McAfee Receives Award For Research Into Botnet

Anti-virus company McAfee has at the Virus Bulletin conference in Prague received an award for research into a botnet which was in collaboration with the Dutch police shut. The botnet, which Beebone, VObfus or AAEH was called, was a polymorphic botnet.


The malware that caused computers part of the botnet had been active since 2009 and spread via infected USB sticks and social engineering. In early April of this year, the botnet was the High Tech Crime Team (THTC) of the Dutch police, the FBI, Europol and security Intel Security, Kaspersky Lab and Shadow Server taken off the air.

To disable the botnet domains were all registered and seized that used the malware to communicate with infected computers. Then the investigating authorities showed these areas to the servers of Internet providers and computer emergency response teams (CERTs) by pointing all over the world, a process also known as "sink holes" is mentioned.Research showed that the malware had infected 12 000 computers.

According to McAfee cooperation between law enforcement agencies and security companies was essential to make the botnet from the air. The anti-virus company wrote a technical report (pdf) on the malware and operation of the botnet.Previously received McAfee last week at the Virus Bulletin conference Peter Szor Award. An annual prize for the best security research named after the anti-virus pioneer deceased in 2013.

Szor began twenty years ago with the analysis of malware and in 2005 wrote the book "The Art of Computer Virus Research and Defense. He worked for Symantec and F-Secure, before he went to work in 2011 at McAfee. In 2013 died he unexpectedly. "This kind of research makes everyone safer, as did the survey conducted late Peter Szor," said Martijn Grooten of Virus Bulletin.

18 Virus Scanners For Linux Systems Tested

The Austrian test lab AV-Comparatives tested for the first virus for Linux. According to the test organ Linux is often considered a more secure platform than Windows, but does exist malware for Linux. In addition, Linux systems are often used as a file server, and can therefore come into contact with Windows Malware.

By installing a virus scanner can this malware are detected and thus prevent Windows computers become infected. The test report indicates AV-Comparatives also explain why so few Linux malware in circulation. That would relate to the large number of Linux Kernels and Linux distributions. The large number of different software configurations makes it more difficult for an attacker to produce malware that is compatible with a large part of the configurations.

Another factor that AV-Comparatives is pointing to is the small market share of Linux, which makes no lucrative target for attackers. This low proportion may also explain the small number of virus scanners for Linux compared to Windows. Unlike an earlier test of Virus Bulletin , AV-Comparatives decided not to test with malware but only to see the operation and features of the programs. For example, for each program discussed the installation and user interface.

Joint Research To Test Fraud Anti-Virus Companies

Three major laboratories engaged in testing of virus scanners have announced a joint investigation into fraud by anti-virus companies to test anti-virus software. This weekend the Austrian test laboratory AV-Comparatives came with the news that it had discovered a product of a yet unnamed anti-virus vendor which was specially adapted for the big test laboratories.

In addition, a second anti-virus company of similar practices is suspected. Adjusting virus scanners to perform better during anti-virus testing is contrary to contract rules. AV-Comparatives shows via Facebook know that with Virus Bulletin and AV-Test, two other large testing laboratories, has consulted and has begun a joint investigation into the fraud. Further details on the two suspect anti-virus companies have not been given yet.