admini – Page 87 – CyberSecurity Institute

Emerging threats include kinetic attack, offensive forensics

Posted on March 4, 2013December 30, 2021 by admini

A six-by-eight-foot miniature city, CyberCity features a SCADA-controlled power grid, traffic system, trains, a military base and more, all of which can be hacked and defended in cyberspace similar to a real city. When asked by an audience member whether any significant vulnerabilities were found in the CyberCity hospital, Skoudis offered a stark reminder of the insecure state of the nation’s health care infrastructure.

Attackers, whether they are nation-state actors or run-of-the-mill cybercriminals, are increasingly trying to hide their trails by purposefully inserting code that mimics other attackers.

Or sophisticated malicious hackers may purposefully insert what may be considered rudimentary mistakes into their malcode just so forensics experts won’t think to attribute an attack to them.

Now, Skoudis said, attackers are able to target the exact data they want through the use of forensics tools, with the added benefit that it reduces the noise in the network so they’re less likely to be noticed. “Offensive forensics is taking forensics techniques, analyzing in-depth file systems and memory and combing through it, looking for the needle in the haystack,” he said.

The ultimate point driven home by Skoudis and Ullrich was that defending industrial control systems and financial institutions should be an absolute priority, though the track record of the security industry doesn’t provide much comfort for those concerned about these matters.

Link: http://searchsecurity.techtarget.com/news/2240178966/Emerging-threats-include-kinetic-attack-offensive-forensics-RSA-2013?utm_medium=EM&asrc=EM_ERU_20845656&utm_campaign=20130305_ERU%20Transmission%20for%2003/05/2013%20(UserUniverse:%20635547)_myka-reports@techtarget.com&utm_source=ERU&src=5111753

Bank of America says hackers lifted its data from a partner

Posted on March 4, 2013December 30, 2021 by admini

In a statement, Bank of America did not confirm it was working with TEKsystems, an IT consultancy that is part of the Allegis Group. “The source of this release has confirmed that the data was not acquired by a hack but because it was stored on a misconfigured server and basically open for grabs,” the group said.

HB Gary Federal, a California security consultancy, was compromised by Anonymous in 2011 after the company had researched the real identities of some Anonymous members.

Par:AnoIA’s data dump includes a batch of more than 500 emails with brief reports on the Occupy Wall Street movement and hacking groups such as TeaMp0isoN and UGNazi. The data also included a special file listing of four intelligence analysts who authored some of the emails, including three who work for TEKsystems and one who formerly worked for Bank of America. Par:AnoIA said its release also includes the application OneCalais, which collects unstructured information from news stories, blogs and research reports.

Link: http://www.pcworld.com/article/2029981/bank-of-america-says-hackers-lifted-its-data-from-a-partner.html

Blackhole Exploit Kit Run Adopts Controversial Java Flaw

Posted on March 1, 2013December 30, 2021 by admini

Using Trend Micro Smart Protection Network™ data, we looked into the most affected countries by this BHEK run and got some interesting results.

For the spam component of this threat, it is also crucial for users and security administrators alike to realize that the usual spam and phishing best practices are not effective to address BHEK spam runs. We previously released our report Blackhole Exploit Kit: A Spam Campaign, Not a Series of Individual Spam Runs, which goes into details about our finding regarding the BHEK runs.

Link: http://blog.trendmicro.com/trendlabs-security-intelligence/blackhole-exploit-kit-run-adopts-controversial-java-flaw/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Anti-MalwareBlog+%28Trendlabs+Security+Intelligence+Blog%29

Hackers use corporate attacks as staging grounds for other cyber assaults

Posted on March 1, 2013December 30, 2021 by admini

For one thing, any counterstrike against what might be thought to be the lair of the attacker may in reality simply be just another corporate network that’s been compromised. An IT manager that wants to take steps to definitely stop certain actions is proceeding into an area that’s immediately dominated by legal and insurance considerations.

It would be a better world if IT managers could reach out across corporate boundaries and one could tell another about what’s perceived to be an attack based on malware coming from the other’s network and quickly snuff it out. … Instead, it’s the company lawyers that will be needed to try and resolve serious problems that seem to emanate from other corporate networks.

Serge Jorgensen, CTO at Sylint Group, the Sarasota, Fla., firm that provides incident response and remediation services, pointed out that one legal option would be seeking a temporary restraining order (TRO) from a judge against what is seen as the offending entity where the cyber-attack appears to originate.

Link: http://www.networkworld.com/news/2013/030113-rsa-cyberattacks-267279.html

Hacker raids ABC

Posted on March 1, 2013December 30, 2021 by admini

“As soon as the ABC was made aware of this activity the site was shut down,” Cray said. “This breach originated at an overseas location and an activist has claimed responsibility for it.”

Random checks against user identities listed within the 10 page online database dump returned legitimate matches.

The hacker claiming responsibility said the attack was in response to an interview broadcast on the ABC’s Lateline program with the right-wing Wilders.

Link: http://www.crn.com.au/News/334708,hacker-raids-abc.aspx?utm_source=pcta&utm_medium=web&utm_campaign=networkbar

New Java 7 security flaws emerge as old one lands in crime kits – java 7, software vulnerabilities,

Posted on February 25, 2013December 30, 2021 by admini

Security experts generally advise users to disable the Java browser plugin, which was exploited in recent targeted attacks on developers at Facebook, Apple and Microsoft.

Reports of the new Java flaws come as an exploit for a flaw patched in the Java 7 update 13 on February 1 has found its way into automated exploit kits designed for mass infections.

Security researcher Kafiene, who has closely monitored the development of ransomware and popular exploit kits, on Sunday reported the exploit’s arrival in several crime kits.

Another, Popads, included an additional lure of a self-generated fake Microsoft certificate for a malicious Java applet that is designed to trick users into installing a fake Java security update.

The social engineering is “tricky”, Kafiene notes, but the upshot for potential Windows victims is that they need to click “run” in the security warning to become infected.

Link: http://www.cso.com.au/article/454780/new_java_7_security_flaws_emerge_old_one_lands_crime_kits/