Category Archives: Web Fraud 2.0

Virus Scanners for Virus Authors, Part II

April 5, 2010
10 Comments

The very first entry I posted at Krebs on Security, Virus Scanners for Virus Authors, introduced readers to two services that let virus writers upload their creations to see how well they are detected by various commercial anti-virus scanners on the market. In this follow-up post, I’ll take you inside of a pair of similar services that allow customers to periodically scan a malware sample ad receive alerts via instant message or e-mail when a new anti-virus product begins to detect the submission as malicious.

Naming and Shaming ‘Bad’ ISPs

March 19, 2010
64 Comments

I asked or simply polled some of the most vigilant sources of this information for their recent data, and put together a rough chart indicating the Top Ten most prevalent ISPs from each of their vantage points. ISPs or hosts that show up more than others on these various lists are color-coded to illustrate consistency of findings (click the image to enlarge it). The trouble is, all of these individual efforts map badness from just one or a handful of perspectives, each of which may be limited in some way by particular biases, such as the type of threats that they monitor. For example, some measure only phishing attacks, while others concentrate on charting networks that play host to malicious software and botnet controllers.

Researchers Map Multi-Network Cybercrime Infrastructure

March 17, 2010
32 Comments

Last week, security experts launched a sneak attack against Troyak, an Internet service provider in Eastern Europe that served as a gateway to a nest of cyber crime activity. For the past seven days, unnamed members of the security community reportedly have been playing Whac-a-Mole with Troyak, which has bounced from one legitimate ISP to the next in a bid to reconnect to the global Internet. But experts say Troyak’s apparent hopscotching is in fact the expected behavior from a carefully architected, round-robin network of backup and redundant carriers, all designed to keep a massive organized criminal operation online should a disaster like the Troyak disconnection strike.

A Peek Inside the ‘Eleonore’ Browser Exploit Kit

January 25, 2010
66 Comments

If you happen to stumble upon a Web site that freaks out your anti-virus program, chances are good that the page you’ve visited is part of a malicious or hacked site that has been outfitted with what’s known as an… Read More »