I am searching good info on sophisticated viruses/worms. One example would be STUXNET and the very good analysis made by folks from Symantec. Any ideas?
-
I just did a presentation on Stuxnet actually. Do you only want info on Stuxnet, if not what other worms? Also, do you want technical info or more news-type articles? I have several from each.– mrnapCommented Mar 5, 2011 at 2:22
-
1I would like to see others as well, and I am rather interested in technical details (mostly replication strategies)– ts01Commented Mar 5, 2011 at 8:02
Add a comment
|
3 Answers
Celebrity malware like Stuxnet, Confiker, Zeus will get the kind of attention you're referring to. Any list of those sort of reports is going to get out of date very fast though.
Many organisations inlcuding Symantec, Trusteer, Microsoft, SRI and Sophos publish malware analysis reports. There aren't any RSS feeds of these resources and some organisations spread the content all over their web presence in blogs, press releases and the like (Microsoft is particularly bad at this). You'll also have to wade through some promotional content from the commercial vendors and other research output from the pure research outfits. The easiest way to keep up with most of the publications in this area is to follow the SANS Internet Storm Center who publish links to a lot of the papers.
Shallower but more immediate analysis can be found from the VirusTotal community or ThreatExpert.
There is an extensive new analysis of Stuxnet by Kim Zetter at Wired: How Digital Detectives Deciphered Stuxnet, the Most Menacing Malware in History | Threat Level | Wired.com
If you are looking for real technical info and not just executive summaries, here's a blog you will enjoy
http://contagiodump.blogspot.com/ and the sister site http://contagiominidump.blogspot.com/
~~~
Edit: Just wanted to add another one, probably one of the best of its kind:
http://www.malwareblacklist.com/showMDL.php
warning: these sites contain links to real malware samples
