CyberSecurity Institute – Page 194 – Security News Curated from across the world

CookieMonster Can Steal HTTPS Cookies

Posted on September 12, 2008December 30, 2021 by admini

Sadly, it turns out that many Web sites do not properly set the “Encrypted Sessions Only” property of their cookies.

Because HTTPS cookies are full of tasty authentication information, they can be used to access online banking accounts, Webmail accounts, and the like.

Perry proposes the following test to see whether sites you use are vulnerable: “To check your sites under Firefox, go to the Privacy tab in the Preferences window, and click on ‘Show Cookies.’ For a given site, inspect the individual cookies for the top level name of the site, and any subdomain names, and if any have ‘Send For: Encrypted connections only,’ delete them.

Having tried these steps with two “Encrypted connections only” Google (NSDQ: GOOG) cookies, Google appears to be vulnerable to a CookieMonster attack. A Google spokesperson confirmed this to be the case and said the company’s engineers are working with Perry to eliminate the vulnerability.

http://www.informationweek.com/news/security/vulnerabilities/showArticle.jhtml;jsessionid=2P0R3N2D1VQU4QSNDLPCKH0CJUNN2JVN?articleID=210601197

Enterprises Struggle to Identify Sources of Risk

Posted on September 12, 2008December 30, 2021 by admini

More than a third of respondents plan to implement risk management tools across all of their business units in the next 12 months; another 26 percent will implement such tools with some business units. In 2006, about 40 percent of respondents said internal attacks were their top concern; that figure has dropped to 33 percent.

“Given all the attention that’s been paid to user awareness in the past few years, it’s sort of surprising that the user issue continues to be such a big part of the problem,” says Rick Blum, director of strategic marketing at BT. “This will require quantifying the potential cost of data loss as well as downtime caused by a virus or other attack,” the report states.

“These costs should take into account financial damages (outright theft), recovery costs (notification of affected parties, etc.), and loss of reputation (leading to loss of business).”

http://www.darkreading.com/document.asp?doc_id=163569&WT.svl=news2_1

Report: In-Depth Analysis Finds More Severe Web Flaws

Posted on September 11, 2008December 30, 2021 by admini

As usual, the vulnerabilities most found in Web applications were cross-site scripting, information leakage, and SQL injection.

XSS accounted for 41 percent of all vulnerabilities; information leakage, 32 percent; SQL injection, 9 percent; and predictable resource location flaws, 8 percent.

“Looking at the numbers, I thought SQL injection would have a bigger presence in the number of vulnerabilities and vulnerable sites. Although the statistics seem to show the number is decreasing from previous years, do not stop fighting this class of attack, and all types of injection in general!!

http://www.darkreading.com/document.asp?doc_id=163467&WT.svl=news2_4

CIS looks to community for security metrics

Posted on September 10, 2008December 30, 2021 by admini

To measure a company’s ability to deal with security incidents, the group suggested that companies measure the mean time between security incidents and the mean time to recover from security incidents.

As an indicator of a company’s network security readiness, companies should measure the fraction of systems configured to approved standards, the fraction of systems patched as per corporate policy, and the fraction of systems with antivirus software, CIS stated.

Finally, companies should review their software applications for potential security issues by measuring the fraction of business applications that have had a risk assessment, the fraction with a penetration or vulnerability assessment and the fraction of application code that had a threat-model analysis or security code review prior to deployment.

http://www.securityfocus.com/brief/814?ref=rss

A [Phone] Alarming Development at Tech Conference

Posted on September 10, 2008December 30, 2021 by admini

If the software detects that your phone’s SIM card has been altered, it will notify your reporting contact phone, sending them a log of calls and messaging activity made on the phone.

By sending a “Hang” command to your stolen phone, a loud alarm goes off repeatedly. The only way to make it stop — short of smashing the phone — is to remove the battery.

But that is only short-term relief, as Jain happily explained, since the alarm will resume blaring the moment the battery is replaced. “We’ll have support for Blackberry and Windows Mobile devices in the next four to six weeks,” Jain later told InternetNews.com.

Jain said the company is negotiating with carriers and other potential partners and expects to have information on rates and availability in the U.S. shortly.

According to Maverick’s Web site, another feature of the software, called “Spy Call”, will let the owner call the stolen device from the reporting phone.

http://www.internetnews.com/mobility/article.php/3770266/An+Alarming+Development+at+Tech+Conference.htm

IT security devours 10% of operating budgets

Posted on September 6, 2008December 30, 2021 by admini

Those are impressive numbers in this economy, analyst Khalid Kark said in a keynote during Forrester’s Security Forum in Boston.

An organisation-wide focus on security also brings higher expectations, and sometimes conflicting expectations from the various departments in a business. Security has been the top priority for CIOs in Forrester surveys for four straight years, and 30% of security decision-makers surveyed report having a “dotted-line relationship” with the board or CEO.

Kark attributes this change in attitude partly to data breaches and resulting media coverage and lawsuits that focus public scrutiny on information security.

http://www.computerworlduk.com/management/security/data-control/news/index.cfm?newsid=10842