Showing posts with label Didier Stevens. Show all posts
Showing posts with label Didier Stevens. Show all posts

Sunday, 20 September 2015

Tip: Adobe Reader Lets You Open Any Embedded Files




In recent weeks, cyber criminals several times PDF files sent which was hiding a malicious Word document. Once users opened the PDF file they were asked if they wanted to open the embedded Word document.

The Word document contains another macro that installed malware on the computer. The macro is executed only if users set it, but in practice this is an effective method of attack. Users and administrators can easily avoid, however, Adobe Reader opens these embedded documents, says Didier Stevens, handler at the Internet Storm Center. Through the Trust Manager, available via the settings of the PDF reader option can be switched off, as Stevens Also in this video shows.

Friday, 11 September 2015

TrueCrypt Message Suspicious Europol Do Not Mislead



A suspect who had his laptop via TrueCrypt encrypted and a custom startup screen foresaw eventually still managed not to mislead investigators Europol, says Vice Magazine according to a confidential document that was in hands.

The document describes how researchers at the European Cyber crime Centre (EC3) Europol tried to examine an encrypted laptop from a suspect. Although she possessed the password they were denied access to the machine. After the laptop was set up which showed an error message because it lacked the operating system. Therefore, the researchers thought that there was something wrong with the laptop, according to the document. Later it appeared that the defendant had changed the startup screen TrueCrypt.

Once a machine is started TrueCrypt asks for a password. This screen can be provided with arbitrary text, such as an error message. A tactic which the Belgian security researcher Didier Stevens already explained in 2009. In the case of the accused came Europol behind the trick yet gained access to the laptop by typing the password on the screen with the error message. When the laptop was examined on is not reported. It is unknown how Europol got hold of the password.