Seeking Investor Contact!

Dear blog readers, I'm currently seeking a investor contact regarding an upcoming security project and wanted to find out whether you might be aware of an investor that would be willing to invest in my upcoming security project?

I can be reached at dancho.danchev@hush.com

Dancho Danchev's Blog Going Private - Request Access

Dear blog readers, it's been several years since I last posted a quality update following my disappearance in 2010. I wanted to take the time and thank everyone including researchers and colleagues who participated in the search including colleagues and vendors who offered expertise and advice including possible career opportunity.

As I've recently launched InfoWar Monitor 2.0 I decided that the time has come for me to take my blog to a new level by offering proprietary invite-only commercial access to selected readers who request access. The access guarantees unlimited access to daily cybercrime research information security topics coverage including an unlimited supply of actionable threat intelligence research on a daily basis including access to InfoWar Monitor 2.0 security podcast subscription security mailing list security newsletter a closed security community and a hacker E-zine released by the community including unlimited access to proprietary research reports and articles.

How to request access?
Users interested in requesting access can approach me with the following details:

Name:
Position:
How long have you been reading my blog?
How much would you be willing to invest to obtain access on a monthly basis?

I can be reached at dancho.danchev@hush.com

Enjoy!

Summarizing Webroot's Threat Blog Posts for January - 2012

In this post I'll summarize Webroot Threat Blog Posts for January, 2012. Feel free to check out some of the latest research published at the blog here and consider subscribing to its RSS feed.

01. Cybercriminals generate malicious Java applets using DIY tools
02. A peek inside the uBot malware bot
03. Researchers intercept a client-side exploits serving malware campaign
04. How phishers launch phishing attacks
05. A peek inside the Umbra malware loader
06. How malware authors evade antivirus detection
07. Inside AnonJDB – a Java based malware distribution platforms for drive-by downloads
08. Zappos.com hacked, 24 million users affected
09. Inside a clickjacking/likejacking scam distribution platform for Facebook
10. A peek inside the Cythosia v2 DDoS Bot
11. A peek inside the PickPocket Botnet
12. Mass SQL injection attack affects over 200,000 URLs
13. Email hacking for hire going mainstream
14. Millions of harvested emails offered for sale

Security News - Safe Browsing protection from even more deceptive attacks - Commentary

Google's security initiatives, continue, indicating, the search engine market's leader, ambitions, towards, building, a vibrant, ecosystem, for, protecting, end users, from malicious attacks, and, further, position, the company, as, an emerging, leader, whose, activities, contribute, to the, overall security level, of the entire ecosystem.

External Link:

"Safe Browsing has been protecting over one billion people from traditional phishing attacks on the web for more than eight years. The threat landscape is constantly changing—bad actors on the web are using more and different types of deceptive behavior to trick you into performing actions that you didn’t intend or want, so we’ve expanded protection to include social engineering."

The latest, indication, of this, trend, is the company's, introduction, of, social engineering attack, warnings, fully capable, of preventing, widespread damage, and to prevent, a malicious attack, from taking, place, in the early stages, of the campaign. With malicious actors, continuing, to utilize, visual social engineering campaigns, to serve, malicious software, and potentially unwanted applications, compromising, the confidentiality, integrity, and, availability, of information, visual social engineering, will, continue, to represent, a growing attack vector, to be utilized, by malicious actors, that, needs, better, protective, mechanisms, on behalf, of ecosystem participants.

This post has been reproduced from Dancho Danchev's blog. Follow him on Twitter.

Introduction to Dancho Danchev's Infowar Monitor 2.0

Dear blog readers it's been quite some time since I last posted a quality update following my dissapearance in 2010. I wanted to express my gratitude to everyone who participated in the search including colleagues and companies and wanted to say thanks for taking your time and effort to keep track and follow my research and disappearance.
.

As I've been busy working on Dancho Danchev's Blog - Mind Streams of Information Security Knowledge Infowar Monitor 2.0 I wanted to let you know that I've recently resumed my Twitter account following a successful career at Webroot Inc. including a short-term venture at GroupSense following a successful launch of my own company called Disruptive Individuals and Threat Data - the World's Most Comprehensive Threats Database including the Obmonix Platform - The World's Most Comprehensive Sensor Network, including a possible book writing project including a successful cyber security consultancy and a possible career opportunity request.

Let's take the time and effort to elaborate on what exactly InfoWar Monitor 2.0 aims to achieve including a detailed explanation of some of the key features of the newly launched portal-based type of research-based Information Security and Cybercrime Research and Threat Intelligence gathering community. Users interested in contributing with content including blog contribution including partnership sponsorship and possible advertising requests can approach me at dancho.danchev@hush.com

01. What is Inforwar Monitor 2.0?
Inforwar Monitor 2.0 aims to build the World's largest and most comprehensive community for Information Security, threat intelligence gathering and cybercrime research. Managed and operated by Dancho Danchev the World's leading expert in Information Security and cybercrime research and threat intelligence gathering the community seeks to provide information data and knowledge to thousands of users globally.

Among the key features include:
- Daily Security News Coverage
- Information Security Videos
- Security and Hacking eBook
- Security Newsletter
- Information Security Podcast
- Security and Hacking E-Zine
- Security Mailing List
- Daily Intelligence Brief
- Closed Security Community

02. What is Disruptive Individuals?
Disruptive Individuals is a research-intensive data-driven company successfully establishing the world's largest snapshot of malicious cybercrime activity for the purpose of offering the industry the world's most versatile portfolio of malicious cybercrime-driven services successfully positioning itself as the world's leading provider of real-time intelligence-driven services and product portfolio including cybercrime-research data malicious activity profiling services and custom-tailored intelligence assessments successfully positioning the company as the world's leading provider of cybercrime-data driven research-intensive intelligence data-driven company.

03. What is the Obmonix Platform?
The Obmonix platform aims to build the World's most versatile and comprehensive sensor network for intercepting monitoring and responding to cybercrime and cyber jihad events successfully deploying a variety of proprietary sensor network based of honeypot appliances industry-wide partnership including the utilization of proprietary cybercrime and cyber jihad forum and community monitoring and infiltration campaigns successfully positioning the platform as the leading indicator for cybercrime and cyber jihad activity globally empowering the operator law enforcement and the security industry with then necessary tactics techniques and procedures (TTPs) for successfully responding and monitoring cybercrime and cyber jihad activity globally leading to successful launch of the Disruptive Individuals startup successfully serving the needs of the Intelligence Community, the security industry and law enforcement agencies globally successfully anticipating an emerging set of malicious and fraudulent tactics techniques and procedures successfully protecting millions of users globally.

04. What is Threat Data?
Threat Data is the industry's leading and most versatile JSON-capable threats database successfully empowering companies and security researchers with the necessary knowledge to stay ahead of current and emerging threats, further, positioning their company and enterprise on the top of its game.

- Russian Business Network coverage
- Koobface Botnet coverage
- Kneber Botnet coverage
- Hundreds of IOCs (Indicators of Compromise)
- Tactics Techniques and Procedures In-Depth Coverage
- Malicious and fraudulent infrastructure mapped and exposed
- Malicious and fraudulent Blackhat SEO coverage
- Malicious spam and phishing campaigns
- Malicious and fraudulent scareware campaigns
- Malicious and fraudulent money mule recruitment scams
- Malicious and fraudulent reshipping mule recruitment scams
- Web based mass attack compromise fraudulent and malicious campaigns
- Malicious and fraudulent client-side exploits serving campaigns

Potential users and clients interested in obtaining access to Threat Data including a possible trial and a sample can approach me at dancho.danchev@hush.com

Stay tuned!

Dissecting the Latest Koobface Facebook Campaign

The latest Koobface malware campaign at Facebook, is once again exposing a diverse ecosystem worth assessing in times of active migration to alternative ISPs tolerating or conveniently ignoring the malicious activities courtesy of their customers. The -- now removed -- binaries that the dropper was requesting were hosted at the American International Baseball Club in Vienna, indicating a compromise.

us.geocities .com/adanbates84/index.htm
lostart .info/js/js.js (79.132.211.51)
off34 .com/go/fb.php (79.132.211.51)
youtube-spyvideo .com/youtube_file.html (58.241.255.37)
ahdirz .com/movie1.php?id=638&n=teen (208.85.181.69)
top100clipz .com/m6/movie1.php?id=638&n=teen (208.85.181.67)
hq-vidz .com/movie1.php?id=638&n=teen (208.85.181.68)

The dropper then phones back home to : f071108 .com/fb/first.php (79.132.211.50) with the binaries hosted at a legitimate site that's been compromised :

aibcvienna.org/youtube/ bnsetup24.exe
aibcvienna.org/youtube/ tinyproxy.exe

Related fake Youtube domains participating :
catshof .com (79.132.211.51)
youtube-spy .info (94.102.60.119)
youtubehof .net (218.93.205.30)
youtube-spyvideo .com (58.241.255.37)
yyyaaaahhhhoooo.ocom .pl (67.15.104.83)
youtube-x-files .com (94.102.60.119)

The development of cybercrime platforms utilizing legitimate infrastructure only, has always been in the works. With spamming systems relying exclusively on the automatically registered email accounts at free web based providers, to the automatic bulk registration of hundreds of thousands of domains enjoying a particular domain registrar's weak anti-abuse policies, it would be interesting to monitor whether marginal thinking or improved OPSEC relying on compromised hosts will be favored in 2009.

Related posts:
Fake YouTube Site Serving Flash Exploits
Facebook Malware Campaigns Rotating Tactics
Phishing Campaign Spreading Across Facebook
Large Scale MySpace Phishing Attack
Update on the MySpace Phishing Campaign
MySpace Phishers Now Targeting Facebook
MySpace Hosting MySpace Phishing Profiles