When it is dark enough, you can see the stars.
Charles Beard
.BMP)
3 days ago
WISH YOU A HAPPY AND SECURE YEAR 2009
Sunday, July 19, 2009
New IT Term of the day
New IT Term of the day
spamware
Software that is used by spammers to send out automated spam e-mail. Spamware packages may also include an e-mail harvesting tool.
SURVEY : One in six consumers acts on spam
SURVEY : One in six consumers acts on spam
Jeremy Kirk
July 14, 2009
IDG News Service
About one in six consumers have at some time acted on a spam message, affirming the economic incentive for spammers to keep churning out millions of obnoxious pitches per day, according to a new survey.
Due to be released Wednesday, the survey was sponsored by the Messaging Anti-Abuse Working Group (MAAWG), an industrywide security think tank composed of service providers and network operators dedicated to fighting spam and malicious software.
Eight hundred consumers in the U.S. and Canada were asked about their computer security practices habits as well as awareness of current security issues.
Those who did admit to opening a spam message -- which in and of itself could potentially harm their computer -- said they were interested in a product or service or wanted to see what would happen when they opened it.
"It is this level of response that makes spamming a lot more attractive as a business because spam is much more likely to generate revenues at this response rate," according to the survey.
One other study, conducted by the computer science departments of the University of California at its Berkeley and San Diego campuses, showed the number people who actually made a purchase following a spam pitch was just a fraction of a percent.
Those researchers infiltrated the Storm botnet, a network of hacked computers used to send spam.
They monitored three spam campaigns, in which more than 469 million e-mails were sent. Of the 350 million messages pitching pharmaceuticals, 10,522 users visited the advertised site, but only 28 people tried to make a purchase, a response rate of .0000081 percent. Still, that rate is high enough to potentially generate up to $3.5 million in annual revenue, they concluded.
MAAWG's survey showed that nearly two-thirds of the 800 polled felt they were somewhat experienced in Internet security, a highly complex field even for those trained in it, said Michael O'Reirdan, chairman of MAAWG's board of directors.
And some 80% of people felt their machine would never be infected with a bot, or a piece of malicious software that can send spam, harvest data and do other harmful functions. That's dangerous, O'Reirdan said.
"If you don't believe you aren't going to get one, you aren't going to look for one," he said. "If you get a bot, you're a nuisance to other people."
Interestingly, 63% of consumers said they would allow remote access to their computer to remove malware. That idea is under increasing discussion in the security community, which is grappling with how to deal with botnets. Botnets can also conduct denial-of-service attacks against Web sites, such as the ones attacked last week in South Korea and the U.S.
Some ISPs are building automated systems that can cut off a computer's Internet access if the machine is suspected of containing malware. Consumers are then given instructions on how to patch their machine and install security software. When their PC is clean, they are restored full access to the Internet. MAAWG is close to issuing a set of guidelines for ISPs on how to battle botnets.
"The best thing a user can do is patch their machine religiously," O'Reirdan said. "It's incredible easy to do."
RISK : SPAM BOT for 3G Phone
RISK : SPAM BOT for 3G Phone
Zombies bite into Symbian smartphones
Low-risk mobile Trojan bundles botnet features
By John Leyden
16th July 2009
http://www.theregister.co.uk/2009/07/16/mobile_trojan/
Security researchers have identified the first known spam bot client for 3G phones.
YXES-B poses as a legitimate application called Sexy Space (ACSServer.exe) to steal the subscriber, phone, and network information of victims. The malware forwards these details to a site under hacker control.
The same site contains message clips that form the template to send spammed SMS messages to the victims' contacts.
The malware therefore has a command and control infrastructure that makes it a botnet for mobile phones, according to Trend Micro, the security software firm.
The code-signing process applied by Symbian is designed to enure that threats like YXES-B never meet the light of day. Hackers have subverted this process for a second time - YXES-B was proceeded by an earlier variant. It it's unclear how they have done this
The damage potential posed by the malware is quite high. Fortunately, incidents of actual infections remain low.
More details on the threat can be found in a write-up from Trend Micro here http://blog.trendmicro.com/signed-malware-coming-to-a-phone-near-you/#ixzz0LLLdJHN9&D
PROFESSIONAL : Cyber Criminals using Business School Teachings
PROFESSIONAL : Cyber Criminals using Business School Teachings
Cyber crime lords using big business tactics:Cisco
PHYSorg.com / AFP
14 Jul 2009
www.physorg.com/news166817806.html
Cyber criminals are aping executives when it comes to sales, marketing and risk management in the world of online treachery, according to a report released by networking giant Cisco.
"A lot of techniques they are using today are not new; it is really about how they may be doing some of the same old things," said Cisco chief security researcher Patrick Peterson.
Cyber criminals are aping executives when it comes to sales, marketing and risk management in the world of online treachery, according to a report released by networking giant Cisco.
"A lot of techniques they are using today are not new; it is really about how they may be doing some of the same old things," said Cisco chief security researcher Patrick Peterson.
"The novel thing is that they have taken the Harvard Business School, General Electric board room
business training and applied it to their old techniques."
The California technology firm specializing in computer networking gear summarized current threats in a "Midyear Security Report" that concludes hackers are increasingly operating like successful businesses.
Peterson cited how cyber hackers capitalized on interest in the death of pop icon Michael Jackson in late June.
Disasters, celebrity doings and other major news is routine fodder for bogus emails and websites
booby-trapped with computer viruses, but in the case of Jackson's death, crooks cranked out fake news stories to dupe readers.
"They had their criminal copy editors working on copy for the story as fast as it happened," Peterson said.
"They brought the Jackson story to market in a way that rivals media outlets. They have an advantage; they don't have to do any reporting."
Billions of spam messages with links to trick websites or videos promising scintillating Jackson images and information were fired off in the days after his June 25 death, according to Cisco.
"Sales leads" that followed online links were turned into "customers," whose computers were stealthily infected with nefarious codes for stealing data, usurping control of machines or other evil deeds.
Cyber criminals are reportedly embracing a nefarious version of a "cloud computing" trend of offering
computer applications online as services.
Commanders of infected computers woven into "botnet" armies rent out illegally assembled networks to fellow criminals for sending spam, launching attacks or other deeds, according to Cisco.
Peterson told of an "anti-anti-virus" online operation called "Virtest" that charges hackers monthly fees to keep them informed about which security firms can detect their malicious programs.
"It's a criminal service," Peterson said of the operation, which appears to be based in Russia. "We've seen lots of examples of criminals sharing tools, but we've never seen a commercial business like this."
Spammers also employ a business marketing practice of packing booby-trapped websites with terms
typically used as keywords in various Internet search engines so that their links land high in query results.
Cisco referred to the practice as "Spamdexing."
"Because so many consumers tend to trust and not be suspicious of rankings on leading search engines, they may readily download one of the fake software packages assuming it is legitimate," Cisco said in the report.
Cyber crooks are also hunting for prey in the rapidly expanding population of mobile telephone users by sending trick text messages.
Criminals have taken to sending blanket text messages to numbers based on area codes of local banks directing people to call into a service center to address supposed concerns about their accounts.
Callers are connected to automated voice systems that, feigning to represent the banks, ask people to enter account passwords and other personal information that can later be exploited, Peterson said.
Online social networks, according to Cisco, are becoming popular "customer acquisition" territory for cyber criminals.
"It's big business now to penetrate those networks," said Peterson.
People in online communities are more likely to click on links and download content they believe is from people they know and trust, the report said.
BEWARE : Hacker Hacked Twitter – Stolen Secret Documents
BEWARE : Hacker Hacked Twitter – Stolen Secret Documents
By Maggie Shiels
Technology reporter
BBC News
2009/07/16
http://news.bbc.co.uk/go/pr/fr/-/2/hi/technology/8153122.stm
The microblogging service Twitter has been terribly hacked. Twitter is taking legal advice after hundreds of documents were hacked into and published by a number of blogs.
TechCrunch has made public some of the 310 bits of material it was sent.
It posted information about Twitter's financial projections and products.
"We are in touch with our legal counsel about what this theft means for Twitter, the hacker and anyone who accepts...or publishes these stolen documents, " said Twitter's Biz Stone.
In a blog posting he wrote that "About a month ago, an administrative employee here at Twitter was targeted and her personal email account was hacked.
"From the personal account, we believe the hacker was able to gain information which allowed access to this employee's Google Apps account which contained Docs, Calendars and other Google Apps Twitter relies on for sharing notes, spreadsheets, ideas, financial details and more within the company."
Mr Stone, Twitter's co-founder, went on to stress that "the attack had nothing to do with any vulnerability in Google Apps".
He said this was more to do with "Twitter being in enough of a spotlight that folks who work here can be a target".
In his blog post, Mr Stone underlined the need for increased online security within the company and for staff to ensure their passwords are robust.
It is believed a French hacker who goes by the moniker "Hacker Croll" illegally accessed the files online by guessing staff members' passwords.
"News value"
A number of technology blogs were offered the documents for publication in what is now being dubbed "Twittergate" in some online forums.
TechCrunch, one of the most respected blogs in Silicon Valley, has set off a firestorm of criticism and debate over its decision to post some of the material.
It started things off with what it called a "softball" and published details about a reality TV show involving Twitter. Details of such a programme were made public in May.
That was followed by documents relating to an internal Twitter financial forecast that the company said is no longer accurate.
"There is clearly an ethical line here that we don't want to cross, and the vast majority of these documents aren't going to be published, at least by us.
"But a few of the documents have so much news value that we think it's appropriate to publish them," wrote TechCrunch Editor and founder Michael Arrington
Mr Arrington noted the site received a deluge of comments on the issue and said "many users say this is "stolen" information and therefore shouldn't be published. We disagree.
"We publish confidential information almost every day on TechCrunch. This is stuff that is also "stolen," usually leaked by an employee or someone else close to the company."
The TechCrunch founder cited examples of stories it has covered in the past that involved information it had acquired and also those covered by newspapers like the Wall Street Journal that had done a similar thing.
Mr Arrington said that he has also consulted lawyers about the laws that cover trade secrets and the receipt of stolen goods.
"Embarrassing"
Many in the technology industry said this latest episode points to the potent reminder of how much information is stored in the cloud and the vulnerability or otherwise of that data.
The hacker has claimed to have wanted to teach people to be more careful and in a message to the French blog Korben, wrote that his attack could make internet users "conscious that no one is protected on the net."
"The security breach exploited "an easy-to-guess password and recovery question, which is one of the simplest ways to make a username and password combination really insecure," said Phil Wainewright of ZDNet.com
"Unfortunately, users won't wise up until the cloud providers force them to."
In a study last year the security firm Sophos found that 40% of internet users use the same password for every website they access.
The affair has put Google on the defensive because the information was stored in Google Apps, an online package of productivity software that includes email, spreadsheets and calendars.
The company issued a blog post. While it highlighted the need for strong security, it said it could not discuss individual uses or customers.
Twitter's Mr Stone tried to play down the importance of the information being touted around the web.
"Obviously, these docs are not polished or ready for prime time and they're certainly not revealing some big, secret plan for taking over the world.
"This is "akin to having your underwear drawer rifled: Embarrassing, but no one's really going to be surprised about what's in there." That is an apt apology," Mr Stone said.
At the social media blog Mashable, Adam Ostrow agreed.
"It's another embarrassing moment in Twitter's torrid growth, but nothing that's likely to bring the house down."
Also see -
Tech Crunch’s posting-
http://www.techcrunch.com/2009/07/14/in-our-inbox-hundreds-of-confidential-twitter-documents/
Twitter’s response
http://blog.twitter.com/2009/07/twitter-even-more-open-than-we-wanted.html
Subscribe to:
Posts (Atom)
