Category: News

1. Social engineering attacks will continue to predominate, while attacks based on operating system vulnerabilities will continue to decline as more people move to more secure operating systems.
2. Hot topical issues will be used as hooks on which to hang social engineering attacks.
3. Increased probing of mobile devices.
4. Increasing emphasis on the isolation of the owners of infected systems.
5. Data breaches will continue to grow in importance
6. More use of rogue software to extort money
7. Malware as a Service will, more and more, reflect the models of cooperation between specialists seen in the legitimate business world.
8. There is likely to be more use of high-level languages (especially scripting languages) so as to re-purpose malicious code across multiple platforms.
9. Social networks will be targeted
10. There will be further research into and attacks on virtualised environments,
11. Phishing and related attacks on online gamers will continue to be big business, though attacks on gaming consoles are likely to be meet with limited success.
12. Attacks that manipulate wireless connections will continue.
13. Criminals and legitimate businesses will mine data from a widening range of resources, exploiting interoperability between social networking providers.
14. Crimeware will be the most common and successful.
15. The subversion of legitimate web sites and social networks as an attack vector will continue to be a highly successful criminal activity.
16. Targeted attacks can be expected

http://irishdev.com/Home/News/816-Cybercrime-.html

The CSA’s guidance, which dozens of contributors helped develop, outlines key issues and provides advice across 13 domains, including incident response, encryption and key management, identity and access management, and legal and electronic discovery.

It’s designed to help organizations understand what questions to ask cloud providers, current recommended practices, and pitfalls to avoid.

In its first year, the CSA expanded its membership and now counts 23 corporate members, including heavyweights Microsoft, Cisco Systems Inc. and Hewlett-Packard Co. SearchSecurity radio:

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1377211,00.html

The Homeland Security Department has also stopped posting documents with security information, either in full or in part, on the Internet until the TSA review is complete, Mr. Heyman told the Senate Homeland Security and Governmental Affairs committee.

Among many sensitive sections, the document outlines who is exempt from certain additional screening measures, including U.S. armed forces members, governors and lieutenant governors, the Washington, D.C., mayor and their immediate families.

It also offers examples of identification documents that screeners accept, including congressional, federal air marshal and CIA ID cards; and it explains that diplomatic pouches and certain foreign dignitaries with law enforcement escorts are not subjected to any screening at all.

http://www.post-gazette.com/pg/09344/1019885-84.stm

BSI explained the plan at the Information Technology Summit, an annual meeting between industry chiefs and Chancellor Angela Merkel.

The survey offered a ranking of 15 nations’ competitiveness in the overall information and communications technology field, awarding the United States the top score.

Even more damning were the judgements of Chinese and US experts asked to say where they had noticed excellence in Germany.

http://in.news.yahoo.com/43/20091208/838/tbs-germany-plans-internet-virus-phoneca.html

The service was launched by a well-known security researcher who goes by the name of Moxie Marlinspike.

Hackers have known for some time that these WPA-PSK networks are vulnerable to what’s called a dictionary attack, where the hacker guesses the password by trying out thousands of commonly used passwords until one finally works.

WPA Cracker customers get access to a 400-node computing cluster that employs a custom dictionary, designed specifically for guessing WPA passwords.

If they find the $34 price tag too steep, they can use half the cluster and pay $17, for what could be a 40-minute job.

The service could save security auditors a lot of time, but it will probably make it easier for senior management to understand the risks they’re facing, said Robert Graham, CEO of penetration testing company Errata Security.

http://news.techworld.com/security/3208347/new-cloud-hacking-service-steals-wi-fi-passwords/

The United States marked October as a month of cybersecurity awareness, but analysts said the rest of the world still needs to catch up on the full implications of new security risks posed by technologies that are open to attack by hostile forces.

This [enhanced information exchange betweem the suppler and the customer] will enable utilities to combat fraud, introduce effective real-time management of the grid and slow down their investment in new energy generation capabilities, a DS2 study said.

However, any vulnerability in the smart grid could have an impact on that utility’s energy distribution grid, which could result in power cuts, and could be used by hackers and fraudsters to gain access to consumers’ private personal information.

So, alongside high-speed communications and robust features, what the smart grid also requires is cybersecurity — the protection required to ensure the confidentiality, integrity and availability of the electronic information communication system.

It said that expansion of the networks increases the complexity of the grid, which could expose it to potential attackers and unintentional errors.

http://www.upi.com/Business_News/Security-Industry/2009/12/08/Smart-grids-may-be-prone-to-cyberattacks/UPI-30271260314731/