May 2004 – Page 3 – CyberSecurity Institute

A third of UK corporates open to hackers

Posted on May 13, 2004December 30, 2021 by admini

According to security firm NTA Monitor, UK businesses are drowning under a rising tide of medium and low-level security vulnerabilities as they fight to deal with high-risk security flaws.

The company’s research – based on analysis of almost 500 network perimeter security tests of clients in both the public and private sector – found that a third of corporate networks have at least 10 flaws, opening themselves to “considerable risk of malicious attack”.

High-risk flaws were discovered in only 3.9 per cent of tests, while medium flaws were found in 74.3 per cent of tests and a low-risk vulnerability of some kind was found in every test carried out.

Security issues relating to the configuration of internet routers were found to account for the most frequently identified vulnerability.

Poorly configured routers can allow an attacker to let themselves into a network and can also be used as a stepping stone to attack other systems, NTA Monitor warned.

The most common problem the security firm found threatening its customers was denial of service (DoS) attacks.

Low-level flaws were identified in all networks in both 2003 and 2004, while medium-level flaws climbed from 73 per cent in 2003 to 74.3 per cent in 2004.

http://www.vnunet.com/News/1155120

Lottery scams new flavour of the month

Posted on May 11, 2004December 30, 2021 by admini

Last month the Austrailian group, FraudWatch International, received over 1000 variations, double the number of phishing email scams.

They are to contact a claims agent to collect their winnings, typically at a free email address. The claims agent sends his victims a claim form, and asks for copies of their passport and driver’s license to verify their true identity. They can have the money wired to their bank account, they can open an account with a specified bank (bogus), or they can pick up their winnings personally.

http://www.securityfocus.com/news/8571

Sasser shows there must be a better way

Posted on May 10, 2004December 30, 2021 by admini

Microsoft announced an unprecedented eight patches to fix 21 vulnerabilities on “Patch Tuesday” last month, one of which Sasser’s creators exploited within three weeks.

Given the Sasser worm variants have hit 500,000 to 1 million unpatched machines to date, according to industry estimates, concern abounds that the window is rapidly closing between the time it takes vendors to identify holes and for attackers to take advantage of them.

Each new assault taking the world closer to zero-day exploits, when hackers will have the means to strike the day a new gap is announced.

Mark Nicollet, analyst for Connecticut-based research and advisory firm Gartner Inc., said the challenge is for organizations to put systems in place to end the recurring nightmare where administrators scramble to update their security software ahead of the next worm or virus, only to discover later that the patches they installed conflict with other software, causing computers to slow down or crash. We need to reach the point where blocking technology is effective enough to let us patch in a less disruptive, risky way, even without zero-day exploits.”

Eric Schultze, chief security architect for Shavlik Technologies of Roseville, Minn., said when it comes to the prospect of zero-day attacks, his biggest concern is that software experts are putting too much information in the public domain and unintentionally helping the hackers. He said researchers think they’re helping the IT community by putting detailed reports outlining the latest security flaws on the Internet for all to see. Schultze said the best approach is for researchers to “find the bug, alert the vendor and keep the rest out of the public domain.”

As the industry waits for Microsoft’s announcement and the next malicious code, some express skepticism that the zero-day attack will ever happen.

“I don’t think it’ll reach the point where hackers have a zero-time turnaround,” said Dennis Racca, president of network security provider Umbra Networks in Andover, Mass.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci963170,00.html

Regulator says U.S. nearing Basel bank rules deal

Posted on May 6, 2004December 30, 2021 by admini

The accord — known as Basel 2 because it would replace an existing regime — is a set of rules governing international bank capital and oversight and is focused on preventing financial problems from spreading across borders while taking into account modern risk management methods.

But Roeder said the United States will conduct an extensive survey of how the new regulations will affect the estimated 10 large U.S. banks that must follow them.

Officials have not publicly identified which 10 banks will be subject to the rules, but they must have at least $250 billion in assets or have 10 percent of their assets outside the United States.

http://www.reuters.com/financeNewsArticle.jhtml?type=bondsNews&storyID=5065845

Enhanced Wi-Fi security, quality on tap for 2004

Posted on May 4, 2004December 30, 2021 by admini

As the adoption of wireless technology continues to grow among businesses and home users, two key improvements in the security and performance quality of Wi-Fi devices are set to reach wireless network users later this year.

The 802.11i standard is the complete version of the preliminary WPA (Wi-Fi Protected Access) security standard introduced last year, while 802.11e is a new standard that will improve the quality of wireless networks that transmit voice and video.

Security has been one of the biggest obstacles to the growth of wireless networking. Last year, WPA replaced the flawed WEP (Wired Equivalent Privacy) protocol to shore up wireless security before the full 802.11i standard could be ratified. WPA uses a dynamic encryption key as opposed to the static key used by WEP, and it also improves the user authentication process.

The 802.11i standard adds Advanced Encryption Standard technology, a stronger level of security than that used in WPA.

Enterprises and governments, which need the highest level of security available, may have to replace some of their networking equipment in order to support the AES standard.

Newer networking equipment released within the last three months will probably have enough computational power to handle the increased performance requirements of AES security, Hanzlik said. Network managers with older wireless devices should check with their vendors to see if that equipment will support a software download of the full 802.11i standard, he said. Companies with older networking equipment must decide whether the data traveling over their wireless networks is critical enough to warrant a significant upgrade, said Aaron Vance, a senior analyst at Synergy Research Inc. in Scottsdale, Ariz. In many cases, third-party products that can secure a wireless network when combined with the WPA standard are available, he said.

http://www.computerworld.com/mobiletopics/mobile/wifi/story/0,10801,92906,00.html

Microsoft Confirms Windows XP SP2 Delayed Until 3Q

Posted on May 1, 2004December 30, 2021 by admini

The Windows XP SP2, a significant Windows client update that incorporates a host of new security features, has slipped for release until sometime in the third quarter, a Microsoft spokesman said.

On April 20, Microsoft security executives said the second-release candidate would be released in mid-May and Microsoft was still targeting to ship during the first half of 2004.

One solution provider, who requested anonymity, said Microsoft bumped into some security issues that it couldn’t resolve before June. Michael Cherry, an analyst with Directions on Microsoft, a newsletter in Kirkland, Wash., said the delay illustrates the difficulty of integrating new features with a set of constantly-evolving patches.

More info: http://www.crn.com/sections/BreakingNews/dailyarchives.asp?ArticleID=49808