Plug and Play port scan reveals new worms

Posted on by admini

The W32/Bobax-A worm, which employs the same Microsoft security vulnerability as the Sasser worm to break into computers, uses port 5000 to identify Windows XP systems (the port used for “Universal Plug and Play”).

According to the Sophos Web site, this new worm “is capable of turning infected computers into spam factories and launchpads for denial-of-service attacks against Web sites.”

The process is explained on the LURHQ security site: “unlike proxy Trojans which require the spammer to connect and send each individual piece of mail, Bobax sends the mail using a template and a list of email addresses.

This has the benefit of offloading almost all the bandwidth requirements of spamming onto the Trojaned machines, allowing the spammer to operate with minimal cost.”

Kibuv.B creates an FTP server on port 7955 for which any username/password combination will work.

Like other malware of this type, the FTP server sends a copy of the worm in response to any file request.

The vulnerabilities exploited by these two worms are not new — users with the latest patches from Microsoft are protected.

More info: http://news.zdnet.co.uk/internet/0,39020369,39155162,00.htm

Read more

Hackers penetrate global finance firms

Posted on by admini

According to consultant Deloitte’s 2004 Global Security Survey, many of these hacks resulted in financial loss. But even with security attacks on the rise, a quarter of firms admitted that their security budgets were frozen.

The study reported that 83 per cent of respondents admitted their systems had been compromised in the past year, compared to only 39 per cent in 2002. Of this group, 40 per cent stated that the breaches had resulted in financial loss to their organisation.

“Financial institutions, particularly security officers, are facing greater challenges than ever,” said Simon Owen, partner at Deloitte, in a statement. “They are fighting an ongoing battle to overcome evolving security threats and to comply with an increasingly stringent regulatory environment but, at the same time, resources have stagnated.”

Companies are sliding backwards when it comes to the use of security technologies, Deloitte claimed.

While more than 70 per cent of respondents said they saw viruses and worms as the greatest threat to their systems in the next 12 months, the number with fully deployed antivirus measures was down to 87 per cent from 96 per cent in 2003. One third of respondents felt that security technologies acquired by their organisations were not being used effectively, while only one quarter felt that their strategic and security technology initiatives were well aligned.

More info: http://www.infomaticsonline.co.uk/News/1155258

Read more

A third of UK corporates open to hackers

Posted on by admini

According to security firm NTA Monitor, UK businesses are drowning under a rising tide of medium and low-level security vulnerabilities as they fight to deal with high-risk security flaws.

The company’s research – based on analysis of almost 500 network perimeter security tests of clients in both the public and private sector – found that a third of corporate networks have at least 10 flaws, opening themselves to “considerable risk of malicious attack”.

High-risk flaws were discovered in only 3.9 per cent of tests, while medium flaws were found in 74.3 per cent of tests and a low-risk vulnerability of some kind was found in every test carried out.

Security issues relating to the configuration of internet routers were found to account for the most frequently identified vulnerability.

Poorly configured routers can allow an attacker to let themselves into a network and can also be used as a stepping stone to attack other systems, NTA Monitor warned.

The most common problem the security firm found threatening its customers was denial of service (DoS) attacks.

Low-level flaws were identified in all networks in both 2003 and 2004, while medium-level flaws climbed from 73 per cent in 2003 to 74.3 per cent in 2004.

http://www.vnunet.com/News/1155120

Read more

Lottery scams new flavour of the month

Posted on by admini

Last month the Austrailian group, FraudWatch International, received over 1000 variations, double the number of phishing email scams.

They are to contact a claims agent to collect their winnings, typically at a free email address. The claims agent sends his victims a claim form, and asks for copies of their passport and driver’s license to verify their true identity. They can have the money wired to their bank account, they can open an account with a specified bank (bogus), or they can pick up their winnings personally.

http://www.securityfocus.com/news/8571

Read more

Sasser shows there must be a better way

Posted on by admini

Microsoft announced an unprecedented eight patches to fix 21 vulnerabilities on “Patch Tuesday” last month, one of which Sasser’s creators exploited within three weeks.

Given the Sasser worm variants have hit 500,000 to 1 million unpatched machines to date, according to industry estimates, concern abounds that the window is rapidly closing between the time it takes vendors to identify holes and for attackers to take advantage of them.

Each new assault taking the world closer to zero-day exploits, when hackers will have the means to strike the day a new gap is announced.

Mark Nicollet, analyst for Connecticut-based research and advisory firm Gartner Inc., said the challenge is for organizations to put systems in place to end the recurring nightmare where administrators scramble to update their security software ahead of the next worm or virus, only to discover later that the patches they installed conflict with other software, causing computers to slow down or crash. We need to reach the point where blocking technology is effective enough to let us patch in a less disruptive, risky way, even without zero-day exploits.”

Eric Schultze, chief security architect for Shavlik Technologies of Roseville, Minn., said when it comes to the prospect of zero-day attacks, his biggest concern is that software experts are putting too much information in the public domain and unintentionally helping the hackers. He said researchers think they’re helping the IT community by putting detailed reports outlining the latest security flaws on the Internet for all to see. Schultze said the best approach is for researchers to “find the bug, alert the vendor and keep the rest out of the public domain.”

As the industry waits for Microsoft’s announcement and the next malicious code, some express skepticism that the zero-day attack will ever happen.

“I don’t think it’ll reach the point where hackers have a zero-time turnaround,” said Dennis Racca, president of network security provider Umbra Networks in Andover, Mass.

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci963170,00.html

Read more

Regulator says U.S. nearing Basel bank rules deal

Posted on by admini

The accord — known as Basel 2 because it would replace an existing regime — is a set of rules governing international bank capital and oversight and is focused on preventing financial problems from spreading across borders while taking into account modern risk management methods.

But Roeder said the United States will conduct an extensive survey of how the new regulations will affect the estimated 10 large U.S. banks that must follow them.

Officials have not publicly identified which 10 banks will be subject to the rules, but they must have at least $250 billion in assets or have 10 percent of their assets outside the United States.

http://www.reuters.com/financeNewsArticle.jhtml?type=bondsNews&storyID=5065845

Read more