Technical Papers

Here you will find a range of papers aimed at system administrators and security specialists on a variety of topical issues. Some of these papers have been presented at security seminars and technical conferences around the world.

Back Channels and Bitcoins: ZeroAccess' Secret C&C Communications

In this paper, presented at the Virus Bulletin 2013 conference in Berlin, SophosLabs researcher James Wyke examines the secret communications channels used to administer the ZeroAccess botnet.

Between an RTF and OLE2 Place: An Analysis of CVE-2012-0158 Samples

In this paper, presented at the Virus Bulletin 2013 conference in Berlin, independent researcher Paul Baccas documents some pitfalls of the file formats that make detection problematic, with particular attention placed on high-profile attacks using Microsoft vulnerability CVE-2012-0158. Baccas used tools based on the proprietary Sophos Virus Description Language (VDL) in this research.

GinMaster: A Case Study in Android Malware

This paper by SophosLabs researcher Rowland Yu, presented at the Virus Bulletin 2013 conference in Berlin, gives an overview of three generations of the GinMaster family, examines their core malicious functionality, tracks their evolution from source code, and presents notable techniques utilized by specific variants.

Classifying PUAs in the Mobile Environment

This paper by SophosLabs researchers Vanja Svajcer and Sean McDonald introduces a structured PUA taxonomy for mobile apps, which can be applied both by security vendors and by mobile app developers. It was presented at the Virus Bulletin 2013 conference in Berlin.

Trapping Unknown Malware in a Context Web

In this paper, SophosLabs researchers Numaan Huq and Peter Szabo demonstrate combining URL information, e.g., keywords, patterns, paths, etc., with file properties to create web-context detections (WCD). It was presented at the Virus Bulletin 2013 conference in Berlin.

Ransomware: Next-Generation Fake Antivirus

Ransomware may often be compared to fake antivirus in the way it operates and the motivation behind it. However, fake antivirus plays on the security fears and calls for the user to take actions in self-preservation, whereas ransomware works either as extortion or punishment. This paper describes in detail our findings about the motivations, strategies and techniques utilized in creating and propagating ransomware.

Inside a Black Hole: Part 2

The first part of this paper concluded in the deobfuscation of the server code which, while not complete, was still sufficient for a general understanding of the operation. It enabled us to follow the procession of the events both from the client and server side. The client side events we have already documented in detail. This paper attempts to fill in the missing server side piece.

Inside a Black Hole

Without exception the most actively deployed exploit kit in the past year was the Blackhole exploit kit. Now that the much heralded 2.0 version of the kit is out, it is safe to gradually release information about the previous 1.x version. The first portion of this paper will concentrate on the stolen 1.0.2 version of the exploit kit. A more comprehensive version of this material was published in the October issue of the Virus Bulletin magazine.

The ZeroAccess Botnet: Mining and Fraud for Massive Financial Gain

Since our last paper on ZeroAccess the authors have made significant changes. In this paper we will examine those changes and take a closer look at the ZeroAccess botnet itself, exploring its size, functionality and purpose. We will explain in detail how the peer-to-peer protocol works, what network traffic is created, and how the bot phones home during installation. Then we will examine the plugin files that the botnet downloads: what these files are, what they do and how they work.

Exploring the Blackhole Exploit Kit

This paper lifts the lid on the Blackhole kit, describing how it works and detailing the various components that are used to exploit victim machines infecting them with malware.

ZeroAccess 

In this paper we will explore the ZeroAccess threat; from the distribution mechanisms used to spread it, through the installation procedure, memory residence and payload. We examine how ZeroAccess works and what its ultimate goal is.

Fake Antivirus: Journey from Trojan to a Persistent Threat

 In this paper, we study the evolution of FakeAV over the last three-and-a-half years. We analyze the major FakeAV events, infection vectors and some important anti-emulation/anti-reverse engineering (RE) tricks used by FakeAV packers.

A time-based analysis of Rich Text Format manipulations: a deeper analysis of the RTF exploit CVE-2010-3333 

This paper explores the continued distribution of the exploit CVE-2010-3333. By examining the differences seen the paper will explore the reasons for the continued prevalence.

Popureb - A small rootkit with a big reputation

New rootkits always garner attention from the malware research community and often panic among end-users. This paper dissects the workings of Popureb and explains how to safely restore affected computers to their original state.

What is Zeus? 

This paper will explore the various components of the Zeus kit from the Builder through to the configuration file; examine in detail the functionality and behaviour of the Zbot binary; and assess emerging and future trends in the Zeus world. 

Want my autograph? The use and abuse of digital signatures by malware

This paper discusses the abuses of digital signatures and possible approaches to turn the criminals' investment in their fraudulent reputation into additional protection mechanisms.

This paper was presented at Virus Bulletin in Vancouver, 2010

Finding rules for heuristic detection of malicious PDFs: With analysis of embedded exploit code

This paper, presented at Virus Bulletin 2010 in Vancouver, shows tips and tricks to help with classification and detection of malicious PDFs.

This paper was presented at Virus Bulletin in Vancouver, 2010

Malware with your Mocha? Obfuscation and antiemulation tricks in malicious JavaScript

Fraser Howard of SophosLabs describes the tactics that attackers use to hide malicious JavaScript from detection and analysis.

Poisoned search results: How hackers have automated search engine poisoning attacks to distribute malware

Fraser Howard and Onur Komili of SophosLabs describe in this paper recent research by SophosLabs into how attackers are using blackhat Search Engine Optimization (SEO) techniques to stuff legitimate websites with content designed to rank highly in search engine results, yet redirect users to malicious sites.

The Partnerka — What is it, and why should you care?

In this paper Dmitry Samosseiko of SophosLabs Canada discusses and analyzes the Russian 'partnerka' networks, their economic model, and their relation to spam and malware. It will reveal some ‘insider’ statistics and information, show the tools used for ‘black SEO’ (search engine optimizations), and explain its terminology and techniques. This technical paper also discusses how traditional email spam evolved into a complex web-based industry, creating new challenges for law enforcement, user education and for security labs.

This paper was presented at the Virus Bulletin Conference in Geneva, 2009.

Affiliate web-based malware

This paper will attempt to show some straightforward affiliate networks, with more detailed analysis of some affiliate malware delivery systems.

This paper was presented at Virus Bulletin in 2008.

10 steps to better secure your Mac laptop from physical data theft

This paper describes the steps that Mac users can take to improve the physical security of their laptops — away from the safety of the corporate environment with its security controls and into new environments with new risks and threats — discussing the context and benefits of each change.

Securing websites

In this updated paper Fraser Howard, principal virus researcher at Sophos, discusses some of the common ways that web servers are attacked, the reasons why they are targeted, and details various techniques in which they — and the websites they host — can be protected.

Modern web attacks

In this paper, Fraser Howard, principal virus researcher at Sophos, explores how modern malware uses the web to infect victims. The increased use of compromised websites in attacks is discussed and illustrated with examples of real attacks. Finally, methods to defend against such attacks are discussed.

The game goes on: An analysis of modern spam techniques

This paper analyses the many modern anti-anti-spam techniques, with statistical reports and real-life examples. Methods of combating these often highly effective and 'popular' spam techniques are explored.

This paper was presented at the VB Conference 2006

Can strong authentication sort out phishing and fraud?

Leading anti-malware expert, Paul Ducklin, addresses the following questions: can strong authentication (especially so-called two factor authentication) sort out phishing and fraud? Will smarter technology leave us safe from organized crime, or are there aspects of phishing and on-line fraud which will allow the bad guys to keep stealing from unfortunate victims no matter what we do?

This paper was presented at the VB Conference 2006

The challenge of detecting and removing installed threats

In this paper, Jason Bruce, Detection Development Manager at SophosLabs, discusses scanning techniques for detecting and removing threats that have been installed on computers, with a focus on the difficulties faced in removing threats that are comprised of many installed components. Jason concludes by highlighting that the measure of success of threat removal is not always as clear cut as the measures used in the detection tests the industry has become used to.

This paper was presented at the VB Conference 2006

download Download our free Virus Removal Tool
Find what your antivirus missed