Obfuscation

Code Comments Reveal SCP-173 Malware

Code Comments Reveal SCP-173 Malware

| | Black Hat Tactics, Hacked Websites, Labs Note, Malware, Obfuscation, Sucuri Labs, Website Backdoor, Website Malware Infections, Website Security, wordpress security
We sometimes find malware code injections that contain strange code comments, which are normally used by programmers to annotate a section of code — for example, a short description of a feature ...
Sucuri Blog
CSS-JS Steganography in Fake Flash Player Update Malware

CSS-JS Steganography in Fake Flash Player Update Malware

| | Black Hat Tactics, Hacked Websites, Malware, Obfuscation, Phishing, Security Education, Sucuri Labs, Website Malware Infections, Website Security
This summer, MalwareBytes researcher Jérôme Segura wrote an article about how criminals use image files (.ico) to hide JavaScript credit card stealers on compromised e-commerce sites. In a tweet, Affable Kraut also ...
Sucuri Blog

Lessons from Teaching Cybersecurity: Week 5

| | Cyber Skills, IT Security and Data Protection, Obfuscation, Teaching
As I had mentioned previously this year, I’m going back to school. Not to take classes, but to teach a course at my alma mater, Fanshawe College. I did this about a ...
The State of Security
P.A.S. Fork v. 1.0 — A Web Shell Revival

P.A.S. Fork v. 1.0 — A Web Shell Revival

| | Black Hat Tactics, Hacked Websites, Malware, Obfuscation, Security Education, Sucuri Labs, Website Backdoor, Website Malware Infections, Website Security
A PHP shell containing multiple functions can easily consist of thousands of lines of code, so it’s no surprise that attackers often reuse the code from some of the most popular PHP ...
Sucuri Blog
Malicious Pop-up Redirects Baidu Traffic

Malicious Pop-up Redirects Baidu Traffic

| | Black Hat Tactics, Hacked Websites, Labs Note, Malware, Obfuscation, Redirects, Security Education, Sucuri Labs, Website Security
Malicious pop-ups and redirects have become two extremely common techniques used by attackers to drive traffic wherever they want. During a recent investigation, we came across an obfuscated pop-up script leveraging baidu[.]com ...
Sucuri Blog
Missing DMARC Records Lead to Phishing

Missing DMARC Records Lead to Phishing

| | Black Hat Tactics, Hacked Websites, Obfuscation, Phishing, Security Education, Sucuri Labs, Website Security
Email will continue to be the dominant mode of digital communication for the foreseeable future. However, the email framework was not designed with security in mind. There still are security flaws that ...
Sucuri Blog
WordPress Malware Disables Security Plugins to Avoid Detection

WordPress Malware Disables Security Plugins to Avoid Detection

| | Black Hat Tactics, Hacked Websites, Obfuscation, Sucuri Labs, Website Malware Infections, Website Security, WordPress Plugins and Themes, wordpress security
An alarm or monitoring system is a great tool that can be used to improve the security of a home or website, but what if an attacker can easily disable it? I’ve ...
Sucuri Blog

Using assert() to Execute Malware in PHP 7 Environments

| | Black Hat Tactics, Hacked Websites, Labs Note, Obfuscation, Sucuri Labs, Website Backdoor, Website Malware Infections, Website Security
Initially released December 2015, PHP 7 introduced a multitude of performance and security improvements. Approximately 43.7% of websites across the web currently use PHP 7.x, making it an incredibly popular scripting language ...
Sucuri Blog

CDN-Filestore Credit Card Stealer for Magento

| | Black Hat Tactics, Ecommerce Security, Hacked Websites, Labs Note, Magento Security, Obfuscation, Sucuri Labs, Website Malware Infections, Website Security
During a website remediation, we recently discovered a new version of a Magento credit card stealer which sends all compromised data to the malicious domain cdn-filestore[dot]com. My colleague Luke Leal originally wrote ...
Sucuri Blog

Web Crawler & User Agent Blocking Techniques

| | Black Hat Tactics, Labs Note, Obfuscation, Redirects, Security Education, Sucuri Labs, Website Security
This is a simple script that allows hackers to block specific crawlers based upon website requests from specific user-agents. This is useful when you don’t want certain traffic from being able to ...
Sucuri Blog
Load more