Design and Test Lab's News Feed

Computer and Internet Security Video Tutorials

DntAdmin — Fri, 06 May 2011 12:33:06 +0300

Design and Test Lab presents a series of video tutorials on Computer and Internet Security. The tutorials are prepared by security experts with 5+ years of experience.

Runtime of the video course is 4 hours 36 minutes.

Buy Now!

Only $49.95

The topics are arranged in 29 clips shown below.

Introduction
Computer Threats Terminology	9:32
History of Malware	20:58
A Motivation for Malware Creation	6:00
Modern Trends in Mobile Malware	13:49
Are Operating Systems Safe?	5:54
Malware Classification	28:13
Spam	17:28
Ways of Infection
Introduction	2:49
Removable Media	6:32
Peering Networks	5:46
Websites	6:23
Email. Spam	18:02
Messengers	9:56
Social Networks	6:58
What To Do if a Computer is Infected?	9:30
Code Injection	12:29
Detecting Malware
A General Principle of Detecting Malware Infection	6:09
Typical Malware Habitats	7:03
Task Manager, tasklist, taskkill	8:03
The Windows Registry	12:19
A List of Opened Ports	10:02
A List of Services	1:32
The hosts File	7:27
Advanced Topics & Case Studies
Stealth Malware (Rootkits)	8:00
Online Multiscanner: www.virustotal.com	2:39
Online Sandboxes	6:58
Diagnosis. Msconfig tool	6:09
Removal of a Trojan. The General Case	4:55
Safe Browsing	14:27

Graphical User Interface

The tutorials are distributed electronically over the Internet. After quick download and straight-forward installation process a user will see the user-friendly graphical user interface.

End-User License Agreement

Read the Design and Test Lab's End-User License Agreement for "Computer and Internet Security Video Tutorials".

Buy now!

Buy Now!

Only $49.95

Orders are processed by share-it! — a service of Digital River GmbH.

Design and Test Lab’s Experts Helped Microsoft to Protect Customers

DntAdmin — Tue, 05 Oct 2010 13:55:17 +0300

October 5, 2010
Kharkov, Ukraine

Vitaly Kiktenko and Alexander Saprykin, the employees of Design and Test Lab, in cooperation with Kaspersky Lab’s employees, helped Microsoft to protect Windows’ users. They discovered and reported a critical security vulnerability in Print Spooler Service.

The description of the vulnerability is the following. The Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when printer sharing is enabled, does not properly validate spooler access permissions, which allows remote attackers to create files in a system directory, and consequently execute arbitrary code, by sending a crafted print request over RPC, as exploited in the wild in September 2010, aka “Print Spooler Service Impersonation Vulnerability”.

The MS10-061 security update resolves a publicly disclosed vulnerability in the Print Spooler service.

Vitaly Kiktenko, Design and Test Lab’s Lead Security Expert: “Malware reverse engineering is essential in fast eliminating and preventing the consequences of cyber attacks performed with use of malware. An in-depth code analysis helps us to reveal hidden malware functionality, such as exploitation of 0-day vulnerabilities that were not known before. This is very important, because software vendors in collaboration with security experts can fix vulnerabilities before they become widely used and can cause major problems. It was as always pleasure to work with Kaspersky Lab professionals and with Microsoft who was also fast and open for collaboration in fighting against malware”.

About Design and Test Lab

Design and Test Lab, LLC, (www.dnt-lab.com) — antivirus research center, located in Kharkov, Ukraine. The Lab’s focus is analysis of malware and Internet threats: viruses, trojans, and worms. During last five years, Design and Test Lab has described more than 5000 malware samples.

Contact Information

Volodymyr Obrizan
Manager, Design and Test Lab, LLC
volodymyr.obrizan@dnt-lab.com
Phone: +380 50 949-51-09

International Computer Biathlon

DntAdmin — Thu, 11 Feb 2010 16:25:53 +0200

Alexander Adamov
10th of February, 2010

Recently the first stage of the first International Computer Biathlon (ICB) has been finished at www.av-school.com! ICB is a competition for secondary educational institutions which is held within educational project initiated by Kaspersky Lab, Moscow. This first one was started in summer 2007 only for Russian students, and now it is available for foreign participants. Currently there are 18 teams from Russia and Poland.

Our analysts as well as Kaspersky Lab Experts and informatics teachers are in jury and it is honour for us to judge the students answers. Moreover, it is extremely interesting, because some tasks target creative abilities and the results are very impressive. For instance, creating video business card at www.youtube.com to present each team’s members. We have noted the high level of competition between teams and rate the efforts they give to the game.

The rules of the game and detailed information about commands can be found at http://av-school.com/game.

Case Study: IT Manager in Trouble

DntAdmin — Wed, 03 Feb 2010 19:36:51 +0200

Volodymyr Obrizan, Alexander Adamov
3rd of February, 2010

This case study shows an application of «Creating a description for a malware sample» service at virtual enterprise and virtual situation.

Introduction

John Doe is an administrator of a local area network at Some Corporation. His responsibilities are setting-up internal and external services for employees, and maintenance of their personal computers. Every day John responds to employees’ issues and solves problems, which they cannot solve independently. Also John looks through logs of some services, including anti-virus software.

An Incident

One day, John observed a malware detection report while looking through an anti-virus software log. This malware was detected as «Backdoor.Win32.Bancodor.bk» and removed from the system. John remembered what instructor on Information Security said: «Anti-virus software doesn’t provide 100 % protection guarantee. Nowadays, it is important not only to detect and remove malware, but to know which security hole or which personnel’s action leads to infection, what this malware does, which remote computer connections are established, what type of data is gathered and sent away.»

John was curious about these questions and he decided to know all the details. This information is needed to handle the security incident and minimize security risks.

John saved the malware sample from a quarantine and sent it to Design and Test Lab for an urgent expertise.

Expertise at the Lab

Virus analysts of Design and Test Lab reversed the malware sample and studied its behavior within single day. The analysts identified type of the sample — a trojan allowing remote control of infected system.

Right after the start, the backdoor copies it to Program Files folder, using name «ashAvast_.exe».

The trojan adds a registry key to provide automatic start-up during the system boot:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Alwil Software SA"="%Program Files%\ashAvast_.exe"

Once loaded, the backdoor downloads a file from the location:

http://recallbr.com/img/call.cfg

This file contains commands to control the backdoor. The file is downloaded to current user’s temporary folder:

%Temp%\call.cfg

The backdoor reads commands from the file and puts redirect rules to hosts file located at:

%System%\drivers\etc\hosts

It leads to a situation when user may be redirected to a criminal’s site instead of needed web-site during web-browsing.

The backdoor may read additional links from its configuration file and download additional malware samples. These samples will be stored at the temporary folder with unique filenames.

When the malware expertise was done, the virus analysts put all information to a report and sent it to John Doe.

The administrator’s actions

John learnt from the report that the malware grants full access to the file system to the criminal.

John followed the advices provided by Design and Test Lab. First, all passwords must be changed, because the backdoor might use phishing sites to gather passwords. Secondly, it is needed to updated antivirus databases and scan the system.

Conclusions

Anti-virus Software does not provide 100 % guarantee. There is need for additional expertise of malware samples, detected in the system. Depending on results of expertise, IT Manager may perform necessary actions to prevent sensitive information leaks and future intrusions.

Such kind of expertise can be achived using "Creating a description for a malware sample" service.

Design and Test Lab has launched the YouTube channel

DntAdmin — Wed, 20 Jan 2010 12:06:58 +0200

January 14, 2010
Kharkov, Ukraine

Design and Test Lab has launched the YouTube channel.

One of Design and Test Lab’s objectives is to spread knowledge about Internet Security and computer threats. Lab’s personnel strongly believe that increased security awareness among end-users will decrease the number of security-related incidents significantly. Courses and open lectures in universities are taught, several articles are being prepared and published in blogs.

To develop a new way of communication with users, Design and Test Lab has created a channel on the most popular video-hosting site — YouTube. The address is www.youtube.com/user/dntlab. The Lab tries a new format: short educational clips on important Internet Security topics. These lectures are free and available 24x7. Any person can comment the clips on the channel’s page or send an email with questions or remarks to info@dnt-lab.com.

About YouTube

YouTube is the world’s most popular online video community allowing millions of people to discover, watch and share originally-created videos. YouTube provides a forum for people to connect, inform and inspire others across the globe and acts as a distribution platform for original content creators and advertisers large and small. YouTube, LLC is based in San Bruno, CA and is a subsidiary of Google Inc.

About Design and Test Lab

Contact Information

Volodymyr Obrizan
Manager, Design and Test Lab, LLC
volodymyr.obrizan@dnt-lab.com
Phone: +380 50 949-51-09

Design and Test Lab starts beta-testing of a service

DntAdmin — Wed, 20 Jan 2010 12:06:22 +0200

January 21, 2010
Kharkov, Ukraine

Design and Test Lab starts beta-testing of a service — analyzing a contents and behavior of malicious file and creating a textual description for it.

The main idea behind the service is to perform detailed analysis of structure and behavior of malware such as viruses, worms, or trojans. As a result, a client gets textual description containing general information about the malicious file, penetration, payload and spy activity, information leaks, removal instructions.

Alexander Adamov, leading virus analyst: «Nowadays it is not enough just to remove a malicious program from a system. It is important to know which vulnerability or personnel’s action made it possible. Then, what did the malware do within the system? Which remote systems did the malware establish a connection with? What information had been collected and transmitted to a criminal? Depending on this report, an IT-manager can make proper decisions and actions to protect confidential data and prevent infections in future.» During last five years, Design and Test Lab has described more than 5000 malware samples in partnership with Kaspersky Lab, Russia. Visit www.totalmalwareinfo.com to see sample descriptions.

Beta-testing of the service is free for a limited number of customers. To evaluate the service please send a request to info@dnt-lab.com and specify:

Name of the contacting person
The contacting person’s email and phone number
Company name
Approximate number of employees

About Design and Test Lab

Contact Information

Volodymyr Obrizan
Manager, Design and Test Lab, LLC
volodymyr.obrizan@dnt-lab.com
Phone: +380 50 949-51-09

Visit to Kiev Technical University

DntAdmin — Wed, 13 Jan 2010 15:16:05 +0200

24th of December, 2009

Alexander Adamov, head of the Malware Research Department at Design and Test Lab, has delivered an open lecture dedicated to Conficker Worm Analysis at Kiev Polytechnical University on Thursday, 24th of December in conjunction with the partner Kaspersky Lab, Moscow.

Deputy CEO of Development and Innovation Department in Kaspersky Lab Stanislav Shevchenko talked to students about antivirus industry trends and answered to questions about current security threats. Also his colleagues Yuri Sekin and Margarita Bakina told about new Kaspersky Antivirus features and the ways how the students could collaborate with Kaspersky Lab. At the end the students were passed the psychological test to detect whether they are potentially “black” hackers or “white” future security analysts!

The most active students were presented with free tickets from Design and Test Lab to Avatar 3D Movie in IMAX cinema.

Kiev main Square at New Year’s Eve looked very glorious in the evening lights.

And, of course, the main New Year Tree of Ukraine:

Design and Test Lab's News Feed

Computer and Internet Security Video Tutorials

Contents

Graphical User Interface

End-User License Agreement

Buy now!

Design and Test Lab’s Experts Helped Microsoft to Protect Customers

About Design and Test Lab

Contact Information

International Computer Biathlon

Case Study: IT Manager in Trouble

Introduction

An Incident

Expertise at the Lab

The administrator’s actions

Conclusions

Design and Test Lab has launched the YouTube channel

About YouTube

About Design and Test Lab

Contact Information

Design and Test Lab starts beta-testing of a service

About Design and Test Lab

Contact Information

Visit to Kiev Technical University