VoIP is a threat to wireless security

Posted on by admini

“Security obviously cannot be ignored,” said Nick Jones, a research vice-president for Gartner, “but you can worry less — so long as you are willing to pay, for it security can be achieved.” Jones said that a variety of advances in areas such as encryption and virtual private networks — and better management strategies — were helping businesses secure their networks more effectively.

Jones, who gave a keynote speech at Gartner’s Wireless and Mobility Summit, said that mobile computing was becoming an increasingly important issue for IT bosses to consider. “Mobility is one of the top priorities for CIOs,” he said. “If you are a CIO, I hope you have a wireless strategy because your peers will have one.”

The Summit also heard that VoIP products such as Skype were likely to drive down mobile phone costs, as some companies are now encouraging staff to use VoIP for long-distance calls.

Jones, however, warned that VoIP services pose a threat to corporate security because they require some ports on the firewall to be left open, which can give hackers opportunities to penetrate a network.

http://www.silicon.com/research/specialreports/voip/0,3800004463,39129635,00.htm

Read more

How vulnerable is the ‘Net?

Posted on by admini

“It was an attempt to make a massive problem,” says KC Claffy, principal investigator at CAIDA. “They certainly made a blip on a graph.” But the Internet and its users got off easy. The barrage lasted only an hour, and no end users were affected. The attack did, however, serve as a wake-up call, as network operators and others have taken steps to better secure the Internet since then.

But some still question whether the Internet is susceptible to attack and needs more authoritative oversight. “If somebody was to do a real concerted, knowledgeable attack, it wouldn’t be very difficult to have a catastrophic impact on a huge component of commerce,” says Larry Jarvis, vice president of network engineering at Fidelity Investments. “It would be huge to the U.S. economy and to a lot of companies that now view the Internet as the equivalent to a dedicated circuit to all these entities.”

Clif Triplett, global technology information officer at General Motors, says he is worried mostly about router and host software bugs, as well as broadcast storms such as distributed DoS (DoS) attacks bringing down the ‘Net. “I’m highly concerned about it,” Triplett says. “If that network is a core piece of your business, I think you’re at a risk.”

Two-thirds of the 1,300 “technology leaders, scholars and analysts” surveyed recently by the Pew Internet & American Life Project said they “expect a major attack on the Internet or the U.S. power grid within the next 10 years.”

The 13 DNS root servers resolve Internet naming and addressing. If they were knocked out, Internet sites would become inaccessible. The servers repel distributed DoS attacks every day, operators say.

CAIDA research shows that up to 85% of the queries against the DNS servers are “bogus” or repeated from the same host.

The system has been bolstered since the 2002 attack, with root servers now consisting of 50 to 100 physically distributed, highly redundant boxes in 80 locations across 34 countries. In 2002, far fewer servers were located in 13 sites across four countries. This level of distribution and redundancy makes a complete shutdown of the DNS system unlikely, says Paul Mockapetris, chairman and chief scientist of IP address management vendor Nominum and the inventor of DNS.

The physical servers use Anycast, a routing technique that heightens resiliency by multiplying the number of servers with the same IP address and balancing the load across an army of geographically dispersed systems.

“If I was going to try and arrange a DNS 9/11, it’s a very bad target to try and attack because it’s so distributed – you’d have to take [the servers] out everywhere,” Mockapetris says. “If you took out one root server today, nobody would notice.”

But the more distributed a system is, the more difficult it is to defend, notes Stephen Cobb, an independent security consultant who was recently quoted in a Network World column stating a belief that the ‘Net can be brought down and kept down for 10 days or more.

“The reason it hasn’t gone down for days so far is that the people who know how to do it aren’t so inclined.” However, the good guys are inclined to implement security best practices, like those outlined in an IETF informational document on root server operation called RFC 2870, says Jose Nazario, security researcher and senior software engineer at Arbor Networks, which makes products carriers use to protect their networks from cyberattacks. Originally drafted in 2000, RFC 2870 has been extended over the past couple of years.

Cisco, the leading provider of Internet routers, regularly issues bug alerts. And BGP, which distributes routing information between networks on the Internet, is susceptible to IP address spoofing. “BGP peering has some security problems,” says Sam Hartman, area director for the IETF’s Security Area working group.

http://www.nwfusion.com/news/2005/041805-internet-security.html

Read more

F5 Fires Up Powerful SSL VPN Solution

Posted on by admini

It supports clustering environments up to 10 nodes, allowing up to 20,000 concurrent users—1,000 concurrent users per node—and secure Web-based remote access to corporate applications and desktops. The FirePass 4100 includes four 10/100/1000 copper Ethernet ports and three PCI slots for optional SSL acceleration as well as an 80-Gbyte hard drive. It’s Federal Information Processing Standards (FIPS) 140-compliant, an important selling point for solution providers serving the health-care, government and military verticals. The FirePass 4100 is an enterprise-class appliance engineered to provide remote access as well as create SSL VPNs with greater ease and manageability than any products previously available.

To evaluate the appliance, they used a test network running Windows Server 2003 Active Directory and using Cisco and AdTran access routers and switches at Clover Park Technical College, Lakewood, Wash. This article publishes the results of their revew.

http://www.crn.com/showArticle.jhtml?articleID=160900298&flatPage=true

Read more

Six Ways To Protect Against Zero-Day Attacks

Posted on by admini

Use file integrity checking
File integrity checking tells you if the software you think you have installed on your network is actually what it is supposed to be. There are a number of free utilities to do this — Tripwire is the best known among them. Traditionally, file integrity checking is used is to identify recent changes on a PC. That way, when things go desperately wrong you can try to back out of the latest changes. File integrity checking is also useful for discovering spyware and viruses your antivirus software has missed.

Run new or unknown software in a sandbox
A new generation of antivirus software extends file integrity checking by making unknown software run in a “sandbox.” This form of isolation prevents viruses or worms from propagating unless they can trick a known program into doing the work for them. Another way to develop a sandbox is by using Microsoft’s Active Directory to keep users from installing anything new. Any new software is then carefully checked by the network administrator before it is installed on the rest of the network. In effect, this makes the network administrator’s PC the sandbox.

Scan autoruns
Each PC’s autorun programs should be periodically scanned for threats. There is a terrific free utility from SysInternals that will show you everything that is run when you boot up your PC.

Use intrusion prevention at the gateway and on each desktop
Effective intrusion prevention soft-ware monitors network traffic and matches it to known types of attacks. This approach would have stopped the Sasser and Korgo.W worms in their tracks since they exploited known vulnerabilities. Intrusion prevention rules are continually updated by your vendor. You also should be able to add new intrusion prevention rules yourself.

Use heuristic and signature- based antivirus software
A recent addition is the ability for users to easily create their own virus signatures and to distribute them throughout their networks.

Be aware of Microsoft holes
It is no secret that Microsoft systems and programs are the most vulnerable to attack. Some software vendors have extended Microsoft’s security by adding to Windows the concept of program permissions. Just as users have permissions for directories and files, programs can have permissions to access different parts of the operating system, giving you direct control over what they can and cannot do.

http://www.networkingpipeline.com/160902074

Read more

Is Machine-To-Machine (M2M) The Gap In Your Security

Posted on by admini

M2M connections are endemic and can range from all the complex communications within a modern aeroplane, through to internal Microsoft servers talking to each other.

In manufacturing, all processes are increasingly linked automatically. Lathes, for example, are driven by production scheduling systems and robots are managed by manufacturing systems. In the pharmaceutical industry, production processes are very closely monitored to ensure legal compliance with FDA and other regulations. In finance, automated linked processes are subject to close regulation; and ATMs communicate directly with their core corporate systems. In the average organisation, servers talk to other servers all the time without manual intervention.

While these linkages provide major cost benefits, most of these internal appliances are not given the same level of security as outward facing systems. They typically rely on gateway systems for firewall and anti-virus protection. This was more than adequate in the past but not any longer, as has become increasingly clear to the many organisations who have had to build patch scheduling (or rush patching) into their timetables.

Unsecured IP connected devices are potentially vulnerable to a range of problems such as network viruses, trojans and hacking. A recent report on ‘The Register’ web site described how a couple of simple web searches threw up over a thousand unprotected surveillance cameras.

Other areas at risk include VoIP servers and VoIP devices. Digital telephone switches can also be a problem. The list of ‘machines’ with a potential security risk is long and includes wireless devices, video conferencing systems, data centre monitoring equipment, internal security cameras, webcams, POS devices and ATM devices.

Real life examples include a company where production was lost for days when robots on an IP network became infected. A pharmaceutical company had to take its systems down for two weeks, to recalibrate them to comply with Food and Drugs Administration (FDA) regulations, after needing to install urgent patches.

Telephone switch and router problems, though probably less expensive, can still run into tens of thousands of pounds.

Adding tens or hundreds of additional security devices to the IT department’s management load would have been an expensive nonsense. Finally, patching vulnerabilities has often been dealt with on a tactical basis, so the workload and expense have not always been planned or costed.

http://www.ebcvg.com/articles.php?id=675

Read more

Microsoft Worm Cleanser Goes Rootkit Hunting

Posted on by admini

It is the first time Redmond has added rootkit detection capabilities to the free Malicious Software Removal Tool, a move that underscores the increased prevalence of stealth rootkits on Windows machines.

Stephen Toulouse, program manager at the Microsoft Security Response Center, told eWEEK.com that the decision to add Hacker Defender to the worm zapper was the result of feedback from users. In all, Toulouse said four child variants of the stealth rootkit will be detected.

Hacker Defender (Win32/Hackdef) is a family of backdoor Trojans capable of creating, changing and hiding Windows system resources on a computer that it has infected. The program works on Windows NT 4.0, Windows 2000 and Windows XP machines. According to definitions posted by Computer Associates, Hacker Defender is a Trojan creation tool that can also be used to wrap existing Trojans to make them harder to detect. It can also hide proxy services and back-door functionality and conceal use of TCP and UDP (User Datagram Protocol) ports for receiving commands from attackers.

Microsoft isn’t the only software vendor flagging rootkits as a growing threat. Finnish anti-virus specialist F-Secure Corp. recently released the BlackLight Rootkit Elimination Technology as a free beta tool through Apr. 30.

Sysinternals Freeware, a site that offers Windows utilities, also offers RootkitReveal, a tool capable of finding registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit.

The availability of rootkit detection tools has triggered a cat-and-mouse game between security researchers and spyware writers.

The latest iteration of Microsoft’s worm cleanser also adds detections for the Mimail family of mass-mailing and network worms and the Rbot backdoor Trojan family. New new variants from the Berbew, Bropia Gaobot, MyDoom and Sober worms can also be detected.

http://www.eweek.com/article2/0,1759,1785621,00.asp

Read more