Microsoft Malware Protection Center

Greetings from Tokyo…

2009-11-06T01:40:00Z

This year at the PacSec conference, I will present a Microsoft view of the threat landscape during the first six months in 2009. It will be based on telemetry data published in the latest Security Intelligence Report (SIR) published on Nov 2nd, 2009. You can find agenda of the conference at http://pacsec.jp/agenda.html

From data gathered by a number of Microsoft security products (e.g. Forefront Client Security, Windows Defender, Microsoft Windows Malicious Software Removal Tool, etc.), we see attacks by malware continuing to target specific regions or groups of users. While Japan has a relatively lower infection rate than many countries, we notice that other Asian countries have a high relative infection rate which, in a number of cases, is due to high prevalence of Win32/Taterf (a worm used to steal passwords).

As attackers continue to exploit the Internet infrastructure and application/service environment in large scale, it is important to establish collaboration among ISPs, security solution providers, law enforcement and other service providers to combat malicious threats. In Japan, participants in Japan’s Cyber Clean Center (e.g. ISPs, security ISVs including Microsoft, government) have been working collaboratively against malicious and potentially unwanted malware. We shall appreciate more in similar efforts and collaboration models, particularly in countries and regions where threats are most prevalent.

I hope to see people at the conference and invite them to learn more about the different threat mixes and trends in a number of countries, by downloading and reading the latest SIR.

Regards,
Tony Lee

...Greetings from the old Capital, Kyoto

Hello from the historical imperial city of Kyoto. Yesterday, or today depending on where you are, I had the honor of giving the opening presentation at the twelfth annual AVAR conference. The AVAR conference has grown in significance over the past decade to become one of the top security conferences in the world.

The International AVAR conference concentrates on the computer security situation in the Asia Pacific region. So I will be highlighting data from volume 7 of the Security Intelligence Report that has been gathered from the region.

All in all, most of the Asia and Pacific regions are significantly below worldwide average. But, two of the most highly infected regions are among the largest and increasing. This tells us we still have work ahead of us. Community based defenses are what's needed in our next step in the war against malware. And organizations like AVAR are necessary to bring the community together.

Jimmy Kuo

The Low-Down on Daonol

2009-11-04T01:00:00Z

A relatively new trojan has been making the rounds and causing some problems, particularly on Windows XP systems. Trojan:Win32/Daonol is malware which hooks various system calls in order to steal credential information and redirect some Web traffic. It also protects itself by keeping some security-related software from running.

Several recent versions of this malware are buggy and prevent computers from successfully shutting down or (more importantly) starting up. If you have (or someone you know has) a Windows XP system which won’t boot completely (ie, shows the ‘Windows XP’ splash-screen with the progress bar, but then the screen turns black and the system never starts up completely), it’s likely a Daonol infection. Visit our write-up for Trojan:Win32/Daonol to find instructions on cleaning Daonol off your system if you think you are infected.

Another obvious symptom of infection is that regedit.exe and cmd.exe will not launch properly. To see if this is the case, navigate to Start->Run and enter regedit.exe. If nothing happens after a few seconds, most likely you are infected with Daonol. If you launch cmd.exe in the same way, you will see a command-prompt window but no text will appear in the window itself. Daonol allows the regedit and cmd processes to launch, but it forces them into a suspended state and doesn’t allow them to do anything.

Microsoft Security Essentials can detect and remove all known variants of Daonol, as well as keep you from being infected by it in the first place. If you aren’t using an anti-malware solution, do yourself a favor and head over there for a free copy of Microsoft Security Essentials.

Stay safe out there on the interwebs,
Aaron Putnam

Security Intelligence Report v7 is Now Available

2009-11-02T15:00:00Z

Twice a year we put together a report detailing trends that we see which are threat related in the computer security environment. Today we have released our seventh report which you can find at www.microsoft.com/sir. I’m very excited about this report. We, the MMPC, and our partners in the Microsoft Security Engineering Center, Bing, Windows Live and many others have collaborated to make this our most comprehensive report to date.

The report includes insights drawn from data collected consensually from the more than 450 million people running the Malicious Software Removal Tool each month, the hundreds of millions of mailboxes at Hotmail we protect, data gathered by Bing in scanning billions of web pages each year as well as the telemetry received from more than 100 million of our customers running Windows Live OneCare, Forefront Client Security, Windows Defender as well as spam, phishing and malware data relating to the billions of emails scanned by Forefront Online Protection for Exchange.

The data we have available gives us an unparalleled view of threat activity on the internet both worldwide as well as regionally in more than 212 countries and regions across all seven continents.

In this edition we provide an in-depth review of malicious and potentially unwanted software, software exploits, security breaches, software vulnerabilities (both Microsoft and third party) around the world as well as providing detailed views of a number of countries. We review malware distribution sites by country, discuss phishing and spam trends and geographic distribution, details on vulnerability disclosure practices, differences in threat distribution between consumers and enterprise and we also provide guidance for IT professionals and business decision makers based on this information.

For the first time ever, we include Best Practices contributed by representatives from four of the countries (Austria, Finland, Germany, and Japan) that have managed to maintain the lowest malware infection counts in their countries.

It is our hope that you find this information valuable and that it helps you to make shrewd risk-management decisions. We also welcome your feedback for future editions. Please email us at SIRFB at microsoft.com with your thoughts.

--Jeff Williams Principal Group Program Manager, MMPC

MSRT October Release – Case Study

2009-10-27T18:45:00Z

As of October 21st, the MSRT has removed the newly added threat, Win32/FakeScanti from 56,700 infected machines. For this month, it was the 12th most prevalent threat family worldwide and 7th in the US. Overall the MSRT has cleaned 2,516,235 machines this month from all kinds of malware infections.

We all know the threat landscape is not homogenous across geographic regions. Let’s take a look at US, China, and Brazil as a case study.

United States			China			Brazil
Family	Threats	Machines Cleaned	Family	Threats	Machines Cleaned	Family	Threats	Machines Cleaned
Alureon	147,387	117,351	Lolyda	77,781	72,863	Taterf	72,464	70,069
Taterf	121,988	116,217	Frethog	21,927	20,042	Bancos	67,577	59,414
FakeXPA	108,026	103,578	Ceekat	9,440	8,767	Frethog	33,455	32,009
Renos	69,147	55,461	Conficker	8,899	8,427	Banker	27,421	26,420
FakeRean	78,067	53,376	Hupigon	5,127	4,879	Conficker	19,664	18,398
Yektel	52,259	51,061	Parite	7,518	4,592	Banload	18,617	18,121
FakeScanti	70,120	50,260	RJump	3,875	2,552	Cutwail	8,452	5,269
Frethog	51,038	49,526	Brontok	980	969	Alureon	3,656	3,053
Daurso	32,205	32,150	Taterf	1,177	963	Renos	3,192	2,228
Koobface	43,640	27,793	Corripio	980	855	IRCbot	1,929	1,874
FakeSpypro	26,530	26,242	Sdbot	776	770	Brontok	1,768	1,739

Note: Rogues in italics; Password Stealer (PWS) bolded

Some key takeaways:

In the US (as well as other English speaking countries) rogues are predominant. Six of the top ten threat families in the US are rogues or rogue-related trojan downloaders. This poses a challenge for the end users to identify the legit AV products when there are so many rogue products popping up on the users’ machines.
Six of the top ten threat families in China are password stealers, most of which are hunting for online gamers’ credentials.
Six of the top ten threat families in Brazil are also password stealers, though a lot of them (Bancos, Banker and Banload) tend to target online banking credentials in Brazil.

We close, as we always do, by urging you to take action and protect yourself.

Scott Wu

VISTA_32_BIT_BLACK(HAT)_EDITION_2009.iso

2009-10-20T22:10:00Z

As we’ve mentioned before, your average user is the most at risk of getting infected these days. So, with the release of Microsoft Security Essentials recently en masse, we’re really able to see some of the fruits of our labour over the last few years. We’re very pleased to see such a positive response to MSE, with many new home users giving it a try, which as you can imagine, makes us all happy little Vegemites*.

As you might expect, we see pretty different infection types from home-users versus the enterprise. Generally, infection vectors for the home user are web-based; either via malicious websites or by being enticed to download something that is, how you say ‘not so much with the good’. The term ‘home user’ generalises – computer-based experience of these users covers a broad spectrum. The savvier of these computer users, one would expect, would have a better chance of avoiding infection. However this is not entirely true; as we’ve mentioned in previous posts, savvy computer users actually open themselves up to more risks while they’re exploring the deeper darker depths of what the Internet has to offer.

To wit, after MSE’s release, we’ve seen a spike in a particular variant of Win32/Bifrose – Backdoor:Win32/Bifrose.EO. Why, you ask? Well, it seems that the malware authors (or perhaps an unsuspecting pirate) are distributing a ‘cracked’ version of Windows that comes pre-infected for your convenience – labelled, fittingly, “Vista Black Edition”. Just to clarify, this means computer users are downloading an ISO of pirated Microsoft software (and saving to disk on a Genuine Windows system) and a free Microsoft anti-virus product is alerting them to a potential infection in their freshly stolen software. I’m not really sure if ‘irony’ really emphasises the situation enough. But hey, at least the Windows is free**, right?

What’s even more interesting (read: funny) is that despite this, it seems this isn’t enough to stop people from trying to utilize their ill-gotten gains. Underground forums are teeming with helpful hints on how to disinfect your newly acquired (though somewhat ‘not as advertised’) software. No doubt some of the instructions include using other pirated software products.

So you see kids, illegal software is seldom free of all cost. Chances are you’re paying for it in ways you didn’t consider.

Matt McCormack
MMPC Melbourne

*The team down in Australia at least
** Disclaimer: “Free” may be changed at any time to actually mean “cost you”, with one or more of the following words appended to the end: passwords, bandwidth, login information, bank account details, email accounts, credit rating, dignity, ...

Microsoft Security Essentials – Week One

2009-10-16T02:05:00Z

Now that Microsoft Security Essentials is generally available to consumers in 19 countries, we've had a chance to go over the data, and there are some very interesting results. Just in the first week we saw well over 1.5 million downloads of Microsoft Security Essentials, but the price (free to Windows users) is hard to beat!

Computers reporting detections up to October 6: almost four million detections on 535,752 distinct machines. The detections are eight times the machine count because many computers are infected with multiple threats.

Microsoft Security Essentials is available in 8 languages and 19 markets at RTM, which covers a lot of the PC using world. The geographic distribution of detections so far still closely follows the Microsoft Security Essentials Beta countries, and is ramping up in other countries that use the 8 languages.

Looking at counts of computers reporting detections by threat categories, we see that the order is different in each of the top three countries. Trojans are the top detected category in the US, China has lots of potentially unwanted software threats, and worms (particularly Conficker) are very active in Brazil. There are also many exploits being encountered in China, which may mean these PCs do not have the latest security updates.

The top threat families for these countries have remarkably similar curves, but very different family mixes.

China top families include several exploits (ShellCode, IFrameRef), the US has the trojans Wimad and rogue trojan FakeXPA at the top, while Brazil has worms Conficker and Taterf.

For family details, see the MMPC threat encyclopedia at http://microsoft.com/security/portal

Looking at the operating systems breakdown, we're seeing lots of Windows 7 using Microsoft Security Essentials, but a pretty even balance between OS'es:

The Windows 7 numbers are spectacular for an operating system that hasn't yet released for global availability. Even better, about 1/3rd of Windows 7 Microsoft Security Essentials machines are 64-bit, which is even more resistant to malware than 32-bit due to PatchGuard.

By looking at detections divided by active Microsoft Security Essentials machines over the whole population, we see far more detections per XP machine, with the fewest from Win7. This follows our usual observed trend of seeing less malware on newer OSes and service packs.

In one short week, Microsoft Security Essentials's making a big difference to those people using it on their computers. If you don't have updated antimalware on your computer we strongly recommend giving Microsoft Security Essentials a try.

--Joe Faulhaber

Scanti-ly Clad - Another Rogue Stripped by MSRT

2009-10-13T18:10:00Z

Anyone who’s seen a system infected by a rogue security program doesn’t need to be told how annoying they can be, as they attempt to scare, threaten, cajole, hector, harangue, pester, aggravate, intimidate, badger, harass and generally nag* the user into paying to register the fake software. And even among rogues, there are few that are quite as annoying as Win32/FakeScanti, which is this month’s addition to the Malicious Software Removal Tool (MSRT).

*I realize I’m being more than a little repetitive here. But this still pales in comparison to how repetitive your average rogue can get.

We first saw a variant of Win32/FakeScanti back in early March of this year, when it went by the name of ASC Antivirus. There was then very little activity on the FakeScanti front until late July, when we noticed a file, which we detect as TrojanDownloader:Win32/FakeScanti, downloading a new version of the scanner going by the name of Windows Antivirus Pro. This version was proactively detected by the signatures added in March. Since then there has been a steady stream of new files, but only one name change, to Windows Police Pro. Apart from the name change, the user interface, and even the list of alleged “malware” detected by this rogue, has remained identical:

FakeScanti has your usual grab bag of popups, system tray balloons, and dialog boxes (and there are many examples of these in our Win32/FakeScanti description) all reporting malicious activity, and recommending that the reported threats be removed. Of course, if you want this to happen, then naturally you have to pay:

These popups tend to pile up on the screen at a rapid rate, and dismissing any one of these results in the confirmation dialog below, which also needs to be closed. Notice how the placement of the Purchase and Continue buttons is swapped compared to the dialog above.

Win32/FakeScanti also uses a number of other tricks common to many other rogues, such as the display of a fake version of the Windows Security Center, or blocking access to certain web sites:

It uses a number of other methods in an attempt to convince users that the system is infected. These include:

Periodically rebooting the system
Preventing other executables from running

It does this by associating the .exe extension with desot.exe, one of the files installed by Win32/FakeScanti. As a result, when an attempt is made to run one of these files, the filename is passed to desot.exe, which will decide whether it is allowed to run, and display a message box such as the one above if not.

Using Active Desktop to place text on the desktop background

Displaying error messages which resemble the “Dr Watson” Windows system error dialog

The “Fix it” button launches the fake scanner. The other buttons do not do anything.

As we've mentioned before, if you're concerned about the veracity or legitimacy of a particular antivirus scanner, it's a good idea to check if the product in question has received any industry-recognized certification. Virus Bulletin VB100 is a good place to start, but there are other industry-recognized testing and certification bodies that are good for this kind of verification. If you're looking for security software for your computer, you could also visit http://www.microsoft.com/windows/antivirus-partners for a list of security software providers.

If you believe you are infected, we encourage you to use the Windows Live OneCare safety scanner to check your PC for malware and to help remove them from your system. In addition we encourage you to submit any suspicious files to the MMPC team for analysis. If you don’t already have active, up-to-date Anti-malware protection remember that our new security product - Microsoft Security Essentials – runs quietly in the background and never asks you for payment.

--David Wood

Where in the world is the MMPC

2009-10-12T18:40:00Z

Based on the interest we saw in the various presentations our team did at Virus Bulletin in Geneva a couple of weeks back we thought you might be interested in where else we will be presenting in the coming weeks.

October 13 Vinny Gullotto will be in a panel discussion in Washington D.C. at the Emerging Threats, Vulnerabilities, & Challenges in the Cybersecurity Ecosystem event put on by TechAmerica. You can find information on how to register for this event at http://www.techamerica.org/cybersecurity-ecosystem.

Also on October 13, Jeff Williams will present the keynote for Malware 2009 in Montreal, Canada. Information on Malware 2009 is available at http://www.malware2009.org/.

On November 4, Jimmy Kuo will present the keynote for the Association of anti-Virus Asia Researchers International Conference (AVAR) in Kyoto, Japan. Information on AVAR 2009 can be found here: http://www.aavar.org/avar2009/

November 4-5 also is when you will find us at the PacSec conference in Tokyo, Japan where Tony Lee will be presenting on the threat landscape and where Jeff Williams may deliver a lightning talk if he has the chance. You can find information about PacSec at http://pacsec.jp/.

That’s all for now since we need time to pack. We hope to see many of you at one or more of these events.

--Microsoft Malware Protection Center

National CyberSecurity Awareness Month

2009-10-02T09:13:00Z

Today marks the beginning of National CyberSecurity Awareness Month here in the United States.

I would like to take this opportunity to acknowledge all the security professionals around the world who work tirelessly to make cyberspace a safer place for all our online pasttimes. You know who you are. It's nice to know we all work for the same team.

Jimmy Kuo

PS. I'm glad to see www.staysafeonline.info still going strong.

Notes from the VB Conference

2009-10-01T02:06:00Z

Back in our labs in Dublin, Melbourne, and Redmond from the 2009 Virus Bulletin conference!

This year there were almost 400 attendees and 49 presentations covered by 60 speakers (7 of them from Microsoft). The MMPC had presenters from all three labs at the conference and we started and ended the technical stream. The topics this year included malware, spam, and this year's hot topic, cloud technology. There were also interesting talks on social networks, URL shortening, browser plug-ins, Banker trojans, and testing the performance of in-the-cloud antivirus scanners.

It was exciting for our first-time speakers to meet others from the industry. It was also an opportunity to catch up with old friends and colleagues. The welcome drinks and gala dinner allowed us to mingle with them in a relaxed atmosphere. Microsoft also won second place in the IT Security Table Foosball Championship. Francis from the Dublin MMPC lab and Terry from the Antispam team played against foosball teams from other companies.

We had also the chance to see some sights in Geneva and the surrounding countryside and vineyards (which are directly adjacent to France). Luckily, the weather was perfect the whole time we were there and so the beautiful fountain in Lake Geneva, the Jet d’eau, was turned on every day. We also saw the flower clock and the old town with its gorgeous architecture.

Next year, the Virus Bulletin conference will be in Vancouver. We're certainly looking forward to it.

--Katrin

Introducing Microsoft Security Essentials

2009-09-29T20:45:00Z

The Microsoft Malware Protection Center (MMPC) would like to introduce you to Microsoft’s new security program - Microsoft Security Essentials. The MMPC is very excited about this release, which should help us to protect more customers around the world at no cost.

Here’s a note from the Microsoft Security Essentials team:

Microsoft Security Essentials (formerly codenamed “Morro”) is the newest security product from Microsoft that helps protect consumers against viruses, spyware and other malicious software. The program, using the same technology as the Forefront product family, is designed to protect and take the guess work out of you wondering if you are protected or not.

If you’re green, you’re good.

Red or yellow means there is something that needs to be done to keep your PC secure. A single click and the PC is back to the green protected state.

Microsoft Security Essentials is also designed to address cost and other barriers that have prevented many of our customers from running up-to-date security protection on their PCs. Because there are no subscription fees, there is no registration required to collect billing or other personal information.

It also runs quietly in the background scheduling scans when the PC is most likely idle and interrupting the user only when there is an action required to keep their PC secure. It employs practices like active memory swapping and CPU throttling to limit the impact on your PC performance, even on older or less powerful PCs.

This isn’t a security suite product that provides rich PC tuning capabilities or backs up your data. But if what you’re looking for is “install and forget” malware protection and solid quality Microsoft Security Essentials may be just what you’ve been waiting for. Plus, as a user of Microsoft Security Essentials you’ll get support from the MMPC.

We think you’re gonna like what you get with Microsoft Security Essentials. See for yourself and download it now!

Microsoft Security Essentials is available now in 8 languages and 19 markets around the world for genuine Windows PCs.
Download at: http://www.microsoft.com/security_essentials.

From Dublin to Geneva

2009-09-22T03:28:00Z

Hello! Greetings from Dublin!

As mentioned by Jakub in a previous post, we are presenting at the Virus Bulletin International Conference 2009 in Geneva next week.

It’s an understatement to say that we're excited about attending the conference – and not just about presenting our papers, but about getting the chance to meet the other delegates.

From the technical stream we have Elda and Francis:

We’re presenting our paper entitled "Blast from the Past: Application of the MS08-067 Exploit in Real World Malware". Together with our colleague, Scott Wu from the team in Redmond, we'll talk about the MS08-067 vulnerability and how it was exploited by different malware, including Conficker.

The presentation explains the Server service vulnerability addressed in the MS08-067 security bulletin and shows how different malware families utilized this exploit. We also present some interesting data from the field on the malware families involved.

We’re the first presenters for the technical stream, so we’ll see you on Wednesday morning!

From the corporate stream we have Ina and Marian:

We are presenting our paper, "The Cloud or the Mist?". Those of you who are Stephen King fans might be familiar with his novella “The Mist”, in which an evil mist invades a town and wreaks havoc. In the same way, cloud technology is a buzzword right now, and some people are hyping it as the next evolution of the Internet. Yet there are a lot of valid concerns, especially about privacy and security.

Our paper talks about the potential security risks of the cloud: what dangers exist when we store personal and sometimes highly profitable information in the cloud? What social engineering techniques exist that have only emerged with cloud technology? And what malware families exploit the cloud to perform their malicious routines?

We are presenting on Friday right before lunch, but we promise our slides will be just as filling!

We'd all love to meet those of you who will be attending and especially those of you who are interested in our research.

See you there! Kita kits! (Filipino) Ne vedem acolo! (Romanian) Slán go fóill! (Gaelic)

- Elda, Francis, Ina and Marian

The modern rogue - a timely subject

2009-09-18T04:41:00Z

As Jakub mentioned, I'll soon be presenting at the Virus Bulletin conference in Geneva. I've spent a lot of time looking at rogue security software in the last year, so I'm looking forward to sharing some of my findings.

The subject of rogues (or "scareware") is a timely one. You may have heard reports in the past few days of a couple of malware attacks which involved rogues. One of these was an attack where visitors to the New York Times web site were seeing pop-ups telling them that their computer was infected, then being redirected to a fake online malware scanner. There have also been several reports of "hackers" exploiting the news of Patrick Swayze's death in order to direct people to (you guessed it) a fake online scanner.

Not only were both of these attacks distributing rogues, they were both pushing the same rogue. We call it Win32/FakeXPA.

Win32/FakeXPA has been using these distribution methods for a while now. The New York Times attack was accomplished through a malicious advertisement; these have been used to distribute rogues via legitimate web sites at least since early 2007. The second attack was not an attempt to exploit the death of Patrick Swayze specifically, but rather part of an ongoing campaign that Win32/FakeXPA's distributors have been running to poison results from search engines to lure people to their malicious sites. Most popular search terms are exploited in this way, by rogues like Win32/FakeXPA and other types of malware too.

These are the same techniques that have made Win32/FakeXPA the most prevalent rogue for some time. Despite the press, we are not seeing increased activity from Win32/FakeXPA through our telemetry or from our customers.

I'll be talking about both of these distribution techniques (and a lot more about rogues) in Geneva. I hope to see you there!

- Hamish O'Dea

I can’t go back to yesterday - see you in Geneva

2009-09-16T04:35:00Z

At last year’s VB conference, my talk “Playing with shadows - exposing the black market for online game password theft” discussed malware being sold on the black market for password stealing purposes. During the “Q & A” time, someone asked a question regarding the technical details of Dogrobot, a family of malware that can penetrate the protection offered by a ‘hard disk recovery card’ (used to restore a machine to a known, clean state). Unfortunately, I don’t think I gave a satisfactory answer due to my limited research on it at that time. I’ve been feeling guilty since then and the experience encouraged me to spend more time studying it.

After crawling around in file system drivers and Dogrobot drivers for a few months, I finally managed to get a comprehensive understanding of the technical details of this malware. Unfortunately, “I can’t go back to yesterday” to answer the question again; fortunately, the VB committee gave me a second chance - they accepted my paper entitled ‘'I can't go back to yesterday, because I was a different person then'’ which will be presented at VB2009, on 23rd September in Geneva. In the presentation, delegates will hear about:

Malware designed to specifically target the recovery hardware used in Internet Cafés in China - how it works, and why?
Malware that has caused 8 billon RMB (1.2 billion USD) in losses but doesn’t infect files
Further details of the black market for malware

Are you interested in this? See you in Geneva.

Chun Feng

September in Geneva

2009-09-15T03:57:00Z

Another year has passed, and the time of the most important annual anti-malware event is upon us. The Virus Bulletin International Conference 2009 takes place on 23-25 September at The Crowne Plaza Hotel in Geneva, Switzerland.

As usual, the program is packed to the rafters with malware-related material, with presentations spread across two parallel streams, and three busy days that, no doubt, will be filled with research papers, discussions and heated but friendly arguments.

A strong contingent from Microsoft is attending, including authors and presenters discussing the results of their latest research. The delegates can see the following Microsoft presentations:

On Wednesday, September 23, a paper titled “Blast from the past: application of the MS08-067 exploit in real world malware” by Elda Dimakiling, Francis Allan Tan Seng and Scott Wu.

On the same day, and also in the Technical stream, the paper “I can't go back to yesterday, because I was a different person then” by Chun Feng.

On Thursday, in the Corporate stream, the paper “How to reclaim your sender reputation” by Terry Zink from the FOSE team.

During Friday's proceedings, in the Corporate stream, the paper: “The cloud or the mist?” by Marian Radu and Hilda Larina Ragragio.

On the same day, as the last presentation of the conference, and just before the closing panel discussion, the paper: “The modern rogue - malware with a face” by Hamish O’Dea.

Traditionally, every VB Conference attracts big interest and large crowds, making each event a perfect venue for various industry meetings – and it's no different this year - the AVPD and the WildList meetings are already scheduled for the same time, at the same location.

Jakub Kaminski