Cybercriminals Likely To Expand Use Of Browser Proxies

Posted on by admini

“You can essentially have the end users interact with a shadow Internet, essentially an Internet experience that is designed by the bad guys,” says Daniel Ingevaldson, chief technology officer for Easy Solutions, a fraud-prevention company that operates extensively in South America. “We haven’t seen anything that sophisticated yet, but I can see a scenario when this attack can be used to implement a server-side or cloud-based man-in-the-middle attack,” Ingevaldson says.

In an analysis of one attack, cloud security firm Zscaler detailed a PAC file that would set a victim’s browser to forward traffic for several Brazilian banking sites and American Express’s site to an attacker-controlled server. With a PAC file, the attackers can be a lot more choosy, redirecting requests to a group of sites or to one site in particular, says Anup Ghosh, co-founder and CEO of Invincea, a firm which detect and blocks Web and e-mail threats.

Preventing PAC files from compromising browsers is not a simple task, as client-side security software will likely find it difficult to detect whether a give PAC file is a valid change or a malicious attack, he adds.

In addition, companies that use a proxy for security or DNS–and so use a proxy auto-configuration file to configure their employees’ browsers–have a good chance of detecting changes that affect their infrastructure.

Link: http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/240150191/cybercriminals-predicted-to-expand-use-of-browser-proxies.html.html

Read more

Cybercriminals Likely To Expand Use Of Browser Proxies

Posted on by admini

“You can essentially have the end users interact with a shadow Internet, essentially an Internet experience that is designed by the bad guys,” says Daniel Ingevaldson, chief technology officer for Easy Solutions, a fraud-prevention company that operates extensively in South America. “We haven’t seen anything that sophisticated yet, but I can see a scenario when this attack can be used to implement a server-side or cloud-based man-in-the-middle attack,” Ingevaldson says.

In an analysis of one attack, cloud security firm Zscaler detailed a PAC file that would set a victim’s browser to forward traffic for several Brazilian banking sites and American Express’s site to an attacker-controlled server.

With a PAC file, the attackers can be a lot more choosy, redirecting requests to a group of sites or to one site in particular, says Anup Ghosh, co-founder and CEO of Invincea, a firm which detect and blocks Web and e-mail threats. Preventing PAC files from compromising browsers is not a simple task, as client-side security software will likely find it difficult to detect whether a give PAC file is a valid change or a malicious attack, he adds.

In addition, companies that use a proxy for security or DNS–and so use a proxy auto-configuration file to configure their employees’ browsers–have a good chance of detecting changes that affect their infrastructure.

Link: http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/240150191/cybercriminals-predicted-to-expand-use-of-browser-proxies.html.html

Read more

Hackers Hit Czech Central Bank, Stock Exchange, Commercial Banks | Fox Business

Posted on by admini

Komercni Banka AS (BAAKOMB.PR), majority owned by France’s Societe Generale SA (SCGLY), confirmed that several websites belonging to the bank were not functioning.

At the current moment were are intensively working on countermeasures which will enable us to restore services for our clients,” Komercni’s spokeswoman Monika Klucova said.

The Czech Police Wednesday said they are analysing all the cases but at present they are unable to confirm the location of the hackers or provide further details.

On Monday the websites of several of the country’s largest news agencies were hit by hackers, and in that case the agencies said it appeared the hackers were located within the Czech Republic.

Link: http://www.foxbusiness.com/news/2013/03/06/hackers-hit-czech-central-bank-stock-exchange-commercial-banks/

Read more

Microsoft Establishes Cybercrime Center to Combat Piracy, Malware

Posted on by admini

A corrupted PC in Latvia or Thailand may not appear to be a threat, but once compromised it can be networked to infiltrate PCs anywhere and deploy threats such as malware that tracks keystrokes to gather passwords and account information.

“Malicious code and nongenuine code go hand-in-hand, it’s as simple as that,” said David Finn, associate general counsel for Microsoft and head of its Cybercrime Center, who has spent the past 13 years leading piracy investigations for Microsoft from his Paris office.

Software counterfeiters have graduated from gangs selling disks of pirated software on street corners to sophisticated enterprises that distribute pirate code online and on new PCs–even name-brand PCs. In an investigation in China last year, researchers purchased 169 branded PCs through traditional Chinese IT malls, and all contained counterfeit versions of Windows pre-installed and 91% contained malware. From a base in Eastern Europe, CD Cheap spammed the world selling pirate versions of Windows and at its peak was generating about $3.9 million a month, said Peter Anaman, a senior investigator for Microsoft.

What investigators have done is develop a range of techniques and tools to stymie online thieves and, in some cases, “we’ve reached the point where we’ve taken the profit out of it,” he said.

Link: http://www.foxbusiness.com/technology/2013/03/06/microsoft-establishes-cybercrime-center-to-combat-piracy-malware/

Read more

Hot security skills of 2013 – security

Posted on by admini

By understanding the needs of the industry and keeping on top of new technologies and threats, good CSOs can identify the special skills and expertise (such as analytics expertise or a specialty in malware) needed in their new hires on both the information- and physical-security fronts, says Young.

Tom Verzuh, president of recruiting firm SCW Consulting, is seeing great demand for physical-security professionals who are fluent in technology, especially digital-video software management and analytics.

“The way to increase your value as a physical security professional is to invest in learning the world of IP networking and Microsoft server technologies and data analytics solutions,” says Charles Foley, chairman and CEO of Watchful Software. “Security pros that know these two areas will be able to spearhead their companies efforts to streamline costs, increase value delivered, and will literally sell information collected to the rest of the organization.”

Information-protection skills are in great demand, according to Foley –in particular, knowledge of data-centric technologies such as enterprise rights management, multilevel security models, data classification techniques and biometrics.

This understanding is also important for recognizing where potential vulnerabilities might lie within the organization, such as with outsourced services or data, or lines of business that are popular targets for cyberattacks.

CSOs that have an advanced business degree such as an MBA are always going to be that much more desirable than those who do not, according to Jerry Irvine, CIO of IT outsourcing company Prescient Solutions and a member of the National Cyber Security Task Force. Not only must CSOs make complex security issues understandable to the enterprise at large, they must also make it clear how important security risk, particularly digital risk management, is to the executive suite’s agenda. David Luzzi, executive director of Northeastern University’s Strategic Security Initiative, adds logical reasoning and the ability to inspect ideas as important skills to build on the foundation of excellent verbal and written communication skills.

Link: http://www.cso.com.au/article/455664/hot_security_skills_2013/

Read more

This Research Paper Explains How to Predict the Next Arab Spring and Cyber Attacks

Posted on by admini

In a paper (PDF) released late last year, “Proactive Defense for Evolving Cyber Threats,” Sandia researchers Richard Colbaugh and Kristin Glass outline a computer model that they claim can monitor the Internet to identify volatile situations weeks before they go south—with “perfect accuracy.” While that information may be enough for a retailer to bet that the “steampunk” look will be the next hipster fashion, it’s what spymasters call “non-actionable intel.”

They start by tracking how many times a specific phrase turns up, using a website that tracks memes daily—sort of an early early warning system. … Their approach works, Colbaugh says, because it’s a blend of social science (the power people have to influence others) and computer science (the power of Big Data).

Intelligence agencies, embarrassed by the unforeseen events that lead to the Arab Spring and historic changes in the region, have been working on open source tools (PDF) that will make them more prescient about world events.

The research, Colbaugh points out, is in the public domain and it wouldn’t be difficult for a large corporation concerned about cyber attacks, say in financial services, to modify the model for its use. Encouraging as the research appears, it is not designed to replace existing cyber security tools or traditional methods of intelligence gathering. It is best used to zero in on public chatter on the Web—not the modus operandi of your lone cyber criminal or a state-sponsored pro because, as John Pescatore, director of emerging security technologies for SANS Institute, points out: “They’re not going to yak about it on social media.”

Link: http://www.businessweek.com/articles/2013-03-04/this-research-paper-explains-how-to-predict-the-next-arab-spring-and-cyber-attacks#r=pol-s

Read more