Month: January 2006

U.K. bill would increase penalties for cybercriminals

Posted on by admini

If the bill is passed into law, those convicted of unauthorized access to a computer could face up to a two-year prison sentence, up from six months.

“Over the last 18 months there have been a lot of high-profile DoS attacks which have in turn been accompanied by extortion requests against U.K. online bookmakers,” the spokeswoman said. Of 200 companies that participated in the survey, 90%reported they had experienced unauthorized access to their networks, while 89 percent had been victims of data theft.

http://www.computerworld.com/securitytopics/security/story/0,10801,108133,00.html

Read more

Microsoft’s Allchin: Buy Vista for the security

Posted on by admini

“Safety and security is the overriding feature that most people will want to have Windows Vista for,” the co-president of Microsoft’s platform, products and services division said in an interview with CNET News.com. It is reversing its plan to add virtual folders that contain all the files that match specific criteria, such as “created by Michelle” or “images,” no matter where they are on the PC.

Originally, Microsoft wanted virtual folders to replace standard views, which show the physical location of files on a hard disk drive, but it has backpedaled on that decision. The software maker had already scaled back on planned features for Vista, leaving some out so it could meet a ship date in 2006 for the update.

Vista will go much further in protecting consumers, he said. “If we ever find something trying to open a port that the developer said it should not be opening, it is immediately shut down,” he said.

Additionally, Vista aims to offer improved security by letting people run their PC with fewer privileges, which control how a particular person can interact with the software. In Windows Vista, the default will likely be “protected administrator,” a new privilege level that Microsoft is introducing with Vista, Allchin said. The standard user mode has been improved from Windows XP–people won’t have to call IT to change their PC clock, for instance–but it won’t allow a user to install applications, for example.

http://news.zdnet.com/2100-3513_22-6032344.html

Read more

Good worms back on the agenda

Posted on by admini

The topic of whether self-propagating code can have a good use has cropped up occasionally among researchers in the security community. In 1994, a paper written by antivirus researcher Vesselin Bontchev concluded that ‘good’ viruses are possible, but the safeguards and limitations on the programs would mean that the resulting code would not resemble what most people considered a virus. Later attempts at creating ‘good’ worms have failed, however, mainly because the writers have not adopted many of the safeguards outlined in the Bontchev paper. The Welchia worm–a variant of the MSBlast, or Blaster, worm–had apparently been created to fix the vulnerability exploited by the MSBlast worm, but had serious programming errors that caused the program to scan so aggressively for new hosts, it effectively shut down many corporate networks.

Immunity’s research is the latest attempt to create a more rigorously conceived framework for creating worms that could spread across specific networks to find and report vulnerabilities. The research essentially offers two advances, a strategy for the controlled propagation of worms and a framework in which reliable worms could be created quickly, Aitel said. The nematode worms would have to get permission to spread by querying a central server for a specific digital token, which Aitel dubbed a nematoken, before spreading to a particular machine.

http://www.securityfocus.com/news/11373?ref=rss

Read more

Gartner Says Don’t Deploy 802.11n until 2007

Posted on by admini

VBroadcom and Marvell have already announced that they will start producing ‘draft-compliant’ chipsets, but Gartner labelled these claims as “misleading” and “premature”.

The analyst firm believes that the technology is likely to be changed before a final standard is approved, and that additional testing will be required to ensure compatibility with existing Wi-Fi standards.

http://www.vnunet.com/vnunet/news/2149265/gartner-pleads-restraint-802

Read more

Cambridge prof warns of Skype botnet threat

Posted on by admini

Voice-over-IP apps could be used to cloak networks of zombies, used to launch denial of service attacks, a Cambridge professor has warned. Armies of ordinary PCs – “botnets” – that have been infected by a virus and put under malicious control, could be controlled and orchestrated by messages hidden in VoIP traffic generated by programs such as Skype, warned Jon Crowcroft, Marconi professor of communications systems at Cambridge University.

Denial-of-service (DoS) attacks are usually shut down by tracing control messages, normally sent by chat and IM programs.

“There isn’t a protocol you can’t use as a covert signalling channel,” responded Kurt Sauer, director of security operations at Skype. “Some large commercial groupware products have encrypted XML streams – they may not be quite as good at firewall traversal, but that’s still an opaque data stream.”

Some IT managers do not want uncontrolled traffic punching holes in their firewalls, and using bandwidth, and security vendors have launched specific products to block Skype.

Crowcroft would like Skype to publish its routing specifications, so IT managers can work better with the application, tracking it and checking its behaviour. “There are a whole bunch of reasons why obfuscation is not helpful in the long run.” Although Skype still wants its proprietary edge, the issue is up for discussion: “The people who own networks and systems have a right to manage as they see fit,” said Sauer.

http://www.techworld.com/security/news/index.cfm?NewsID=5232&inkc=0%3CBR%3E%3C/P%3E%3CP%3E

Read more