Kaspersky Lab at Virus Bulletin 2011

BARCELONA — The annual Virus Bulletin conference kicks off here tomorrow with anti-malware researchers discussing a wide range of important issues facing the industry.

Researchers from Kaspersky Lab will have a major presence at the conference this year — nine speaker slots! — with talks on the cyber-crime underground, mobile (Android) malware, web application security and social network threats.

I’d like to call attention to a few of the important Kaspersky Lab presentations:

• Dmitry Besthuzhev (Twitter: dmitribest) will take a detailed look at the cyber-crime underground economy and will discuss the current black market structure and the business model used for black market transactions.
• Brazilian researcher Fabio Assolini (Twitter: assolini) will tell the story of Igor Soares da Silva and his wife Emily who together stole more than US$300,000 from one Brazilian bank in a single year. The presentation will look at cyber-crime in Brazil and discuss how the bad guys go about their business in the land of samba, soccer and carnivals.
• Stefan Tanase (Twitter: stefant) will offer a glimpse into the challenge of trying to clean up 100 infected websites in the least amount of time possible. He will present detailed and relevant statistics alongside pieces of malicious code and bits from the discussions with the webmasters to show exactly how difficult it is to manually get in touch with each website owner.
• Denis Maslennikov (Twitter: hEx63) will have two presentations this year. First, he will team up with Tim Armstrong (Twitter: _timarmstrong to take a look at the dangers associated with the Android Market and how malware may proliferate through the misuse of a fragmented security architecture. He plans to delve into the basics of the Android security model and its flaws, some of the malware currently found (both in the Android Market and outside), as well as future threats to expect. In the second presentation, Maslennikov will discuss cell phone money laundering in Russia and show the methods used by the criminals, how they make money and, most importantly, how much money they are making.
• Kurt Baumgartner (Twitter: k_sec) will examine and categorize the types of Java malcode in the wild over the past year, the obfuscation and anti-reversing techniques embedded in them (see abstract), the Java components affected and the best tools to tackle these challenges.
• Maksym Schipka (Twitter: maksyms) will attempt to predict the shape of the anti-threat market in 2020. His presentation will talk about the kinds of threats that will exist, the types of ‘products’ that will be needed and the characteristics of threat protection companies that will remain relevant. The goal of the presentation is to open the minds of anti-threat experts and modern IT decision makers to the challenges of our high-tech future.
• And finally, I will be teaming up with representatives from Sophos, McAfee and GFI Software for a panel discussion on the need for better industry collaboration to neutralize major threats and the problems that occur when public relations and marketing get in the way of better information sharing. Follow me on twitter here: ryanaraine.

All our researchers will be blogging from the conference and we will also be using Twitter to share our thoughts from all the presentations.

You should also follow the official virusbtn conference feed and the VB2011 hash tag to stay connected to the proceedings.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.