The prototype so far has focused on one subset of RFID, the 13.56 ISO 15693 tags that are typically used in credit card and smart card applications.
http://www.theregister.co.uk/2007/04/08/rfid_guardian/
Security News Curated from across the world
The prototype so far has focused on one subset of RFID, the 13.56 ISO 15693 tags that are typically used in credit card and smart card applications.
http://www.theregister.co.uk/2007/04/08/rfid_guardian/
The LIME Tag will also help pharmaceutical manufacturers and other cold chain distributors track and monitor product temperature history.
http://www.darkreading.com/document.asp?doc_id=121254&WT.svl=wire_4
And many exploit providers simply wait for Microsoft Corp.’s monthly patches, which they then reverse-engineer to develop new exploit code against the disclosed vulnerabilities, Ollmann said.
While investigating a Trojan horse named Gozi recently, Jackson discovered that it was designed to steal data from encrypted Secure Sockets Layer streams and send it to a server in St. Petersburg, Russia. A customer query returning three passwords for a small retailer might cost 100 WMZ, while a query for 10 passwords for an international bank might fetch 2,500 WMZ or more. Customers could also choose how they wanted their search results delivered — as compressed files in e-mails or via FTP. In addition to the original Trojan horse, the server also hosted two ready-to-deploy variants in a separate staging area.
Often, groups such as the HangUp Team also offer a detection monitoring service with which they keep an eye on antivirus vendors to know exactly when signatures are available that can detect their malware.
The actual server hardware that the 76Service used was being managed by another entity called Russian Business Network (RBN), which provided Simple Network Management Protocol-based management and back-up services.
“We are not talking about kids doing it for kicks over the weekend anymore,” said Yuval Ben-Itzhak, chief technology officer at Finjan Inc., a San Jose-based security vendor. That report said that cybercriminals hold “vulnerability auctions” in which they sell information on freshly discovered software flaws to the highest bidder.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9015588&taxonomyId=17&intsrc=kc_top
For example, internal information thieves can steal vital data using Skype. Meanwhile, there is no shortage of examples of hackers probing Skype for vulnerabilities. Date Vulnerability Nov. 2004 Having uncovered a hole, a hacker was able to gain complete control over a user’s computer by means of overloading Skype’s buffer. Apr. 2005 Skype did not always erase access rights promptly. As a result, ill-intentioned people could replace original attachments with modified ones using previously established authorization. Oct. 2005 A hole was discovered which could be used to induce an overloaded buffer error on the victim’s machine resulting in access to the system. Oct. 2005 A breach in Skype allowed a denial-of-service attack on a remote computer. May 2006 A new breach facilitated the theft of files from a user’s machine. However, for this to work it was necessary to send the victim specially formed packets provoking an abnormal program termination. Dec. 2006 A worm was found to be spread across several countries, infecting workstations which had Skype installed in chat mode.
The present research is the first Russian study into risk-free Skype use on corporate networks.
To assess anxiety among IT and IS specialists regarding the use of Skype on company intranets.
To identify additional IS threats which add to such fears.
To pinpoint the source of these risks.
Key conclusions Skype is the clear leader among VoIP products. Almost half of those surveyed (46.8%) use Skype. If one removes those without any form of VoIP, then Skype takes 64.9%.
The risk of a leak of confidential information is the greatest threat (55.6%) for a corporate network which has Skype. Skype itself can not seriously be blamed for these additional risks. The core problem is with the human factor (44.6%) rather than with faults in the program. Despite this, almost two-thirds of those surveyed (66.4%) incline to the view that the threats which attend the introduction of Skype into the corporate environment are a serious obstacle to the program’s wider acceptance. Only one-third of specialists (33.7%) felt that IS problems would not prevent the program’s wider acceptance among companies.
Research methodology and survey participant profile This research was conducted by InfoWatch’s analysis center between 15th and 30th of January, 2007. Survey participants submitted their answers via an online form with 1242 people taking part. Statistical processing and results analysis were carried out by InfoWatch’s analysis center. Percentages are rounded off to the nearest one-tenth of one percent. In the case of some answers, the total percentages exceed 100% due to the use of multiple choice questions.
IS specialists: 37.1% System administrators: 34.3% Users: 28.6% This means that around 71.1% of those surveyed are IT professionals. We should mention that slightly over a third of specialists surveyed (27.9%) had no VoIP service on their intranets at all.
The greatest risk — according to 55.6% of those surveyed — is the leakage of confidential information. In other words, more than half the specialists felt that as a result of using Skype, confidential corporate information could leak out.
The research concludes that the threat of a leak of confidential information is twice as likely (55.6% as opposed to 29%) than a hacker attack on intranet resources.
On top of this, as with the majority of software products, VoIP client programs have vulnerabilities which, theoretically, may be exploited. The most likely explanation is that fear has its roots in past dangers from hacker break-in.
Clearly, apart from factors connected with the Skype program itself, vulnerabilities can arise due to other causes, such as faults in a given piece of software or malignant intent or lack of discipline among users, etc. VoIP is beneficial and convenient, but to prevent the occurrence of the nightmare scenario — the loss of confidential information — companies need to protect their data in the same way as they protect against theft via e-mail, the Internet, printers or USB data-storage devices. Thirdly, there is the issue of copying valuable data to the clipboard then pasting it into the chat facility which Skype supports.
http://www.viruslist.com/en/analysis?pubid=204791933
“IBM ISS understands that scalability is a key ingredient for offering customers a comprehensive set of options for their enterprise security needs,” said Rob Ayoub, Industry Manager, Network Security with Frost & Sullivan. “The addition of a lower-cost intrusion prevention appliance to the company’s product line extends its powerful, preemptive protection capabilities to a broader set of companies, and enables larger companies to cost-effectively shield additional segments of the network from attack.”
Until now, companies needing to protect these points have only had limited-feature IPS offerings available to them. “Long gone are the days when a firewall and antivirus solution were enough to protect a corporate network,” said Greg Adams, Business Line Executive, Network Solutions for IBM Internet Security Systems.
http://www.iss.net/about/press_center/releases/us_intrusion_protection_remote.html
Configuration weaknesses in VoIP devices and underlying operating systems can enable denial of service attacks, eavesdropping, voice alteration (hijacking) and toll fraud (theft of service), all of which can result in the loss of privacy and integrity. To perform well in VoIP environments, security appliances must both protect the VoIP infrastructure and maintain the voice quality, availability and reliability of the connection.
Establishing a secure VoIP and data network is a complex process that requires greater effort than that required for data-only networks.
VoIP systems can be expected to be more vulnerable than conventional telephone systems, in part because they are tied into the data network, resulting in additional security weaknesses and avenues of attack. Confidentiality and privacy may be at greater risk in VoIP systems unless strong controls are implemented and maintained.
Use strong authentication and access controls on the voice gateway system. Since some VoIP telephones are not powerful enough to perform encryption, placing this burden at a central point ensures all VoIP traffic emanating from the enterprise network will be encrypted. Financial institutions should enable, use and routinely test the security features included in VoIP systems.
http://www.bankinfosecurity.com/articles.php?art_id=207
Security Considerations for Voice Over IP Systems – NIST Special Publication 800-58