The worm has infected some 300,000 systems, according to a Lurhq analysis of logs from a Web site statistic counter that the worm uses to keep track of its spread.
http://news.zdnet.com/2100-1009_22-6031881.html
Cambridge prof warns of Skype botnet threat
Voice-over-IP apps could be used to cloak networks of zombies, used to launch denial of service attacks, a Cambridge professor has warned. Armies of ordinary PCs – “botnets” – that have been infected by a virus and put under malicious control, could be controlled and orchestrated by messages hidden in VoIP traffic generated by programs such as Skype, warned Jon Crowcroft, Marconi professor of communications systems at Cambridge University.
Denial-of-service (DoS) attacks are usually shut down by tracing control messages, normally sent by chat and IM programs.
“There isn’t a protocol you can’t use as a covert signalling channel,” responded Kurt Sauer, director of security operations at Skype. “Some large commercial groupware products have encrypted XML streams – they may not be quite as good at firewall traversal, but that’s still an opaque data stream.”
Some IT managers do not want uncontrolled traffic punching holes in their firewalls, and using bandwidth, and security vendors have launched specific products to block Skype.
Crowcroft would like Skype to publish its routing specifications, so IT managers can work better with the application, tracking it and checking its behaviour. “There are a whole bunch of reasons why obfuscation is not helpful in the long run.” Although Skype still wants its proprietary edge, the issue is up for discussion: “The people who own networks and systems have a right to manage as they see fit,” said Sauer.
http://www.techworld.com/security/news/index.cfm?NewsID=5232&inkc=0%3CBR%3E%3C/P%3E%3CP%3E
Bots Nearly Triple In 2005
The first arrest of a botnet herder in the U.S. occurred in November 2005, when Jeanson James Ancheta, 20, of California, was accused of accumulating 400,000 bots. Ancheta pleaded guilty to several federal felony counts Monday, and faces up to 25 years in prison.
http://news.yahoo.com/s/cmp/20060127/tc_cmp/177104269;_ylt=AtcaWdg2oQE051AhT6AP3GQ1k4gC;_ylu=X3oDMTBiMW04NW9mBHNlYwMlJVRPUCUl
Zero-day details underscore criticism of Oracle
The database company should have fixed the issue in the latest critical patch update (CPU), but failed to do so, he said, adding that he believes the flaw is more significant than a privilege escalation issue fixed in less than three months by Oracle in the latest update.
After hearing about the conference presentation, Oracle slammed the researcher for releasing information about the vulnerability, saying that doing so puts its customers in danger. “We are always disappointed when researchers feel the need to publish details of vulnerabilities before a fix is available,” Duncan Harris, senior director of security assurance for Oracle, said in an interview with SecurityFocus.
At the Black Hat Security Briefings in Las Vegas last summer, networking giant Cisco and network protection firm Internet Security Systems filed suit against a security researcher for disclosing methods to run code on Cisco’s networking hardware.
On Wednesday, he posted a workaround for the vulnerability on SecurityFocus’ BugTraq mailing list. However, Oracle said that it studied the workaround proposed by Litchfield and found it inadequate. Other security professionals have also taken Oracle to task for its troubles in effectively handling security researcher and vulnerability disclosure.
http://www.securityfocus.com/news/11371?ref=rss
Top Security Trends for 2006
1.) More damages, but fewer epidemics.
2.) Accelerated legislation, some litigation.
3.) Points of attack move beyond Microsoft’s Operating System.
4.) Mobile phone and PDA/ Smartphone virus concerns.
5.) Spyware a major issue.
6.) IM and P2P will become a bigger headache.
7.) Messaging security will get serious.
8.) Data protection energized as publicized data breaches in the United States intensify.
9.) Convergence will accelerate; security becomes embedded in the infrastructure.
http://www.csoonline.com/read/010106/caveat010906.html
Online crime matures beyond adolescence
“With increased security protection on most systems and stiffer penalties, we are seeing organized, committed, and tenacious profiteers enter this space. This means that attacks will be more targeted and potentially damaging.”
The recent guilty plea by a 20-year-old California man for compromising hundreds of thousands of computers to create a botnet and then selling access to those computers underscores the shift in cybercrime towards more profitable activity.
http://www.securityfocus.com/brief/116