Quote of the day

Quote of the day

---

One man gives freely, yet grows all the richer, another withholds what he should give, and only suffers want.

Bible, Proverbs 11:24

New IT Term of the day

---

TACACS

---

Short for Terminal Access Controller Access Control System, an authentication protocol that was commonly used in UNIX networks. TACACS allows a remote access server to communicate with an authentication server in order to determine if the user has access to the network.

TACACS is now somewhat dated and is not used as frequently as it once was. A later version of TACACS was called XTACACS (Extended). These two versions have generally been replaced by TACACS+ and RADIUS in newer or updated networks. TACACS+ is a completely new protocol and is therefore not compatible with TACACS or XTACACS.

TACACS is detailed in RFC 1492.

Top Online Security Threats for 2009

TRENDS : Top Online Security Threats for 2009

by Lidija Davis

December 27, 2008

http://www.readwriteweb.com/archives/top_online_security_threats_for_2009.php

Twenty years after the release of the Morris Worm, one of the first worms discovered on the Internet, the Web has proven to be the primary place where bad guys lurk, looking for poorly secured websites to plant malicious code. And, they find plenty.

According to the 2009 Security Threat Report from Sophos, one new infected Web page is discovered every 4.5 seconds. With that in mind, we thought we'd take a look at the top security threats you should be looking out for in 2009.

SQL Injection Attacks

The Sophos research showed that over the past year the number of SQL injection attacks against innocent websites increased, a trend Sophos expects will continue next year.

Web insecurity, notably weakness against automated remote attacks such as SQL injections, will continue to be the primary way of distributing web-borne malware.

A recent report from the Internet Crime Complaint Center also points to an increase in SQL injection attacks in 2008, specifically relating to financial services and the online retail industry. Unfortunately, cyber criminals prey on the needs of Web users at any given time, and this time the economic crisis is their meal ticket.

The article is well worth reading if you're interested in how attackers compromise websites by SQL Injection or if you want ideas on how to reduce the likelihood of intruders gaining access to your private data.

Third Party Advertising Agencies and Scareware

In February 2008, Sophos confirmed a 'poisoned Web advertising campaign' on BBC competitor ITV's website that affected both Windows and Mac machines. While we've all seen Scareware, the pop ups designed to scare people into buying anti-virus software, this is the first time it has been seen for the Mac.

According to Sohpos, a Flash file was injected into traffic served up by ITV.com via third party advertising agencies. Designed to promote a program called Cleanator (Windows) or MacSweeper (Macs), the programs claimed to detect "compromising files" and encouraged users to purchase a full version of the package.

As websites often use third parties to serve up their advertising, Graham Cluley, senior technology consultant at Sophos suggests taking care when selecting agencies. "Website owners should ask the third party agencies they use what procedures they have implemented to positively vet the adverts that they deliver for malicious content or unsavory links.

Social Networking Sites

With social networking on the rise, the bad guys have found yet another playground on the Web. The Sophos report reveals 1800 Facebook users had their profiles defaced in August by an attack that installed a Trojan while displaying an animated graphic of a court jester.

Gated sites appeal to the bad guys because they form a "launching pad" for mass distributing malware attacks and spam, like the recent Koobface Trojan which attacked both MySpace and Facebook and transformed victim machines into zombie computers to form botnets.

Twitter too has become a tool for cyber criminals to distribute malware and marketing messages. In many cases, the bad guys steal members' usernames and passwords and bombard the victims' friends with marketing messages or direct them to third party websites. With Twitter especially, it is difficult to discern where links are going due to the 140 character limit and the use of services that shorten URLs.

On the flip side however, Chris Boyd of FaceTime Security Labs at this years RSA Conference explained that social networking sites are incredibly useful for security researchers. "The people that create these things have been on social networking sites since the beginning; they need to be on them a lot to understand them intimately enough to exploit them. But many times they leave a trail online that we can use to track them, to find out things like their names, ages and friends."

Apple Macs Becoming "Soft Targets"

While Mac malware is miniscule compared to Windows malware, Sophos recommends Mac users follow safe computing best practices and avoid complacency even though cyber criminals are more likely to stick to attacking Windows computers in the foreseeable future due to the higher financial incentive.

With so many Windows home users seemingly incapable of properly defending themselves against malware and spyware, it seems sensible to suggest that some of them should consider switching to the Apple Mac platform. This is not because Mac OS X is superior, but simply because there is significantly less malware currently being written for it.

Along with the scareware attack mentioned earlier, there have been other attempts to infect Mac computers in 2008: the OSX/Hovdy-A Trojan, the Troj/RKOSX-A Trojan, and the OSX/Jahlav-A Trojan.

Smartphones: A New Toy for Cyber Criminals

While most malware and spam is produced as a result of financial incentive, with smartphones, Sophos believes malware will more likely be written by those wanting to make headlines. As neither the iPhone or the G1 has yet been the target of a significant attack, someone will want to be the first and claim the title.

Apple iPhone

According to Sohpos, iPhone users are more vulnerable to phishing attacks than their desktop counterparts for three reasons:

· They may be more willing to click on links because entering URLs on a touch screen is more difficult

· The iPhone version of Safari doesn't display URLs embedded in emails before they are clicked on making it more difficult to tell whether a link leads to a phishing site

· The iPhone browser doesn't display full URLs making it easier for the bad guys to trick users

Google Android

Hackers are only just getting a real look at the Android OS so there is not much to report however, one security flaw was revealed only days after the G1 went on sale. The flaw, discovered by Charles Miller, a principal security analyst at Independent Security Evaluators, was in the browser partition of the phone. According to the New York Times, the flaw enabled keystroke logging software to be installed, making it an easy trick to steal identity information and passwords.

Additionally, while many are impressed with Google's open attitude to applications, others are concerned about the ease in which malicious software could be distributed and caution when it comes to downloading third party apps is advised.

Sophos predicts as more people purchase smartphones, creating threats will become increasingly attractive to cyber criminals: Imagine a generic Mac OS X attack made for the iPhone that could also cripple the Mac computer.

Other Interesting Stats from the Sophos Report

v There were five times as many malicious e-mail attachments at the end of 2008 than at the beginning of 2008

v The United States hosts the most malware on the Web at 37 percent

v Computers in the United States relay the most spam at 17.5 percent

Cyber criminals will always be ahead of security experts simply because most of what the anti-malware providers discover is generally published for the public; the bad guys aren't as open with what they do. But, being aware of trends, keeping security patches up to date, and installing firewalls will do much to thwart the majority of attacks.

2008 was a good year for bad guys

LOOK BACK : 2008 was a good year for bad guys

'Boom year' for hi-tech criminals

By Mark Ward, Technology correspondent,

BBC News

2008/12/28

http://news.bbc.co.uk/go/pr/fr/-/2/hi/technology/7797280.stm

If 2007 was witness to the rise of the professional hi-tech criminal, then 2008 was the year they got down to work.

"The underground economy is flourishing," said Dan Hubbard, chief technology officer at security company Websense.

"They are not just more organised," said Mr Hubbard, "they are co-operating more and showing more business savvy in how they monetise what they do."

Statistics gathered by firms combating the rising tide of computer crime reveal just how busy professional cyber thieves have been over the last twelve months.

Sophos said it was now seeing more than 20,000 new malicious programs every day. 2008 was also the year in which Symantec revealed that its anti-virus software now protected against more than one million viruses.

The vast majority of these malicious programs are aimed at Windows PCs. Viruses made their debut more than 20 years ago but the vast majority of that million plus total have been created in the last two-three years.

Tidal wave

Criminal gangs generate so many viruses for two main reasons. Firstly, many variants of essentially the same malicious program can cause problems for anti-virus software which can only reliably defend against threats it is aware of.

Secondly, in the past security firms have tended to focus on the big outbreaks. By staging a series of small outbreaks the criminals hope to go unnoticed while their family of viruses racks up victims.

Another statistic from Sophos reveals how the tactics of the online criminal groups are changing.

Before 2008 the preferred method of attack was a booby-trapped attachment circulating by e-mail.

Provocative, pornographic and personal subject lines were used to trick people into opening the attachment. Anyone doing so risked having hi-tech criminals hijack their home computer and turn them to their own nefarious ends.

In 2008, said Graham Cluley from Sophos, the main attack vector started to shift. Increasingly, he said, attackers have tried to subvert webpages by injecting malicious code into them that will compromise the computer of anyone that visits.

By the close of 2008, said Mr Cluley, Sophos was discovering a newly infected webpage roughly every 4 seconds.

The type of page being booby-trapped had also changed, he said. Prior to 2008 gambling, pornographic and pirated software sites were much more likely to be unwitting hosts for the malicious code used to hijack visitors' machines.

In 2008 the criminals turned their attention to mainstream sites that had very large audiences and were vulnerable to the code-injection attack.

Bug report

For Mikko Hypponen, chief research officer at F-Secure, 2008 was the year in which some hi-tech criminals got much more sophisticated.

The best example of this, he said, was the virus known as Mebroot.

"We saw it very early in the year and it continues to be a very complicated case," he said.

One of its most remarkable features is its built-in bug reporting system, said Mr Hypponen. When Mebroot is detected or malfunctions revealing its presence it sends off a report to its creators who then turn out a new version with the bug fixed.

"It's amazing that the bad guys were capable of pulling this off," said Mr Hypponen.

Dan Hubbard from Websense said 2008 was also notable for some hi-tech criminals turning away from viruses completely and embraced another way to make money.

Many, he said, were turning out bogus security programs that look legitimate but do not work. Once installed they purport to carry out a detailed scan of a machine and always turn up many instances of spyware and other malicious programs.

Cleaning up a machine using one of the bogus security programs always involves a fee, said Mr Hubbard.

"They are testing legal boundaries that are a grey area right now," said Mr Hubbard.

In mid-December 2008 the US Federal Trade Commission won a restraining order to shut down several firms that ran so-called "scareware" scams.

Research by Israeli security company Finjan suggests that up to five million people around the world have fallen victim to such scams.

A US court granted the FTC an injunction which stopped those behind the scareware products advertise their products, from making false claims about their efficacy and froze assets in the hope that duped customers could be refunded.

2008 also saw other big successes against criminals. In mid-November spam volumes around the world plummeted briefly following the closure of US network firm McColo.

Despite this, said Mr Hypponen, 2008 was a good year for the bad guys. The successes, he said, came due to action by ISPs, other net bodies and the media rather than from the action of law enforcement agencies.

This was mainly due, he said, to the trans-national nature of hi-tech crime that made it very difficult to quickly carry out an investigation and make arrests.

"The vast majority of these cases do not seem to go anywhere," he said.

Paki Cyber criminal economy set to expand in 2009

PAKISTAN : Paki Cyber criminal economy set to expand in 2009

Pakistan Times

Dec 27, 2008

http://www.pak-times.com/2008/12/27/cyber-criminal-economy-set-to-expand-in-2009/

Islamabad: The Pakistan Economy Watch said on Saturday said global financial turmoil has boosted Internet underworld and unleashed a new wave of crimes that is engulfing the globe. The development is enhancing cost of doing business everywhere and creating new challenges to already dull economies.

New task force, increased budget, awareness campaign must to combat threat

Government of Pakistan should immediately form a high-powered task force, upgrade the existing setup and launch an awareness campaign about expanding online criminal market set to hurt limping businesses, said Dr. Murtaza Mughal, President, Pakistan Economy Watch. “Private sector should also come forward and cooperate as it will be major looser by the end of the day,” he said.

2009 will see a record increase in identity thefts, credit and debit card frauds, network breaches, phishing, unauthorised telecom interceptions and database accesses, damaging, deletion, deterioration, alteration and suppression of critical information, misuse of devices, forgery, spam, adware, malware, Trojans, worms, viruses, frauds, threats, and online attacks, he warned.

Tens of thousands of computer engineers, experts, friendly hackers, technicians, and scientists have lost jobs in developed world due to the global crunch. Some are getting allowances that are not enough while others are left high and dry.

With such a high skill-level, backed by company’s information, the recently fired experts have become darling of cyber criminals. Internet mafia has hired many while others are operating in small groups. Some are working individually, said Dr. Murtaza Mughal adding that they pose seriously threat due to their potential to shake the whole world.

Growing e-crime wave sweeping across Pakistan

Supported by abilities of disgruntled IT employees, the underworld is now bolder and sophisticated, they will operate from west but prefer to hit east where the level of IT knowledge is alluring for them. The companies and websites offering stolen financial data have hike prices manifold due to increased demand by unemployed IT experts. Majority of such outfits are based in Russia and former Eastern Europe. Some are also operating from India.

Not a single country is fully prepared to face the menace. There will be no institution immune to online attacks during 2009. Apart from unsuspecting masses, finance, banking and credit card providers will suffer the most while the situation will prove a blessing for companies providing IT security.

Pakistan Economy Watch asked masses to avoid keeping sensitive information, bank records, financial transactions’ detail, agreements and passwords in computers. Online transactions and loading information on websites has become a risky business as around 1500 fraudulent sites are uploaded daily. Credit and debit cards should be used with extra caution.

There is growing evidence that some of the staff operating legitimate financial websites have compromised confidential information for petty gains. Bank data breach has become a routine. Hundreds of such stories are revolving in markets and offices of Islamabad. Other cities are no exception. “Majority of PCs and notebooks in Pakistan are infected with a hidden programmes that record and transmit your every keystroke, don’t become a victim,” warned Dr. Mughal.

(The above is a grim situation. Further, economic bankruptcy of Pakistan, ineffectiveness of elected government and Terror factories on it’s soil, makes it more gloomy - Editor).

Wi-Fi Security eBook became a big hit

HIT : Wi-Fi Security eBook became a big hit

CRPCC Team

28 December 2008

“The eBook – Securing Wi-Fi Network – 10 Steps to DIY Security has became a big hit. As per our calculations, about 4 million copies are distributed and downloaded”, said Ankur Goyal, co-author of the eBook, which he authored along with Rakesh Goyal.

The eBook is available free and can be downloaded from various sites including www.sysman.in.

“We have taken a different model to distribute the eBook. We contacted various egroups on Internet and requested them to distribute the eBook in their groups. Since, most of their members use Wi-Fi network to connect to Internet, most of these group owners distributed the eBook in their groups for the benefit of their members. We thank these group owners to consider the interest of their group members” said Ankur Goyal in an interview.

It was observed by the traffic on the site that about 1.2 million eBooks were downloaded from www.sysman.in site.

The eBook was released on 10 December 2008 and reaching to 4 million readers in just 2 weeks in remarkable and only possible with the power on internet. In the physical world, this was just not possible. We are still working to reach-out more and more people all-over-the world in their own interest, so that they can secure their wi-fi network themselves by DIY.

The eBook has been published with backing and encouragement from Information Security Education and Awareness Project (ISEAP) of Ministry of Information Technology, Government of India; CERT-In, Ministry of Information Technology, Government of India; Data Security Council of India (DSCI) of NASSCOM and Mumbai Police Cyber Crime Investigation Cell.