Trustwave Holdings

History

Products and technologies

• Deep Content Inspection
• SpamBotCensor
• Blended Threats Module

Significant discoveries

• Skype for Mac vulnerability – Trustwave discovered a local backdoor in the code of Skype for Mac OS X that could have existed since 2005. Microsoft quietly patched the Mac OS X client for Skype in October, closing a backdoor that could have existed for as long as a decade and would have allowed attackers to control many aspects of the software.
• Zen Cart XSS Vulnerabilities – Trustwave discovered multiple Cross-Site Scripting vulnerabilities in the popular online open source shopping cart Zen Cart. Zen Cart released version 1.5.5 to resolve the security flaws and also introduced a new sanitization class with a number of sanitization groups, each meant to perform a defined sanitizations on specific GET/POST parameters. Both reflective and stored XSS flaws were affecting multiple parameters of a number of requests, and successful malicious XSS injection could result in access to cookies and sensitive information or site defacement.
• “Angler” Malvertising – Trustwave discovered the domain takeover of what once was a reputable advertising site, which was purchased and repurposed with the “Angler Exploit Kit” to deliver a payload known as the “BEDEP Trojan” through malicious ads. Very popular websites both in the US and internationally were affected by this malvertising campaign: "answerscom", "zerohedgecom" and "infolinkscom" were a few of the notable websites involved.
• “Dridex” botnet using “Locky” ransomware – Trustwave found that the Dridex botnet had adopted “Locky” ransomware to spam massive numbers of targets, sometimes up to 200k spam emails per hour. In the first week of March 2016, the “Locky” campaigns accounted for 18% of the 4 million malware spam emails monitored by the Trustwave Spam Research Database.
• “Neutrino Exploit Kit” updated – Trustwave discovered that the popular “Neutrino Exploit Kit” had been updated to avoid detection by security researchers. Neutrino had been re-engineered to use passive OS fingerprinting, which is a method to collect and analyze data packets without the entity that is sending the packets knowing their computers are being profiled. In this case, the computer sending the packets is a security researcher's system that's probing the hackers' server.
• “Cherry Picker” point-of-sale malware – Trustwave discovered a new form of sophisticated malware designed to steal payment card data from point-of-sale systems. The company's SpiderLabs team discovered the malware during data breach forensic investigations. Cherry Picker remained largely undetected by antivirus tools and security companies because of the sophisticated techniques it uses to hide itself from sight.
• RIG 3.0 Malvertisement Campaign – Security researchers from Trustwave monitored the operations of the RIG 3.0 exploit kit over about six weeks, during which attackers attempted to exploit more than 3.5 million potential victims and succeeded with about 1.25 million – an infection rate of 34 percent. RIG 3.0 is the next generation of a service for distributing malware. RIG 3.0 works by infecting users who are simply browsing the web through malicious advertisements. Trustwave determined that nearly 70 percent of the traffic being delivered to RIG could be directly linked to a number of malicious ad campaigns.
• "Punkey" point-of-sale malware -- Security researchers from Trustwave SpiderLabs discovered RAM-scraping point-of-sale threat they named "Punkey" during an investigation with the U.S. Secret Service. The malware uses a variable called 'unkey' to send the data to the C&C server, and the data is sent using an 'HTTP POST' command. So Punkey is a portmanteau of 'POST' and 'UNKEY': Punkey.
• “Backoff” point-of-sale malware -- Trustwave SpiderLabs investigators were the first to identify and name the Backoff point-of-sale malware that infected 1,000+ businesses in North America. The malware targeted point-of-sales systems by exploiting weak passwords on remote access software. Trustwave found it to be a unique new family of malware.
• Reflected File Download -- Trustwave SpiderLabs researcher Oren Hafif identified a new method of attacking web clients dubbed Reflected File Download. The new attack method allows attackers to piggyback on the trust given to a valid website to send malware to their victims.
• Same Origin Method Execution -- Trustwave SpiderLabs researcher Ben Hayak identified a new method of attacking web clients dubbed “Same Origin Method Execution”. The method capitalizes on a flaw in JavaScript Object Notation with padding that allows an attacker to execute arbitrary methods on affected websites. A victim that clicks on a specifically malicious link could expose confidential data to an attacker utilizing this attack method.
• Magnitude -- Trustwave SpiderLabs researchers found an instance of the Magnitude exploit kit that shed light on how the exploit kit's business model works and how exactly it infects its victims.
• Pony Botnet Discoveries -- Twice in 2013 and again in 2014 Trustwave SpiderLabs did an analysis of primary Pony botnet controllers. The results of the analysis found that the botnets had gathered more than two million passwords and credentials for accounts on ADP payroll, Facebook, Twitter, Yahoo and more, and over US$220,000 in crypto-currency like Bitcoin.
• Redkit -- Trustwave SpiderLabs researchers discovered a new exploit kit they named RedKit. The exploit kit was one of the first to provide a constantly changing attack URL to make it difficult for organizations to block the exploit kit.

  Congressional testimony

Unrestricted sub-CA incident

Allegations against Trustwave

Recognition