IT wary of insider attacks as economy slows down

By JAIKUMAR VIJAYAN, IDG

 

About a year ago, a senior manager at Pilz GmbH left the company to work at a rival firm -- and took some classified data about an unfinished vision-based camera safety system with him.

 

If it hadn't been for the honesty of executives at the rival business, more than five years of research and development work would have gone down the drain, said Steve Farrow, managing director at Pilz, which is in Ostfildern, Germany. "It would have impacted our product development and allowed one or two competitors to catch up with us much more quickly," he said. Farrow didn't identify the rival company.

 

The incident is a classic example of the threat rogue insiders pose to your data and systems at any time. But as the faltering economy forces companies to turn to job cuts, wage and bonus freezes, outsourcing and other belt-tightening moves, the risks are multiplying, analysts said.

 

"All of these [cost-cutting measures] increase risk for the company from an insider perspective," said Shelley Kirkpatrick , director of assessment services at Management Concepts Inc., a consulting firm in Vienna, Va. "When there is uncertainty, it creates stress for employees [and] makes the company more vulnerable."

 

Thus, corporate executives must be very vigilant, especially today, in learning what warning signs to look for and how to respond to them, said Matt Doherty , a senior vice president at Hillard Heintze LLC, a Chicago-based security consulting firm.

 

Red flags could include an employee who suddenly starts working long hours for no obvious reason, or someone seeking access to systems and information not needed in his job. IT managers should also be on the lookout for employees who print out large volumes of data after hours or who send information to themselves via e-mail.

 

Doherty also said it's important that companies train supervisors to spot distressed employees. "It's critical for a supervisor to be aware of the employees -- who they are and what's going on in their lives. It's really about keeping a finger on the pulse," he added.

 

Kirkpatrick suggested that companies set up a cross-functional team consisting of IT, human resources, corporate security, legal and operations department managers to quickly deal with potential insider attacks.

 

"There are [often] warning signs. But they are not always listened to," she said.

 

Ted Julian , vice president of marketing at Application Security Inc., a New York-based vendor of security tools, added that companies should have controls to monitor privileged user activity to make sure managers and technology professionals with elevated access rights don't "rob you blind." "Some sort of monitoring on your most sensitive systems is a must," he said.

 

Several recent incidents show that the threat of data theft from insiders with privileged access should not be underestimated.

 

In July, Terry Childs, a disgruntled administrator working for the city of San Francisco, locked access to a critical network by resetting administrative passwords to its switches and routers. After he was caught, Childs refused to divulge the passwords for days.

 

In a similar incident last fall, Yung-Hsun Lin, a Unix systems administrator at Medco Health Solutions Inc. in Franklin Lakes, N.J., planted a logic bomb on an internal system that would have deleted data on 70 servers if it had gone off. Lin had feared he was going to be laid off from the health care provider.

 

Farrow noted that last year's theft of confidential data at Pilz was not an isolated incident -- the company was victimized by insiders at least two other times over the past couple of years. In one incident, minutes from a confidential board meeting were leaked to a major competitor, Farrow said.

 

The maker of automation technology has since deployed an enterprise rights management tool from Waltham, Mass.-based Liquid Machines Inc. to better limit access to confidential documents and control how that data can be used.

 

Analysts said that unless IT managers further beef up their defenses, such incidents are likely to continue.

 

This version of this article originally appeared in Computerworld's print edition.

 

 

Offense must drive IT defense

10/27/08

By Wyatt Kash

Agencies seeking to secure federal information systems should use attack-based metrics as one of several approaches to reduce vulnerabilities and better manage risks, according to a group of government and industry officials.

 

Escalating threats to agencies’ information systems continue to put pressure on the government to find better ways to manage risks. But of three core factors commonly associated with determining risk assessments — threats, vulnerability and impact — the only factor that can really be managed and reduced is vulnerability, said Alan Paller, director of research at the SANS Institute.

 

Current government guidance on assessing information system security leaves too much room for interpretation, which in turn breeds uncertainty, said Paller, who was a member of a panel on managing risks at the American Council for Technology and Industry Advisory Council’s Executive Leadership Conference in Williamsburg, Va., today.

 

“Uncertainty causes wasteful wars between inspectors general and chief information officers,” Paller said.

 

He said a better approach would borrow banking-industry measures that deal with many of the same information technology security concerns. Specifically, Paller recommended that agencies:

 

    * Engineer to block against known attacks.

    * Buy systems that have embedded security.

    * Continually monitor and fix vulnerabilities to known attack vectors.

    * Monitor new attacks that highlight critical vulnerabilities on a daily basis.

    * Find innovative ways to block new attacks.

    * Automate to make old defenses inexpensive to maintain and direct spending to more important issues.

    * Ensure business continuity and effective incident response.

 

However, to be successful, agencies have to embrace the notion that “defense must be informed by offense,” Paller said. They must staff IT security teams with people who have dealt with cyberattacks, and those teams need to focus on attack-based metrics when prioritizing response measures, he added.

 

Agencies have a long way to go to get to that point, he said, citing a recent estimate that at a typical agency, “70 percent of the [IT security] staff has soft skills, [and] only 30 percent have specialized security skills.” We need to reverse that ratio, he added.

 

Paller was followed by a group of panelists that included Sallyanne Harper, chief financial officer and chief administrative officer at the Government Accountability Office; Cathleen Berrick, director of GAO’s Homeland Security and Justice Team; Karen Evans, administrator of e-government and IT at the Office of Management and Budget; Gregory Friedman, inspector general at the Energy Department; and Erik Hopkins, a member of the professional staff of the Senate’s Homeland Security and Governmental Affairs Committee.

 

Among other measures, panelists recommended that agencies improve their risk management efforts by:

 

    * Completing the transition to having government desktop computers fully compliant with the Federal Desktop Core Configuration. “Offense has to know what the environment is to work on the defense,” one panelist said.

    * Tapping the expertise of GAO analysts and IGs who have had the opportunity to see and share best practices in risk management.

    * Expanding the discipline of risk management through training and exposure to commercial experts.

    * Including the people actively involved in cybersecurity in high-level decision-making circles.

    * Being careful not to become paralyzed by fear of risk in the process of mitigating vulnerabilities.

In case you missed it…

 

"World Bank Under Cyber Siege in 'Unprecedented Crisis'

 

The World Bank Group's computer network — one of the largest repositories of sensitive data about the economies of every nation — has been raided repeatedly by outsiders for more than a year, FOX News has learned.

 

It is still not known how much information was stolen. But sources inside the bank confirm that servers in the institution's highly-restricted treasury unit were deeply penetrated with spy software last April. Invaders also had full access to the rest of the bank's network for nearly a month in June and July.

 

In total, at least six major intrusions — two of them using the same group of IP addresses originating from China — have been detected at the World Bank since the summer of 2007, with the most recent breach occurring just last month.

 

In a frantic midnight e-mail to colleagues, the bank's senior technology manager referred to the situation as an "unprecedented crisis." In fact, it may be the worst security breach ever at a global financial institution. And it has left bank officials scrambling to try to understand the nature of the year-long cyber-assault, while also trying to keep the news from leaking to the public.

 

The crisis comes at an awkward moment for World Bank president Robert Zoellick, who runs the world's largest and most influential anti-poverty agency, which doles out $25 billion a year, and whose board represents 185 member nations. This weekend, the bank holds its annual series of meetings in Washington — and just in advance of those sessions, Zoellick called for a radical revamping of multilateral organizations in light of the global economic meltdown.

 

Zoellick is positioning himself and the bank as an institution that can help chart a new path toward global financial stability. But that reputation, more than ever, depends on the bank's stable information infrastructure.

 

The fact that the information vaults of the World Bank have been repeatedly pried open won't help Zoellick's case.

 

While it remains unclear how much data has been pilfered from the bank, it's a lot. According to internal memos, "a minimum of 18 servers have been compromised," including some of the bank's most sensitive systems — ranging from the bank's security and password server to a Human Resources server "that contains scanned images of staff documents."

 

One World Bank director tells FOX News that as many as 40 servers have been penetrated, including one that held contract-procurement data.

 

Despite the gravity of the break-ins, the bank is trying hard to pretend to outsiders it didn't happen. "There were attempts to hack the bank's computer systems last summer," says a World Bank spokesman. "However, there was no compromise of confidential information." Requests for on-the-record interviews with Zoellick and other top officials were declined.

 

Meanwhile, the bank's treasurer, Kenneth G. Lay, has been briefing Zoellick's senior management team regularly on the situation since April.

 

Other bank officials are also sleuthing. The bank's chief information officer, Guy De Poerck, has engaged Price Waterhouse Coopers to do a confidential million-dollar assessment that is expected to tell him what's going on in his own department. And a 22-page internal report by a computer security company named MANDIANT, dated August 18, fleshes out many details of the June-July breaches. But very few people have ever seen the report, and nobody has been permitted to retain a paper copy.

 

At the same time, De Poerck has been downplaying the problem to the bank's 10,000 rank-and-file staffers as mere intrusion "attempts" in his e-mails. Yet most of those staffers have been asked to change their password three times in the past three months.

"As previously reported in mid-July," CIO De Poerck and a senior bank treasury official wrote in an August announcement to employees, "we would like to reassure you that there is no evidence that Bank staff personal information is at risk from the recent external attempts."

 

It's unclear how that statement squares with an internal memo to De Poerck a month earlier revealing that a sensitive Human Resources server "that contains scanned images of staff documents" had been successfully breached. De Poerk declined to comment to FOX News about any of these details.

 

In reality, the situation is serious enough that federal investigators have been called in. "We're not talking about hackers playing games or messing up our website," insists a senior member of the bank's IT department at its Washington headquarters. "It's about the FBI coming last summer and saying, 'You should take a look at your systems because we think something weird is going on.' It's about the intruders knowing what information they wanted — and getting to it whenever they wanted to. They took our existing data stores and organized them in a way that they could be easily accessed at will."

 

In plainspeak: "They had access to everything," says the source. "They had the keys to every room at the bank. And we can't say whether they still do or don't until we fully and openly address what's happening here."

 

The data raids are not a matter of stealing inconsequential bits and bytes. The World Bank's data center is literally a treasure trove of vital financial information from around the globe. As a clearinghouse for financial data from both governments and companies, the bank's computers could provide intruders with both a financial and intelligence gold mine — from inside information on bids and contracts to the minutes of confidential board meetings.

 

If the bank takes a position in a currency, for example, that currency usually moves in response to the bank's actions. Stocks and bonds can also swing up and down based on World Bank announcements. "If you know beforehand that the bank is going to put an order in for oil pipelines in Chad or healthcare systems in India, you can actually make a good amount of money," says one insider.

 

Although the bank typically provides only a fraction of the financing for a project, its influence on those projects is immense. Private corporations see the bank's stamp of approval as a guarantee that their own larger investments will be safe — and profitable. Knowing in advance what projects the bank's board will reject could be just as profitable.

 

Some insiders fear that contractors — perhaps even governments — might be seeking advance knowledge on the status of the bank's anti-corruption probes. "The bank knows the books of countries almost as well as the countries do — including the corruption at times," says one insider.

 

The first breach of the bank's secrets was discovered in September, 2007, after the FBI —while at work on a different cybercrime case — notified the bank that something was wrong. The feds pointed to a part of the bank's network that led out of the Johannesburg hub of the International Finance Corp. (IFC), a bank arm that lends to the private sector.

 

Within a week of the tip, teams of bank investigators sent to Johannesburg discovered that intruders had gained full and total access to all of IFC's worldwide information — including all incoming and outgoing e-mail — for at least six months. "They were downloading everything and anything," says one insider, who says that IFC's monitoring systems were extremely weak. "They [intruders] had full access."

 

Investigators discovered that the intruders were using a so-called "cluster" of IP addresses from Macao, China. But since those addresses can be spoofed (i.e., disguised) the discovery doesn't prove that the breaches actually originated in China. Nonetheless, bank officials and its executive director for China clashed behind closed doors over whether or not China's government is involved in the break-ins.

 

Bank sources tell FOX News that Johannesburg is one of several secret "hubs" containing a "common data store" (or CDS) that the World Bank Group has established around the globe. In layman's terms, a CDS is the cyber-world's version of a bomb shelter where every piece of an organization's data is replicated and backed up in case of a data-wipeout at headquarters in Washington. While it's known that IFC data was accessible at the hub, it remains unclear if all World Bank Group data was compromised there.

 

The second major breach — of the bank's treasury network in Washington — was discovered in April 2008. The World Bank's Treasury manages $70 billion in assets for 25 clients — including the central banks of some countries. It carries out substantial collaborations with the world's finance ministers on public wealth and debt management, runs an active bond-trading desk in Washington, and does everything from currency trading to capital markets financings.

 

After a forensic analysis of the treasury breach, bank investigators discovered that spy software was covertly installed on workstations inside the bank's Washington headquarters — allegedly by one or more contractors from Satyam Computer Services, one of India's largest IT companies.

 

The software — which operates through a method known as keystroke logging — enabled every character typed on a keyboard to be transmitted to a still-unknown location via the Internet.

 

Upon its discovery, insiders report, bank officials shut off the data link between Washington and Chennai, India, where Satyam has long operated the bank's sole offshore computer center responsible for all of the bank's financial and human resources information.

 

Satyam was also banned from any future work with the bank. "I want them off the premises now," Zoellick reportedly told his deputies. But at the urging of CIO De Poerck, Satyam employees remained at the bank as recently as Oct. 1 while it engaged in "knowledge transfer" with two new India-based contractors.

 

Satyam — one of the largest and most prestigious IT companies in India — is publicly listed on the NYSE and boasts having $2 billion in sales and more than 150 Fortune 500 companies as clients. In 2003, Satyam — it means "truth" in Sanskrit — won a much-heralded and lucrative five-year "sole source" contract to design, write and maintain all of the World Bank's information systems.

 

The contract — which began at $10 million and grew to more than $100 million by 2007 — was suddenly not renewed this year. Satyam so far declines to comment.

 

Then came the June-July breaches in Washington. They were similar to the Johannesburg attack, as the same group of IP addresses from Macao were used.

 

This time, however, the cyber-burglars used a different spyware. They broke into an external server run by the bank's private sector development unit. They were able to acquire passwords — including the password for the systems administrator.

 

That enabled them to jump into the servers at MIGA, the bank's giant insurance arm. It was there that they captured the security administrator's password as he was logging on to his computer.

 

It took ten days for bank officials to detect that they'd been invaded. Once they did, they shut down all external servers, except for e-mail — which it turns out the invaders were already using as their entrance point. By the end of July the invaders "had completely mapped out the topography of the bank's information systems," says one expert — "where everything was, the types of servers, and the types of files on the servers."

 

What the intruders did with all that information is the World Bank's most sensitive and painful mystery. It has clearly left the institution in a highly vulnerable position.

 

And the same may go for bank president Zoellick. Bank insiders say that he needs desperately to get the security of his own house in order. Despite the vast sums that the Bank spends on data and data storage, its information systems are deeply in disarray.

 

Today the total cost to maintain the bank's information infrastructure is at least $280 million per year. But according to one disgruntled bank staffer, "We don't even have an internal search engine that works."

 

The truly alarming fact, however, is that someone — or many people — seem to know their way around the bank's most valuable resource very well, even though they aren't supposed to be there at all.

 

UPDATE: After FOX News published its story, a World Bank spokesman issued the following statement:

 

"The Fox News story is wrong and is riddled with falsehoods and errors. The story cites misinformation from unattributed sources and leaked emails that are taken out of context.

 

"Like other public and private institutions, the World Bank has repeatedly experienced hacking attacks on its computer systems and is constantly updating its security to defeat these. But at no point has a hacking attack accessed sensitive information in the World Bank's Treasury, procurement, anti-corruption or human resources departments.""

October is National Cyber Security Awareness Month!

 

Each October, NCSA joins with the Department of Homeland Security’s National Cyber Security Division (NCSD), the Multi-State Information Sharing and Analysis Center (MS-ISAC), along with corporations, government agencies, nonprofits and the academic sector, to support National Cyber Security Awareness Month. This month-long series of programs is aimed at ensuring that home users, small businesses, educators, students and all Americans fully understand the importance and the urgency of safeguarding themselves while online.

 

Every day, cyber criminals employ social engineering tactics and evolving technologies to do harm via the Internet. Without even knowing it, some consumers and businesses are helping criminals carry out cyber attacks and online scams against other organizations and individuals. In a world that will only continue to become more connected and dependent on the Internet, we are working together to create a culture of cyber security and safety by providing the knowledge and tools necessary to help prevent cyber crime and cyber attacks.

 

We encourage everyone to take advantage of the materials, tools and information on our website and watch this blog for timely tips and information so that you can learn how to "Protect Yourself Before You Connect Yourself."

 

 

Phishing and the Economic Crisis

 

Criminals are opportunistic and prey on people's vulnerabilities. In tumultuous times, like the economic storm we are living through, criminals seek and seize new opportunities that are directly related to people's anxiety and tied to the current events of the day.

 

Phishing, the collection of personal information for criminal purposes by posing as a legitimate business, is no exception. The most common form of phishing is the fake email that looks exactly like an email you might get from your financial institution or other business.  They often seek immediate action to rectify a problem with your account and request you click through a link to fix it. The link is to a fake, or spoofed, website that looks like the real thing. When a logon name, password and any other information is entered, the cyber criminal has collected what they need to hijack an account.

 

True to form, cyber criminals engaged in phishing, were quick to tailor their scam approaches. Last week the Federal Trade Commission (FTC), one of the leading government agencies fighting phishing, issued an alert about phishing email that used the rapid consolidation of the banking industry and confusion about the mortgage market to try and snag unknowing consumers.

 

While you are at it, check out the FTC's On Guard Online, a great site to learn about tips to prevent fraud and protect your computer. There are many great features including videos and games.

 

Another new website with great information about phishing and protecting yourself was launched by Consumer Reports at the beginning of National Cyber Security Month.  Check out Consumer Reports' Guide to Online Security.

 

Take the time to get educated about phishing and other ways to protect yourself online.

New expert panel report suggests shifting control of corporate cyber infrastructures from IT departments to chief financial officers

 

A panel of business executives and policy experts laid out a road map for companies to mitigate the economic impact of cyber attacks. The report, titled "The Financial Impact of Cyber Risk: 50 Questions Every CFO Should Ask," was released by the American National Standards Institute and the Internet Security Alliance, and it builds on recommendations included in legislation that passed Congress after the 9/11 terrorist attacks that called for increased industry coordination to secure the nation's computer-based networks.

 

ISA President Larry Clinton said that as was the case with the economic turmoil, which stemmed from "a fundamental misunderstanding and mismanagement of modern financial systems," the country's critical infrastructures rely on cyber systems "that are also misunderstood and mismanaged." Two thousand copies of the report, which suggests shifting control of corporate cyber infrastructures from IT departments to chief financial officers, are being shipped to executives at major companies, Clinton said. In addition to offering fifty questions every CFO should ask, the guide offers charts to help calculate the probability and severity of financial loss from both risk events and the actions taken to mitigate them.

IT security during tough economic times

 

Tough economic times lead to layoffs and mergers and acquisitions; a key aspect of such transitions is the inevitable turnover and its impact on internal security

 

Tough economic times lead to an increase in layoffs, mergers and acquisitions. This increased activity could potentially weaken data security, but most security experts agree that large firms have the right procedures to follow to ensure security and data integrity in the event of a major shake up. As Claudiu Popa, president and chief security officer of data security vendor Informatica Corp. explains in a conversation with SearchSecurity that mergers and acquisitions force IT security pros to be more aware of internal threats. Popa outlines a strategy and some best practices to ensure data security and consumer trust during times of uncertainty. Here are two questions he was asked, and his responses:

 

SearchSecurity: What is the biggest challenge for companies facing a merger and acquisition (M&A) from a security prospective?

 

Claudiu Popa: M&A situations are one of the most sensitive times in the existence of a company. The risk to information assets during this time is increased by numerous factors such as different policies in effect, people, process inefficiencies, breakdowns in leadership and lax security controls. This kind of transitional period results in situations that can not only foster security breaches, but critically make them more difficult to detect. Any organization going through a merger or a sale must prepare for the transition by testing their business continuity plans, their incident response program and by verifying the security awareness level of their workforce.

 

Finally, a key aspect of such transitions is the inevitable turnover and its impact on internal security. Whether employees are disgruntled or simply feel that no one's watching, beefing up your security monitoring and reviewing employee agreements is an absolute must. Unfortunately, due to the numerous project and change management challenges involved, organizations and executives drop the ball on security on a regular basis. Part of the reason is that competent security consultants that offer this specific type of service are difficult to find. Look for a firm whose offerings include a standards-based approach to secure project management (SPM).

 

SearchSecurity: What's your take on data security for these financial firms going out of business and being acquired?

 

Popa: The types of fire sales and mergers we are seeing in the financial industry are a cause for serious concern because so much personal and financial data is changing hands on such tight deadlines that mistakes are likely being made every day. Customers of such firms should inquire with their own institution about the nature and amount of their personally identifiable information being stored there. It is also important for clients of these firms to scrutinize bank statements on a monthly basis to identify any security issues as soon as they occur. The unfortunate reality is that in situations where organizations change in such fundamental ways, information assets, which represent the vast majority of the company's value, are the first to be misplaced or stolen. Whether that information is ever used for fraud or other unauthorized purposes is very difficult to determine going forward.

If this bank would have used IDentiWall eBanking, non of this would have happened

 

"French President Sarkozy's bank account hacked

Small amounts of money disappeared from his account last month

Leo King

 

October 21, 2008 (Computerworld UK) Cyberthieves have stolen money from the personal bank account of France's president, Nicolas Sarkozy.

 

The criminals reportedly managed to obtain Sarkozy's online username and password, and removed several small sums of money from the account.

 

Reports state Sarkozy noticed that small amounts of money had disappeared from his account last month, and informed the police of the losses.

 

The French government has begun an investigation into the theft, according to French news agency AFP. Luc Chatel, secretary of state for consumer affairs, said: "An inquiry is under way, the President of the Republic has filed a complaint. ... We will see if there was fraud in a way in which the perpetrators can be sanctioned."

 

The French government needed "to reflect on how to improve the [Internet banking] system," he reportedly told French radio. At the time of writing, the French Elysée -- Sarkozy's office -- had not responded to a request for further comment.

 

The thieves may not have known that the account they had accessed was Sarkozy's, a source "close to the inquiry" told AFP. "This was a classic case of data piracy, likely by one or several low-level swindlers," the source said.

 

Sarkozy is the latest high-profile politician in recent weeks to fall victim to hackers. Last month, U.S. vice presidential candidate Sarah Palin's e-mail account was compromised.

 

Graham Cluley, senior technology consultant at security software firm Sophos PLC, said the latest incident demonstrated that politicians need to understand the potential danger of hackers accessing their PCs and stealing information.

 

"It shows that anyone working in a position of authority needs to make sure they have good PC security in place," he told Computerworld U.K. "They have sensitive information on their computers, even potentially embarrassing data, and they don't want it to become public."

 

There was no way of knowing yet how Sarkozy's accounts had been accessed, Cluley said, but asked whether keyloggers could have recorded his password as he typed it in, he said it was "possible."

 

For users to prevent themselves becoming a target, Cluley said, they need proper defense against spam, phishing and malware.

 

"The first step is to defend your computer with antivirus software, and in that way you can prevent keyloggers from grabbing your access details. You also need good antispam and antiphishing protection."

 

It was vital for people to use authentication devices, if sent to them by their banks, he said. These devices continually generate a random access number between the user and the bank, helping to reduce fraudulent access."

Researchers log keystrokes from afar

Snoops can detect slight electromagnetic radiation emitted from wired keyboards when key pressed, research suggests

Jeremy Kirk

 

October 20, 2008 (IDG News Service) Computer keystrokes can be snooped from afar by detecting the slight electromagnetic radiation emitted when a key is pressed, according to new research previewed on Monday.

 

Other security experts have theorized that keyboards were vulnerable to such detection, wrote Sylvain Pasini and Martin Vuagnoux, both doctoral students with the Security and Cryptography Laboratory at the Ecole Polytechnique Fédérale de Lausanne in Switzerland.

 

But Vuagnoux and Pasini believe theirs is the first set of experiments showing that such spying is feasible. They faulted cost pressures on keyboard manufacturers for not making keyboards more snoop-proof.

 

Keyboards "are not safe to transmit sensitive information," they wrote in an entry on the school's Web site. "No doubt that our attacks can be significantly improved since we used relatively inexpensive equipment."

 

The researchers tested 11 different wired keyboard models produced between 2001 and 2008, including some with USB connectors and keyboards embedded in laptops. All were vulnerable to one of four surveillance methods.

 

Two videos posted show two different experiments, both of which accurately picked up the typed text.

 

The first video shows a white Logitech keyboard with a PS/2 connector that was attached to a laptop for power. It was monitored with a simple 1-meter wire cable about a meter away. After typing "Trust no one" on the keyboard, the same phrase is returned on the researchers' monitoring equipment.

 

In a second video, a larger antenna picked up keystrokes through an office wall. All told, various experiments shows they could monitor keystrokes from as far as 20 meters away.

 

Vuagnoux and Pasini have written a paper that's currently in peer review detailing the technique. It will be released soon at an upcoming conference, they wrote.

 

Efforts to reach Vuagnoux and Pasini were unsuccessful.

Security industry falling behind the hackers

Report warns of new threats on the horizon

 

The hacking community is outpacing the security industry, and different sectors of the IT community need to work together more closely to narrow the gap, warns a new report from the influential Georgia Tech Information Security Center (GTISC).

 

A GTISC panel comprising members of the government, IT specialists and academics warned in its 2008 Emerging Cyber Threats Report (PDF) that existing systems are falling behind hacking techniques, which are becoming more popular and effective.

 

"The rapid rate of application development for these mediums has outpaced information security technology so far," the report concludes.

 

"While the emphasis on functionality over security may not change in 2008, GTISC expects collaboration between the security industry, carriers, ISPs, application developers and internet users to begin closing the security gap."

 

The report highlights five key areas that need addressing: botnets, Web 2.0 attacks, targeted messaging, telecommunications and RFID hacking.

 

The panel estimates that about 10 per cent of the world's computers are currently part of a botnet, and that the rate of infection is increasing. Such networks are increasingly being used for fraud, and the panel suggests that carriers must do more to integrate firewalls within IP subsystems to check the spread.

 

The emergence of Web 2.0 poses new threats to internet users, the report finds. Web developers need to be more security aware, and security technology needs to make better use of heuristics to identify and curtail suspicious activity.

 

"As the natural evolution of the web progresses from 1.0 to 2.0 and beyond, more content and code from multiple and varied sources will be housed together on the client side, creating a highly complex environment for security governance and protection," said Gunter Ollmann, director of security strategy at IBM Internet Security Systems.

 

"In 2008, expect to see underground organisations shift tactics and focus more on Web 2.0, particularly mashup technologies, leading to more abuses at the user end wherever possible."

 

Improvements in anti-spam technology have caused hackers to move towards more targeted messaging to steal data, according to the panel. As phishing sites get shut down faster these targeted messages will attempt to install permanent malware on users' computers to steal information directly.

 

The increasing convergence of communications systems and computing into voice over IP (VoIP) systems also poses new dangers. In one scenario the panel explained how a mass VoIP infection could be used to overload the 911 emergency phone system in a denial-of-service attack.

 

Finally RFID hacking is expected to take off in 2008. The report referred to existing RFID security as "extremely limited" and warned that hacking will become a major issue in 2008.

 

"In the early stages only the hacking elite could exploit Wi-Fi devices, but as the technology gained popularity and became standardised, the first generation of automated Wi-Fi hacking tools and instructions became available," the report stated.

 

"In the near future, GTISC expects mainstream exploit tools to enable less technical hackers to attack RFID technologies."

New ID Theft Rules Kick In Nov. 1

 

Once thought to apply only to large financial institutions, new federal Red Flag regulations to battle identity theft are raising questions among companies originally considered to be exempt. Rules not only require a written ID theft policy that identifies patterns and practices that lead to identity but also a plan action when the red flags drop.

 

The Nov. 1 deadline for new federal identity theft regulations requiring financial institutions and other creditors that provide financing is fast approaching. Known as FACTA (Fair and Accurate Credit Transactions Act), the rules require covered entities to re-examine their ID theft prevention policies and implement new procedures and business practices.

 

More specifically, FACTA requires a written ID theft prevention policy that includes polices that identify "patterns, practices or specific activities that could indicate identity theft," according to the FTC (Federal Trade Commission). Violators of the new rules can be subject to civil penalties of up to $2,500 per violation.

 

The new regulations – also known as Red Flag rules -- have long been thought to only apply to financial institutions such as banks, savings and loans, mortgage lenders and credit unions, but as the compliance deadline nears, SMBs (small and midsize businesses) are concerned the rules may also cover them. While clearly targeting financial institutions, the rules also cover "any person or business" that arranges for customer credit.

 

"A creditor includes anyone who regularly extends credit to their customers, but the definition is not limited to that and can be broader," said Frank Dorman, a spokesman for the FTC.

 

The agency defines a creditor as "any entity that regularly extends, renews, or continues credit; any entity that regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew, or continue credit."

 

A business alert issued by the FTC adds, "Accepting credit cards as a form of payment does not in and of itself make an entity a creditor."

 

When asked if the Red Flag rules apply to SMBs, Steve Neville, Entrust's director of identity products and solutions, replied, "Technically not, but it is a devilishly detailed question."

 

Neville said most companies that extend credit to customers are doing so through an intermediary such as GE Creditline. In that case, GE would assume responsibility for FACTA compliance. Companies that don't use intermediaries would be subject to the Red Flag rules.

 

The FTC added the Red Flag rules to FACTA in January. Businesses are required to define policies for recognizing red flags in identity verification. Typical red flags include discrepancies in address histories, fraud alerts on consumer reports, questionable use of Social Security numbers, credit freeze notifications and unusual patterns of customer activities.

 

Once those definitions are in place, companies are then required to define appropriate courses of action when a red flag drops.

 

The new Red Flag rules evolved over a long series of congressional hearings that sought to find the causes of identity theft, particularly phishing and pretexting, the practice of using false pretenses to obtain the telephone records of another person.

 

Pretexting gained widespread notoriety in 2006 when Hewlett-Packard admitted it used pretexting to obtain the personal telephone records of board members and the media as part of its efforts to investigate boardroom leaks. In addition to HP, the hearings revealed many companies were being duped into turning over personally identifiable customer data.

 

The FTC estimates that as many as 9 million Americans have their identities stolen each year.

Identity theft industry updates

Identity theft is Big Business - see Danger! Your identity is not secure. And each year it gets worse.

Top 10 Security Trends

When it comes to security flaps, the British government takes the 2007 prize. The personal records of about half the population of Britain were copied onto a CD, sent through the mail and lost. No encryption, no registered mail and no idea where they vanished to.

And that's one of the big trends in security.

1. Data Breaches Are on the Rise

"High-profile data breaches underscored the importance of data loss prevention technologies and strategies," says Oliver Friedrichs, director of security response at Symantec Corp. of Cupertino, CA. "Most breaches are due to physical loss of equipment. Theft or loss of computer or other data storage medium made up 46 percent of all data breaches."

2. The Introduction of Vista Provided Hackers with More Holes

About a year ago, Microsoft Vista made its debut. Just how quickly attackers were able to exploit it is evident in the fact that the company has already released 16 security patches.

"We have observed abuse of the driver signing process which can result in allowing malicious code such as a rootkit to load into the kernel without being signed," says Friedrichs.

3. Spam Has Reached Record Levels

Surprisingly, Symantec reports that spam was on a steady decline for the first half of the year. Unfortunately, it rebounded in June and hit an all-time high in October. This meant that 70.5 percent of all email was spam. Of that, image spam fell while PDF spam grew significantly. Greeting-card spam was a new annoyance, and was responsible for delivering the Storm Worm malware (also known as Peacomm).

"E-card spam had become particularly virulent and the trend continued for the latter part of 2007," says Friedrichs. "These evolved to include different hooks intended to lure users into following malicious URLs containing malware."

4. Professional Attack Kits Multiplied

The sophistication and degree of organization of modern day attackers is demonstrated by the fact that they have adopted methods similar to those used in traditional software development. The Mpack toolkit, for example, made a big splash during the year and phishing toolkits were also popular.

5. Phishing — More People Taking the Bait

Phishing continued to be big last year. Symantec reports an 18% increase in unique phishing sites.

"In September, we observed 18,424 unique phishing URLs," says Friedrichs . "Banks continue to be the most phished sector with 52% of these URLs spoofing financial institutions.

6. Trusted Brands are Being Exploited

Attackers have moved away from actively seeking out their intended victims. They prefer to wait for their targets to come to them by compromising trusted sites and applications. When someone visits that site or uses that application, the attacker gains entry to the victim's computer. Social networking sites, in particular, have proven a fruitful area for hackers because they give access to large numbers of people. Such sites are also prone to various other vulnerabilities.

7. Bots and Botnets Continue to Silently Slip onto Computers

Bots perpetrate a wide variety of malicious activity. Bots knocked Estonia off the online map, for instance, and the Storm Worm employed bot technology as well. Bots are became more of a menace in 2007, and 2008 will be no different.

8. ActiveX Gets X-Rated

ActiveX controls pose various security threats that continue to plague IT in 2007. Such threats cause problems with regard to availability, confidentiality and system integrity.

"Users should ensure that the security settings of their client browsers do not allow for scripting of ActiveX controls that are not marked safe for scripting," says Friedrichs. "The browser should prompt for ActiveX controls and deny downloading unsigned ActiveX controls."

9. Vulnerabilities for Sale

The best example was when Wabi Sabi Labi was introduced. It offered an auction-style system for selling vulnerability information to the highest bidder. The resulting controversy sparked much discussion about the ethics of such practices. Regardless of the rights and wrongs, look for more of this kind of activity in 2008.

10. Virtual Machine Security Implications

From a security perspective, the spread of virtualization has opened new doors for hackers to impact the enterprise.

"The speed and ease of provisioning and deploying virtual machines may lull people into complacency about considering proper security of the virtual machine and the environment into which it is deployed," says Friedrichs. "Most data center managers put a lot of thought into architecting the security of their systems and deployments, and the same care should be done for virtual machine configuration and deployment."

This article was first published on www.EnterpriseITPlanet.com.

Rival malware gangs wage turf war

 

Security researchers have uncovered evidence of a turf war between rival criminal enterprises connected to two of the most sophisticated malware toolkits in current use.

 

Like competing gangs in the Mafia - for those who followed the HBO series The Sopranos, think the New York-based Lupertazzi crime family and its sometimes enemy the DiMeo crime family, which Tony Soprano ran from New Jersey - the malware groups are fighting for turf and control.

 

But rather than clashing over who gets to skim money off a garbage collection contract or a major construction project, the cyber criminals are battling to own tens of thousands of compromised computers.

 

Enter the propagators of a piece of malware Symantec dubs trojan.Srizbi, one of a handful programs spread by the MPack attack kit. A trojan that makes infected computers part of a botnet that churns out spam, Srizbi is also known to uninstall competing spam malware being spread by another nasty piece of malware dubbed the Storm Worm.

 

"The Storm Worm criminals appear to have taken exception to that," says Lawrence Baldwin, a malware researcher who has recently observed Storm zombies DDoSing the server Srizbi uses to download installation files. Baldwin is unable to estimate how much traffic the Storm bots are sending to the Srizbi server, but he says attempts to get an infected machine in his lab to update the Storm malware makes him believe the attack is significant.

 

"All day we've been trying to make that work, and it's not happening," Baldwin said in an interview. "Whatever amount of activity they're shoving at those servers, it appears to be sufficient enough to prevent their downloader from getting a new version of the MPack spam malware."

 

The rival attack kits are examples of the strides criminals have made in developing highly sophisticated software that makes detection and eradication increasingly difficult.

 

In one camp is the MPack attack kit. Earlier this month, it became a force to be reckoned with after it enabled crooks to hijack more than 10,000 websites in just a few days. The kit is a professionally developed collection of back-end web components built on PHP that bundles together many different malware tools.

 

Among other things, it logs detailed information about the computers it attacks, including the IP addresses of machines it has infected and what exploits a particular user is vulnerable to. A gang in Russia is believed to sell the kit, according to Symantec.

 

Not to be outdone is the Storm Worm, which got its name after an early version of the malware spread through mass email promising information about winter storms that ravaged Northern Europe in January. Because Storm employs a Peer-to-Peer protocol, its command and control center is highly decentralized, making it difficult to shut down.

 

As we reported earlier, a recent version of the Storm trojan (technically, it's not a worm) comes disguised as an e-postcard but actually recruits zombies for a botnet. The malware is highly resourceful, scanning a victim machine first for a javascript vulnerability, and if that doesn't work, moves on to try one of three other exploits.

 

Only about 25 per cent of the anti-virus scanners detected the trojan when the SANS Institute's Internet Storm Center recently ran it through 30 different security programs.

 

According to Baldwin, who has acquired copies of the latest Storm trojan and has been observing it in his lab, the malware has been working overtime lately.

 

"We believe the same system we were running [and infected by the Storm Trojan] was simultaneously running the ecard scam and DDoSing competitors," he says.

Man-in-the-middle phishing kits circulating freely on the Web

Security vendor RSA is reporting an increase in the amount of free 'man-in-the-middle' phishing kits - designed to subvert bank two-factor authentication controls - circulating in the fraudster underground.

 

In its monthly online fraud report, the RSA FraudAction Intelligence team has highlighted a rise in the number of hacker repositories dedicated to providing free man-in-the-middle kits. The kits themselves target more than ten of the world's leading financial institutions, says the vendor.

 

The free kits are usually primed to send stolen user credentials to both the instigator of the fraud and the creator of the software.

 

The vendor first encountered demo kits for sale on the Web in January this year. It forecasts a sharp increase in man-in-the-middle attacks as the software becomes more widely available over the next twelve months.

 

American consumers lost more than $7 billion over the last two years to viruses, spyware, and phishing scams, according to a Consumer Reports survey released earlier this week.

Cybercriminals now plan raids like bank robbers

Targeted and organized profit-driven attacks - planned like bank raids - are replacing random individual hacker attacks and presenting increased threats for businesses and government, says the Information Security Forum (ISF).

This new breed of attacks, designed to steal valuable and sensitive information or customer data for major financial gain are being orchestrated by criminal networks that bring together specialist skills and expertise, the ISF said.

Many criminal networks even place sleepers within organizations to provide inside knowledge and access.

According to the ISF, profit-driven attacks have five phases: reconnaissance to identify targets, development to plan the attack and write malware, extraction of the data, exploitation by advertising and selling stolen information, and finally the laundering of the profits.

Normally there is a different person or team running each phase, often operating from different parts of the world, making it extremely difficult to track and trace.

Each group takes a slice of the profits with the criminal ringleaders reaping the largest rewards that can run into millions.

"It's not dissimilar to the process of robbing a bank," said Nick Frost, senior research consultant at the ISF. "The difference is that this cybercrime is more sophisticated and harder to trace. Most attacks are able to circumvent generic security controls, whilst anti-forensic techniques are used to remove traces, such as deleting system logs."

Advanced attack kits such as Limbo 2 Trojan are available online with "non-detection-warranties", said Frost.

He said, "Most organizations do not have the necessary controls in place to deal with these attacks, and the financial profits from successful breaches are simply used to fund more sophisticated and malicious attacks, creating a vicious cycle."

Typically, profit-driven attacks are targeted at high value organizations or individuals.

"Spear phishing" is a common social-engineering technique used to seek out data such as bank details or access credentials from groups of customers or employees that can then be sold online.

So called "Whaling" targets hand-picked individuals, such as wealthy billionaires and CEOs or those with privileged access rights like database administrators.

The results of the last ISF Security Status Survey in 2007 showed a 50% increase in social engineering attacks in two years.

"To reduce the risks from profit-driven attacks, organizations need to focus on three key areas," said Frost. "Fundamental security measures such as patch management and access control need to be strengthened, along with often under-utilized controls such as analyzing event logs and implementing network sniffer tools.

"But in addition, organizations should consider using third parties that monitor hacking forums to understand who is being targeted, the types of information in demand and current developments of sophisticated attack kits."

FBI sting busts 56 for buying, selling stolen credit card data

Dan Kaplan

October 16 2008

Fifty-six people have been arrested for their unknowing association with an FBI-run online forum that traded stolen credit card information, authorities revealed on Thursday.

At its height, the DarkMarket forum counted 2,500 people as registered members, the FBI said in a statement. Authorities estimate the sting helped save $70 million in victim losses.

The statement did not say how the FBI got control of the forum, which was reportedly under the bureau's control for about two years. However, law enforcement said it worked with international partners to identify and track down culprits.

A German radio station was the first to unmask the sting, and the story was first reported in the United States by Wired. Published reports said the site was voluntarily shut down earlier this month by its site moderator, who used the handle “Master Splyntr.” In reality, Splyntr was FBI senior cybercrime agent, J. Keith Mularski, working out of the FBI's National Cyber Forensics Training Alliance in Pittsburgh.

Wired reported that the FBI used the site as a way to create profiles of DarkMarket users. The agency tracked users' IP addresses and their activity on the site, along with transaction records from the E-Gold electronic currency service.

The FBI said the sting also netted new leads into other cybercrime cases, which now are being investigated by the FBI and international partners.

 

Read what they have to say about the internal threat...

"Compuware Study Shows Insiders Pose Biggest Threat to Data Security

Employing Best Practices and Technology Can Protect Sensitive Data, Maintain Company Reputation and Prevent Financial Losses

DETROIT--October 13, 2008--Compuware Corporation (NASDAQ: CPWR) today announced the results of a new study, commissioned by Compuware and conducted by the Ponemon Institute©, that showed insiders were the number one cause of all data breaches with hackers ranking a distant fifth.

The survey shows insiders caused 75 percent of all breaches in the U.S. while external hackers committed only one percent of breaches. The 2008 Study on the Uncertainty of Data Breach Detection also reveals 79 percent of U.S. respondents had experienced at least one data breach.

“Enterprises must recognize that simply trusting employees will inevitably prove detrimental to their security, their risk postures and their business interests,” wrote Perry Carpenter, Gartner.[1] “A mixture of tried-and-true security practices, security awareness, and low- and high-tech toolsets will provide the most effective and comprehensive defense against the insider threat.”

The study also shows that 41 percent of all data breaches occurred in a mainframe environment, putting abundant confidential customer data at risk considering more than 80 percent of the world’s corporate and governmental data resides on mainframes.[2]"…

 

The New Face Of Cybercrime

By Stefanie Hoffman,

 

For decades, cybercrime has been the stuff of Hollywood thrillers and pulp fiction novels. But the days when cybercrime was tantamount to a gaggle of teen-age hackers creating viruses in their parents' basements have long since died. Now, the FBI reports that, for the first time ever, revenues from cybercrime have exceeded drug trafficking as the most lucrative illegal global business, estimated at reaping in more than $1 trillion annually in illegal profits.

 

Individuals or groups of hackers loosely tied together with common goals have coalesced into organized criminal hierarchies, and like multiheaded cyber Corleone families, they come complete with defined roles and systems of rewards. They're well-funded, well-managed businesses, and they are growing at breakneck speed, continuing to evolve by means of complex ecosystems and technologies that have become increasingly sophisticated and efficient. And like any growing enterprise, they're expanding their reach to smaller and more vulnerable targets, to the multitude of underequipped and cash-strapped SMBs and small midtier companies.

 

As more SMBs and midmarket companies struggle to protect sensitive data, solution providers are finding that many are beginning to re-evaluate their security environments and adopt what were once considered high-end solutions. VARs selling these solutions to largely enterprise and upper midmarket customers are finding that they are making rapid inroads downmarket. And while many SMBs still remain unaware of the threat, VARs are ready at arms to provide innovative and surprisingly affordable solutions to protect the SMB.

 

"Anybody that stores large amounts of data is most vulnerable. They're all vulnerable," said Kevin Newmeyer, worldwide principal for strategic security and counterterrorism for Unisys. "The ones that don't think they're vulnerable haven't been hit yet."

 

Cybercrime Inc. Keeps Growing

In August, 11 defendants were formally charged in last year's high-profile T.J. Maxx data breach in which more than 45 million accounts were compromised over a couple of years. The defendants included three U.S. citizens as well as citizens of the Ukraine, Estonia, Belarus and the People's Republic of China. What's become clear to investigators and security experts alike is that organizations perpetrating these kinds of attacks are not only increasingly global, they're becoming nimbler, smarter and more efficient at wreaking havoc on company networks and profiting from their illegal activities. They have names like the Russian Business Network, Gray Pigeons, and Honkers Union of China. And they're growing—in numbers, power and reach.

 

"What we've seen is really a deep stratification of electronic crime into a growing, prosperous and responsive economy, with a number of specialty organizations, syndication and deepening organization of peers, both within a vertical skillset and across the entire enterprise of electronic crime," said Peter Cassidy, secretary general of the Anti-Phishing Working Group, a nonprofit organization dedicated to counteracting cybercrime. "Increasingly, we see this is turning into big business."

 

Members originate from all over the world, Cassidy said, with large concentrations in Russia and Eastern Europe, as well as parts of Africa—typically areas with access to technology coupled with political upheaval and limited financial opportunities.

 

In recent years, China has also emerged on the world stage as a global security threat as its population soared and economy exploded with a young and highly skilled volunteer labor force. A recent McAfee report found that of 265 countries surveyed, Hong Kong was by far the biggest security risk, with almost 19 percent of Web sites with the .hk domain hosting malware. Hong Kong was seconded only by the .cn domain out of the People's Republic of China, followed by the Philippines, Romania and Russia.

 

Scott Henderson, a former U.S. military intelligence analyst with a specialty in the Chinese cyberthreat, said that there are about 280,000 to 300,000 individual hackers in China belonging to about 250 cybercrime organizations.

 

Next: A Shadow Economy A Shadow Economy

It didn't happen overnight. According to a Q2 2008 Web Security Trends Report by Finjan, a San Jose, Calif.-based security company specializing in Web gateway security solutions, these cybercrime organizations—some claiming hundreds of members, others up to tens of thousands of members—have all emerged over the past two years to create a viable shadow economy, designed to mimic real-world economies financially and structurally.

 

"It's a contemporary economy mediated by Internet workings. It just happens to be illegal," Cassidy said.

 

Just like a Mafia family, they're organized into strict hierarchies. They're headed by a criminal boss, who is seconded by an underboss, providing Trojans for attacks while acting as the command and control center of the operation. Spearheading the malware attacks against businesses and individuals are the campaign managers, who direct their drones in affiliation networks further down the chain of command to actively steal the data from users' computers.

 

Meanwhile, hacking tools aren't just relegated to the cyberelite. Affiliate and smaller hacker organizations can also propagate a malicious campaign by renting software and programs, ranging from botnets, to rootkits and phishing toolkits, in order to steal users' data.

 

"People take over somebody's computer, and then the computer is being controlled by someone in Mexico or Russia," said Unisys' Newmeyer. "The advantage in the cybercriminal world is that you don't have to go into a bank to rob."

 

The stolen data—generally users' credit cards and social security numbers—is often sold by cyber resellers, who specialize solely in buying and selling the stolen data.

 

"This is definitely an area of growing concern," said Dave Marcus, security research and communications manager for McAfee. "Instead of accessing and stealing information, they'll sell account information for a premium."

 

Marcus said that the resellers typically post the stolen information onto Web sites, then it is offered for sale to hackers based on brand, location and additional value-added features. Marcus said that one Web site discovered by McAfee Avert Labs offered stolen bank accounts for sale with significantly higher prices from U.S. financial institutions such as Citibank and Bank of America than for smaller credit unions and more obscure foreign banks. Criminals who want to use the information can then contact the resellers to negotiate a price.

 

"If you're trying to get inside and trying to get the information, you've got to know the secret handshake," Newmeyer said. "If you don't have the right responses, they'll identify you as a cop."

 

Driven by the laws of supply and demand, the price of an average identity has dropped in recent years from $100 to somewhere between $10 and $20 apiece, with the commoditization of data such as credit card and bank account numbers with pins.

 

However, other information is deemed more valuable. Experts say that prime real estate for cybercriminals surrounding health-related data, internal corporate notes and Outlook and FTP accounts that can provide access to intellectual property go for much higher prices on the black market. As a result, attackers will increasingly be targeting health and government organizations, as well as corporate intellectual property, security experts say.

 

Next: Cybercrime 2.0 Cybercrime 2.0

With any flourishing industry come technological advancements. Viruses and worms from a decade ago have been replaced by sophisticated password-stealing Trojans and keyloggers that are designed to silently sit on a user's computer and funnel important data into remote foreign servers.

 

The malware is often distributed through malicious links sent via e-mail, directing people to an infected Web site. As of late, security experts have also seen a rise in malware attacks on legitimate, but vulnerable Web sites, which stay for a short period of time before they're detected and removed. During that time, however, attackers can identify thousands of potential victims. Often the victims are individuals and employees encouraged to click malicious links by some kind of enticing social engineering tactic delivered through e-mail. Some of the most popular tactics include malicious eVites or e-cards, and links to Web pages or videos impersonating high-profile news events or celebrity sensationalism. Henderson said that, in particular, Chinese hackers have perfected the art of creating effective social engineering techniques with highly researched and biographically targeted messages. "They're very skilled at going out online and collecting biographical information from a myriad of sources and going out and planning attacks," he said.

 

Once a user's computer is infected, it will generally become part of a larger network of infected computers, or botnet, which will, in turn, become a vehicle to distribute malware onto other systems. "They're constantly changing their methods of getting you to click," Henderson said. "Most people will be blissfully unaware that their computer is infected and is attacking the Pentagon."

 

Meanwhile, cybercriminals are honing techniques to circumvent most standard security measures. They can create malware that bypasses or breaks the antivirus signatures, and encrypts or obfuscates the payload, security experts say.

 

"And you cannot create a signature to block it," said Yuval Bet-Itzhak, chief technology officer for Finjan. "It will never block MySpace or Yahoo pages. The combination of serving malicious code and encrypting it, manages to bypass security techniques most enterprises are using today."

 

Attacking The SMB

With more cybercrime organizations creating malware at breakneck speeds, businesses can only expect to see their networks afflicted with more security breaches.

 

Yet, as enterprises build up their security environments, cybercriminals are now looking elsewhere for easier targets. Those who will likely be most at risk will be the small business and midmarket segments—companies with fewer or limited resources and outdated or inadequate security infrastructures. And while many SMBs may not have heard of the Russian Business Network, many undoubtedly will feel the ill effects of malware distributed via the Web.

 

"When it comes to vulnerability management, smaller firms have a bigger challenge," said Nic Alicandri, managing director at New York-based information security firm CipherTechs Inc.

 

Security experts have begun warning companies that the threat is definitely growing. A July McAfee study, "Does Size Matter? The Security Challenge of the SMB," found that one in five small businesses have suffered a security attack, with a third of those suffering more than four IT breaches in the past three years. One in five respondents said that a security attack could put them out of business. Additionally, the 10th Annual CSI/FBI survey released last October found that U.S. businesses lost an average of $350,424 in 2007 as a result of cybersecurity incidents—a number that more than doubled from losses incurred from 2006.

 

"I think that the people that think because they're not a household name, they're not going to be an attack target [are] going to be mistaken," said Ken Phelan, chief technology officer for Gotham Technology Group, a Montvale, N.J.-based IT consulting VAR, with specialties in access management and information security.

 

Phelan said that one of his SMB clients with fewer than 100 people was given a sheaf of confidential company data that was lifted from the company. The client was told they needed to pay the attacker, or run the risk of losing the information to their competitors.

 

Gotham Technology points SMB customers to pre-existing regulatory security solutions, such as those outlined by Payment Card Industry standards, Phelan said. Among other things, PCI standards recommend that all businesses encrypt data, authenticate users and secure networks with an array of endpoint protection software.

 

SMB company networks "are being pounded," and "a lot of them don't even know it's happening," said Stephen Nacci, regional account manager for TLIC Worldwide Inc., an Exeter, R.I.-based VAR specializing in security solutions and network management.

 

Nacci recommends that his clients extend their security solutions beyond the perimeter.

 

"(SMBs) are getting killed. These guys are bleeding and they don't even know it," Nacci said. "We need to counter that."

 

Next: Tracking Chinese Hackers Tracking Chinese Hackers

 

Chinese hackers are the largest group of hackers in the world, said Scott Henderson, former military intelligence analyst and administer of the Web site www.thedarkvisitor.com, which tracks hackers throughout China.

 

They also don't hide in the shadows, said Henderson. In fact, they maintain the most open Web presence of any group of hackers globally. "Some even have hardware and software companies as advertisers on their Web sites," he said. "Chinese hackers are very entrepreneurial," said Henderson. "It's a real subculture."

 

As their numbers and profiles grow, some have achieved rock star-style popularity. Many have taken advantage of their high profiles and are becoming more professional, even conducting recruiting efforts, he said.

 

So, expect many more in the not-too-distant future. Henderson said a recent study found that one in three Chinese middle-schoolers wants to grow up to be a hacker.

 

Top security suites fail exploit tests

Security software suites -- including popular programs from McAfee, Symantec, and Trend Micro -- don't protect users from real-world exploits, Secunia warns

By Gregg Keizer, IDG News Service

 

Security software suites don't protect users from real-world exploits, a bug tracking company charged today after launching 300 test attacks against a dozen programs, including popular software from McAfee, Symantec, and Trend Micro.

 

 

"The Internet security suites are marketing themselves as the one solution users need to be safe online," said Thomas Kristensen, chief technology officer at Secunia, which ran the tests. "In our opinion, that's just not true."

 

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

 

Secunia sicced hundreds of vulnerability exploits -- some proof-of-concept code that triggered a vulnerability, others that included payloads -- on 12 suites, including Symantec's Norton Internet Security 2009, Microsoft Corp.'s Windows Live OneCare, AVG Technologies' Internet Security 8.0, and McAfee Inc.'s Internet Security Suite 2009. The attack code was delivered by files of various formats, including Office documents and malformed images, and by malicious Web sites that triggered browser and ActiveX bugs. The target was a Windows XP SP2 machine missing "certain patches and with a number of vulnerable programs," according to Secunia.

 

While Symantec's Norton Internet Security 2009 took honors, it detected only 64 out of 300 exploits, or just 21 percent of the total. Even so, that beat most rivals by substantial margins. Trend Micro's Internet Security 2008, for example, only detected 2.3 percent of the exploits, while McAfee's Internet Security Suite 2009 identified 2 percent and Microsoft's OneCare spotted just 1.8 percent of the exploits.

 

The reason why current security suites had such trouble detecting the 300 exploits, Kristensen explained, is that anti-virus software vendors are geared toward cranking out signatures for hacker payloads: the worms, Trojan horses, and spyware that are identified in the wild, given names, and then spotted by adding a new detection "fingerprint" to the software.

 

"They don't focus on detecting vulnerabilities, they focus on detecting the payload," Kristensen said. "But the problem with detecting the payload is that you're always behind [the hackers]. It's easy for the bad guys to create a new payload that's not detected by the scanning mechanisms and current signatures."

 

In order to craft a signature for a specific payload, security companies must first capture a sample, analyze the malware, and write a detection fingerprint. Then they must push that new signature to users. The process, said Kristensen can take hours at best, and then must be repeated as soon as a new piece of malware is bundled with an exploit.

 

But by looking for vulnerability exploits rather than for payloads, argued Kristensen, security software could stop multiple pieces of malware with just one signature, essentially making a more efficient defense in the long run.

 

"If there's a vulnerability in [Microsoft] Office and someone is exploiting that in an Office document, you'll be able to block that attack with just one signature," he said, no matter how many different payloads hackers may try to load into a vulnerable PC. "It's a much better way, we think, even though it's somewhat more time consuming to come up with a vulnerability signature."

 

Although Secunia sells its vulnerability research and proof-of-concept exploits to legitimate security vendors, Kristensen maintained that was not the reason why the company tested the 12 suites. Instead, he said, the take-away should be to patch, patch promptly, and patch all software, not just the operating system.

 

"Security software alone isn't sufficient" to protect a PC," Kristensen said. "People need to patch all their programs. Patching is absolutely necessary, and not just the main programs, but third-party software as well."

 

Secunia has posted a paper that describes its suite testing procedure and lists results on its site (download PDF).

Microsoft betting on secure development metamorphosis

Posted by Jon Oltsik

 

 

Back in 2002, Microsoft executives realized they had a serious problem at hand. As the primary target of a growing global community of amateur hackers and professional cybercriminals, Microsoft knew it had to do something to improve the security of its code or it was likely to become a party pooper at the online fiesta. The Bill Gates Trustworthy Computing e-mail of January 2002 got lots of PR focus, but Microsoft's real security work horse was a new development process called the Security Development Lifecycle (SDL).

 

Since 2004, all new Internet-facing software developed by Microsoft has gone through SDL. Microsoft says that SDL has really helped to decrease the number of software vulnerabilities and lower the cost of fixing insecure code.

 

SDL always seemed like a hidden treasure that Microsoft should bring to the masses. Redmond finally externalized SDL last month with a series of tools, services, and programs. Great stuff until you realize what you are up against. Software developers are trained and paid to write business logic as quickly as they can. Few know anything about secure development. Even Microsoft needs help.

 

Redmond found these secure development skills in a number of partners, including a small Massachusetts company named Security Innovation. Never heard of 'em? You are not alone. In the esoteric overlapping worlds of security and software development, Security Innovation may stand alone. The company offers a portfolio of training, testing, and tools. Don't know anything about secure development processes? Security Innovation can teach you. Want to figure out how secure (or insecure) your code is? Security Innovation can tell you which way the security winds are blowing. Security Innovation can even certify code that passes its tests and meets certain metrics.

 

I am fairly convinced that large organizations will require specific secure software development processes and certifications as part of their Request for Purchase (RFPs) with technology vendors in the near future. Microsoft also anticipates this, which is one reason why the company continues to evangelize and offer its SDL to the market.

 

Ultimately, however, secure software development depends upon expertise and guidance, not just models and testing tools. Given this, companies like Security Innovation transform from geeky niche security players to critical service providers to a broad market. Microsoft, for one, is betting on this secure development metamorphosis.

Jon Oltsik is a senior analyst at the Enterprise Strategy Group.

National Cybersecurity Initiative R&D effort launched

By Ben Bain

Published on October 14, 2008

 

The government officially has begun to formulate a national research and development agenda for "game-changing ideas" as part of the multiyear, multibillion-dollar, governmentwide effort to secure cyberspace through the Comprehensive National Cybersecurity Initiative (CNCI).

 

The National Science Foundation today issued a request for information initiating the National Cyber Leap Year. The Leap Year is meant to seek "the most promising game-changing ideas with the potential to reduce vulnerabilities to cyber exploitations by altering the cybersecurity landscape," according to the RFI. The project aims to formulate an integrated national approach to making "cyberspace safe for the American way of life."

 

Specifically, the project has the dual goals of forming a national research and development agenda that identifies the most promising technologies and how to bring them to fruition and to "jump-start game-changing, multidisciplinary efforts." The Leap Year will run during fiscal 2009.

 

"These game-changing technologies (or nontechnical mechanisms that are made possible through technology), developed and deployed over the next decade, will fundamentally change the cyber game into one where the good guys have an advantage," the RFI published in today's Federal Register states.

 

In January the Bush administration kicked off the multibillion-dollar CNCI by signing a presidential directive. Although much of the initiative remains classified, officials have released more detail regarding the scope and detail of the multiyear effort in recent months.

 

According to today's RFI the presidential directive calls for leap-ahead research and technology to reduce vulnerabilities to asymmetric attacks in cyberspace.

 

"Unlike many research agenda that aim for steady progress in the advancement of science, the leap-ahead effort seeks just a few revolutionary ideas with the potential to reshape the landscape," the RFI states.

 

The first stage of the Leap Year project – which begins with today's RFI – involves surveying the cybersecurity community for the ideas. The second phase involves a series of workshops to develop the best ideas.

 

During the second phase the government plans to publish findings on "game-changers" and technical strategy with as many specifics as possible on the types of invention or research needed. The government will also publish findings on how the capability will be implemented, delivered and used, as well as recommendations on funding, authorities and policies.

 

Contributors to stage one can submit as many as three leap-ahead concepts. According to the RFI many of the concepts can be classified as ideas that either aim to "morph the gameboard," "change the rules" or "raise the stakes" to protect against potential cyberattacks.

 

Although the RFI is open to everyone, officials are encouraging collaborative, multidisciplinary efforts and those with cybersecurity interests to apply. Deadline for submission is Dec. 15, 2008.

Firefox add-on blocks 'clickjacking' attacks

NoScript now stymies new class of exploits by revealing secret content

Gregg Keizer

October 9, 2008 (Computerworld) A popular Firefox add-on designed to block scripts and plug-ins has been updated to stymie the new "clickjacking" class of attacks, the extension's developer said today.

The latest version of NoScript, a free extension for Mozilla Corp.'s Firefox browser, now boasts something that Italian developer and security researcher Giorgio Maone calls "ClearClick" to protect users from clickjacking attacks.

"Rather than relying on frame/plug-in blocking, which were already available, I decided to move on and add a brand new feature, developed from scratch, for people who couldn't bear blocking frames outright," said Maone in an interview conducted via instant messaging.

In a blog post earlier this week, Maone spelled out what ClearClick does in greater detail. "Whenever you click or otherwise interact, through your mouse or your keyboard, with an embedded element which is partially obstructed, transparent or otherwise disguised, NoScript prevents the interaction from completing and reveals [to] you the real thing in 'clear,'" he said.

At that point, users can decide for themselves whether to continue clicking, or free up the mouse from the underlying -- and potentially exploitive -- content.

Clickjacking, which was coined just last month by a pair of American researchers -- Robert Hansen of SecTheory LLC and Jeremiah Grossman of WhiteHat Security Inc. -- describes attacks in which hackers and scammers hide under the cover of a legitimate site, then use that cover to disguise clicks. Among possible clickjacking exploits was one that Adobe Systems Inc. described this week in Flash that lets attackers secretly spy on users by getting them to turn on their computer's webcam and microphone without realizing they've done so.

"Clickjacking is bad, old and difficult to protect from because it depends Web features modern sites heavily rely upon today," said Maone. "It's also quite easy to pull [off] and unlikely to be fixed by a mainstream browser in the short term."

Although Hansen and Grossman have not yet released technical information of their clickjacking research -- they only outlined the threat in any detail yesterday -- Maone was able to create ClearClick by piecing together what clues had been made public in the last two weeks. He also got help from other researchers, including Hansen.

"Even without knowing the gory details of the [then still undisclosed] Adobe vulnerability, it was not hard analyzing the problem from a general mitigation perspective," said Maone. "[And] after I started speculating on the effectiveness of already existent NoScript features against clickjacking, notably IFRAME blocking, [Hansen] pinged me, also because he's a NoScript user himself, and we had some deeper discussion on NoScript's alternate and specific defenses."

NoScript uses the "canvas" HTML element to draw two snapshots, one of the clicked component only, the other of the top page with all its content, then compares the two images. If they differ, the extension triggers the ClearClick warning.

Maone was confident that NoScript with ClearClick would stop virtually every conceivable clickjack attack. "It conceptually shuts down any kind of clickjacking, either based on transparency, overlays, position, redressing and so on, because all the variants boil down to 'hide the element user is interacting with,'" he explained.

Hansen was not as certain that NoScript is the right answer.

"Giorgio is doing Mozilla a huge favor," he said in an interview Wednesday. "But I don't think that it's the best way to protect users." His objections: NoScript blocks much of the content that users expect to find on sites, and it's aimed at technical, not mainstream, users. "If my Mom was using NoScript, I'd be taking all kinds of technical support calls," he said.

Not surprisingly, Maone sees NoScript differently. "The problem is that many of the problems we're facing, and not just clickjacking, originate from the 'flat' security model of the Web, where everything is equally trusted and the boundaries between Web applications are very fragile," he said.

"NoScript takes a radical approach to this, dividing the Web in[to] 'trusted' and 'untrusted' -- the latter includes both unknown sites and those you explicitly marked as bad -- and this allows greater margin to outmaneuver Web-based threats," Maone added. "Playing on a field where all is trusted by default, like mainstream browser vendors are forced to do, makes security much harder, and in many cases impossible."

NoScript, available free of charge, works only with Firefox and other Mozilla-based browsers, such as Flock and SeaMonkey. Version 1.8.2.1, released Wednesday, includes ClearClick.

Free Tool Hacks Banking, Webmail, and Social Networking Sessions

Free Tool Hacks Banking, Webmail, and Social Networking Sessions Man-in-the-middle attack tool automates hacks for non-Web security experts OCTOBER 6, 2008 | 5:55 PM By Kelly Jackson Higgins Senior Editor, Dark Reading A researcher will demonstrate a free, plug-and-play hacking tool this week that automatically generates man-in-the middle attacks on online banking, Gmail, Facebook , LiveJournal, and LinkedIn sessions -- even though they secure the login process. Jay Beale, who recently released the so-called “Middler” open-source tool, will show it off at the SecTor conference in Toronto. Aside from the unnerving capability of hacking into sites that perform secure logins and then use clear-text HTTP, Middler is also designed for use by an attacker with no Web-hacking skills or experience. “The Middler allows an attacker with no Web application-hacking experience to launch attacks that previously required substantial time and skill,” according to the Middler Web page. The Middler basically clones the victim’s online session by using the same cookies and HTML form parameters as the victim. Then the attacker can inject malicious JavaScript onto the Web pages, redirect the user to another page, or log the victim’s session. Beale’s tool can override a secure banking session by rewriting the URLs on the page to remove the Secure Sockets Layer (SSL) protection. Beale, who is co-founder of security consultancy Intelguardians LLC , says many organizations don’t realize that only encrypting the password form leaves users vulnerable to man-in-the-middle attacks. LinkedIn, for example, first has users sign in at its HTTPS address. But after you’re in, you get sent back to the regular HTTP address, http://www.linkedin.com/home. Then the attacker can access the LinkedIn user’s contact information and inbox, and even add himself to the victim’s “network,” or add the victim to his network. The researcher also plans to demonstrate at SecTor how to use Middler for injecting JavaScript into browser sessions using Metasploit, and how the tool can execute cross-site request forgery (CSRF) attacks. The Python-based tool can be set up to “fire and forget” so the attacks can execute automatically. Beale also plans to show how Middler can meddle with software installations and updates and inject Trojans, both in computers and on the iPhone. Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Report: Data Breaches Expose About 30M Records in '08

 

U.S. corporations, governments and universities reported a record 516 consumer data breaches in the first nine months of this year, incidents prompted chiefly by hackers and employee theft, according to a report released today by a nonprofit group that works to prevent fraud.

 

The Identity Theft Resource Center, of San Diego, found that this year's data breach tally has easily eclipsed 2007's 446 incidents. At an average of 57 caches of consumer data reported lost or stolen each month, U.S. organizations are on track to divulge at least 680 breaches by the end of 2008.

 

About 80 percent of the breaches involved digital records, while the remainder stemmed from the loss, theft or exposure of paper-based records. A description of each incident is available in the Identity Theft Resource Center 's 2008 Breach List (PDF).

 

Some 30 million records on consumers have been exposed so far this year. But experts say that figure almost certainly masks a much larger problem, as there is currently no federal requirement for organizations that experience a data breach or loss to acknowledge precisely how many consumers nationwide may have been affected.

 

Resource center founder Linda Foley said it's not clear whether there are more breaches, if organizations are getting better at detecting them or if more organizations are simply complying with state data breach notification laws.

 

At least 40 states now require entities to alert consumers in their states when a data breach has placed residents' personal and financial data at risk of exposure. Yet, in nearly 42 percent of the breaches reported this year, affected entities have not divulged the total number of Americans potentially at risk from the incidents, Foley said.

 

Consider the breaches that the Identity Theft Resource Center tallied last year: In 2007, 446 incidents exposed more than 127 million consumer records. Yet in 40 percent of those cases, the entities that experienced the breach did not say how many records were affected nationwide. A single omission can skew the numbers dramatically. Nearly three-quarters of those 127 million records were attributable to a single data breach: that of TJX Inc., which operates T.J. Maxx stores, among others.

 

What's more, the resource center counts breaches by contractors as a single incident, even when the breach affects a large number of the contractor's clients. For example, Bank of New York Mellon in February said it had lost backup tapes containing names, addresses, birth dates and Social Security numbers on roughly 4.5 million Americans. Following an investigation by Connecticut authorities, the bank acknowledged that as many as 12.5 million records may have been lost. Since the institution administers investment plans for a number of companies, even people who had no direct relationship with the bank received notices from the institution that their personal data was compromised.

 

"We get calls all the time from people who receive a breach notice from a company they've never done business with directly," Foley said. "Companies that collect information on behalf of other organizations need to take extreme security measures because they have a lot more information at stake."

 

More than 36 percent of the breaches so far this year have been at U.S. businesses, while educational institutions were the second most frequent source of incidents (21 percent). Breaches attributed to the military or state and federal government declined for the third year running, down from a quarter of all breaches last year to just 16 percent in 2008.

 

Organizations reported that hacking (13.4 percent) and insider theft (16.5 percent) were the cause of nearly one-third of all breaches this year. Lost or stolen laptops and other digital media storage accounted for 20 percent of breaches, with another 14 percent blamed on accidental exposure, such as the posting of Social Security numbers and other data to a public Web site.

 

Clear and present dangers

10/06/08
By William Jackson

Four key categories of cyberthreats will likely dominate the security landscape during the next year

Sponsored By

Identifying the most serious cybersecurity threats is an inexact science. How do you measure just how bad something potentially is, and how can you be sure it will still be important tomorrow?

Lists of top threats change almost daily as vulnerabilities and exploits come and go, and others turn out to be surprisingly resilient. Who would have guessed when the Storm worm first appeared in early 2007 that it would be so persistent? And you might have thought that we learned our lesson a decade ago about e-mail messages with “I love you” in the subject line, but this social-engineering trick still works today.

However, there are a handful of techniques — with a lot of overlap and interrelationships — for exploiting systemic weaknesses in the information technology environment that can broadly define the threat landscape. They include:

BOTNETS AND ORGANIZED EXPLOITS. The phenomenon of organizing compromised computers into a network that can be used for nefarious purposes has been around for years, but it is becoming an increasingly powerful platform responsible for a growing variety of attacks. “Botnets are very much the Swiss Army knife of online miscreants,” said Zulfikar Ramzan, technical director at Symantec Security Technology and Response.

WEB SITE AND WEB APPLICATION EXPLOITS. According to one recent study, as many as 82 percent of Web sites have at least one security weakness. This is linked to the botnet phenomenon. Some experts blame the augmentation of Structured Query Language injection vulnerabilities for the apparent rapid growth in botnets in recent months. SQL injection is a form of attack on a database-driven Web site in which the attacker executes unauthorized SQL commands by taking advantage of insecure code on a system connected to the Internet, bypassing the firewall. One out of every three vulnerabilities reported in the second quarter of 2008 was a SQL injection, said Tom Stracener, senior security analyst at the Cenzic Intelligent Analysis Lab. “There is a tremendous focus on it in the research community,” he said.

VIRTUALIZATION. This is an emerging security issue, but one that is important because of the rapid adoption of virtual machines in data centers and of virtual environments for delivering applications to users. It is not that virtualization is inherently insecure, said Kurt Roemer, chief security strategist at Citrix. In fact, it can offer some security advantages. But it is neither a panacea nor a disaster. “Virtualization is just a different delivery vehicle,” he said. “It does beg you to think differently in some ways.”

NETWORK INFRASTRUCTURE. As operating systems become more secure, more attention is being paid to the network and its underlying services. The recently reported vulnerability in the protocols of the Domain Name System (DNS) is a good example. If you can control the network, you can control the nodes on it. “I don’t want to sound like Chicken Little here, but it is a pretty dire situation we are in,” said Paul Parisi, chief technology officer at DNSStuff.

This is not a comprehensive list, and vulnerabilities and exploits will continue to come and go, requiring day-to-day attention from IT administrators and security shops. But the list addresses matters that are going to merit concern in the coming year and are worth further investigation.

Botnets and organized exploits

Networks of compromised computers are being organized into turnkey solutions for activities such as spam delivery and phishing. Criminals can outsource an infrastructure and the management of their enterprises. The distinguishing characteristic of modern botnets is that they are all about cash flow and profitability, said Zulfikar Ramzan, technical director at Symantec Security Technology and Response.

Size matters in botnets, but in many cases, smaller is better. Although the number of compromised computers is growing, botnets are increasingly used to deliver low and slow attacks, staying under security monitoring devices’ radar to maximize their return. The new twist in botnets is not their technology but the use of social engineering.

The Storm worm has worked well in expanding botnets by delivering malware through e-mail messages with compelling, often targeted subjects. But “it’s getting harder to get e-mail to work,” Ramzan said. The trend now is toward the use of peer-to-peer networks for downloading files for infecting PCs. Peer-to-peer networks also are being used for command and control of botnets, making it more difficult to shut down the lines of communication that deliver malicious code and marching orders to the zombies.

The job of protecting your network from infection is being complicated by a new generation entering the workforce that has grown up with computers and take personal mobile computing for granted. But although new workers might know how to use computers, they are not necessarily savvy about how they work or the security implications that come with them.

“The new workforce has a lot more demands from a security perspective,” Ramzan said. “The enterprise boundary has become amorphous. It is becoming more difficult to manage a network.”

BT America, which is expanding its Multiprotocol Label Switching network offerings in this country, has recently added botnet detection to its suite of security services. Correlation engines look for anomalies and traffic patterns culled from firewalls and other network security devices that could indicate botnet activity. Suspicious events are passed along to human analysts at security operations centers in Chantilly, Va., and El Segundo, Calif.

Host agents for detecting suspicious activity are appropriate for servers and PCs, but correlating and analyzing network data is a necessary second line of defense against botnets, said Jeff Schmidt, general manager of BT America’s Managed Security Solutions Group in North America.

“We believe that correlation of events across all devices is the best way to do it,” Schmidt said. Millions of reported events a month can be boiled down to a few hundred anomalies that can be analyzed to identify a handful of security incidents that managers should address.

Because so many channels can be used to compromise the computers that are brought into botnets and because they can be used in a variety of ways that often go undetected, technology will not solve the botnet problem, Ramzan said.

“As long as these people can make money with them, the demand for botnets will continue,” he said. “We have to take a big step forward to hinder their profitability.” This means increasing the risk to the criminals using them, reducing the return and driving down the demand for these automated networks.

Web site and Web application exploits

Although recent security surveys show a slight decrease overall in the number of vulnerabilities being reported, a growing percentage of those vulnerabilities is occurring in Web sites and Web applications. According to Cenzic, Web applications accounted for 73 percent of reported vulnerabilities in the second quarter of this year, up 3 percent from the previous quarter and 5 percent from late 2007.

“This quarter has been the highest on record,” Stracener said. “It’s part of a trend that has been going on since 2006.”

Cenzic reported that 70 percent of the Web applications the company analyzed used insecure communications that opened them to possible exploits during transactions, and another 70 percent contained cross-site scripting vulnerabilities, the most common injection flaw.

These findings are in line with those of WhiteHat Security, which reported that 82 percent of Web sites analyzed had at least one security issue despite a decline in the number of overall IT vulnerabilities being reported. The company said that since 2006, “the industry has seen the Web-layer rise to be the No.1 target for malicious online attacks.”

As with botnets, the motive is money, Stracener said. Although fewer vulnerabilities exist, more exploit toolkits are being developed and commercialized for the Web for an underground criminal economy.

“The world hasn’t grown more secure,” he said.

The overwhelming majority of reported vulnerabilities are showing up in Web applications, which accounted for 88 percent of vulnerabilities in the Cenzic study, compared with just 7 percent for Web servers, 4 percent in browsers, and 1 percent in plugins and Microsoft ActiveX. Most of the flaws were accounted for by SQL injection, at 34 percent, and cross-site scripting, at 23 percent.

Cross-site scripting is a security breach wherein an attacker inserts a malicious script in dynamically generated Web pages that is activated when a browser reads it. The attacker can change user accounts, steal information and poison cookies.

WhiteHat reported that cross-site request forgery vulnerabilities broke into its top 10 list for the first time last quarter. The company estimates that 75 percent of the world’s Web sites contain one.

“On a positive note, 66 percent of all vulnerabilities identified have been remediated,” WhiteHat said, although the pace of remediation leaves something to be desired. In the study, the company found the average time to patch or fix HTTP response splitting vulnerabilities was 93 days, while information leakage problems required 26 days to fix.

This leaves large windows of opportunity for exploitation and underscores the need for consistent and aggressive configuration and patch management programs. It also illustrates the lack of vulnerability assessment during the Web application development process. Stracener estimated that less than 5 percent of applications undergo assessment during development.

“It’s not clear that there has been improvement in that area,” he said. Applications are developed under tight time constraints that do not allow for adequate testing, and the applications often become business-critical once they go live on a Web site. “They can’t stop doing business and put the code into dry dock.”

Noninvasive testing in a virtual environment can help in assessing the security of online code throughout its life cycle, but it is clear that the pressure on IT administrators to efficiently patch and manage online applications is growing.

Virtualization

Virtualization is a hot topic, and like all hot topics, it comes with security baggage.

A common driver for virtualization is data center optimization, reducing space and energy requirements, with security only an afterthought. “Security usually is not built in,” said Kurt Roemer, chief security strategist at Citrix. “It is bolted on at the end.”

Virtual machines often are looked at as if they are free, said Dave Capuano, chief marketing officer at Fortisphere, which sells management tools for virtual environments. This can lead to virtual sprawl, with new machines being rapidly added to a network, often lying dormant and unnoticed until their resources are needed.

The result is an expanding virtual infrastructure with little thought being given to configuration control, policy enforcement or management of communications among a multitude of operating systems and applications coexisting on the same hardware.

All of that puts a premium on planning when deploying virtual images that thousands of people will be use.

“You’d better be sure you’ve got it right the first time,” Roemer said. “You’d better make sure you got the right image in place and have configuration management.”

Policies also must be in place to control how virtual machines communicate with one another within their new environment because they coexist within the network perimeter and are not buffered by firewalls.

Keeping track of virtual machines can be difficult, because they often lie dormant until needed. The latest release of Fortisphere’s Virtual Essentials suite of management tools includes the ability to look at dormant machines so that policy enforcement can be applied before they are brought online.

Although virtualization on the back end can add new security concerns, virtual applications and desktops for the client can provide additional security, Roemer said.

“Now you’ve given the end user a sandboxed application that is separate from everything else on their machine,” he said. The user can’t screw things up, and configuration can be managed centrally. “That was all designed in when the application was provisioned.”

IT managers can use an appliance or thin client using a virtual desktop to supply a suite of applications and tools without putting the data itself on the client. This could make it simple to comply with requirements from the Office of Management and Budget for securing and controlling sensitive data on mobile devices, mandated after several high-profile data breaches involving stolen laptop computers. The only things that occur on the remote device are keystrokes, mouse clicks and screen refreshes.

“The data never hits the laptop,” Roemer said. “You can even control what people can copy, paste and print locally.”

“Is this right for everybody?” Roemer asked, referring to virtual computing. “No.” One drawback is that the user usually has to be online to use the application, although some streamed applications can be used off-line. “And there may be some reasons a user would have to have the data locally.

But that should be the exception rather than the rule,” he said.

Network infrastructure

Security researcher Dan Kaminsky’s discovery earlier this year of a flaw in the Domain Name System protocols highlighted the vulnerability of network infrastructure to manipulation, but it was neither the only nor the first problem that could let bad guys misdirect Internet traffic.

“Cache poisoning has been a soft underbelly” of the Internet for years, Parisi said. Dan found a way to leverage it.”

DNS is crucial because it is the system for resolving common domain names to numerical Internet addresses used to locate and route traffic to and from online devices. If users cannot be sure that a DNS request has received an accurate response, they can have no confidence in the resources they are accessing.

“On the surface, it is a very simple protocol, based on trust, but it can be very complicated when you go into it,” Parisi said. This complexity, plus DNS’ interrelated nature, makes correcting problems difficult.

Despite the potential for misuse, “there have not been a lot of original exploits” since the most recent vulnerability discovery, Parisi said. But security experts have observed a lot of poking and prodding.

Parisi described the Internet — which was not designed with security in mind — as a house of straw. “Everything we do on the Internet is based on trust,” and we can no longer trust it, he said. “The Internet is broken. I don’t think that’s too much of an overstatement.”

That does not mean that there is no hope.

“IPv6 would fix a lot of this,” Parisi said, but its adoption in applications to date has been marginal.

DNSSec, which provides cryptographic protection by signing DNS requests, also would be a step forward. Some experts describe DNSSec as a hodgepodge, others say it is fairly effective, and still others say it is merely the best we have. Regardless of opinions, to be effective, it would have to be adopted universally. Otherwise, the overall system would remain as weak as its weakest point.

“If .com were to adopt DNSSec and mandate signing, online commerce would stop” because setting it up is complex, Parisi said. “There are vendors scrambling to make DNS simple, and they will charge for that.”

Regardless of its complexity, the U.S. government is taking initial steps toward universal deployment by putting DNSSec on the .gov domain.

The Federal Information Security Management Act has already required security protocols for IT systems rated at high- or moderate-impact levels, but there was no timeline for implementing them. In August, Office of Management and Budget issued a new policy mandating the use of DNSSec on all government systems by the end of next year.

“The federal government will deploy DNSSec to the top-level .gov domain by January 2009,” OMB said. “Signing the top-level .gov domain is a critical procedure necessary for broad deployment of DNSSec, increases the utility of DNSSec and simplifies lower-level deployment by agencies.”

Agencies must have plans in place to deploy DNSSec to all of their systems by December 2009.

Need we say more than "IDentiWall"…

Massive, under-reported online banking breach raises serious disclosure and remedy questions

Posted by David Berlind

It was just last week that I wrote about a scary list that you can only hope doesn’t include you….a public list of all of the recent compromises to personal data that’s being stored by banks, merchants, universities, and most recently (the biggest breach of all), the Veteran’s Administration (a breach that included over 26 million names and that may end up costing $500 million).  The list is massive and left me with the impression that the odds that you and I have somehow been affected are pretty good.  Especially when you consider the fact that the list is only partial (in some cases, it just says "unknown" in terms of the number of records compromised) and how some incidents are probably not getting reported. 

One massive security breach that’s not on that list and that apparently gave Madrid-based hackers direct access to the online banking credentials belonging to customers of over 300 banks has avoided the spotlight until our very own George Ou noticed and looked under the hood.  The incident and his reporting raises serious questions about what really happened, who was affected, and how it was disclosed.  While I can’t tell for sure whether or not the disclosure is enough to satisfy lawmakers, my belief is that it’s clearly not enough for the public.

According to Ou, he received a tip from a customer of one of the impacted banks who himself had received a notice that his password had been reset.  In what has to be one of the better case studies of how a monoculture can lead to massive security problems, the reason so many banks were affected was because of how they all turned to the same third party provider — GoldLeaf Financial Solutions, Inc. — for certain home page services that included the capture and digestion of online banking credentials.  With one exploit, hackers were able to redirect the login IDs and passwords to a site in Madrid, Spain.

The disclosure that has so far followed leaves much to be desired.  According to a press release from GoldLeaf (one that was regurgitated word-for-word by news outlets such as Forbes under the heading of news and analysis):

Goldleaf Chief Executive Officer, Lynn Boggs, said, "We have identified and corrected the problem. We have fully restored our Web site, remote deposit and ACH services. In addition to contacting our customers, we have communicated with our vendor partners, regulators and law enforcement authorities. We are fully operational and will remain diligent in our security efforts."

What exactly was communicated isn’t known.  What we do know is that most of the information that has so far been made public (outside of Ou’s post) is at best misleading and at worst, wreaks of spin control. The problem starts with the press release’s headline which reads Goldleaf Technologies Responds to Phishing Attempt.  That’s an interesting choice of words to describe what happened here.  If it was a phishing attempt, Goldleaf could easily escape any blame by deferring some of it to insecure client software (emails, browsers, etc.) and the rest to a lack of best practices on the end user’s behalf. Phishing is a form of email-based social engineering that dupes users into clicking on links (in email) that they wouldn’t otherwise click on.

eBay is a frequent target of phishers. Even when such phishing attempts are successful, it’s hardly eBay’s fault. Neither email nor phishing played a role in this exploit.  End users were not social engineered.  They entered their credentials as they normally would, into Web pages that were served from the domains they should have been served from.  At the very least, Goldleaf needs to redisclose so that (a) it’s absolutely clear that it’s services were hacked and (b) phishing played no role in this attack.

Further drawing the disclosure and reporting into question is an AP Wire story that quotes Goldleaf spokesman Scott Meyerhoff as saying that the security breach affected about 150 to 175 bank Web sites for anywhere from a minute to an hour and a half.  In a subsequent interview with Goldleaf however, Ou learned that the actual number was more than 300.  The best case scenario (300 banks compromised for 1 minute each) involves 300 minutes or five hours of exposure.  If one bank was exposed in this way for five hours, how many of that bank’s customers could have been potentially compromised? The worst case scenario (300 banks compromised for 90 minutes each) is the equivalent of one bank being exposed for 27,000 minutes or nearly 19 days.  Can you imagine one bank being compromised for nearly 3 weeks?  So, questions remain.

What 300 banks?  We don’t know.  Where are their press releases?  No idea.  Was it really a minute to an hour and half? Or was it longer? We don’t know.  There’s no obligation to reveal the data or the methodology that led Goldleaf to that conclusion.  Even so, a lot of logins can happen in 90 minutes across 300 banks.  How many actually did happen? Was money taken?  How were the customers of the banks notified of the potential breach? Where can or should have they gone for more information to find out if their accounts had been compromised?

Some banks, the ones we know of, notified their customers by both regular mail and email. First State Bank, one of the affected banks, sent two separate notices.  The first one, signed by First State E-Banking offficer Christa Walton, has the audacity to include a link that points people to a remedy Web page that isn’t even within First State’s domain: an absolute no-no that is exactly the same trick used by phishers.  Says that first email:

…..In an effort to ensure that all customers are aware, this same communication was mailed via US Postal Service.  If, at receipt of this mailed communication, you have already obtained access to your accounts through our new Online Banking site, located at <URL masked by ZDNet>, there is no need to take any further action…..

The reason I masked the URL found in Walton’s email is that it’s a URL that isn’t in First State’s Internet domain. Technically, it could be fodder for phishers who might try to take advantage of the fact that some banks had to move their online banking home page to an off-domain page. Personally, I find it unconscionable that a bank would even consider sending an email that flies in the face of all conventional wisdom and best practices regarding the security and privacy of its customers (the USPS cc: helps but is far from perfect).  In Walton’s second email, she advises:

On Thursday, May 25, 2006, First State Bank became aware of an apparent attempt by an unauthorized party to gain access to our third-party website host and thus to our Online Banking site……Although there is no current evidence that customers information has been accessed, this incident may have increased the probability of your information being used for fraudulent purposes……Your Online Banking password has been defaulted back to your original password; when you established your Online Banking service….you may not have access to your original login information, First State Bank has established a help center that you may contact at 1-800-527-6335 or by email at info@first-state.net…..A temporary Online Banking login website has been established at <URL masked by ZDNet>.  This temporary site is safe…… 

Forget for a minute that most people don’t have a clue what their original password is (heck, I can’t even remember my current ones). When receiving an email like this from a financial institution, if you’re even half as sensitized to the phishing problem as I am, then you’d probably do what I do when I get an email like this one: delete it without even looking. In this case, the email goes beyond the faux pas of providing an off-domain site (that asks for user credentials); it provides an 800 number to call for more information or help. What are email recipients supposed to do with that? Call it? Over their dead bodies (hopefully).  I can see it now….hundreds of people calling an 800 number that they got from an email whose source can’t be authenticated and then calling that number, divulging all sorts of other compromising data to some unathenticated source. 

The bottom line (or at least one of them)? This event is a case study that demonstrates how badly a financial breach can unravel into a disaster. The void in information that the public deserved to have as soon as the incursion was discovered is simply shocking.  Not only that, it’s evidence of how the public will invariably end up mis-, under- or, worse yet, dis-informed (in the name of spin control) when organizations are left to their own litmus tests to decide whether a breach is serious enough to warrant disclosure (as the toothless disclosure legislation that’s currently before Congress suggests they should be), just what exactly should be disclosed, and what the remedies are.  Opponents to more heavy-handed legislation with stricter requirements argue that consumers will be overwhelmed by the number of disclosures as though that’s a good reason not to have them.  To that I say disclose away folks.  I want to know each and every time some bit of personal information may have been compromised and I want all the gory details — including specific actions I should take that don’t go against the very best practices that the financial and technology industries recommend in the first place.

 

Those of who do not protect themselves with IDentiWall should really read this…

 

Malware Targets E-Banking Security Technology

 

A new class of malicious software contains a feature specifically designed to thwart online security technology implemented by Bank of America and many other financial institutions that allow their customers to monitor and make changes to their accounts via the Internet.

 

The feature was found in a recent version of "Pinch," a widely distributed Trojan horse program that gives bad guys the ability to steal usernames and passwords from a victim's computer. Turns out, the newly detected version of Pinch also looks for and steals a special token that gets planted on the machine of anyone who banks online with a financial institution that is using Adaptive Authentication, a Web site security technology owned by RSA Security. The technology is often called "Site Key," which is Bank of America's branding of the RSA technology, and for most of this post that's how I'll refer to it.

 

First, an explanation of how SiteKey works. If you access your account at BankofAmerica.com, for example, the first time you do so the company will ask you to pick an image that will be displayed to you each time you log on from your usual location, whether that be home or at work. This is supposed to act as an assurance to the user that they are indeed at Bank of America's site, not some phony look-alike.

 

If you later log on to your account from an Internet address that Bank of America has never before seen associated with your account, the bank will require you to provide the answers to one or more secret questions that you provided when you first set up the account. If you answer the question(s) correctly, the bank's site will place a bypass token on whatever machine the user is on so that he or she won't be bothered by security questions the next time that machine is used to access the site. The idea is that even if a bad guy plants malware on your machine that steals your online banking username and password, he still would have to know the answers to all or most of your secret questions to be able to log in to your account.

 

But here's the rub: SiteKey stores that token in the same place on every user's machine. The updated version of Pinch simply goes into that directory and snags the token, storing it along with the victim's stolen usernames and passwords.

 

Lawrence Baldwin, co-founder of myNetWatchman.com, said he discovered the Pinch feature while observing the behavior of a customer's computer that was infected with the malware. Baldwin said that it was only a matter of time before some clever malware writer incorporated the SiteKey hack, as the methodology was first detailed in a paper published in July 2006 by Jim Youll, chief technology officer and founder of Cambridge based start-up Challenge/Response LLC, a company that builds security solutions for e-commerce companies (as the name suggests -- solutions that may one day compete with the likes of SiteKey).

 

Marc Gaffan, RSA's head of marketing, said while malware that steals victims' security token is not very common, "we are seeing more and more of them coming out." But he cautioned that the company's technology offers additional layers of protection for banks even if a customer's username, password and token are stolen.

 

"The current version of Adaptive Authentication includes technology that even in cases where [the security token] is stolen, [the criminals] are prevented from gaining access to the account," Gaffan said. He declined to give more specifics about those protections, saying he didn't want to "give away the secret sauce."

 

Pinch showcases some of the best (or worst, depending on your vantage point) point-and-click products that the malware industry has to offer these days. All versions of Pinch are created with the help of an extremely sophisticated and configurable virus creation kit called Pinch Pro. The kit, which can be purchased at certain Russian hacker forums, also includes a Pinch Parser Pro, a slick front end program for sorting through the mounds of data that Pinch steals from victims, said Eric Sites, a researcher at security firm Sunbelt Software. For more details on Pinch's capabilities, check out this fascinating write-up from Panda Software.

 

An analysis by anti-virus vendor F-Secure says the guys behind the Pinch trojan are from Russia and the tool is available in both English and Russian languages: "This clearly indicates that the bad guys are working in a professional manner, creating easy-to-use tools to quickly get to the information instead of having just TXT files with loads and loads of text to filter through."

If you don't protect access with IDentiWall, at least read the following…

 

4 things your remote staff should know about your company's data security

Your telecommuters are out there in the ether, along with all your company data.

Julia King

 

Click here to find out more!

 

April 14, 2008 (Computerworld) No matter their job title, business department, industry knowledge, computer savvy and/or exposure to security training, end users are the second-weakest spot in every organization's security fence. They are bested only by one subgroup of employees -- remote workers.

Remote Staff

 

Think of the person who works in a satellite or branch office, perhaps with just one or two other employees. Think of the person who works three days a week at corporate headquarters and then travels with his laptop or telecommutes on other days. Think of the countless salespeople working from hotel rooms, airport gate areas, customer sites and Starbucks shops. These are the people who cause security managers to lose the most sleep.

1. Be aware that almost every data decision has a security implication.

 

Security awareness training typically occurs on an annual basis, yet remote users make hundreds of security choices every week in the course of their work, says Carol Suchit-Hudson, director of citywide security for the New York municipal government.

 

For example, should they pop into the corner coffee shop and hop on its wireless network to answer an urgent e-mail? Or if their flight is delayed, should they use that extra hour to work on that customer spreadsheet?

 

IT's response: One of the best ways to ensure that remote workers make the right decisions is to offer them more frequent training coupled with periodic security reminders that are tailored to the way they work.

 

"The appropriate step is to tweak your education program based on the type of user," says Suchit-Hudson. That means using real-life examples and anecdotes. "No one wants to sit through training that isn't applicable to their needs," she says.

2. Your children aren't afraid to download.

 

"Mom, can I use your computer to check online for my homework?"

 

Answering "yes" to this question -- as many parents do -- can open the gates to security hell, experts say. "Letting kids and others download programs and data of unknown origin onto their machines is one of the biggest worries we have for telecommuters," says Matthew Kesner, chief technology officer at Fenwick & West LLP in Mountain View, Calif.

 

IT's response: Even the most Draconian of usage policies won't end such incidents altogether. Instead, try appealing to users' self-interest, Kesner advises. If a user has downloaded an unauthorized program or left a wireless connection open after working at home, it will really slow their computer down, he notes. "That's how we message it," he adds. One more tip: Regularly monitor users' hard drives.

3. Be a responsible gadget geek.

 

BlackBerries, flash drives, mobile phones and handhelds frequently contain critical corporate data, yet most users treat these relatively low-cost devices far more casually than laptops.

 

IT's response: "Our rule is, if we don't own it, you don't plug it into our network," says Chris Blake, workstation administrator at The Benchmark Group, an architectural and engineering firm in Rogers, Ark.

 

Another option is to instead have users upload and download data from the server and to encrypt all data transmissions, he says.

4 Don't forget it -- shred it.

 

Paper may seem quaint in our increasingly digital world. Yet, it's actually quite dangerous if tossed around carelessly, says Darryl Lemecha, CIO at Vertafore Inc., an insurance software and services company in Bothell, Wash. "Dumpster diving remains a common way for thieves to get information," he says. "People have become quite accustomed to shredding at work, but there are still individuals who work from home who are without a shredder."

 

IT's response: Shredders for all. And they should be cross-cut shredders, so thieves can't piece back together documents that have been torn in only one direction.

How to spot -- and stop -- a spy

Con artists make it their job to extract sensitive corporate intelligence from unsuspecting employees. Here's how to stop them.

Mary Brandel

 

April 14, 2008 (Computerworld) Corporations are woefully unprepared to counter attempts at corporate espionage, say experts who perform vulnerability assessments designed to uncover security weaknesses. U.S. corporations lose as much as $300 billion a year to hacking, cracking, physical security breaches and other criminal activity, according to Ira Winkler, author of Spies Among Us (Wiley, 2005) and president of the Internet Security Advisors Group, which performs espionage simulations and provides other services.

 

Although espionage is usually associated with high-tech approaches involving wireless security breaches and zombified PCs, low-tech tactics such as walking into a building are common, says Johnny Long, a security researcher at Computer Sciences Corp. and author of No-Tech Hacking (Syngress, 2008).

 

"To me, computers are irrelevant," Winkler says. "It's about what data do I want, what form does it take, and how can I steal it?"

 

Any company can be a target, says Peter Wood, chief of operations at First Base Technologies, a U.K.-based consultancy that performs ethical hacking services. Spies are interested in anything from financial data to intellectual property and customer data. They might steal information for blackmail purposes, but "the most common motive for physical intrusion is industrial espionage," he says.

 

Here are several of the most common ploys and the countermeasures you can put into place to spot -- and possibly even stop -- the work of a spy.

Tailgating

 

One of the most disturbingly successful ways for outsiders to infiltrate an organization is also the least high-tech: following an authorized employee through the front door. "In 90% of the companies I've worked with, it's so simple to get in, it's pathetic," Winkler says (Read Winkler's chilling accounts of espionage). To blend in, the spy might hold a cup of coffee or a sandwich, dress in a suit minus the jacket or even wear a counterfeit badge.

 

Antismoking regulations have also made it simple to sneak into buildings through the back door, where smokers tend to huddle, Wood adds. And Long claims to have walked right through delivery or loading dock doors.

 

Once they're inside, spies have lots of ways to access sensitive information. They can pose as IT support personnel, photocopying papers they find on unattended desks or at printers. Or they can just walk into an empty meeting room, plug in a laptop and pull data off the network. In that scenario, a convincing ploy is for spies to work in pairs, with one posing as a consultant and the other as an employee, says Wood, who has used that tactic. If someone enters the room, Wood says he apologizes for the "double-booking" and moves on. "It's just a matter of having the right attitude and being confident," he says.

 

How to stop them: According to Winkler, you can't just establish policies; you must also enforce the rules that prohibit security guards, receptionists and other workers from letting people into the building if they can't prove that they're employees. Companies also need to set clear procedures for reporting suspicious people. No one wants a vigilante culture, "but if you see someone acting unusually, you should make note of what that person is doing," Winkler says. (Read our blogs: Security training doesn't have to be hard.)

Posing as an Employee

 

Spies often pretend to be IT support personnel because it enables them to look legitimate while sitting at users' PCs. The tactic involves either looking for vacated offices or blatantly asking employees to leave their desks so the spy can, say, update the antivirus software. In other cases, spies have posed as cleaning staffers, gaining after-hours access.

 

Winkler says he was once hired to expose a company's security vulnerabilities but was asked to avoid accessing the CEO's system. However, as he was leaving the executive suite, an assistant asked him, "Why didn't you update Mr. So-and-So's computer?" "There I was, sitting at the CEO's desk at a Fortune 50 company," he says. "I tried to avoid seeing anything sensitive, but I had to pretend I was doing something."

 

How to stop them: Employee awareness goes a long way. "Most organizations don't even remotely invest in staff awareness," Winkler says. "Most people seem to assume if you're in the building, you must be OK, and that's a presumption that criminals rely on. You need to have standards for what is and isn't appropriate and then reinforce that with a mind-set of challenging people who don't adhere to those parameters."

 

A second line of defense is to use protective tools like screen savers with password controls, and to encrypt data and require strong passwords for employees with liberal access rights, such as IT administrators and C-level executives. "Most networks are poorly protected," Wood says. "We see trivial, stupid passwords in every firm we visit. Often, the password is the same as the account name."

 

Finally, classify information in terms of how valuable it is and store it accordingly, says Wood. Even by applying encryption and password controls to just the accounts of IT administrators and senior staff members, companies could solve 70% of the problem, he says. "It would make [accessing information] so much more difficult that it would be a major accomplishment," says Wood.

Posing as a Visitor

 

Another way of infiltrating a corporation is by posing as a legitimate visitor, such as a telephone or electrical maintenance person, a burglar-alarm inspector or someone from the fire department checking smoke detectors. Wood says he creates convincing costumes by purchasing a fluorescent jacket and work boots and downloading iron-on logos from the Internet. "The whole thing can cost $7," he says, which goes to show how useless physical credentials like business cards are today. Some things he has found while walking around buildings posing as a visitor include customer account details, payroll data disks, a voice-mail guide with default passwords, information about spending on advertising, bank statements, a staff directory, and whiteboards covered with notes about corporate strategy.

 

How to stop them: The identities of outsiders seeking access to the building must be verified with more than ID cards, Wood says. An employee should ask a visitor to identify his employer, and then the employee should verify the information on the Web and follow up with a phone call to the company to ensure that the visitor is legitimate. "It's tedious but necessary," Wood says.

 

Persistence pays. Once, when Winkler was posing as a person from corporate who needed a tour of a facility, he was interrupted by a manager who asked why he was being shown around. Winkler gave him a West Coast phone number. "It was 8 a.m. on the East Coast, so by the time he could reach anyone, I was out of the state," he says.

Web Applications

 

Of course, not all spies take the low-tech approach; an increasing number are taking advantage of known insecurities in Web applications, according to a SANS Institute report on the Top 20 Internet security risks of 2007. The report names vulnerable Web applications as the top new risk, enabling Web sites to be poisoned, data stolen and computers connected to the Web site compromised. In 2008, the report says, Web application attacks will grow substantially.

 

How to stop them: Web scanning tools can help find application vulnerabilities, especially when combined with source code review tools and application penetration tests. The SANS Institute also recommends inspecting the Web application framework's configuration and hardening it appropriately. "No one should be engaged to write Web applications unless they can pass the GSSP Secure Software Programming exam that covers the essential security skills and knowledge that developers need to produce more secure applications," the report concludes.

Insider Theft

 

An efficient way for spies to work is to pay inside employees to steal information. Often, there's nothing high-tech about the maneuver, Winkler says; employees simply use their existing access rights to download greater volumes of data than they ordinarily should.

 

How to stop them: Use a combination of access control and proactive auditing, Winkler says. For instance, if customer service representatives generally access 30 records a day, he says, and suddenly a couple of people are accessing 100 a day, that's a red flag. So is an employee who suddenly begins accessing data from home, adds Ken van Wyck, a principal consultant at KRvW Associates LLC, a security consultancy in Alexandria, Va. "You're looking for drastic changes in behavior," he says, which can be detected through statistical anomaly detection programs.

 

It's also important to use the access control capabilities of the operating system, van Wyck adds. "People don't take the time to configure these very well," he says. "Many employees can access more than they need to do their job."

 

Another counter-measure is to disable the USB ports through the system's password-protected BIOS or use centralized tools that restrict the use of ports and external devices, according to the SANS Institute report, making it more difficult for wannabe spies to easily export the data.

Keystroke Loggers

 

Spies that get inside buildings can do other damage, such as implementing keystroke loggers. Some of these devices e-mail the keystrokes of anyone using the computer to a predefined e-mail address, while others store keystrokes in flash memory. Many are nearly impossible to detect, such as those that attach directly to the keyboard connector. Wood knows one case where spies pretending to be office cleaners nearly stole $300 million pounds from a U.K. bank using this technique.

 

How to stop them: Physical inspection of the computer is the only way to detect a keystroke logger, Wood says. Because of the impracticality of doing that, one company that Wood knows of now glues all its keyboards into the system unit.

Phishing

 

As defined by Wikipedia, phishing is a form of social engineering in which spies use a collection of techniques to manipulate people into releasing information (such as passwords) or performing actions that compromise confidential data, such as clicking on a link that enables someone else to remotely control a machine. In fact, the SANS Institute identifies phishing as one of the biggest Internet security risks.

 

For example, a spy might call the help desk from a pay-as-you-go mobile phone, claim to be working at home and request that a new username and password be sent as a text message to his phone. And some spies employ what the SANS Institute calls "spear phishing," in which they send individual employees highly targeted e-mail messages that include specific information designed to make the messages look genuine. For instance, a request for usernames and passwords might appear to be from the head of human resources.

 

How to stop them: Wood suggests training staffers to be cautious and giving them tips on how to detect social engineering. For instance, he says, they should withhold information when callers act rushed, drop names, use intimidation, ask odd questions or request forbidden information. There should also be clear policies as to how to report an incident and to whom.

 

The SANS Institute says it's important to continually raise employee awareness of these techniques, perhaps through drills that involve mock phishing attempts. Companies should also avoid exposing too much information on public Web sites, including logos and employee e-mail addresses.

 

Brandel is a Computerworld contributing writer. You can contact her at marybrandel@verizon.net.

FAQ: Clickjacking -- should you be worried?

Nearly all browsers are vulnerable to this new attack class, but details are scarce

Gregg Keizer

 

September 29, 2008 (Computerworld) Last week, a pair of security researchers spread the news that a new class of vulnerabilities, called "clickjacking," puts users of every major browser at risk from possible attack.

 

Robert Hansen, founder and chief executive of SecTheory LLC, and Jeremiah Grossman, chief technology officer at WhiteHat Security Inc., spilled some beans last week after they gave a semi-closed presentation at OWASP AppSec 2008 in New York.

 

Maybe because of the catchy name, or perhaps because it's actually serious stuff, clickjacking got some press. But that still leaves open the question: Just how spooky is it? Are we talking run-for-the-hills scary, or is this just another theoretical attack vector? And what should you do to protect yourself?

 

We have questions, as usual, and fewer straight answers than we'd like.

 

What is clickjacking? Good question. Getting to an answer, though, is a little tough, since Hansen and Grossman are keeping virtually all details confidential, at least for now. Here's how Grossman put it to Computerworld last Friday:

 

    "Think of any button on any Web site that you can get to appear between the browser walls. Wire transfers on banks, Digg buttons, CPC advertising banners, Netflix queue.... The list is virtually endless, and these are relatively harmless examples. Next, consider that an attack can invisibly hover these buttons below the users' mouse, so that when they click on something they visually see, they actually are clicking on something the attacker wants them to."

 

In plain English, clickjacking lets hackers and scammers hide malicious stuff under the cover of the content on a legitimate site. You know what happens when a carjacker takes a car? Well, clickjacking is like that, except that the click is the car.

 

Is clickjacking new? Nope. Not only is it similar to a cross-site request forgery -- a type of vulnerability and attack that has been known since the 1990s -- but Hansen acknowledged that clickjacking goes back several years.

 

Coincidentally or not, Mozilla last week patched a clickjacking vulnerability in Firefox that was, in turn, a variant of a similar flaw in Internet Explorer that Microsoft first patched in 2003, then patched again in 2004.

 

How would a clickjacking attack work? We're not sure -- again, because of the paucity of information. But Michal Zalewski, a renowned security researcher who now works for Google, offered up one example. "A malicious page in domain A may create an IFRAME pointing to an application in domain B, to which the user is currently authenticated with cookies," Zalewski said in a message to a mailing list on Thursday. "The top-level page may then cover portions of the IFRAME with other visual elements to seamlessly hide everything but a single UI button in domain B, such as 'delete all items,' 'click to add Bob as a friend,' etc. It may then provide [its] own, misleading UI that implies that the button serves a different purpose and is a part of site A, inviting the user to click it."

 

In other words, the hacker would dupe users into visiting a malicious page -- through the usual methods -- but then hide the nasty bits under what appears to be the real-deal content from a legitimate site.

 

How bad is clickjacking? Another good question, but again, the answer's a little dodgy. "Attackers can do quite a lot," Grossman said in a blog post two weeks ago when he and Hansen announced that they had pulled their presentation. "Some things that could be pretty spooky."

 

Not everyone's convinced that this is a big deal, however. "The difficult thing is finding out what to do with this," said Dave Aitel, CTO at Immunity Inc., in a message to his Dailydave mailing list on Thursday.

 

In that same vein, there have been few sirens sounded by security teams or organizations. US-CERT, which is under the Department of Homeland Security umbrella, acknowledged the reports but had no new information, and no advice except its standing recommendations for securing a browser.

 

Speaking of which, what can I do to keep clickjackers back? Not much at the moment.

 

Of the few concrete pieces of advice that have surfaced, one requires giving up the Internet as you know it, while the other will put a serious crimp in your browsing.

 

The first way to protect yourself from clickjacking is to switch to Lynx, an open-source text-only browser that harks back to the Web's Dark Ages: 1992. Although Lynx is better known in the Unix/Linux world, there are versions for Mac OS X and Windows.

 

Clickjacking won't work if you're using Lynx, simply because there's no graphic content that an attacker can grab from it to pull over his own malicious code. But text-only browsing is, well, so last century. Hansen, however, said that the combination of Firefox and NoScript, an extension that blocks JavaScript, Flash and Java content, would keep you safe from "a very good chunk of the issues, 99.99% at this point."

 

NoScript, which can be downloaded free of charge, has its drawbacks, though: Unless a user manually enables the switch-off-by-default content, many sites will either be unusable or prohibitively limited.

 

Take note: Giorgio Maone, the creator of NoScript, posted a very interesting entry on his blog Saturday that spells out the add-on's contribution to the clickjacking story. It's well worth reading.

 

When will the clickjacking problems be patched? That's a toughie.

 

Hansen had no clue, really -- although he was certain that the only sensible solution is for the browser makers -- Microsoft, Mozilla, Apple, Opera, Google and others -- to build protection into their applications. "The only people who can fix this in a scalable way are the browser vendors," he said.

 

He and Grossman have connected with Microsoft, Mozilla and Apple so far, companies that together account for more than 98% of the current browser market share. "All are working on solutions," Hansen said, though he's unsure just how high they're prioritizing the problem.

 

In the meantime, Adobe Systems is working on a fix, reportedly for Flash, although Hansen refused to confirm that last week. It was Adobe that convinced the pair to ditch their planned OWASP AppSec 2008 presentation and delay disclosing their research findings.

 

When will we know more about clickjacking? Soon. Hansen and Grossman said they will release nearly all of their research, including proof-of-concept code, when Adobe posts its patch.

Business hacks reap money from e-commerce sites

No '133t' tech skills required in many cases

Tim Greene

 

August 8, 2008 (Network World) Anyone with a sharp eye for flawed business logic and a dim view of business ethics can exploit e-commerce Web sites for millions of dollars, security experts told Black Hat attendees.

 

For instance, one could infer how well a business is doing on the stock market and make appropriate purchases or sales to reap millions, said Jeremiah Grossman, chief technology officer, and Arian Evans, director of operations at White Hat Data Security.

 

Ordering a company's stock online and receiving an order number, then doing the same thing later and comparing the order numbers, which in many cases are sequential, can indicate how much of a company's stock is being traded over that time interval, said Grossman, who with Evans presented "Get Rich or Die Trying -- Making Money on the Web the Black Hat Way." Buying or selling based on that can result in big profit, he said.

 

In addition, White Hat has come across other exploits in its work penetration-testing customers' Web sites, Grossman says.

 

In one instance, an Estonian financial firm managed to crack the URL format used by Business Wire for embargoed press releases that detailed earnings-related data about corporations. The firm used that data before it was public and profited by $8 million before the Securities and Exchange Commission caught the activity and halted it.

 

In a similar case, a Ukranian hacker broke into Thompson Financial for data on a health care firm and reaped $300,000. The SEC froze those funds, but a judge ordered them released to the hacker because the hacker wasn't an insider and therefore couldn't be charged with insider trading. He might have been charged with hacking, but he was in the Ukraine, where official cooperation with prosecution was unlikely, Grossman said.

 

During his talk, Grossman displayed checks for $132,994.97 and $901,733.84 from Google Inc. to people who used "cookie stuffing" to reap payments for driving traffic to Web sites.

 

The way it's supposed to work, someone with a Web site includes a link to an affiliated business' page. If a consumer clicks on it, his computer gets a cookie, and if he buys something later, that cookie notes what Web site referred the buyer, and that site gets a payment.

 

Scammers have developed elaborate schemes to exploit the system, Grossman said, starting with sites automatically hitting visitors with the marker cookie as soon as they visit the scammer's pages. All visitors get the cookie, not just those that click on the link. If a visitor later happens to buy something from an affiliated site, the scammer gets money.

 

E-commerce sites got smart and kicked out affiliate networks that made suspiciously high claims, Grossman said, but scammers responded by stuffing cookies from Secure Sockets Layer Web pages because the cookies don't reveal what pages they came from.

 

Online ordering systems can also be a risk to businesses, Grossman warned. Home shopping network QVC was hit for $412,000 in merchandise by one scammer because of a lag in its online ordering system, he said. Customers could order items online, then immediately cancel the order, but the order would be sent anyway.

 

A North Carolina woman took advantage of this: She ordered and canceled merchandise, then sold it on e-Bay. She was caught only because her customers thought it was odd that she was mailing the items in QVC packaging and reported her.

 

She wasn't prosecuted for selling the goods because they were legally hers, Grossman said. Rather, he says, she pleaded guilty to wire fraud.

 

Other potentially lucrative hacks include:

 

    * Guessing the numbers of online discount coupons and buying merchandise with them. One scammer got $50,000 worth of merchandise and was caught because he entered his new batches of guessed coupon numbers all at once in the middle of the night, causing a suspicious spike in traffic that the merchant noticed. Items were sent to a nonexistent address, and a colluding postal worker intercepted them and turned them over to him. He was prosecuted for mail fraud.

    * Setting up multiple bank accounts and arranging for transfers among them. Before banks actually make electronic transfers, they make a small transfer -- cents or a few dollars -- just to make sure the real transfer will work. Scammers arrange for large transfers to a central account, then cancel them after the dry-run transfer. Enough of those can add up, Grossman said.

    * Cracking captchas, the distorted numbers and letters that some sites use to verify that a human being, not a machine, is contacting the site. Some captchas use the same number-letter combinations over and over, so automated guessing can work to crack them, said Evans. Some sophisticated optical scanners can read captchas, and there are even overseas businesses that offer to break them for cash.

Majority of Web users share personal data online

Carrie-Ann Skinner

 

August 12, 2008 (PC Advisor) LONDON -- Although 84% of Internet users claim they never give out personal details online, the reality is very different, said AOL LLC.

 

According to research conducted by the Web portal, 89% of Internet users have at some point willingly given away personal details online, highlighting that although surfers may understand the dangers of data security online, they don't actually take steps to ensure their safety.

 

"Our research identified a significant gap between what people say and what they do when it comes to protecting sensitive information online," said Jules Polonetsky, AOL's chief privacy officer.

 

The results of the survey also show that 34% of Web users expect to be the victim of credit card fraud online, while only 11% have actually experienced the problem.

 

With this in mind, AOL has launched a privacy education campaign designed to make consumers aware of their ability to easily protect their identity and personal data while online.

 

According to Information Commissioner Richard Thomas, the sharp differences between what people say and how they behave online need to be addressed.

 

"By taking a practical, down-to-earth approach to data protection and privacy, we can simplify good practice for the majority of organizations who seek to handle personal information well. However, it is equally important for individuals to be aware of their information rights and to take steps to protect their own privacy."

Web mail rivals at risk of password-reset hacks

Gregg Keizer

 

Click here to find out more!

 

September 29, 2008 (Computerworld) Yahoo Mail isn't the only Web-based e-mail service that hackers could dupe into giving up user passwords, the tactic that was apparently used to break into the e-mail account of Alaska Gov. Sarah Palin, the Republican nominee for vice president.

 

Google Inc.'s Gmail and Microsoft Corp.'s Windows Live Hotmail also rely on automated password-reset mechanisms that can be abused by someone who knows the username associated with an account and an answer to a single security question, according to tests done by Computerworld.

 

Several reporters were able to access colleagues' accounts on all three services and then quickly reset their passwords. None of the services required the new passwords to be sent to an alternate e-mail address, although all three offered that as an option.

 

Adam O'Donnell, director of emerging technologies at messaging security vendor Cloudmark Inc., said that automated password-reset is the rule in Web mail, whether the service is free or offered to users by ISPs as part of their subscriptions.

 

Personal information that provides answers to account security questions can often be found by searching social networks and other Web sites. The hacker who accessed Palin's account -- a person using the name "Rubico" -- claimed in an online post that it took just 45 minutes to dig up the needed info.

 

David Kernell, the 20-year-old son of a Tennessee state representative, has been connected to the Rubico name in blog posts and online message boards. A federal grand jury in Chattanooga began hearing testimony about the hacking incident last week.

 

Meanwhile, the FBI served a search warrant at the Knoxville apartment of a college student, who was identified as David Kernell by a local television station. And a lawyer who is representing Kernell said in a statement that the student's family "wants to do the right thing, and they want what is best for their son."

 

This version of the story originally appeared in Computerworld's print edition.

dentity theft victim wins right to sue county clerk over posting of personal data

Ohio appeals court reverses dismissal of lawsuit claiming that posting of speeding-ticket image violated privacy laws

Jaikumar Vijayan

September 30, 2008 (Computerworld) An Ohio woman whose identity was allegedly stolen after an image of a speeding ticket containing her personal information was posted on a county government Web site can sue the county official responsible for putting such records online, a state appeals court in Cincinnati ruled last week.

The appeals court reversed a trial judge's decision to dismiss an identity theft lawsuit filed by Ohio resident Cynthia Lambert against Greg Hartmann, the clerk of courts for the state's Hamilton County, which is centered around Cincinnati. Last week's ruling (download PDF) allows Lambert to reinstate her legal claims that Hartmann violated Ohio's Privacy Act, invaded her privacy and unlawfully published "private facts" by posting her personal data on his office's Web site.

The ruling is the latest in a series of controversies involving county governments across the U.S. posting public records containing sensitive personal data on publicly accessible Web sites. Earlier this month, for instance, the Iowa County Recorders Association said it would disable online access to mortgage documents and personal financing statements on a statewide land-records Web site after concerns were raised about the possible compromise of Social Security numbers that are included in some of the documents.

Over the past few years, privacy advocates have warned that county Web sites have become a treasure trove for identity thieves and other fraudsters, and they have pushed government officials to redact personal data from online copies of public records.

The case in Ohio stems from a speeding ticket that Lambert received in September 2003. The ticket, which included her name, Social Security number, driver's license number, home address, birth date and signature, was filed with the Hamilton County clerk's office, and an image of it was posted on the clerk's Web site as part of a policy to make public records available online.

According to court documents, about a year after Lambert received the ticket, she was notified by two separate retailers of large purchases made by someone using her name. Lambert said in her legal filings that a Sam's Club store told her a woman who showed a driver's license that purportedly was hers had bought $8,000 worth of electronics. In addition, a Home Depot store informed Lambert of $12,000 in purchases made by an individual who had opened a credit-card account in her name, again using a fake driver's license.

Lambert claimed that the information used to steal her identity came from the online image of the speeding ticket. She pointed out in her filings that the number on the driver's license used at the stores was different from hers by one digit — exactly how the number had appeared on the county clerk's Web site because of a recording error by the police officer who issued the ticket.

In addition, Lambert noted that a woman who was arrested on and pleaded guilty to felony fraud charges for stealing Lambert's identity had admitted to being part of a gang that misused personal information taken from the clerk's Web site.

In a federal lawsuit filed in late 2004, Lambert charged that Hartmann had acted with willful disregard for her privacy in posting the image of the speeding ticket. She claimed that the clerk had known since at least 2002 that identity theft had been committed by individuals using information gathered from public Web sites such as his, but that he nonetheless had continued to post public records without redacting sensitive data to hide it from public view.

Hartmann, on the other hand, argued that he should be held immune from prosecution because he had authorized the posting of the speeding ticket and other public records as part of his official duties, without any malicious intent or forethought. He also said that at the time the image of Lambert's speeding ticket was put online, there were no laws in Ohio that prevented or limited such postings. And he contended that he couldn't be held liable for publishing Lambert's private data because by definition, the speeding ticket was a public record.

A federal judge dismissed Lambert's lawsuit, which she then refiled in the Hamilton County Court of Common Pleas, where it was similarly dismissed. But last week's ruling by Ohio's First District Court of Appeals — which serves Hamilton County only and is also known as the Hamilton County Court of Appeals — reversed the trial-court decision and said Lambert had established valid claims relating to privacy violations that she had a right to argue in court.

The ruling noted that although there was no law preventing Hartmann from posting public records on the county Web site, he should have known that there was a law preventing personal data such as Social Security numbers from being published online.

In a voice-mail message, Hartmann referred questions about the appeals court's ruling to the county's legal counsel, who didn't immediately return a phone call. The home page of the clerk's Web site includes a notice saying, without further explanation, that public access to court documents has been "temporarily suspended." The notice is undated, although it apparently predates the ruling by the appeals court.

One of the goals of posting public records online is to make them more easily accessible to businesses, such as title companies, that need to access them for legitimate purposes. But the trend has resulted in many counties making public records containing Social Security numbers and other personal data available to anyone with Internet access.

States such as California and Florida have enacted laws that require counties to redact personal data from documents before making them available online. As a result, most of the sensitive data that can be found on Web sites is in older records that had already been posted. But with some sites holding tens of millions of documents altogether, the number containing personal data can easily run into the hundreds of thousands per site — leaving counties facing big redaction efforts and costs.

 

Researcher finds evidence of massive site compromise

Digs up cache of 200,000 site credentials for Fortune 500 firms, weapons makers, governments

Gregg Keizer

 

Click here to find out more!

 

October 3, 2008 (Computerworld) Several criminal gangs have acquired administrative log-in credentials for more than 200,000 Web sites -- including the one used by the U.S. Postal Service -- and have used the compromised domains to attack unsuspecting users' PCs with a notorious hacker exploit kit, a researcher said today.

 

More than a month ago, Ian Amit, director of security research at Aladdin Knowledge Systems Inc., found and infiltrated a server belonging to a longtime customer of Neosploit, a hacker tool kit used by cybercriminals to launch exploits against browsers and popular Web software such as Apple Inc.'s QuickTime or Adobe Systems Inc.'s Adobe Reader.

 

On that server, Amit uncovered logs showing that two or three hacker gangs had contributed to a massive pool of Web site usernames and passwords. "We have counted more than 208,000 unique site credentials on the server," said Amit, "and over 80,000 had been modified with malicious content."

 

The site credentials were only the means to an end: The 80,000 modified sites were used as attack launchpads. Each served up exploit code provided by the Neosploit kit to any visitor running a Windows system that had not been fully patched.

 

By examining the server logs, Amit was able to identify the sites whose log-ins had been compromised; he is now working with law enforcement agencies in both the U.S. and overseas, as well as with organizations like the CERT Coordination Center, to tell site operators they need to change their administrative passwords, purge the malicious code and secure their sites.

 

The only compromised site he would name was the U.S. Postal Service's at www.usps.gov. That site and others have been cleaned of the code that calls Neosploit down on unsuspecting visitors. Also on the list were sites for governments and Fortune 500 companies, universities and other businesses, including several unnamed weapons manufacturers. More than half of the affected sites belong to European companies and organizations.

 

Other evidence that Amit gathered ranged from the way the criminals processed the site log-ins to the number of IP addresses authorized to access the credentials.

 

"The server-based application that validated the credentials and then modified the sites was completely automated," said Amit. "Access to that application was restricted to about six or seven IP addresses, [so] it's clear that that access was intended only for the use of the criminals using the server." Based on the number of IP addresses and their distribution, he estimated that two or three separate groups were involved.

 

More than half of the site credentials -- approximately 107,000 -- had been validated by the cybercrooks' custom application as providing administrative access to the sites.

 

The groups apparently pooled resources, with site log-in information contributed by multiple users. Amit was not, however, able to determine how the criminals came to the site credentials in the first place. It's possible, he said, that the log-ins were purchased from others or harvested by a botnet dedicated to the job.

 

But even with such clues, Amit isn't confident that authorities might be able to identify the hackers. "As much as I'd like to optimistic, I'm not fooling myself. They're using a software-as-a-service model, and it will be hard to track down all of them," he said. However, he acknowledged that authorities had "a few solid leads" on who's responsible for the server, which may lead to the hackers. The server, for instance, was relocated since last week from Argentina and is now being hosted in the U.S.

 

"We've exposed the back-end infrastructure of the organization," Amit said. "We've been chasing bugs for a couple of decades now, and we need a different approach. That's what we have here. Now we know more about their M.O. and their business model.

 

"I hope that this will help both law enforcement and security researchers stay ahead of the game," he said.

The grim situation of identity theft

 

The following is some statistics which were published lately:

 

1. Hacking has changed in the last two years from young hackers who preformed their act for their amusement and sense of achievement, to professional organized crime.

 

2. In the last 12 month ended in July 2007, there were 15 million reported cases of identity theft in the US alone.

An average damage cost of such identity theft was $3,648. This mounts to a total of around $50 billion.

This is a staggering upturn of about 100% from a year before. If this trend continues, and according to experts it will, we’re facing a $100 billion problem this year in the US alone.

It is apparent that we’re facing an identity theft tsunami.

 

3. Almost 80% of internet users use the same password they use at work when asked to open an account in a web site.

 

4. The latest Wikipedia scandal, of commercial companies employing writers who tamper the Wikipedia articles in a way that will favor the companies they work for, revealed also a counter measure that Wikipedia intend to use.

It is small free code software which is able to discover the fact that the update to the article comes from a certain company’s network.

 

5. A Trojan horse that will send the user’s credentials off to the criminal costs $600.

 

6. A list of one million emails addresses costs $100.

 

7. Renting a spam server which will send out millions of emails costs $500.

 

8. It is believed that around 10% of the users are falling in phishing traps.

 

9. So, a phisher who sends out 1 million of emails with a Trojan horse is expected to get 100,000 credentials.

 

 

To summarize the situation, we’re dealing with organized crime who is phishing for our identities through offering us goodies in innocent looking web sites such as “free ring tons”, “free news and services” or others.

They have the ability to discover the company we work for, our bank and ecommerce accounts and are willing to make use of all that.

 

Scary!!!!

 

Hackers hijack a half-million sites in latest attack

They're exploiting phpBB open-source forum software, says researcher

Gregg Keizer

 

May 12, 2008 (Computerworld) More than half a million Web sites have been compromised in a new round of attacks that hacked domains in order to infect unsuspecting users' PCs with a variety of malware, a security researcher said today.

 

"This is an ongoing campaign, with new domains [hosting the malware] popping up even this morning," said Paul Ferguson, a network architect at antivirus vendor Trend Micro Inc. "The domains are changing constantly."

 

According to Ferguson, over half a million legitimate Web sites have been hacked by today's mass-scale attack, only the latest in a string that goes back to at least January. All of the sites, he confirmed, are running "phpBB," an open-source message forum manager.

 

Ferguson didn't know how the sites were compromised; Trend Micro's investigation is in progress, he said. "We're not sure if it's [because of] improper configuration of phpBB or a vulnerability. Open-source applications like phpBB tend to be targeted quite a bit."

 

Visitors to a hacked site are redirected through a series of servers, some clearly compromised themselves, until the last in the chain is reached; that server then pings the PC for any one of several vulnerabilities, including bugs in both Microsoft's Internet Explorer and RealNetworks' RealPlayer media player. If any of the vulnerabilities is present, the PC is exploited and malware is downloaded to it.

 

Some of the compromised sites have been hijacked before, said Ferguson. "Some had recently been used for keyword search ranking manipulation, and others to pitch fake pharmaceuticals or just malware," he said.

 

Although other research by Trend Micro identified the malware hitting users' PCs as a variant of the Zlob Trojan horse, Ferguson said that more than just one piece of malware is being served. "We seeing some new stuff coming out of this one," he said.

 

The last massive site attack was less than three weeks ago, when sites that included government URLs in the U.K. and some domains operated by the United Nations were hacked. At the time, some researchers said that bugs in Microsoft's SQL Server or Internet Information Services server software were to blame. A few days later, however, Microsoft denied responsibility.

 

Don't expect the run of site infections to stop anytime soon, said Trend Micro's Ferguson. "As long as attacks are tied to site development and as long as sites don't secure their content, we'll see these attacks," he said.

New phishing attempt targets bank customers

Many people are wondering what to do now that their bank has been acquired in the wake of the lending crisis. Well, whatever you do, don't click on links in e-mails purportedly sent by your bank.

Security firm SonicWall said Thursday that it has been seeing e-mails that attempt to lure people to fake bank Web sites, where they are asked to re-verify their personal and bank information as part of a merger.

In one example that targets people affected by the Chase acquisition of Washington Mutual, the e-mail asks recipients to click on a link and confirm their identity so Chase can "activate new security features for our new and old online banking customers."

The link goes to a fake Chase Web site that asks for account log-in and other information, said Andrew Klein, a product manager at SonicWall. The scammers are gathering the information to sell to cybercriminals who will use it to transfer money out of victims' accounts or commit identity fraud, he said.

"Banks wouldn't do this online," Klein told CNET News. "Traditionally, what happens is you get a letter in the mail."

Phishers and scammers commonly exploit news events to lure victims to sites that contain malware or that ask them to supply information. Cybercriminals are even using Google Trends to find out what Web search terms are the most popular in order to make sure they have timely and relevant content on their sites with which to attract victims.

But this particular type of phishing attempt is particularly dangerous given how confused many consumers are about what the bank acquisitions will mean for them.

To test your knowledge of phishing and spam, try taking this SonicWall quiz.

This phishing attempt tries to get people affected by the Chase-Washington Mutual merger to give up their bank account information.

 

Protect your online business against identity theft

Identity theft is big business. Online transactions are vulnerable to phishing, man-in-the-browser and other ingenious attacks. Here are some known examples:

Man-in-the-browser – A "Trojan horse" changes the contents of the form that the customer submits to the bank website. The change is not noticeable in the form itself. It takes place only in computer memory. It takes place before SSL encoding.

Man in the Middle - Rogue software is put in place at some point between the customer computer and the bank web sites and intercepts all the information transmitted between the customer and the bank.

Key Logging – Software implanted in the customer's computer that records all the keystrokes of the customer, providing a complete record of user IDs, passwords, pin codes, account numbers and transactions. Sometimes this is integrated with additional rogue software, and usually it sends the information it has collected to the hacker.

Session Hijacking – The session is hijacked by unauthorized use of the cookies deposited by the banking site.

Pharming – Pharming is diversion of traffic from a legitimate site to a rogue web site.

Phishing – Customer identity details are stolen. Typically, this is carried out in a place and context removed from the bank web site, such as a fraudulent e-mail asking for information.

Site Cloaking – Cloaking fools search engines by disguising one web site as another.

Cross-Site Scripting – A script is injected to one web site or web log, but it is operated at a different web site.

OS command injection – Injection of operating system commands to be carried out at the web site.

SQL Injection – Injection of SQL queries to be executed at the web site.

Cookie tampering – Information in the cookie is changed to allow an attack.

Form Tampering (read-only and hidden fields) – Changes are made in hidden or read-only fields in the HTML form.

Outbound Data Theft – Data sent from the web site are intercepted for use in attacks. For example, that may include data about the software installed at the site, version number etc.

Application Denial of Service - Numerous types of attacks make use of the possibility of entering rogue information in input fields.

Identiwall provides an ingenious, inexpensive, easy to install, easy to use and highly secure system for multi-factor authentication and confirmation of online transactions. Click here to learn more about Secure online financial transactions