    |
|
Private Equity Solutions |
|
 |
||||
|
F-Secure.co.uk F-Secure UK (C) / Private Equity SolutionsF-Secure Corporation protects consumers and businesses against computer viruses and other threats from the Internet and mobile networks. We want to be the most reliable provider of security services in the market. One way to demonstrate this is the speed of our response.e are honored and proud to be part of the IMPACT initiative. We see IMPACT as an important global collaboration and a catalyst against cyber threats. We look forward to contributing to the direction and strategies of IMPACT, said Mikko Hypponen, Chief Research Officer at F-Secure. private equity fund of funds Downloads Press and News Weblog Contacts F-Secure.co.uk ProductsProducts A-Z curve equity exposed fund F-Secure Products Security Suites
ARCHIVES ABOUT US SECURITY CENTER SUBMIT SAMPLE FSLABS TUBE LINUX BLOG equity income funds Thursday, May 29, 2008 capital casebook equity Inside a malicious flash file Posted by Gerald @ 19:13 GMT | private investment in public We ve been receiving lots of malicious flash file lately. Most of the flash file that we received has obfuscated shellcodes. equity mutual funds I stumble on one sample and gave a closer look on it. The obfuscation is simple, it only uses XOR and ADD instruction. Basically, this flash file is taking advantage of the recent 0-day vulnerability in Adobe Flash Player. It downloads and execute a file from the following site: hxtp://www.psp1122.cn/[removed].exe We detect the downloaded EXE file as Trojan-PSW.Win32.OnlineGames.ayju and the flash file as Exploit.SWF.Downloader.a birmingham contact equity Here s an animated image of decrypted shellcode: Comments Flash w/ SQL private equity investment firm | complying deal equity funds Google Earth with Worms, Spam and Malware - F-Secure Weblog : News from the Lab Google Earth is cool. We ve been using it to track worms. If a worm contacts our monitoring system, its IP address is logged and is then converted to latitude and longitude. It alls goes into an XML feed that we use with Google Earth s network links. It looks something like this: Google Earth with Worms Click the image for a 1400x1050 view. And while that s pretty neat, worms aren t really today s threat. So we re working on some new data feeds. equity msn private wyoming Lets take spam. This is what the source of spam from a single personal account looks like: Google Earth with Worms and Spam Then there s our worldmap.f-secure.com data. It also feeds an internal system that we use in the lab. We ve adapted that data for Google Earth which then looks like this: Google Earth with Worms, Spam and Malware american equity investment Bot monitoring feeds are in the works as well. We ll do a video demo sometime next week. Comments Inside a Malicious Flash File equity index funds | equity private team wyoming DHS PDF AddressBanner TitleBanner MAIN INDEX ARCHIVES ABOUT US SECURITY CENTER SUBMIT SAMPLE FSLABS TUBE LINUX BLOG equity group investment Sunday, June 1, 2008 capital development equity DHS PDF Posted by Mikko @ 12:14 GMT | article between difference We get samples lots of samples every day. Like tens of thousands of them. contact equity private wyoming They come from various sources: from our customers; from honeypots and honeynets; via our online scanners; submitted directly from our products; from operators and ISPs; via sample exchange with our competitors; and so on. agreement equity investment We also get copies of samples that people submit to online virus scanning services such as VirusTotal, Jotti, and VirSCAN. We d like to give big thanks to these services for their valuable cooperation. business equity funds When we get samples via such online services, we have absolutely no idea where the sample is coming from and who submitted it. Sometimes such samples can be real mysteries. Take for example this PDF file that we got a sample of via VirusTotal. The only information we have on this 130kB file is that it was named .pdf (after its MD5 hash) and that it was submitted on the 23rd of May. private equity fund When you open this document, this is what you ll see: Department of Homeland Security G-325A Looks like a Department of Homeland Security form G-325A. Look again. What s the filename It s not .pdf. It s 0521.pdf. This is not the document we opened. So what happens here Apparently this PDF has been used in a targeted attack against an unknown target. investment property home When this PDF is opened in Acrobat Reader, it uses a known exploit to to drop files. Specifically, it creates two files in the TEMP folder: D50E.tmp.exe and 0521.pdf. Then it executes the EXE and launches the clean 0521.pdf file to Adobe Reader in order to fool the user into thinking that everything is all right. D50E.tmp.exe is a backdoor that creates lots of new files with innocent sounding filenames, including: managed equity funds \windows\system32\avifil16.dll \windows\system32\avifil64.dll \windows\system32\drivers\pcictrl.sys \windows\system32\drivers\Nullbak.dat \windows\system32\drivers\Beepbak.dat The SYS component is a rootkit that attempts to hide all this activity on the infected machine. nbsstt.3322.org The backdoor tries to connect to port 80 of a host called nbsstt.3322.org. Anyone operating this machine would have full access to the infected machine. capital entrepreneurial equity Well, 3322.org is one of the well known Chinese DNS-bouncers that we see a lot in targeted attacks. Does nbsstt mean something Beats us, but Google will find a user with this nickname posting to several Chinese military related web forums, such as bbs.cjdby.net. private equity hedge funds Where does nbsstt.3322.org point to nbsstt.3322.org IP address 125.116.97.19 is in Zhejiang, China. And it s live right now, answering requests at port 80. Comments Google Earth with Worms, Spam and Malware email equity private wyoming | equity loan on investment Creating Malicous PDF Files f 1 be 1 cdea 0 bcc 5 a 1574 a 10771 cd 4 e 8 e 8 f 1 be 1 cdea 0 bcc 5 a 1574 a 10771 cd 4 e 8 e 8 equity income mutual funds Creating Malicous PDF Files - F-Secure Weblog : News from the LabYesterday s post discussed a mystery PDF file that was booby trapped to drop a backdoor. Today we ll look at how these documents are created. Here s an example of a tool called Y08-40 aka GenMDB. GenMDB When run, it displays this user interface: y08-04 by Noble The apparent purpose of this tool is to create trojanized PDF files. You select which EXE you want to embed, which PDF file you want to trojanize, and which platform you expect the victim to be using. private equity group Cool. Now, the real question is this: How on earth did we get our hands on such a tool You d never guess it. We received it inside a trojanized PDF file. Here s what we believe happened: Someone, somewhere was using this tool for the first time. They did a test run, selecting a random PDF file and a random EXE to create a trojanized PDF, just as a test. As a random EXE, they selected wait for it GenMDB.EXE itself! private investment public Then the perpetrator was probably curious to find out if the trojan PDF would be detected by virus scanners or not. So he uploaded the trojanized PDF to an online scanner. Hey, thanks. Keep up the good work. Comments DHS PDF real estate private equity | contact equity private us Symbian Jailbreak AddressBanner TitleBanner MAIN INDEX ARCHIVES ABOUT US SECURITY CENTER SUBMIT SAMPLE FSLABS TUBE LINUX BLOG real estate equity investment Tuesday, June 3, 2008 structuring venture capital Symbian Jailbreak Posted by Jarno @ 18:32 GMT | equity private quebec team A Spanish modder has developed an easy to use privilege escalation hack for Symbian S60 3rd Edition phones. The hack provides unlimited access to the phone s file system. With this access any number of modifications can be made. equity mail private wyoming jojojojo. Image from BigStockPhoto.comMobile modding is a very dynamic scene. See our recent Motorola Razr post and of course Apple iPhone research has had a great deal of activity from the time of its introduction. Despite the diversity of platforms, mobile phone enthusiasts are drawn to popular hardware and are eager to unlock any restrictions that exist. investment home equtiy loan Hacks directed towards S60 3rd Edition have been evolving for a while now. A number of OS security enhancements were implemented between the 2nd and 3rd Editions of S60. One of the practical results of these enhancements was the prevention of malware for 3rd Edition phones. The OS is locked down and applications require a Symbian signature. It s essentially a whitelisting system and only trusted applications can be installed. private equity jobs While this provides a very practical consequence to regular consumers it also tends to frustrate enthusiasts. Late last year we tested a hack technique using Nokia s firmware update application. It ended up bricking one of our test phones and we needed to get it re-flashed. The hack wasn t very, shall we say, user friendly. And being difficult to use it never really took off. Modification of firmware is both difficult and error prone. So modders began to look for easier targets that were more reliable. equity investment strategy Recent techniques used a new approach targeting Symbian s debugging interface, thus giving the modders full control without having to touch the device s firmware. Once a hacker has access to debug controls the device is completely under his control. education equity investment The first versions of this approach still required the use of a PC and thus could only be used by someone who knew what he was doing and required some time. So from the security point of view this was rather harmless. It would never become popular with the average Joe. private equity company But things went on and then last week the steps were reduced to running a single SISX installation file. And it works easily with no fuss. The SISX installation package contains a simple graphical application to remove the access restrictions of any application that is currently running on the device. equity guide in investment It makes modding an S60 phone as easy as jailbreaking an iPhone. The privilege escalation is still not without side effects. After escalation the operating system is not able to start any new applications until the phone is rebooted. But whatever is running at the time has total control over the device. So what does the future hold Will we see new malware for S60 3rd Edition phones It s possible. Cabir, Commwarrior, or Beselo source code could be updated to work on 3rd Edition and with the addition of this privilege escalation they could do pretty much the same things as they do on 2nd Edition phones. contact equity private quebec However Nokia and Symbian have worked on more security features than just the platform security capabilities model. For example, S60 3rd Edition FP1 s user interface was modified to prevent simple social engineering tactics used by Cabir variants. So user interaction would still be required and we think more of a social engineering challenge than with 2nd Edition phones. home equity investment More likely we ll see a small but growing subset of enthusiasts running homebrew applications much as there exists for the iPhone. Those willing to risk the security consequences will run free applications from developers that skip the expensive development cost of the Symbian signing process. Just like those that will skip Apple iPhone s SDK applications which require Apple s approval. dimension equity in private Comments Creating Malicous PDF Files| credit equity home investment Storm Still Alive Storm Still Alive - F-Secure Weblog : News from the Lab AddressBanner TitleBanner MAIN INDEX ARCHIVES ABOUT US SECURITY CENTER SUBMIT SAMPLE FSLABS TUBE LINUX BLOG private equity investor Wednesday, June 4, 2008 equity guarantee insurance Storm Still Alive Posted by Patrik @ 00:20 GMT | private equity analyst Despite reports of Storm being killed off, it s still very much alive. As recently as earlier today we saw an upswing in e-mails being sent out attempting to trick people into visiting Storm sites such as the one below. equity investment policy Storm May 2008While the Storm botnet certainly isn t as big as it used to be, it s definitely one of the most persistent botnets we ve ever seen and we ve not seen the last of it. PS. Nowadays Storm drops a filed called farkrish.exe to the system...we wonder if that means something in some language Comments Symbian Jailbreak create equity equity into | company equity investment AddressBanner TitleBanner MAIN INDEX ARCHIVES ABOUT US SECURITY CENTER SUBMIT SAMPLE FSLABS TUBE LINUX BLOG top private equity firm Wednesday, May 28, 2008 private equity deal Flash w/ SQL Posted by Sean @ 17:16 GMT | apollo private equity There are reports of a critical vulnerability affecting current versions of Adobe Flash and evidence of it being exploited in the wild. Versions including and previous to 9.0.124.0 are reported to be at risk. However chatter on the security lists we frequent suggest version 9.0.124.0 is not vulnerable and that the attacks are only reliably effective against version 9.0.115.0 and earlier (using CVE-2007-0071). birmingham equity msn private In any case we are seeing Flash exploits being used in combination with SQL injection attacks. See Patrik s May 13th post for more information on the SQL attacks. Many/most people probably don t update Flash every time there s an update. This in combination with the SQL injection attacks against tens of thousands of hacked sites is cause for concern. Many, many users could be at risk and should update their Flash software. Shadowserver has a good post highlighting some domains pushing Flash exploits. birmingham equity mail private Adobe is aware of the issue and is investigating but does not yet have a full report. We ll update you later on whether or not version 9.0.124.0 is affected. In the meantime, there may be some mitigating strategies you d like to employ. First of all you can uninstall Flash. But that can be somewhat aggravating as you ll then be prompted frequently to install Flash from numerous websites. So another option is to update and then disable your current installation. private equity capital If you have Flash installed on your Windows computer, Add/Remove Programs includes a Private Equity Equity for support information link. ActiveX component for Internet Explorer: Flash 901240 ActiveX Firefox Plugin: Flash 901240 Plugin Update to the most recent version. You can test your installation from this page. What are your options once you re up to date private equity investing For Internet Explorer, you can use the Manage Add-ons option to disable Flash: IE Manage Add-ons But then you ll get this annoying prompt on Flash enabled sites: Add-on Disabled An alternative is to use registry (.reg) files. This file disables Flash and this file enables Flash in IE. Right-click, save, and place the files in a convenient location and you can toggle Flash on/off as needed. chicago private equity A big hat tip goes to John Haller s Useful Stuff site for the .reg files. And for Firefox We suggest Flashblock and NoScript: Firefox Add-ons NoScript is an excellent plugin and will block Flash from any untrusted sites. But be careful whom you trust. Remember, even trusted sites can be hacked. Still, it s a must have plugin for security conscious individuals. You can install it from noscript.net. capital equity india private Flashblock prevents all Flash content from loading. It inserts a placeholder that then allows the user to toggle only the desired Flash. You can install it from flashblock.mozdev.org. equity mail private quebec Update: The Security Focus BID has been retired, see the details here. Adobe also has an updated post available. Adobe Flash version 9.0.124.0 is NOT vulnerable to the exploits that we re seeing in the wild. But there are a large number of sites hosting exploits for earlier Flash versions, so there is risk. We strongly advise updating your Flash installation as a minimum measure. private equity funding Home users can use our free Health Check service to assist in scanning and updating their systems. Comments Motorola Razr Vulnerability equity jms private | birmingham email equity Inside a malicious flash file In mobile news: TippingPoint has reported a JPEG Processing Stack Overflow Vulnerability affecting firmware based Motorola Razr phones. The vulnerability was discovered last summer. New Razr shipments will not be affected as Motorola has produced a fix for the issue. Motorola Razr The vulnerability allows remote attackers to execute arbitrary code on vulnerable Motorola Razr firmware based cell phones. private equity conference From TippingPoint: A corrupt JPEG received via MMS can cause a memory corruption which can be leveraged to execute arbitrary code on the affected device. So some user interaction is required accepting the MMS. However, people by and large generally trust image files so that isn t a difficult social engineering challenge. On a positive note, the Razr uses a proprietary OS and the knowledge base is limited to enthusiasts and modders. But there are modders are out there. Popular hardware always generates a crowd of recreational hackers, e.g. iPhone. private equity career Perhaps we ll see this JPEG exploit used to simplify unlocking older Razrs. Jailbreaking the iPhone was simplified by a TIFF handling exploit after all. We probably won t see any malware as a result of this vulnerability. Still, one interesting thing to consider is that if a Razr were to be exploited by this, the user wouldn t be able to undo the damage without a reinstall of the firmware. Being a closed OS, there is no hard reset available as there are with many smartphones. private equity definition Updates are available for older Razr models via Motorola. Comments Dear Google AdWords Customer private equity week | private equity fund raising Flash w/ SQL Dear Google AdWords Customer - F-Secure Weblog : News from the Lab Sometimes it can be quite hard to spot a phishing site on the first glance. Adwords Sure, it looks quite real. But always double check the address. Comments Romanian Whack-A-Mole and Linux Bots private equity atlanta | china private equity Motorola Razr Vulnerability Romanian Whack-A-Mole and Linux Bots - F-Secure Weblog : News from the Lab It doesn t always have to be the latest and greatest zero-day exploit that causes you to lose control of your computer or server to external attackers. Today s example comes in the relatively ancient form of brute force SSH. We recently received a sample containing several different files: A psyBNC installation; legitimate software used by many for normal purposes, but it s also a common tool in an attacker s toolkit. largest private equity firm And a collection of scripts, binaries, and password files that were used to scan for machines that have their SSH port open. The binaries that were used maliciously in this case were connecting to a large public IRC network. We see quite many such as these, all headed for the same network even though it does have a working abuse address and the network s administrators actually do something to the botnet channels that get reported. In our experience, the botnets are most often run by various small gangs coming largely from eastern Europe; notably from Romania. axa private equity monebaggasseViridian, the holding company for Northern Ireland's electricity, is in talks over a .62billion bid by Bahraini private equity firm Arcapita Bank. Read more
FF&P Private Equity provides its clients with the opportunity to invest in the equity of high growth, unquoted companies whose objective is to generate attractive returns through the subsequent listing, or trade sale, of these companies. FF&P Private Equity invests typically â5 million to â25 million of equity per transaction and places particular emphasis on backing commercial managers with a track record in successful execution of business plans and enhancing shareholder value. //www.ffandp. equity. |
|
||
X CATALOGUE
|
X GUIDES
|
X LINKS
|
