Category: Trends

http://www.securityfocus.com/brief/299?ref=rss

“We’ve seen criminals hack into hospital systems just to get the Social Security numbers of the newborns. There’s no one, obvious group of organizations that hackers are targeting.”

There are still plenty of independent hackers out on the Web — just look at the recent Black Hat and Defcon conferences — who might sell vulnerabilities or stolen data by putting them up for auction.

Worms and viruses invented by independent hackers still make up a huge portion of the damage done to corporations each year, Pierson notes.

But the visibility of these individuals and their exploits sometimes belies the growing, but largely unpublicized threat from organized criminals who buy data from hackers or insiders and sometimes contract with them to collect data from a specific corporation, experts agree.

Pierson gives the example of stolen customer credit card data, which is sometimes handled by multiple individuals in a joint effort. While credit card information might be collected through the collaboration of phishers and spammers, that data might then be passed to “cashers” who forge credit cards that use the numbers. Then those cards will be passed out to a network of “mules” who use the cards for small purchases — the kind that might not be immediately detected by the victim — and thrown away. Then the syndicate of players might sell the account information to another buyer, just as the parts of a stolen car might be resold. A similar sort of “syndicate” might be formed to fence stolen business secrets or customer lists to competitors, or to other nations or terrorist groups, he says.

External hackers may be paid off; insiders may be disciplined or dismissed; and in some cases, the crime is never detected. Although there are cases in which external hackers break into an enterprise they find attractive, most targeted attacks involve some help from an insider, experts say.

http://www.darkreading.com/document.asp?doc_id=103198&WT.svl=news2_1

Auditing woes mostly stem from improperly securing user machines and servers, according to the council’s findings. “The problems being flagged in audits are in user and access controls on PCs and laptops, audit reporting and problems in configuration change management,” Hurley says.

Those with poor audits are spending 43 percent of their IT budget on security equipment and software for IT compliance and those with successful audits, 52 percent. “They are taking money out of labor and putting it into automating the processes” such as measurement and monitoring IT compliance across the board, Hurley says.

“The organizations [surveyed] doing continuous monitoring had the least number of audit deficiencies.”

Meanwhile, security firms that perform vulnerability assessments and penetration testing say regulatory compliance is driving much of their business today. Steve Stasiukonis, vice president and founder of Secure Network Technologies, says regulatory compliance pressures from SOX and HIPAA, for instance, are one of the main reasons his clients hire him.

http://www.darkreading.com/document.asp?doc_id=103041&WT.svl=news2_5

“It gave you a device to protect your vulnerable systems behind the network from SQL Slammer, Blaster, etc.,” says Richard Stiennon, president of IT-Harvest. But major worm infestations aren’t the problem any more: “The trouble is what we’ve really been doing for the last four years is vulnerability and patch management. “The driver for IPS hasn’t really been there.”

In some cases, the technology is being integrated into hardware and services; in other cases, it is evolving to offer new capabilities.

Arbor Networks’ Morville says service providers and managed security service providers meanwhile are already delivering firewall and IPS-based services, and that trend of blended security services will “accelerate” over the next few years.

Switches, too, are already coming with some IPS technology: Cisco, for instance, sells blades for its Catalyst switches with IPS functionality.

What about the signature-based limitations of IPSes? IPS will also converge with anomaly detection and other features that expand its inspection capabilities beyond known threats, experts say. Rate-based anomaly detection, such as spotting a traffic flood, makes sense at the perimeter, Morville says. And behavioral anomaly detection — where you’re looking for individual people or hosts acting outside the norm — is best for the internal network, he says.

Some experts envision IPSes deploying virtual machine technology — as FireEye’s does with its network access control (NAC) appliance –where virtual machines run copies of incoming traffic to see if it’s legit, rather than just using signatures. The trick with a beefed-up IPS is getting good performance, though: Hardware would have to catch up to make it viable, especially if virtual machine-based features are added, says John Pescatore, a vice president with Gartner.

http://www.darkreading.com/document.asp?doc_id=102608&WT.svl=news1_3

“It’s a great alarm system — there are no false positives with honeypots.

Honeypots have long been used in research networks, federal government agencies (especially the Department of Defense), and law enforcement for tracking potential attacks, attackers, or perpetrators. One such application would be for detecting an internal user’s suspicious activity on the network, or if an outsider was poking around the network from the inside, says Logan. “Most times attackers will use an [enterprise’s] server or end-user PC to further explore the enterprise, so you could have an employee unwittingly being used.”

But once you put up that sexy honeypot and attackers start buzzing around, you’ve exposed yourself, critics say. Thomas Ptacek, a researcher with Matasano Security, says honeypots not only invite trouble, but they also generate operational overhead that most organizations don’t have the manpower to handle. Arbor Networks has a “dark IP” monitoring feature that uses unused IP addresses within an organization for the honeypot machines, so it’s obvious when an attacker is knocking. It used to run honeypots on its DMZs, says Mark Butler, manager of security and compliance services for H&R Block. The devices detect an attacker’s reconnaissance behavior and respond with “fake” information using ForeScout’s proprietary honeynet technology. “It gives me trends, such as what type of behavior is going on,” and if connections are coming from Russia, for example, and at what frequency, says Butler, who acknowledges it doesn’t catch everything.

“Once you turn on a honeypot in your network, you’ve created something to keep you up at night,” says Jeff Nathan, software and security engineer for Arbor Networks.

http://www.darkreading.com/document.asp?doc_id=102139&WT.svl=news1_2

Firstly, RuSpy.A is a Trojan that obtains user names and passwords for a range of programs including ICQ, Internet Explorer, Mozilla, Outlook and The Bat! This information is then sent to the creator in an email message. To avoid detection, it tries to terminate several processes belonging to security tools (antivirus programs and files).

Another widespread fraud technique is to hijack computers. This is what the Tervserv.A backdoor Trojan does.

Finally, this week’s report looks at Banker.DZO. This is a Trojan that monitors Internet traffic generated when a user accesses the web pages of Banco de Brasil, Bradesco, CEF, GERENCIADOR, Itau and Brad.Juridico.

http://www.it-observer.com/news/6645/weekly_report_viruses_intruders/