Category: News

The gambit came after China’s Wireless Authentication and Privacy Infrastructure (WAPI) security scheme was withdrawn and placed on a slower track by the ISO. China initially agreed last year to refrain from making its WAPI security scheme mandatory for wireless LAN equipment in China. It then approached ISO with a fast-track submission in an effort to make WAPI an international security standard.

Until this week, the ISO group was focused on whether or not both 802.11i and WAPI should be cemented as enhanced — but optional — security standards. However, sources said tempers flared when China’s original fast-track submission, designated 1N7506 of China National Standard GB15629.11 (WAPI), was withdrawn from consideration.

http://www.networkingpipeline.com/news/60403249;jsessionid=F5FTSCKZCDLYAQSNDBCSKH0CJUMEKJVN

The site, called ITsafe, will provide free information on the latest virus threats as well as advice on Internet surfing, e-mail use and protecting personal and business data. The site is funded by the British government’s Home Office and will use data from the National Infrastructure Security Coordination Center (NISCC), which is responsible for monitoring threats to the United Kingdom’s critical national infrastructure.

People will receive e-mail or text alerts about new virus and security threats once they have signed up to the service.

The Home Office said the alerts will outline the damage potential of any new threats and will offer instructions for any actions a person needs to take to update the security of their PC. Home Office Minister Hazel Blears said the site will provide jargon-free and easy-to-understand advice for nontechnically minded PC users.

Roger Cumming, director of NISCC, said in a statement that ITsafe will “take our technical expertise and use it to help home users understand the risks and keep their computer systems, mobile phones and a range of related consumer electronic items safe.”

http://news.com.com/U.K.+to+issue+public+virus+alerts/2100-7349_3-5588756.html?tag=cd.top

“Given their record in the security area, I don’t know why anybody would buy from them,” the former White House cybersecurity and counterterrorism adviser said yesterday, when asked for his thoughts on Microsoft’s forthcoming line of security software.

The observation came during an impromptu interview on the sidelines of the RSA computer security conference in San Francisco, where Clarke took part in panel discussions with other experts in technological and national security.

The company plans to release an anti-virus product this year and introduce a new version of Internet Explorer this summer — about a year sooner than expected — to boost security.

He said he asked Microsoft last year to disclose the specific quality-assurance practices it was following in the pursuit of more-secure software code. The idea, he said, would be for the software industry to collectively come up with a set of best practices for secure software development.

“There’s no fine involved, there’s no liability involved, but the marketplace is better informed, and the marketplace works better when it knows what’s going on,” Clarke said, drawing a round of applause from the crowd at San Francisco’s Moscone Center.

“The market is demanding security now, and that hard work is going forward already,” said Amy Roberts, director of product management in Microsoft’s Security Business and Technology Unit, in the statement.

During a panel discussion on technology regulation, Rick White, a former Republican congressman from Washington state, agreed with Clarke that it would be good to establish visible standards by which companies could be judged in the marketplace. “It’s just a question of how far you get the government involved.” But on the subject of government involvement, White and Clarke disagreed, as illustrated by a related discussion of Internet service providers.

http://seattlepi.nwsource.com/business/212437_rsaclarke17.html

The ratings will consist of three numbers, Gerhard Eschelbeck, the chief technology officer at security information provider Qualys said on Tuesday.

The first will be a baseline estimate of the severity of the flaw. The second will rate the bug depending on how long it has been around, and therefore how likely it is that companies have patched against it. The third will measure the threat a vulnerability poses to a specific corporate network. Each will take five or six factors into account for the measurement.

The companies plan to announce the first version of the system on Thursday, Eschelbeck said. They are proposing that vulnerability trackers such as BugTraq use the approach to label the severity of new software bugs.

Businesses can take the ratings to calculate the level of risk on their own network, to generate a single grade, depending on factors such as how reliant they are on the affected software.

“There are three numbers, but customers will deal with a specific final number,” Eschelbeck said. “You can see right out of the get-go how vulnerable you are.”

The launch, which will be made at the RSA Conference in San Francisco this week, is the fruit of a partnership of Redwood Shores, California-based Qualys, networking giant Cisco — which has recently announced a revamp of its security product line — and security company Symantec.

It is designed to provide the first systematic grading of flaws that can be used by companies to assess the potential damage to their vulnerable systems and to prioritise patching. The ratings could also offer insight into the severity of flaws on the different computing platforms, such as Microsoft Windows, Linux and Apple’s Mac OS X.

http://news.zdnet.co.uk/0,39020330,39188056,00.htm

Antivirus experts, who are calling the Trojan “Bankash-A,” say it is the first piece of malicious software to attack Windows AntiSpyware, which is still in beta.

“This appears to be the first attempt yet by any piece of malware to disable Microsoft AntiSpyware,” Graham Cluley, a senior technology consultant at Sophos, said in a statement. “As Microsoft’s product creeps out of beta and is adopted more by the home user market, we can expect to see more attempts by Trojan horses, viruses and worms to undermine its effectiveness.”

Windows AntiSpyware, built using technology from Microsoft’s acquisition of Giant Company Software, is designed to protect Windows PCs from spyware–software that is installed on computers without their owners’ knowledge. Typically, spyware generates pop-up ads or keeps track of people’s Web surfing.

Like many other Trojans, Bankash attempts to steal passwords and online banking details from Windows users, Sophos said in an advisory. The program targets users of U.K. online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest and Smile. Sophos called the Trojan “Bankash” because it attacks banking customers and installs a file called ASH.DLL onto a victim’s hard drive.

Microsoft’s British press office was awaiting comment from the company’s U.S. headquarters at the time of writing.

http://news.zdnet.com/2100-1009_22-5569429.html

The providers of voice-over-Internet Protocol (VoIP), as Net phone services are generally known, are bracing for abuses nonetheless.

Using VoIP, virus writers could conceivably commandeer someone’s phone, or telemarketers could send messages to thousands more phones at a time than they can now.

With little evidence to suggest a problem, however, the 22 member companies of the VoIP Security Alliance run the risk of provoking the digital world’s black hats.

But the outlaws’ attention is inevitable, alliance members say, because VoIP technology is teetering on the mainstream, becoming an increasingly interesting target. There are about 5 million customers worldwide, with almost a third in the United States. Vonage, with 500,000 customers, is the world’s largest VoIP supplier and has recently started offering its services in the UK. VoIP services have begun winning converts, thanks to cheap rates and a slew of features that traditional phone companies can’t match.

The alliance includes business telephone maker Alcatel, network security specialists Symantec and several schools, including New York’s Columbia University, and the 20 other companies.

“The technology has finally arrived, and vulnerabilities need to be discovered and mitigated,” Ron Gula, chief technology officer of alliance member Tenable Network Security, said in prepared remarks.

http://news.zdnet.co.uk/communications/0,39020336,39187096,00.htm