Live truth instead of professing it.
Elbert Hubbard
5 hours ago
WISH YOU A HAPPY AND SECURE YEAR 2009
Friday, January 30, 2009
New IT Term of the day
New IT Term of the day
Turing Number
Abbreviated as TN, turning number is a randomly generated security code, usually a series of digits, displayed as an image that users may need to read and copy into a form field in order to submit or validate a form submission online via a Web browser. Turing numbers are used to ensure there is a human user instead of automated (bot) submissions. Turing numbers are commonly used on e-commerce Web sites or promotional or contest Web sites —anywhere there is a need to avoid automated submissions by bots.
The 7 dirty secrets of the security industry
MIRROR : The 7 dirty secrets of the security industry
By Joshua Corman
Network World
January 27, 2009
http://www.networkworld.com/news/tech/2009/012809-tech-update.html
Do you ever get the feeling your security providers are failing to tell you the whole truth? We entrust the industry to protect us from unacceptable risk. But we must confront the underlying truth: The goal of the security market is to make money.
Here are the seven dirty secrets of the security industry and practical ways to command honesty from your trusted security providers.
- Antivirus certification omissions. The dirtiest secret in the industry is that, while antivirus tools detect replicating malicious code like worms, they do not identify malcode such as nonreplicating Trojans. So, even though Trojans have been around since the beginning of malicious code, there is no accountability in antivirus certification tests. Today Trojans and other forms on nonreplicating malcode constitute 80% or more of the threats businesses are likely to face. Antivirus accountability metrics are simply no longer reflective of the true state of threat.
- There is no perimeter. If you still believe in the perimeter, you may as well believe in Santa Claus. That isn't to say there is no perimeter. But we need to define what the perimeter is. The endpoint is the perimeter, the user is the perimeter. It's more likely that the business process is the perimeter, or the information itself is the perimeter too. If you design your security controls with no base assumption of a perimeter, when you have one you are more secure. The mistake we tend to make is, if we put the controls at the perimeter, then we will be fine. For many threats, we couldn't be more wrong.
- Risk management threatens vendors. Risk management really helps an organization understand its business and its highest level of risk. However, your priorities don't always map to what the vendors are selling. Vendors focus on individual issues so you will continue to buy their individual products. If you don't have a clear picture of your risk priorities, vendors are more than happy to set them for you. Trusted security partners will provide options for assessing your risk posture and help you develop plans to make the most security impact for the least cost and complexity. Security needs to conform to and support your business priorities. Too often, vendors want your business to conform to their portfolio.
- There is more to risk than weak software. The lion's share of the security market is focused on software vulnerabilities. But software represents only one of the three ways to be compromised, the other two being weak configurations and people. The latter is the largest uncovered area of risk. This is malicious code that doesn't leverage a vulnerability but rather leverages the person. For example, downloading a dancing skeleton for 'a spooky good time' (this was a trick employed by Storm), social engineering, spear phishing, etc. While we still need to find vulnerabilities and patch them, we must understand that an organization is only as strong as its weakest link. And more attention needs to be paid in mitigating the other two ways beyond software.
- Compliance threatens security. Compliance in and of itself is not a bad thing. But, compliance in and of itself does not equal security. At the very least it's a resource and budget conflict, and it splits our focus. Compliance is supposed to raise the minimum standard of security, but it just gets us to do what we are required to do and nothing else.
What's more, that which is easy to measure is not necessarily that which is most valuable. So if there were 15 software vulnerabilities last month, we can measure that 12 of them have been patched. It is much harder to measure how effective end user training was to make administrators immune to social engineering attacks. The lesson is you need to be compliant, but your entire risk strategy cannot be based on it.
- Vendor blind spots allowed for Storm. Storm is being copied and improved. The Storm era of botnets is alive and well, nearly two years from when it first appeared. How is this possible? 1. Botnets thrive in the consumer world where there is little money for innovation, a fact Storm and its controllers know. They are making money off of everything from spam to pump-and-dump stock scams. 2. They eat antivirus for breakfast. A lot of the techniques and innovations used by Storm are not new; they are just being leveraged artfully against the blind spots of antivirus certifications and antivirus vendors. 3. Malcode does not need vulnerabilities. Most of the Storm recruitment drives have leveraged social engineering and play off of a holiday or sporting event.
- Security has grown well past "do it yourself". Technology without strategy is chaos. The security market is often far too focused on the latest hot box or technology. The shear volume of security products and the rate of change has super-saturated most organizations and exceeded their ability to keep up. Organizations realize only a fraction of the capabilities of their existing investments. Furthermore, the cost of the product is often a fraction of the cost of ownership. There was a time when you could "do it yourself." But the simple days of Virus meets Antivirus are long gone. Highly effective organizations are embracing professional and managed security services to extend and augment their in-house expertise. By focusing your in-house expertise on what you know best -- your business -- scale comes from teaming with third-party expertise. This will be increasingly necessary in these tough economic times.
The primary goals for executives over the next few years is to cut cost and reduce complexity. Today we are seeing a massive convergence in the security market. There are only going to be a few large players left and a bunch of smaller players. Will consolidation lead to better efficiency, or will it lead to vendor lock-in?
As executives simplify, they will face many choices. Simply reducing vendors may fail to balance cost, complexity and risk. Vendors have a responsibility in this equation and must rise to the challenge. True risk management can show where to prune solutions, but the key is risk driven, responsible simplification.
Ex-Fannie Mae worker charged with planting virus
TROJAN : Ex-Fannie Mae worker charged with planting virus
By Freeman Klopott
Examiner Staff Writer
January 29, 2009
A fired Fannie Mae contract employee allegedly placed a virus in the mortgage giant’s software that could have shut the company down for at least a week and caused millions of dollars in damage, prosecutors say.
Rajendrasinh Makwana, an Indian citizen, was indicted Tuesday on computer intrusion charges. The former Gaithersburg resident is out on $100,000 bail, court documents said.
Makwana was fired from his contract position at Fannie Mae on Oct. 24 for changing computer settings without permission from his supervisor, FBI agent Jessica Nye wrote in a sworn statement. He had worked at Fannie Mae for three years as a computer engineer at the Urbana offices, where he had full access to all of the federally created mortgage company’s 4,000 servers. Before leaving work Oct. 24, Makwana allegedly tried to hide a code in server software that was set to activate the morning of Jan. 31, the agent wrote.
“Had this malicious script executed, [Fannie Mae] engineers expect it would have caused millions of dollars of damage and reduced if not shutdown operations at [Fannie Mae] for at least one week,” Nye wrote. “The total damage would include cleaning out and restoring all 4,000 of [Fannie Mae’s] servers, restoring and securing the automation of mortgages, and restoring all data that was erased.”
A spokeswoman for Fannie Mae declined to comment.
According to Nye’s statement, a senior computer engineer discovered the virus Oct. 29. The malicious code was hidden after a blank page, and “it was only by chance” that the senior engineer scrolled down and found the virus, Nye wrote. The engineer locked down Fannie Mae’s servers to determine whether other viruses were hidden inside and where the virus had come from, Nye wrote. Only about 20 Fannie Mae employees and contractors, including Makwana, had access to the server where the virus was stored.
An Internet Protocol address was eventually linked to Makwana’s company-issued laptop, Nye wrote. He was arrested Jan. 7.
The virus was set to execute at 9 a.m. Jan. 31, first disabling Fannie Mae’s computer monitoring system and then cutting all access to the company’s 4,000 servers, Nye wrote. Anyone trying to log in would receive a message saying “Server Graveyard.”
From there, the virus would wipe out all Fannie Mae data, replacing it with zeros, Nye wrote. Finally, the virus would shut down the servers.
Since the virus’s discovery, engineers have double-checked the servers and found no evidence of other malicious codes, Nye wrote.
Makwana’s attorney, Christopher Nieto, did not return calls Wednesday.
DDoS attack boots Kyrgyzstan from net
CYBER-WAR : DDoS attack boots Kyrgyzstan from net
Russian bears blamed
By Dan Goodin in San Francisco
28th January 2009
http://www.theregister.co.uk/2009/01/28/kyrgyzstan_knocked_offline/
The central Asian republic of Kyrgyzstan was effectively knocked offline for more than a week by a Russian cybermilitia that continues to flood the country's internet providers with crippling data attacks, a security expert said.
The attacks, which began on January 18, bear the signature of pro-Russian nationalists believed to have launched similar cyber assaults on the republic of Georgia in August, said Don Jackson, a researcher with Atlanta-based security provider SecureWorks. The attacks on Kyrgyzstan were so potent that most net traffic in and out of the country was completely blocked during the first seven days.
Over the past 48 hours, ISP have managed to mitigate some of the damage by relocating the servers of their biggest customers to different IP address ranges and employing a technique known as source filtering, which is designed to block harmful traffic while still allowing friendly packets through. Some media organizations and government opposition groups in the country of 5.3 million have not been so fortunate.
"If you're still one of those online media sites or you're still one of the targets by domain names, it's going to be hit or miss," Jackson told The Register. "A lot of the web services are still unavailable."
Representatives from Kyrgyzstan Domain Registration Service (http://www.domain.kg/) and a service known as www.ns.kg (http://www.ns.kg/) didn't respond to emailed requests for comment. The two services carry about 80 percent of the country's traffic, Jackson said.
The attacks are the latest example of geopolitical disputes spilling into cyberspace, a trend that's been growing in the past few years. Web and email traffic in Estonia came to a standstill in May of 2007 after civil unrest over that country's removal of a Soviet-era memorial was accompanied by attacks on the Baltic nation's internet infrastructure. Attacks on websites belonging to the Georgian government, on Radio Free Europe and cable television network CNN by Chinese hackers follow a similar pattern.
So-called distributed denial of service (DDoS) attacks, which flood a victim with so much malicious data it is unable to respond to legitimate requests, aren't the only weapon in the arsenal of politically motivated hackers. The Israeli Defense Force recently paid a Texas company that specializes in search engine optimization to halt the online backlash generated by its military action in Gaza.
Researchers from Arbor Networks, which monitors worldwide internet traffic for attacks and other anomalies, said they weren't seeing any malicious traffic directed toward Kyrgyzstan. Arbor's Jose Nazario said that was most likely because of a "visibility issue" resulting from the company "not tracking the right botnets."
The culprits in the attacks on Kyrgyzstan are most likely a group of technically capable Russian citizens recruited by Russian officials, Jackson said. The vast majority of the drones that are bombarding the Kyrgyz targets are located in Russia. The geographic concentration makes source blocking a more effective countermeasure than when the bots are scattered throughout the world.
Jackson speculated the attacks are designed to silence opponents of Kyrgyz President Kurmanbek Bakiyev, who are demanding the leader reverse his plans to close an airbase to the US military in its war in Afghanistan. The Russian government wants the base closed, Jackson said.
Indian embassy website serving malware in Spain
HACKED : Indian embassy website serving malware in Spain
Ad ranking scam or massive malware attack?
By John Leyden
29th January 2009
The compromise of legitimate websites with hostile code ultimately designed to serve up malware onto the PCs continues apace, with the latest victims including the Indian embassy in Spain.
Security researchers Ismael Valenzuela* and later Dancho Danchev* discovered that the the Indian Embassy in Spain was serving malware through an injected malicious iFrame.
The assault represents a rare but not unprecedented assault on diplomatic immunity by hackers. Previous victims of embassy malware attacks in the past include the US Consulate in St Petersburg, The Netherlands Embassy in Russia and the Ukraine Embassy Web site in Lithuania.
Analysis of the Indian Embassy assault by Trend Micro* revealed that the attack was part of a wider code injection push that's either an "advertisement scam or a massive malware attack in its early stages".
The code inserted into the compromised websites injects pages that look like blog entries into the compromised sites' domain, linking to illicit pharmaceutical websites. The purpose of the attack could be either to raise the search engine ranking of malvertised websites or a plot to use the legitimate domains of the compromised websites in order to evade spam filters.
Since the websites involved are already compromised, simply modifying tags would turn the seemingly "non-malicious" injection of code into a full-blown malware attack, Trend Micro warns.
In other separate examples of code injection attacks, the Times of India website was infected by malicious code identified by Sophos as Badsrc-C. The Russian Pravda website has also become infected with malicious scripts, Sophos reports, but fortunately this is not pointing at a website currently serving up further malware.
Circumstantial evidence suggest the three attacks are only related via the use of similar techniques.
"The three attacks are directing people to different malign sites using techniques such as SQL injection, to plant code of legitimate sites left open to attack," explained Graham Cluley, senior technology consultant at Sophos.
* Get details at -
http://ddanchev.blogspot.com/2009/01/embassy-of-india-in-spain-serving.html
and
and
http://blog.trendmicro.com/embassy-site-attack-reveals-other-compromised-sites/
Subscribe to:
Posts (Atom)
