Look Back at APT1, Threat Actors, and Security
December 18, 2013 8:56 PM By Helena BritoIt's hard to believe that we've reached the end of another year. In the realm of cybersecurity, 2013 was a memorable year not for breaches, but for tectonic-level shifts that completely changed how we perceive cybersecurity and its impact on how we run our businesses, how our leaders govern, and more importantly, how we understand national security.
Read more...Best of the Best in 2013: The Lab
December 20, 2013 4:40 PM By Helena BritoThere is no denying it. Mandiant recruits the best and the brightest talent to be part of our technical teams. This group is one of the most passionate in the industry. Each individual lives and breathes researching, investigating, creating new tools and techniques.
Read more...Best of the Best in 2013: The Armory
December 20, 2013 4:48 PM By Helena BritoEveryone likes something for free. And there is no better place to go to get free analysis, intelligence and tools than The Armory on M-Unition. During the past year, we've offered intelligence and analysis on new threat activity, sponsored open source projects and offered insight on free tools like Redline™, all of which has been highlighted on our blog.
Read more...Hacking a Revolution
December 12, 2013 3:23 PM By Kenneth Geers
Ukrainian protesters. (Credit: Ryan Anderson. Used under Creative Commons CC-BY-SA-3.0 license.) In April 2005, General Boris Miroshnikov, head of the Russian police's cybercrime division (Department К for “Кибер” or “Cyber”), announced that Russian hackers were the “best in the world.” At DEF CON 13 that year, I explained how Soviet scientists had honed their reverse engineering skills on Western products for decades during the Cold War. More recently, Western reporting such as Read more...
Sign up for email update
Get information and insight on today's advanced threats from the leader in advanced threat prevention.
