Category: Trends

“2004 was distinguished by a number of major epidemics caused by e-mail worms such as MyDoom, NetSky, Bagle, and Zafi,” said Alexander Gostev, a senior analyst with Moscow-based Kaspersky Labs, in a report he authored on the security situation for the first quarter of the year. “However, late 2004 and early 2005 were free of such outbreaks, with nothing on the scale of even the mid-sized outbreaks of 2004,” Gostev added.

The decline in destructive power of e-mailed worms may be due to anti-virus vendors developing new technologies to address them, including detecting worms in compressed .zip files and pre-scanning messages with executable attachments, but he also gave credit to Microsoft for patching several Outlook and Outlook Express vulnerabilities.

“The increased media focus on malicious code and security issues has resulted in end users being noticeably more cautious about opening e-mail attachments, especially those from unknown sources,” he noted. “They’ve been effectively displaced by network worms incorporating Trojan components,” he said.

Even though Microsoft has released a record number of patches in the first four months of 2005, “no new vulnerabilities as serious as the LSASS or RPC DCOM vulnerabilities have been detected in Windows so far this year,” said Gostev in his report.

Mass-mailed worms and vulnerabilities may be down, but phishing — as almost everyone knows — is on a rocket ride, and spyware is the security buzzword of the year so far. “Several billion dollars are currently invested in virtual worlds and role-playing games, a sum equivalent to the budget of a small country. Naturally, [that] hasn’t escaped the attention of cyber criminals.

http://www.techweb.com/wire/security/161501182

IM-Worms
Worms that propagate via Internet messaging services by sending URLs to all contacts in the local contact list. The URLs take incautious users to websites containing the body of the worm. This approach is also often used by email worms.

One of the most interesting developments in 2005 was the appearance of worms for instant messenger applications. Instant messenger applications have become very popular, but users rarely perceive them as potential infection vectors. The source code for some early IM-worms was also published on a number of virus writers’ sites, and most of the new worms are clearly based on this code. As P2P-worms were simple to create, and spread rapidly, several hundred families appeared, with numerous versions in each. Kaspersky Lab monitored P2P networks closely during the upsurge in P2P-worms and analysis showed that almost every second file in the Kazaa file-sharing network was a P2P-worm. Despite the fact that Internet messaging services allow file transfer, for some reason virus writers are not utilizing it as a method of infection, possibly because they find overly complex. The worm penetrates victim systems either by exploiting Internet Explorer vulnerabilities or simply by downloading and installing the malicious code. Monitoring incoming http traffic for malicious code (which should be part of any responsible security policy) will block those worms which penetrate via browser vulnerabilities.

Botnets
Initially, infected computers were linked via an IRC channel and received commands from the remote user via IRC, and this is still the most popular way of controlling botnets from a single central point and is used by the Agobot, Rbot and SdBot families, which are the most common malicious bots. Mydoom would open a single port in the range between 3127 and 3198 which gave anyone access to the infected system. The Internet was flooded with worms attempting to penetrate computers already infected by Mydoom. Virus writers also wrote scanners that allowed potential controllers to search computers for the Mydoom backdoor component: if the backdoor was detected, the new controller would drop and execute new malware on the infected machine. At the height of this outbreak, infected machines were passing from controller to controller several times a day. All of these infected machines are being actively used by cyber criminals as spamming platforms in order to make money. Botnets can also be used in DoS attacks and to spread new malware – such threats often lead site owners to pay cyber criminals not to attack their sites. Detection and prevention of botnets should be a priority for both the IT industry and end users, since the future of the Internet depends on coordinated action now.

Email Worms
2004 was distinguished by a number of major epidemics caused by email worms such as Mydoom, NetSky, Bagle and Zafi. However, late 2004 and early 2005 was free of such outbreaks, with nothing on the scale of even the mid-sized outbreaks of 2004.

Social engineering
I.e. techniques used by cybercriminals to trick end users into sharing confidential data, continues to evolve. According to data from the Anti-Phishing Working Group, in January 2005 phishers sent 12,845 unique phishing letters leading to 2,560 spoofed websites. The public fear of spyware has also been exploited by Adware writers and other cyber -fraudsters to penetrate victim machines.

No new critical Windows vulnerabilities
Isolated attacks notwithstanding, the fact that older versions of Windows do not have critical vulnerabilities, and the encouraging trend of more and more Windows XP users installing Service Pack 2 gives hope for the future. The current lack of worldwide outbreaks can be partially acounted for by two important factors: no new serious vulnerabilites in Windows and the migration of users to Windows XP with Service Pack 2.

On the other hand, security holes in Internet Explorer are responsible for a significant number of infections. Kaspersky Lab data shows that the MHTML URL Processing Vulnerability (CAN-2004-0380) is the loophole currently most frequently exploited by virus writers. This vulnerability makes it possible to hide executable files written in VBS or JS in CHM files (Microsoft Compiled Help) and post links to the infected files on the Internet. When an infected CHM file is opened, the hidden files are executed in the Local Internet Zone with current user rights.These scripts are usually Trojan Downloaders or Droppers that install other Trojans on the victim machines. However, this vulnerability is not new and Microsoft issued the MS04-013 patch for it over a year ago on April 13, 2004, meaning that users do have the ability to protect themselves against such attacks.

On-line games: a new arena
Contemporary cyber criminals don’t only steal banking and financial details. Games have achieved enormous popularity since their first appearance, and individual items and/or characters in various on-line games are sold for tens of thousands of dollars in on-line auctions. For instance, a virtual island from “Project Entropia” was sold, for $26,500, the largest amount spent at any one time in online-gaming history. In short, several billion dollars are currently invested in virtual worlds and role-playing games, a sum equivalent to the budget of a small country. Naturally, the presence of real money in on-line games hasn’t escaped the attention of cyber criminals.

The first cybercrime targeting on-line games was committed in early 2003, when Trojans designed to steal user account data to the Asian game Legend of Mir were detected. And two years on, there are more than 700 known malicious programs which target Legend of Mir. Detailed analysis of these programs shows that most of them originate in South Korea and China. The first Trojans attacking Lineage were detected by Kaspersky Lab virus analysts in October 2004; in less than six months the number of such malicious programs has grown to several hundred.

Among the most recent programs targeting online games is a family of Trojans designed to steal personal information from Gamania players. The first one was detected in February 2005 and since then there has been at least one new variant every week. Admnistrators immediately forward any viruses, scripts and Trojans attacking the game portals, and Kaspersky Lab ensures that updates protecting against such threats are released almost immediately.

Adware, spyware and viruses: is there a difference?
Adware and spyware are the IT buzzwords of the moment. Such programs may exhibit Trojan behaviour in how they install themselves, (for instance by exploiting browser vulnerabilities), or in how they behave once they are installed. With adware becoming increasingly inseparable from classic malware, dedicated anti-adware solutions will simply cease to provide adequate protection.

Mobile malware
The first malicious code targeting mobile phones (Cabir) was detected in the middle of June. We are now staring into the abyss: a Warhol Worm, which attacks all possible systems in the shortest possible time, is now a very real possiblity. The first attempt to create such a worm surfaced in March this year. Fortunately, ComWar, an MMS-worm, contained a number of errors and there was a significant time lag during propagation.

At the time of writing, no further Bluetooth-worms have been detected.

http://www.viruslist.com/en/analysis?pubid=162454316

A roving gang of European chief information security officers claims the key to better security is less walls not more — a concept they call deperimeterisation.

Security is a process not a product, says Jericho. Establish open standards for identity management, digital rights, encryption and data-level authentication, and we can eventually do away with the rest of the security infrastructure altogether while maintaining commercial and operational flexibility. But because the Jericho Forum is user-led, it is honest about the problems and pragmatic about a gradual introduction of these ideas.

ZDNet UK spoke to one of Jericho’s founders, Paul Simmonds, global information security director of chemical giant ICI, about the ideas behind deperimeterisation and pushing the organisations unique take on security to the US.

http://insight.zdnet.co.uk/internet/security/0,39020457,39194164,00.htm

Last year the market grew 49 per cent year-on-year to €536m, with Cisco dominating with 21 per cent of the market.

Nokia is the fastest growing vendor, however, with sales increasing by over 90 per cent on the quarter.

“The security market is poised to extend its impressive track record into 2005 and beyond,” said Andy Buss, senior analyst at Canalys. “Our expectation is that 2005 will be up by more than 15 per cent over 2004. Vendors need to continue the pace of innovation and integration, partnering where necessary to ensure short time to market and to develop industry-wide interoperability.”

The biggest growth area has been in security hardware, with 65 per cent year-on-year increases. This is part of a wider move to build security into the network at a hardware level.

The reseller channel has also proved important. Juniper saw its sales grow 57 per cent after an intensive channel support programme, and the Canalys research found that the channel as a whole benefited towards the end of the year as companies started spending the last of their annual budgets.

The findings contradict statements made by Gartner last month that this year would see the start of a decline in security spending.

http://www.computing.co.uk/news/1162250

Google has been allocated an address range, marking the start of its permanent presence on the new frontier. And Microsoft has tried to patent it, surely a rite of passage for any new technology that aspires to be taken seriously. In the US and Europe, it is still not on many people’s lists of things to worry about.

It promises to relieve the lack of address space in IPv4, replacing a mere four billion addresses with enough to label every atom on the planet, but so far the use of NAT to hide private networks behind a single public address has meant that nobody is hurting too much so far. It has better security, quality of service and routing, but IPv4 has proved flexible enough to incorporate its own advances here. These take some managing, so the thought of adding the challenges of an entirely new protocol to the mix — everyone expects that both versions will have to run concurrently for many years — will not come easily to those charged with looking after a company’s network.

All that means that ISPs are reluctant to spend the extra money to provide IPv6 — if nobody is prepared to pay more for it, then you’re better off spending on bandwidth, better security and higher reliability. The Japanese love it: major ISPs such as NTT and IIJ support it, and more are joining in. That is due to a rather over-generous allocation of IPv4 address ranges to the US accentuating the shortage elsewhere, and an enthusiastic take-up of mobile access and multimedia services in Asia. When every mobile and fixed phone, television, recording device and games console has its own network address, a household’s need for multiple independent connections to the Internet can overwhelm NAT’s somewhat limited and inflexible support for multiple services running on multiple devices behind the router.

This value is enhanced by the protocol’s other features, such as automatic configuration and understanding of quality of service requirements: at the moment, for example, there are plenty of problems running VoIP telephony through home routers. As a result of such moves, all the major infrastructure manufacturers have been including IPv6 in routers and other devices for some time — so ISPs and major customers have been acquiring the capability by default as part of the normal cycle of equipment upgrades.

Behind the scenes, IPv6 has already been rolling out — and large, specialist networks such as the 33 country European GEANT research system have provided a lot of practical experience in deploying and managing the protocol. 30 out of the 34 Internet exchanges in the European Internet Exchange Association support IPv6, and between them they have 201 IPv6 customer networks — around 11 percent of the total.

http://comment.zdnet.co.uk/0,39020505,39192571,00.htm

Speaking at the Business Continuity Expo in London’s Docklands, IT security experts from the Royal Mail Group, Proctor & Gamble and Barclaycard acknowledged that their companies are increasingly merging systems used to authenticate employees’ entry to physical facilities with those used to control access to computing resources.

“I have worked in a lot of different areas of our company and I have found that physical and IT security are coming together, especially around the area of identity management,” said David Lacey, director of information security, Royal Mail Group.

David McCaskill, section manager for global security solutions at Proctor & Gamble, explained that the pharmaceutical giant had also integrated its physical and IT authentication systems. Companies have generally treated physical security as the responsibility of the facilities department and computer security as that of IT. But employee information has increasingly become integrated, allowing businesses to link the two systems, Steve Hunt, an analyst with Forrester Research, said in a recent report.

“Locks, cameras, entry systems, and even guard desks will be upgraded to work with the same computing systems that control computer and network sign-on, identity management and security incident management,” Hunt wrote.

Twice as much will be spent on such integration this year compared with 2004, reaching $1.1bn in Europe and the United States, according to Forrester.

http://news.zdnet.co.uk/internet/security/0,39020375,39191839,00.htm