CyberSecurity Institute – Page 126 – Security News Curated from across the world

Australian central bank computers hacked

Posted on March 11, 2013December 30, 2021 by admini

A defence department official cited by the newspaper said “the targeting of high-profile events, such as the G20, by state-sponsored adversaries … is a real and persistent threat”.

In another sophisticated incident the month before, revealed on the central bank’s disclosure log under its freedom of information obligations, “targeted” emails were received regarding its strategic planning for 2012.

“Malicious email was highly targeted, utilising a possibly legitimate external account purporting to be a senior bank staff member,” an official report by the bank’s risk management unit said. “As the email had no attachment, it bypassed existing security controls, allowing users to potentially access the malicious payload via the Internet browsing infrastructure.”

Last year, Chinese telecoms giant Huawei was barred from bidding for contracts on Australia’s ambitious Aus$36 billion (S$46.16 billion) broadband rollout due to fears of cyberattacks.

Link: http://news.asiaone.com/News/Latest%2BNews/Science%2Band%2BTech/Story/A1Story20130311-407662.html

Canadian businesses are resigning themselves to being hacked: study – Canadian Business

Posted on March 10, 2013December 30, 2021 by admini

In one of the interviews, a chief information officer for a large company, told Hejazi that when he was hired, he laid it out for his bosses. Hejazi said the findings are reminiscent of the troubles that former technology giant Nortel Networks faced when international hackers broke into its corporate computers and accessed information for nearly a decade. The Nortel security breach gave hackers “plenty of time” and “access to everything,” according to 19-year Nortel veteran Brian Shields, who was behind a six-month investigation into the security breach that is believed to have started in 2000, but was only made public in 2012.

Hejazi said that organizations that operate with a “Yes” mentality, or are open to discussions with their staff about how to use technology responsibly, are more secure than companies with rigid security controls. Even an attachment file can directly lead to a security breach, or using free public computers at a conference in another country that has keylogging spyware installed.

Link: http://www.canadianbusiness.com/business-news/canadian-businesses-are-resigning-themselves-to-being-hacked-study/

Microsoft Patch Tuesday targets Internet Explorer drive-by attacks – Sharepoint, Microsoft, security

Posted on March 10, 2013December 30, 2021 by admini

“It fixes critical vulnerabilities that could be used for machine takeover in all versions of Internet Explorer from 6 to 10, on all platforms including Windows 8 and Windows RT,” says Qualys CTO Wolfgang Kandek.

It affects Silverlight whether deployed on Windows or Mac OS X operating systems, where it is used to run media applications such as Netflix, Kandek says.

“It is puzzling to see such a high rating for this software that typically requires opening of an infected file in order for the attack to work. It will be interesting to see the attack vector for this vulnerability that warrants the ‘critical’ rating,” he says.

Three of the bulletins are rated important and include two that could allow data to leak and one that could allow attackers to elevate privileges on an exploited machine. Important bulletins include vulnerabilities that could lead to compromised confidentiality, integrity or availability of user data, or of the integrity or availability of processing resources, Microsoft says.

Link: http://www.arnnet.com.au/article/455814/microsoft_patch_tuesday_targets_internet_explorer_drive-by_attacks/

Does your Incident Response Plan include “The Dark Side of the Internet”?

Posted on March 10, 2013December 30, 2021 by admini

Several weeks prior their client-facing website/application had been “hijacked” and was redirecting clients from certain geographic regions to an overseas site. … Best guess would be a drive-by malware site, although the geographic discrimination is an unusual twist that would have been interesting to understand. In order to ensure that any traces of the compromise were eradicated, the client rebuilt the site at a different hoisting provider on a fresh Content Management System (CMS) install with updated modules/templates. That being said, we had several good data points: an overseas IP address attempting to hit the admin page of the app and the fact that the hacker had signed his website defacement.

One thing many people don’t know about TOR is that it can also be used to connect to “hidden services” on the internet – sometimes referred to as the “darknet”. … It’s not for the faint of heart – and despite the “anonymity” that is provided by TOR, you still find yourself looking over your shoulder when you’re on it.

Part of our client’s continuous improvement process is adding TOR/darknet knowledge to their Computer Security Incident Response Team (CSIRT). Hopefully, they won’t have to exercise the plan anytime soon – but if they have a security incident to respond to their Incident Response Plan now includes a trip to the dark side.

Link: http://www.pivotpointsecurity.com/risky-business/does-your-incident-response-plan-include-the-dark-side-of-the-internet

Cybercriminals Likely To Expand Use Of Browser Proxies

Posted on March 6, 2013December 30, 2021 by admini

“You can essentially have the end users interact with a shadow Internet, essentially an Internet experience that is designed by the bad guys,” says Daniel Ingevaldson, chief technology officer for Easy Solutions, a fraud-prevention company that operates extensively in South America. “We haven’t seen anything that sophisticated yet, but I can see a scenario when this attack can be used to implement a server-side or cloud-based man-in-the-middle attack,” Ingevaldson says.

In an analysis of one attack, cloud security firm Zscaler detailed a PAC file that would set a victim’s browser to forward traffic for several Brazilian banking sites and American Express’s site to an attacker-controlled server. With a PAC file, the attackers can be a lot more choosy, redirecting requests to a group of sites or to one site in particular, says Anup Ghosh, co-founder and CEO of Invincea, a firm which detect and blocks Web and e-mail threats.

Preventing PAC files from compromising browsers is not a simple task, as client-side security software will likely find it difficult to detect whether a give PAC file is a valid change or a malicious attack, he adds.

In addition, companies that use a proxy for security or DNS–and so use a proxy auto-configuration file to configure their employees’ browsers–have a good chance of detecting changes that affect their infrastructure.

Link: http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/240150191/cybercriminals-predicted-to-expand-use-of-browser-proxies.html.html

Cybercriminals Likely To Expand Use Of Browser Proxies

Posted on March 6, 2013December 30, 2021 by admini

“You can essentially have the end users interact with a shadow Internet, essentially an Internet experience that is designed by the bad guys,” says Daniel Ingevaldson, chief technology officer for Easy Solutions, a fraud-prevention company that operates extensively in South America. “We haven’t seen anything that sophisticated yet, but I can see a scenario when this attack can be used to implement a server-side or cloud-based man-in-the-middle attack,” Ingevaldson says.

In an analysis of one attack, cloud security firm Zscaler detailed a PAC file that would set a victim’s browser to forward traffic for several Brazilian banking sites and American Express’s site to an attacker-controlled server.

With a PAC file, the attackers can be a lot more choosy, redirecting requests to a group of sites or to one site in particular, says Anup Ghosh, co-founder and CEO of Invincea, a firm which detect and blocks Web and e-mail threats. Preventing PAC files from compromising browsers is not a simple task, as client-side security software will likely find it difficult to detect whether a give PAC file is a valid change or a malicious attack, he adds.

In addition, companies that use a proxy for security or DNS–and so use a proxy auto-configuration file to configure their employees’ browsers–have a good chance of detecting changes that affect their infrastructure.

Link: http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/240150191/cybercriminals-predicted-to-expand-use-of-browser-proxies.html.html