Implementation is simple. »
True Positive False Positive
False positives are an everyday occurrence for analysts. To an analyst, a false positive, while sometimes time…
Learn More
 
Writing a Malware Config Parse…
Radare2 has been receiving a lot of attention lately. Rather than browsing through some of the documentation, I…
Learn More
 
BernhardPOS – New POS Malware…
Yet another new credit card dumping utility has been discovered.  BernhardPOS is named after (presumably) its…
Learn More
 
TrueCrypt’s Egress
Security stories have taken on new life in our post-Snowden information security world.  Truth is stranger than…
Learn More
 
LogPOS – New Point of Sale Mal…
Introduction There has been an explosion in POS malware in the last year.  At Morphick, Nick Hoffman and I…
Learn More
 
Webshells and MOF
(Note: If you would prefer a less technical summary, check out Chinese and Russian Attackers Hide In Plain…
Learn More
 
The Little Dumper That Could
I’ve recently been doing a lot of work around credit card dumpers at Morphick. While casually browsing through…
Learn More
 
The Mozart RAM Scraper
As a reverse engineer on the Morphick Cyber Security team, I spend a large part of my time pulling apart and…
Learn More
 
LusyPOS and Tor
At our day jobs, as reverse engineers at Morphick, Jeremy and I have been hunting new POS malware. A new sample…
Learn More
 
Curious Korlia
Reverse engineers organize discrete of pieces of malware into families. While digging through my malware collection I…
Learn More
 
Network Traffic Anomaly Analys…
Intrusion Detection Systems are a powerful tool in the fight against threats to the network.  Just like any tool,…
Learn More