Too many admins spoil your security

Posted on by admini

The most popular applications at this shipping company have many thousands of users, so at first having roughly 10 percent of your users operating as administrators may not seem like that big a deal. But users should always be lowest privilege level, and having an excessive number of application administrators is as bad as having too many OS administrators. Every additional admin doesn’t just increase his or her own risk; if they’re compromised, they add to the takedown risk of all the others.

But no one had thought to do the same analysis on the application administrators (at least not until I came along — that’s why they pay me the big bucks). Even when they compromise the passwords of the entire domain and all the network administrators, what they are really after lies on application servers, which is why application administrators can do you in. I’ve done a few of these audits; it’s usually easy to find the problem children, and you can eliminate a lot of them.

My favorite applications are the RBAC (role-based access control) ones where almost no one is an admin, and even the admins are limited in what they can do.

That’s why I’m as worried about how a company controls and audits application administrators as I used to be about OS and network administrators.

Link: http://www.infoworld.com/d/security/too-many-admins-spoil-your-security-218023?source=rss_security

Read more

Dutch bill seeks to give law enforcement hacking powers

Posted on by admini

To disable a botnet it is necessary to access the command and control servers that control the botnet which can be located in a foreign country, according to the bill. The new investigative powers would also allow law enforcement to infiltrate computers or servers located in foreign countries if the location of those computers cannot be determined.

“It is important that the government wants to combat cybercrime but this proposal is rushed: it is unnecessary and creates new security risks for citizens,” said Simone Halink of Dutch digital rights organization Bits of Freedom in a blog post on Thursday.

At the moment the draft bill is in the consultation phase, meaning parties involved such as the police and other law enforcement as well as citizens and advisory bodies will be able to comment on it, ministry spokesman Wiebe AlkemaA said. Following that, the bill will be sent to sent to the Council of Ministers after which it will be sent to the Dutch Council of State, an advisory body on legislation.

Link: http://m.networkworld.com/news/2013/050213-dutch-bill-seeks-to-give-269341.html?mm_ref=http%3A%2F%2Fhackerattacks.einnews.com%2Farticle%2F148868025%2FMqlS6swIW71VD0gY%3Fn%3D2

Read more

Saudi Arabia is a top target for cyber attacks

Posted on by admini

Cyber espionage designed to steal intellectual property is also on the rise, with the small to medium sized enterprises (SME) the most vulnerable because of smaller amounts spent on internet security, according to the report. Their motivations are financial and political in some aspects,” said Johnny Karam, the managing director of Symantec for the Middle East and North Africa.

Last year Symantec discovered 1.6 new malicious software (malware) variants every day, one in 532 websites were infected with malware and the company blocked 250,000 web attacks each day, of which about 65 per cent were handled automatically.

The “watering hole” strategy, by which hackers wait for their targets to come to a website they have infected, is becoming more sophisticated.

Most recently, the Associated Press Twitter account was hacked into, with a false tweet posted stating that the US president Barack Obama had been injured in explosions at the White House.

“Mobile is an area where attacks are growing, spam remains as one of the key methods of attacks, as well as web pages and financial sector phishing”.

Link: http://www.cyberwarzone.com/saudi-arabia-top-target-cyber-attacks

Read more

DHS: ‘OpUSA’ May Be More Bark Than Bite

Posted on by admini

The DHS alert is in response to chest-thumping declarations from anonymous hackers who have promised to team up and launch a volley of online attacks against a range of U.S. targets beginning May 7.

But Rodney Joffe, senior vice president at Sterling, Va. based security and intelligence firm Neustar, said all bets are off if the campaign is joined by the likes of the Izz ad-Din al-Qassam Cyber Fighters, a hacker group that has been disrupting consumer-facing Web sites for U.S. financial institutions since last fall.  Joffe said it’s easy to dismiss a hacker manifesto full of swear words and leetspeak as the ramblings of script kiddies and impressionable, wannabe hackers who are just begging for attention.  “The damage they’re capable of doing may be out of proportion with their skills, but that’s been going on for seven months and it’s been brutally damaging.”

What’s more, the DHS warning comes just days after the FBI issued a flash alert on Brobot (PDF) warning that hackers have been modifying the attack scripts to ensure they can evade their targets’ mitigation efforts. “Because the attacks have been ongoing for seven months, the actors are changing their attack methodology to circumvent mitigation efforts of the financial institutions,” reads an FBI alert obtained by BankInfoSecurity.com. “The latest version of the ‘Brobot’ attack scripts that have been utilized to attack the login capabilities of a financial institution’s website spoofs a fraudulent access cookie, user-agent string and referrer. The FBI alert notes that the hard-coded string does not affect the new attack script, but can be used as signatures for intrusion detection and intrusion prevention devices to detect and block attacks from the Brobot botnet.

Link: http://m.krebsonsecurity.com/2013/05/dhs-opusa-may-be-more-bark-than-bite/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29

Read more

Cyber-Responders Seek New Ways to Respond to Cyberattacks

Posted on by admini

Local and state government offices that may not see themselves as prime targets for theft of intellectual property or financial information can be used as the weak link to get at financial institutions, Ling said.

The business models of large anti-virus vendors such as Symantec and McAfee incorporate everyone who has a computer, because perimeter defense is an important aspect of protection and is mandated by many federal regulations, including the Health Insurance Portability and Accountability Act (HIPAA).

As with other vendors, FireEye’s starting point is that malware threats evolve so quickly that the traditional protection model is antiquated, explained Phillip Lin, director of product marketing.

“When we were working for McAfee, we investigated large breaches such as Aurora,” recalled Dmitri Alperovitch, a CrowdStrike co-founder and former vice president of threat research at McAfee.

Based in Orange County, Calif., CrowdStrike was founded in 2011 by George Kurtz, the former worldwide CTO of McAfee; Alperovitch; and Gregg Marston, who worked as chief financial officer of Foundstone Inc., a cybersecurity forensics firm that Kurtz sold to McAfee.

Mike Maxwell, director of Symantec’s state and local government organization, said anti-virus continues to be an important tool for containing and blocking malware, but other approaches are necessary to complement it. This makes it difficult for traditional ‘signature-only’ anti-virus approaches to keep up with these evolving threats,” he explained in an email response to questions from Government Technology. But it also builds a list of bad stuff such as the application is communicating with a known bad IP address or it is attempting to insert files in other common load points, such as the registry, removable storage or file system, so this may be suspicious activity that would be blocked, logged or alerted based on configured policy.

Yet Howard said he has seen real change during the past few years: More organizations are moving away from denying that they are under attack; instead they are trying to figure out how they can limit the damage.

Booz Allen Hamilton’s Ling said that although these new companies may be good at what they do, it’s difficult to create a business model around any one aspect of protection, and a chief information security officer may not want to create a mix-and-match solution, because then the risk is assumed by the decision-maker, not the solution provider.

Link: http://www.govtech.com/security/Cyber-Responders-Seek-New-Ways-to-Respond-to-Cyberattacks.html

Read more