Cyberattacks Abound Yet Companies Tell SEC Losses Are Few

Posted on by admini

After a wave of cyber attacks hit a Federal Reserve website, the New York Times and other news outlets, and U.S. banks, President Barack Obama issued an executive order in February to better protect businesses and critical assets, such as pipelines and power grids.

The SEC issued guidance in October 2011 telling companies to disclose cyber attacks or risks if that information is material, meaning it would affect an investor’s willingness to buy, hold, or sell the company’s stock.

“For the sake of investors, the SEC needs to figure out a way of enforcing the appropriate disclosure of material cyber attacks,” said Jacob Olcott, who led a congressional review as counsel to Senator Jay Rockefeller, a West Virginia Democrat, that resulted in the SEC guidance.

Cyber attacks are more likely to be material for some companies than others, Brian Lane, a former SEC corporation finance director, said in an interview.

Almost all of the top 100 U.S. companies by revenue said they rely on technology that may be vulnerable to security breaches, theft of proprietary data and disrupted operations, according to a review of their most recent annual reports.

ConocoPhillips, one of at least six major U.S. and European energy companies reported by Bloomberg to have been breached by China-based hackers beginning in 2009, said in its 2012 annual report no cyber breaches “had a material effect.”

Coca-Cola acknowledged its “information systems are a target of attacks,” in its 10-K and said the disruptions “to date have not had a material effect on our business, financial condition or results of operations.”

If a company doesn’t disclose an attack in an SEC filing that was reported in the news media, “don’t be surprised if we ask you to provide us with a materiality analysis,” Jim Lopez, an SEC branch chief for disclosure operations, said at a Washington conference in February.

While Verizon said in its 2012 10-K the cyber attacks it experienced haven’t been material, the company said the potential costs of a major assault include “expensive incentives” to keep customers, a jump in security spending, lost revenue and damage to the company’s reputation.

Link: http://www.bloomberg.com/news/2013-04-04/cyberattacks-abound-yet-companies-tell-sec-losses-are-few.html

Read more

The New Normal: Wednesday Is DDoS Day At Citi

Posted on by admini

A group that calls itself the Izz ad-Din al-Qassam Cyber Fighters took responsibility for the American Express attack, as it has for other attacks on banks and financial services organizations. Third party analysis of the attacks on American Express and other banks suggest that those behind the operation are well-funded and sophisticated: leveraging networks of compromised web servers to host attacks and using sophisticated tools to target weak points in public facing banking and business applications.

In February, the website Krebsonsecurity reported that Bank of the West was the victim of a large denial of service attack that acted as cover for unauthorized transfers from one of the bank’s commercial customers that totaled $900,000.

However, Citi has been hampered in its investigation by a lack of reliable data, constrained funding and a dearth of forensic and case management tools to analyze it, she said.

The bank has plenty of security software and hardware, and relies heavily on its security information management (SIM) systems, but the focus is still on protecting Citi’s network from external threats or removing threats, not analyzing activity within the network to spot malicious or suspicious goings on. Activity due to malware or phishing attacks and lateral movement on the network characteristic of so-called “advanced persistent threats” can be difficult to spot with current tools, she said.

Out of 100 countries, Older estimated that only 50 have laws that allow Citi to look at the kinds of specific data on IP addresses, logins and other data that’s necessary to conduct a proper investigation. “We have cases where we know there’s malware there, and we know an investigation happened, but we can’t get the data back,” Older said. “I think it would benefit us greatly if we could get past that and find a way to be sensitive to privacy regulations in a way that also lets us get meaningful data.”

Link: http://securityledger.com/the-new-normal-wednesday-is-ddos-day-at-citigroup/

Read more

Ars Technica: Exclusive: Ongoing malware attack targeting Apache hijacks 20,000 sites

Posted on by admini

“Given that these are dynamically generated, there would be no viable means to do a search to ferret them out on Google, etc.,” Mary Landesman a senior security researcher for Cisco Systems’ TRAC team, told Ars.

Referring to the rogue Apache modules that are injected into infected sites, he added, “Since late 2012 people have sent me new versions of the malicious modules, so this malware is in active development, which means that it pays off well and the number of infected servers can be high (especially given the selectivity of the malware that prefers to stay under the radar rather than infecting every single visitor).”

According to recent blog posts published here and here by researchers from security firm Securi, Darkleech uses rogue Apache modules to inject malicious payloads into the webpages of the sites it infects and to maintain control of compromised systems. They note the third-party attack sites host malicious code from the Blackhole exploit kit, a suite of tools that targets vulnerabilities in Oracle’s Java, Adobe’s Flash and Reader, and a variety of other popular client software. “It looks like the attackers were beforehand well-prepared with some penetration method to gain web exploitation which were used to gain shell access and did the privilege escalation unto root,” the writer of the latter blog post wrote last week, adding that he wasn’t at liberty to discuss the precise method.

The Apache server compromise in many ways resembles a mass infection from 2008 that also used tens of thousands of sites to silently expose visitors to malware attacks. … Because the server malware is designed to conceal itself and because so many individual systems are affected, it can be next to impossible for any one person to gain a true appreciation for the scope of attack.

Link: http://arstechnica.com/security/2013/04/exclusive-ongoing-malware-attack-targeting-apache-hijacks-20000-sites/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29

Read more

Old News, ThreatGRID researchers discovered this a couple of months ago: New APT malware monitors mo

Posted on by admini

The malicious document downloads and executes a component that attempts to determine if the operating environment is a virtualized one, like an antivirus sandbox or an automated malware analysis system, by waiting to see if there’s any mouse activity before initiating the second attack stage. Mouse click monitoring is not a new detection evasion technique, but malware using it in the past generally checked for a single mouse click, Rong Hwa said. BaneChant waits for at least three mouse clicks before proceeding to decrypt a URL and download a backdoor program that masquerades as a technology by performing multibyte XOR encryption of executable files, masquerading as a legitimate process, evading forensic analysis by using fileless malicious code loaded directly into the memory and preventing automated domain blacklisting by using redirection via URL shortening and dynamic DNS services, he said.

For example, during the first stage of the attack, the malicious document downloads the dropper component from an ow.ly URL. The rationale behind using this service is to bypass URL blacklisting services active on the targeted computer or its network, Rong Hwa said. This is an attempt to trick users into believing that the file is part of the Google update service, a legitimate program that’s normally installed under “C:Program FilesGoogleUpdate”

Read more

Cyberattacks on banks signal urgent need for security bill, lawmakers say

Posted on by admini

.”These banks are among the best in the country when it comes to cyber security, but even they are having trouble keeping up with attacks that have the sophistication and the level of resources that a nation-state entity like Iran can devote to them,” he said.

Adam Schiff, D-Calif., a senior member of the House Intelligence Committee, told NBC News Wednesday that the FBI and “other law enforcement agencies are following up aggressively to identify the responsible parties” of the attacks. “Our computer networks are the subject of daily assault by hostile hackers, both state sponsored and independent, who hope to obtain confidential information for economic gain, to test our defenses, or simply because they can,” Schiff said.

Rogers, who is pushing for the passage of the Cyber Intelligence Sharing and Protection Act, H.R.624, says that the federal government is “trying to share cyber threat information with these banks to help them get ahead of these attacks. He said, “needs to pass bipartisan information sharing legislation to knock down those barriers, so that American companies can protect their computer networks and the valuable intellectual property and personal customer information that resides on them.”

Doug Johnson, the American Bankers Association’s vice president of risk management policy, told NBC News that the attacks “have been intensifying since October and we expect them to continue.

Link: http://www.nbcnews.com/technology/technolog/cyberattacks-banks-signal-urgent-need-security-bill-lawmakers-say-1C9202532

Read more

Hackers attacking US banks are well-funded, expert says

Posted on by admini

“The biggest change is the maintenance and the growth in the botnet,” Dan Holden, director of Arbor Networks’ Security Engineering and Response Team explained for Ars Technica.

And they’ve added some twists and techniques to their tools as time goes on, focusing their attacks more on the particular applications of the banks they’re targeting.

And while the attacks bring huge losses to the targeted institutions – whether it’s because the customers can’t access their accounts for days at the time, because the hackers or other cyber crooks might have used the DDoS attacks as a cover for fraudulent transaction, or because of the preventative measures they had to undertake to protect their websites – the cost for the attackers is thought to be also considerable.

Considering the effort and hours it takes to maintain the attack botnets, and the continuing refinement of the attacks, Holden believes that it couldn’t be done without financial backing.

Link; http://www.net-security.org/secworld.php?id=14691

Read more