Oleh yuschuk biography of barack
•
Timeline of digital preservation
•
The term abandonware is commonly used to refer to legacy game software that has been abandoned by the author but is still loved by the gaming community.
The research was carried out by Andy Settle, Nicholas Griffin and Abel Toro, who are on the company's Special Investigations unit that investigates botnets, advanced persistent threats, and other deep reverse engineering topics.
Their research is titled "The Perils of Abandonware" and was done as part of the The Freeman Report, named after Dr Gordon Freeman, the hero of the science fiction first-person shooter game Half-Life developed by Valve.
It was carried out using a lapsed domain that they had "sinkholed". A sinkhole is a standard DNS server set up to hand out non-routable addresses for all its domains so that any computer using it will fail to get access to the real website. As a result of this methodology, the threats discussed in their report remain theoretical.While investigating malware, it is common for the Special Investigations unit to work in a virtualised environment and use network capture tools like Wireshark. During one such investigation, they found that requests were being made to a site www.cracklife.com and discovered that this was a due to a program known as OllyDBG being started.
OllyDBG is a 32-bit
•
05.12.2013
Slides about an in depth analysis of CVE-2013-3906 exploiting a TIFF bug inside a Microsoft Office Winword file. This bug was exploited in a targeted attack in November 2013.
masTIFF - An in depth analysis of CVE-2013-3906.pptx
25.11.2013
A new version of Officemalscanner/RTFScan has been released. This update includes a generic decryption loop detection, enhanced shellcode patterns and bugfixes. Enjoy!
OfficeMalScanner.zip
12.09.2012
The new version of the OfficeMalScanner suite introduces RTFScan. As you might know, there are several samples in the wild, using the RTF format as OLE and PE-File container. So here is a very first version of RTFScan. It currently is able to scan for malicious traces like shellcode, dumps embedded OLE and PE files and other data containers. Buffer decryption in RTFScan is not supported in this release, as OMS and RTFScan will be enhanced to a cryptanalysis feature to break keys up to 1024 bytes in seconds. The old brute force feature in OMS will be kicked then.
OfficeMalScanner.zip
10.08.2012
I found some time to update OfficeMalScanner lately. So here is Version 0.54! Next to bugfixes, it now has its own RtlDecompressBuffer library to support VB-macro extraction on WINE. Further the document format is detected (word, ppt,