Category: Trends

Microsoft announced an unprecedented eight patches to fix 21 vulnerabilities on “Patch Tuesday” last month, one of which Sasser’s creators exploited within three weeks.

Given the Sasser worm variants have hit 500,000 to 1 million unpatched machines to date, according to industry estimates, concern abounds that the window is rapidly closing between the time it takes vendors to identify holes and for attackers to take advantage of them.

Each new assault taking the world closer to zero-day exploits, when hackers will have the means to strike the day a new gap is announced.

Mark Nicollet, analyst for Connecticut-based research and advisory firm Gartner Inc., said the challenge is for organizations to put systems in place to end the recurring nightmare where administrators scramble to update their security software ahead of the next worm or virus, only to discover later that the patches they installed conflict with other software, causing computers to slow down or crash. We need to reach the point where blocking technology is effective enough to let us patch in a less disruptive, risky way, even without zero-day exploits.”

Eric Schultze, chief security architect for Shavlik Technologies of Roseville, Minn., said when it comes to the prospect of zero-day attacks, his biggest concern is that software experts are putting too much information in the public domain and unintentionally helping the hackers. He said researchers think they’re helping the IT community by putting detailed reports outlining the latest security flaws on the Internet for all to see. Schultze said the best approach is for researchers to “find the bug, alert the vendor and keep the rest out of the public domain.”

As the industry waits for Microsoft’s announcement and the next malicious code, some express skepticism that the zero-day attack will ever happen.

“I don’t think it’ll reach the point where hackers have a zero-time turnaround,” said Dennis Racca, president of network security provider Umbra Networks in Andover, Mass.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci963170,00.html

A young virus writer, sitting in his underwear in his parent’s dark basement, takes a hex editor and modifies a few bytes of the latest Netsky.M (16.5kb), Beagle.J (12kb) or Mydoom.G (20kb) mutation, spawns a new virus variant, and then releases it into the wild.

The resulting few thousand compromised machines, a conservative estimate perhaps, will sit naked as drones or “bots” on the Internet, waiting patiently for their summons and commands.

A mere 12 kilobytes of action-packed code is impressive.

For a 12 kilobyte Beagle, you get total system compromise, plus a highly effective spam engine.

The latest code that brings a Microsoft computer to its knees is small enough that it could be silk-screened onto an extra-large t-shirt: a walking time bomb, if you will.

With today’s monolithic software programs and operating systems, often barely fitting compressed on a CD-ROM, it’s easy to see how small bits of malicious code can slip under the radar.

I still remember the days, many computer-years ago now, when BackOrifice and SubSeven Trojans first came out.

At just over 100kb, they were impressive in their day.

Back then most people were running Windows 98, and a small 100kb email attachment could easily slip into the operating system and wreak havoc without ever being noticed.

Today these are 100kb Trojans are monolithic in comparison to our modern email-based worm-virus-backdoor-spam-engines that tend to be under 20kb; these old relics are still a useful footnote, however, for watching the long-term evolution of malicious code.

Speaking of monolithic: Windows XP Home Edition requires approximately 1,572,864 kilobytes (1.5Gbytes) for a typical install, according to Microsoft.

Of course, it’s better/faster/easier-to-use than previous versions, as the advertisements say, and if you believe the literature too it’s also less buggy and significantly more secure.

The public relations spin machine for such a large company is fascinating to me Windows has become bloated into millions and millions of lines code, yet it only takes a mere 12 kilobytes to provide full system compromise and an annoying spam engine.

The divide between David and Goliath has never been greater.

Consider an analogy on the size of modern malicious code: if Windows XP were the size of the Empire State Building, then the little barking Beagle virus – the size of a small dog – can come in through the front door, lift its leg, deliver its payload, and somehow cause the entire building to come crumbling down.

The latest craze in the virus-worm-spam war has seen computer worms crawling inside of other computer worms – like watching maggots crawl on top of each other as they make their way through a tender piece of meat.

Some of the latest worms found in the wild have multi-vector propagation algorithms and also make use of previous viral infections by Beagle and Mydoom.

I do not know to what extent Microsoft’s code is scrutinized through an exhaustive security audit, but two years after Bill Gates’ long-heralded announcement the holes in the cheese are larger than they’ve ever been.

For now we’re stuck with millions and millions of lines code compiled into a giant operating system that can be wiped out of existence remotely with nothing but a small 12 kilobyte piece of code, launched by someone in his underwear on the other side of the world.

http://www.theregister.co.uk/content/55/36345.html

Prices for hacking insurance are predicted to drop for some businesses as insurers begin to understand the market better.

While the number of vulnerabilities found in software essentially has plateaued, the flaws are increasingly easy to exploit and, more often than not, quite severe, according to a new report.

In the survey of more than 950 CIOs from organizations in North America, Latin America, Europe, Asia/Pacific, the Middle East, India, and South Africa, Gartner EXP found that the corporate heads of IT anticipate a technology spending increase of just 1.4 percent during 2004. About 40 percent believe that this increase won’t happen until the second half of the year.

“Even though the global economy is on the up-turn, CIOs still show a lot of caution,” said Marcus Blosch, a vice president and research director for Gartner EXP. “They’re being very conservative, laying down the foundations of growth, but not aggressively pushing for it. “Call it a shifting of gears,” he added, “from a dampened mode to a growth mode.” Global IT spending won’t substantially increase, he added, until CIOs are confident that the recovery is real, and sustainable.

Among the priorities that the CIOs outlined to Gartner EXP, the top one in 2004 will be security, which held the number two spot last year.

“Anything to do with security, data security management, and data privacy and protection will get emphasized by CIOs this year,” said Blosch. With purse strings still tight, CIOs will fight to spend on BI, he said, because “they think that it will help them understand their markets and customers much better.

And the hot-button issue of outsourcing — hot at least with voters and lawmakers in the U.S. — will only get hotter, as CIOs continue to press for lower costs, which leads them to shift services overseas. “Outsourcing is set to continue, and grow quite significantly,” Blosch concluded from the survey. “But while it’s a key initiative in many companies, business process outsourcing remains a bit of a blind spot for many CIOs.”

Rising spam levels are beginning to test the technology we had implemented. It’s out of hand, and implementing a successful solution is a top-5 IT priority for us.

http://informationweek.securitypipeline.com/news/18311537

What are organizations and vendors doing to provide for the security of systems behind the Internet perimeter?

Host security can be broadly defined in a comprehensive host security system that encompasses configuration management, virus scanning, host intrusion detection/protection, and firewall capabilities. However, the deployment of these technologies may still fail if not updated or improperly configured.

Thus, organizations are looking to validate host/endpoint security through checking the correct configuration and operation of host security controls before allowing connections to internal systems. When the workstation connects, whether attached directly to the corporate LAN or remotely via a VPN tunnel, endpoint security verifies that the system is hardened, properly patched, running up to date anti-virus software, and that the host firewall is up and running with the proper rulebase before allowing it to connect to the internal network.

More info: [url=http://www.csoonline.com/analyst/report2170.html]http://www.csoonline.com/analyst/report2170.html[/url]