The development team behind the popular Nginx open-source Web server software released security updates on Tuesday to address a highly critical vulnerability that could be exploited by remote attackers to execute arbitrary code on susceptible servers. Identified as CVE-2013-2028, the vulnerability is a stack-based buffer overflow and was first introduced…
Anonymous May 7 Target List Includes 12 Large Credit Unions
Other credit union sites listed on the OpUSA post on Pastebin include the $54 billion Navy FCU of Vienna, Va., the $27 billion State Employees’ Credit Union of Raleigh, N.C., the $12 billion Boeing Employees Credit Union of Tukwila, Wash., the $9.8 billion SchoolsFirst FCU of Santa Ana, Calif., the $8.2 billion The Golden 1 Credit Union of Sacramento, Calif., the $5.4 billion Suncoast Schools FCU of Tampa, Fla., the $5.6 billion American Airlines FCU of Fort Worth, Texas, the $8.3 billion Alliant Credit Union of Chicago, the $7.2 billion Security Service FCU of San Antonio, Texas, the $6.2 billion San Diego County Credit Union of San Diego and the $5.8 billion America First FCU of Riverdale, Utah. John Magill, CUNA executive vice president of governmental affairs, said during a Monday morning press call he has spoken to NCUA staff members about the attack, and they said the regulator is aware of the target list and has contacted the 12 credit unions.
Kevin Prince, chief technology officer at the Santa Ana, Calif.-based technology management firm Compushare, said the attack could be impactful, but added nobody knows how it could play out. Compushare has worked on an FBI task force for a long time combating Anonymous cyberattacks, and Prince said the bureau “is having a hard time doing anything about it.”
Prince, who was a guest on CUNA’s call, recently released a white paper that reassures small financial institutions they’re not likely targets, but nonetheless provides ways to prepare in case they are, or simply worry they may be.
Instead, Prince advised, credit unions should work with their internet service provider to stop the attack “upstream” before it gets to the credit union’s website or online banking service.
Because most credit unions don’t host their own online banking site, working instead with a third party provider or core processor, their prep time would be better spent reviewing third party due diligence than attempting to shore up their own connections, he said.
The white paper, titled “DDoS Attacks: How Real Are the Risks for Community Financial Institutions”, is available to be downloaded on Compushare’s website.
Link: http://www.cutimes.com/2013/05/06/anonymous-may-7-target-list-includes-12-large-cred?ref=hp
AutoIt scripting increasingly used by malware developers
This content is restricted.
Cybercrime booming in Latin America and Caribbean, Trend Micro finds
Conventional file infector malware was a major issue in the region, which Trend takes to suggest that patching is poor, operating systems run in insecure states and indicative of a general complacency among consumers about the risks of poor software behaviour.
This includes gangs that develop their own crimeware kits, with 2012’s ‘PiceBot’ a good example of banking malware that heralds a new level of sophistication for homegrown malware.
Protection for Industrial Control Systems (ICS) is also a worry with many Internet-facing systems open to attack; Trend itself recorded 39 attacks on infrastructure systems in the geography in a single month during 2012, 12 of which it classified as automated, repeated and targeted.
Money, expertise, and a lack of cyber-awareness remains an issue although Trend did find that many countries were now being positively galvanised by the emerging global culture in government cyber-defence.
“On the whole, political leaders are aware of the dangers of cybercrime and hacking but efforts are often restricted by the lack of resources dedicated to building cybersecurity capacity and shortage of specialized knowledge and expertise to implement technical policies,” said Trend’s researchers.
Too many admins spoil your security
The most popular applications at this shipping company have many thousands of users, so at first having roughly 10 percent of your users operating as administrators may not seem like that big a deal. But users should always be lowest privilege level, and having an excessive number of application administrators is as bad as having too many OS administrators. Every additional admin doesn’t just increase his or her own risk; if they’re compromised, they add to the takedown risk of all the others.
But no one had thought to do the same analysis on the application administrators (at least not until I came along — that’s why they pay me the big bucks). Even when they compromise the passwords of the entire domain and all the network administrators, what they are really after lies on application servers, which is why application administrators can do you in. I’ve done a few of these audits; it’s usually easy to find the problem children, and you can eliminate a lot of them.
My favorite applications are the RBAC (role-based access control) ones where almost no one is an admin, and even the admins are limited in what they can do.
That’s why I’m as worried about how a company controls and audits application administrators as I used to be about OS and network administrators.
Link: http://www.infoworld.com/d/security/too-many-admins-spoil-your-security-218023?source=rss_security
Dutch bill seeks to give law enforcement hacking powers
To disable a botnet it is necessary to access the command and control servers that control the botnet which can be located in a foreign country, according to the bill. The new investigative powers would also allow law enforcement to infiltrate computers or servers located in foreign countries if the location of those computers cannot be determined.
“It is important that the government wants to combat cybercrime but this proposal is rushed: it is unnecessary and creates new security risks for citizens,” said Simone Halink of Dutch digital rights organization Bits of Freedom in a blog post on Thursday.
At the moment the draft bill is in the consultation phase, meaning parties involved such as the police and other law enforcement as well as citizens and advisory bodies will be able to comment on it, ministry spokesman Wiebe AlkemaA said. Following that, the bill will be sent to sent to the Council of Ministers after which it will be sent to the Dutch Council of State, an advisory body on legislation.