Skip navigation

Category Archives: Security

Barack Obama

Barack Obama

The Obama administration will appoint the first US cyber-security chief to oversight network security.

In a briefing on Friday (29/05/2009), Obama said the cyber threat was “one of the most serious economic and national security challenges” facing the US.

He said economic prosperity in the 21st century would depend on cybersecurity, and that acts of terror could come from a few computer key strokes.

“Yet we know that cyber intruders have probed our electrical grid and that in other countries cyber attacks have plunged entire cities into darkness,” he said, citing the cyber-attacks on Georgia last year as Russian tanks rolled into its territory.

“From now on, our digital infrastructure — the networks and computers we depend on every day — will be treated as they should be: as a strategic national asset.”

He revealed that his election campaign last year had been subject to computer attacks. “Between August and October, hackers gained access to emails and a range of campaign files, from policy position papers to travel plans,” he said.

Obama said federal agencies – such as the Pentagon, Homeland Security, the FBI, and the NSA – had overlapping missions and did not coordinate well.

“We saw this in the disorganized response to Conficker, the Internet ‘worm’ that in recent months has infected millions of computers around the world.”

The new Cybersecurity Coordinator would be a member of the National Security Staff and on the staff of the National Economic Council.

Although most critical information infrastructure was in the hands of the private sector, Obama said the government would not set standards for private companies.

IT security firms said they looked forward to seeing details of the security framework, including a new security architecture.

Separately, the Pentagon is planning a new cyberspace military command to conduct offensive and defensive operations online, Reuters reported.

“We view cyberspace as a warfighting domain that we have to be able to operate within,” said Pentagon spokesman Bryan Whitman.

Author : Robert Clark
Source : TelecomAsia

Internet service providers (ISPs) face a growing problem with the rise in botnets, malware that takes control of large numbers of computers. Over the last several months, the Conficker (sometimes called “Conflicker”) botnet has infected more than 10 million machines by some estimates, dwarfing previous botnets by an order of magnitude. Security researchers have also discovered iBotnet, the first large scale Mac botnet, and Psyb0t, the first malware to take over Internet routers.

These trends pose challenges for cable operators. One task is to alert customers without frightening them. In a March 31 post to the Comcast voices blog site, Comcast Senior Director of Security and Privacy Jay Opperman described Conficker and possible preventive actions.

On the macro level, the biggest problem is the increase in Internet traffic associated with spam campaigns and distributed denial of service (DDoS) attacks, in which millions of compromised computers simultaneously send traffic to a Web site to disrupt service. Earlier this year, Time Warner Cable reported that its services had slowed because of a DDoS attack against its DNS servers.

A cat-and-mouse game is playing out between security experts creating tools for finding viruses, Trojan horses and worms, and hackers finding new ways to circumvent them. Success lies in joining multiple elements rather than finding a single weakness. The massive spread of Conficker illustrates this shift in strategy.
Analysis of a botnet

Starting in November, Conficker spread between Windows computers through a vulnerability that had been patched by a Microsoft Windows update a month earlier. Within a few days, millions of computers had been infected, particularly in countries like China, Russia and Brazil, where pirated copies of Windows did not receive security updates.

After the initial infection, the criminals updated the software so that it could infect other computers via USB drives and local area networks (LANs), even ones that had received the Microsoft patch. A single unpatched laptop could infect an entire office when it was brought into work. Massive infections were reported worldwide, including military computers in the UK, France and Germany.

Then the criminals added more features that blocked infected computers from going to Web sites of security companies and blocked security applications, making it more difficult to remove the malicious software. It was not until four months after it was launched, when the Conficker code had taken control of millions of computers, that it began its first malicious activities. In early April, infected computers started installing scareware and spam software. Scareware tells users they have been infected, but that the virus can be cleaned out if they spend $50 on bogus security software.

As of this writing, no one has found the Conficker authors, even though Microsoft has posted a $250,000 reward, and security personnel have launched one of the biggest bot hunts in history.
Tracking the botnets

Botnets communicate with their controller and locate potential targets over the Internet, which provides ISPs and security personnel an opportunity to study them and, in some cases, control or dismantle them.

Deep packet inspection (DPI) lets cable operators see botnet traffic in progress. In some cases, operators have blocked traffic for IRC, a service commonly used for managing botnets. However, these tactics can anger legitimate users.

Botnet owners typically cause the machines to check in with a server at a specific domain name. Initially, Conficker was instructing infected machines to check 250 different domain names every day to find one with an update or instructions. Hackers only had to control one domain name to send out new commands. But security professionals were able to secure all of these.

The Conficker authors raised the bar to having the zombies check 500 out of 50,000 different domain names every day; despite this large number, security professionals succeeded in locking all of these Web sites out of the hands of the hackers, noted Jose Nazario, manager of security research at Arbor networks.

Infected machines downloaded new updates only because hackers had developed another mechanism to send updates via a peer-to-peer (P2P) network. Nazario said that because of the success of their efforts at blocking these attacks, the hackers eliminated the mechanism for checking Web sites for updates.

The future of security looks more like a partnership among service providers, Internet routing and DNS organizations, security personnel and law enforcement. As criminal hackers become more sophisticated, no one magic bullet will solve the security challenge.

An unintended benefit of Conficker is that it raised the security bar. Nazario said: “It is encouraging that so many folks could put aside competitive differences and work together for a common goal that cuts across different silos in operations and research communities. Traditionally, the folks that do routing, run DNS servers, and security researchers don’t talk to each other. This was a huge change.”

Author : George Lawton

Online attack code has been released targeting a critical, unpatched flaw in the Firefox browser.

The attack code, written by security researcher Guido Landi was published on several security sites Wednesday, sending Firefox developers scrambling to patch the issue. Until the flaw is patched, this code could be modified by attackers and used to sneak unauthorized software onto a Firefox user’s machine.

Mozilla developers have already worked out a fix for the vulnerability. It’s slated to ship in the upcoming 3.0.8 release of the browser, which developers are now characterizing as a “high-priority firedrill security update,” thanks to the attack code. That update is expected sometime early next week.

“We… consider this a critical issue,” said Mozilla Director of Security Engineering Lucas Adamski in an email.

The bug affects Firefox on all operating systems, including Mac OS and Linux, according to Mozilla developer notes on the issue.

By tricking a victim into viewing a maliciously coded XML file, an attacker could use this bug to install unauthorized software on a victim’s system. This kind of Web-based malware, called a drive-by download, has become increasingly popular in recent years.

While the public release of browser attack code doesn’t happen all that often, security researchers don’t seem to have much trouble finding bugs in browser software. Last week, two hackers at the CanSecWest security conference dug up four separate bugs in the Firefox, IE and Safari browsers.

Source: Network World Asia By Robert McMillan

The message that popped into Laurie Gale’s Facebook inbox last month seemed harmless enough — a friend had seen a video of Ms. Gale and had sent a link so Ms. Gale could view it. The link led to a video site that prompted her to update her video software, which she did.

“Within seconds, everything started shutting itself down,” says Ms. Gale, a 37-year-old lamp-works artist from Versailles, Ky. Ms. Gale’s new Dell Inspiron laptop had been infected with malicious software, or malware, that has spread through social networking sites like Facebook and MySpace.

“I cried for an hour,” Ms. Gale says. It took a trip to the local computer repair shop and several phone calls with Dell customer-service representatives for her to restore the computer to its factory settings. “It was three days of torture.”

The popularity of social networks and social media sites has grabbed the attention of cyber crooks searching to pilfer passwords, called “phishing,” and steal sensitive personal information. The hackers are exploiting users’ sense of safety within these sites, says Pat Clawson, chief executive of Lumension Security, a computer security company.

Earlier this month, Twitter, a social site in which users communicate in short bursts of text, was hit in a campaign to steal users’ account passwords. On business-networking site LinkedIn, criminals set up fake celebrity profiles that, when visited, downloaded malware onto users’ machines.

Malware attacks in social networks are just as dangerous as ones conducted via email, security experts say. Hackers can mine infected computers for sensitive data like log-ins and passwords to financial sites. Infected computers can also be used to send out spam emails by the thousands.

Since the messages appear to come from friends, users often think they are safe, says Jose Nazario, a security researcher at Arbor Networks, a network-security company in Chelmsford, Mass. “I think the No. 1 thing that people have to remember is that it’s not as gated of a community as you think it is,” he says.

The malware that has made its way through social networks differs from the so-called “Conficker” worm that has spread to millions of personal and business computers in recent weeks, according to security experts. On social networks, malware writers typically trick users into infecting their own computers. The Conficker worm spreads though a vulnerability in Microsoft Windows and infected USB drives.

The attacks via social networks vary in means and intent. Messages may lure users with requests to click on a link to look at a photo or a video. The link may take the user to a phishing site or a site with malware. Some of the spam may be harmless advertising, but users should never risk clicking on such links, security experts say.

Sonny Holmes, a new Facebook user, got a message from his daughter in December about a photo she saw of him. He clicked on the link, and it sent him to a site that asked for his email account, Social Security number and several personal health questions. “I decided post haste that I wasn’t going to answer any of those questions,” says Mr. Holmes, a 59-year-old pastor from North Charleston, S.C.

Later, his Facebook account started spamming all of his contacts. His laptop slowed to a crawl. Mr. Holmes had his church’s information-technology department look at the computer, which the tech person was able to repair. Now “I’m very suspicious of things people send me,” Mr. Holmes says.

Fewer than 1% of Facebook’s 150 million users have become infected with malware using the site, says Max Kelly, Facebook’s director of security. The site started seeing an uptick in malware attacks last summer.

Facebook uses automated systems to watch for unusual activity like accounts spamming their contacts, Mr. Kelly says. Once a compromised account is detected, Facebook will have the account’s passwords reset, and spam messages get deleted. Facebook says it will pursue legal action against parties targeting its users. Just last year, the company filed a civil suit and was awarded $873 million in damages in a default judgment against Atlantis Blue Capital and its Canadian owner for sending Facebook users unsolicited advertisements. The company’s owner couldn’t be located for comment.

MySpace saw malware attacks last summer, though the company says it hasn’t had any reports of it in recent months. Only a “negligible amount” of MySpace’s users have been infected with malware, according to the company. (MySpace is owned by News Corp., which also publishes The Wall Street Journal.)

Twitter co-founder Biz Stone says programmers at the site improved the log-in security after a phishing campaign snared unsuspecting users. In it, users were sent messages saying something like, “Hey, check out this funny blog about you,” along with a link. The link took users to a phony Twitter log-in page where users were prompted to enter their passwords.

Mr. Stone says Twitter has a team that investigates malware threats, phishing attacks and spam on the site. The company also has automated processes that monitor for and delete malicious messages and links, he adds.

LinkedIn Corp. took action when phony accounts of celebrities promised nude photos. The accounts led to sites that contained malware. LinkedIn officials say they removed the fake accounts, but declined to say whether any users’ computers were infected.

“We take these matters very seriously and remove these kinds of inappropriate profiles,” says Kay Luo, a spokeswoman for LinkedIn. “In addition, we are continually adding new technologies and security protocols to prevent this type of abuse.”

Users should use the same caution with messages on social networks as they would with email, says Ryan Naraine, a security expert with Kaspersky Lab, a computer-security company. Users should be especially wary of any messages from friends that don’t sound like their friends wrote them. If they don’t normally write OMG in a message, it’s probably not them, says Mr. Kelly, Facebook’s director of security.

Source: The Wall Street Journal by Joseph de Avila.

Today (11/08/2008), when I logged into my facebook account, I saw a fall post from my friend.
The msg was,

” Somebody wrote something really funny in their blog.
see it here http://glendazylymo.blogsp
ot.com

Once you go to the given URL, it redirect to another URL,

http://faceilbook.com/
or
http://logonsish.com/fb/index.htm
[Note that this site is a perfect imitate to facebook site.]

If you use firefox new version (2> or 3) with phishing protection enabled or a new IE ( I use ver. 7.0.5730.13),
fine, you get the warning msg.

Otherwise you may be a victim.

I THOUGHT IT IS GOOD TO SHARE THIS WITH YOU ALL.
IF YOU TOO LIKE TO SHARE WITH YOUR CARED ONCE, SPREAD THE NEWS VIA EMAIL.

Cheers!