New phishing malware targets Indian aerospace, defence industries – Times Of India

Posted on by admini

The release said that this spear phishing campaign continues to show the sophistication and preparation of attackers, especially gathering intelligence on what social engineering will best entice targets. Also, Symantec Intelligence report (June, 2012) revealed that globally, the defense industry (a sub category of the Public Sector) has been the targeted industry of choice in the first half of the year, with an average of 7.3 attacks per day.

Organizations should thus ensure that proper email security is in place and also make patch management a priority, as the vulnerability exploited here was patched in 2011. Businesses will have to engage with IT security solutions providers as their business partners and engage with them in an ongoing, service level agreement based relationships.

Link: http://articles.timesofindia.indiatimes.com/2013-02-02/software-services/36703043_1_symantec-intelligence-report-targets-attackers

Read more

News briefs: The latest breaches, malware and hacktivist activities – SC Magazine

Posted on by admini

The campaign, part of a distributed denial-of-service (DDoS) operation that began last fall, is being led by the Martyr Izz ad-Din al-Qassam Cyber Fighters, which said it staged the attacks in protest of anti-Muslim film, Innocence of Muslims. … On Dec. 21, the Office of the Comptroller of the Currency (OCC), a regulating body for national banks, issued an alert about the apparent uptick in DDoS attacks being waged in the industry.

Link: http://www.scmagazine.com/news-briefs-the-latest-breaches-malware-and-hacktivist-activities/article/276469/

Read more

At least 80% of mobile apps have security and privacy issues that put enterprises at risk – Network

Posted on by admini

Appthority runs each app with both static analysis and dynamic analysis to determine what the app can do beyond its advertised main function (e.g., gaming, news services, productivity, etc.). Appthority analyzes an app to uncover, for example, what other apps it can communicate with; what backend systems, URLs or websites the app accesses; what permissions the app requests versus what permissions the app actually uses (because there’s often a mismatch there); what behaviors the app exhibits; and how the app is managing sensitive data, including whether or not it is using encryption.

This information is essential to enterprises that are trying to develop policy and manage mobile security, says Domingo Guerra, president and co-founder of Appthority. … “There are lots of technologies on the market that are policy enforcers, but they only enforce what you tell them to do.”

In the app reputation report released in July 2012, Appthority reported that 96% of iOS and 84% of Android apps can access at least one of these data risk categories.

Organizations that already use a mobile device management (MDM) or mobile app management (MAM) solution can incorporate Appthority’s app reputation information to help formulate policy of who can access what apps, and when.

To secure corporate content, networks and data, an enterprise really has to focus on risk management over that data, and what can access that data.

Link: http://www.networkworld.com/newsletters/techexec/2013/020113bestpractices.html

Read more

Second Twitter hoax in two days smacks another stock – The West Australian

Posted on by admini

Just as Muddy Waters confirmed it did not send such a tweet about Audience, so too did Andrew Left, the California-based investor who runs Citron, said his company did not send a message about Sarepta.

The twin incidents targeted a pair of Nasdaq stocks that are not among the most actively traded on a daily basis, showing how certain company shares are vulnerable to information posted on social media networks, even if the information is misleading.

“You need a more volatile stock for this kind of manipulation – obviously if you were to try it on IBM it wouldn’t work,” said Joe Saluzzi, co-manager of trading at Themis Trading in Chatham, New Jersey.

The tweet, with the user name “@citreonresearc,” alleged that drug trial results from the biopharmaceutical company had been tainted and doctored, according to screen shots of the posting captured by Twitter users.

Matt, a trader in San Diego who did not want to give his last name, but who goes by the handle @given2tweet on Twitter, said, “There’s a real severity to that tweet.

The company, which has a market cap of about $692 million, is volatile, moving more than 1 percent in six of the past seven sessions.

Audience went public in May 2012 and has a market cap of $254 million as of Tuesday’s closing price, rising about 15 percent so far this year.

Link: http://au.news.yahoo.com/thewest/business/a/-/tech/16031129/second-twitter-hoax-in-two-days-smacks-another-stock/

Read more

Cisco shows the global picture of information security

Posted on by admini

In fact, more Generation Y workers globally said they feel more comfortable sharing personal information with retail sites than with their own employers’ IT departments – departments that are paid to protect employee identities and devices. As Generation Y graduates from college and enters the workforce in greater numbers, they test corporate cultures and policies with expectations of social media freedom, device choice, and mobile lifestyles that the generations before them never demanded. As the first chapter of the Connected World Technology Report indicated in December, Gen Y is constantly checking social media, email and text updates, whether it’s in bed (3 of 4 surveyed globally), at the dinner table (almost half), in the bathroom (1 of 3), or driving (1 of 5).

Nine of 10 (90 percent) IT professionals surveyed said they have a policy governing the use of certain devices at work, yet only two of five Gen Y respondents said they were aware of such a policy. IT professionals know that many employees don’t follow the rules, but they don’t understand how prevalent it is: More than half (52 percent) of IT professionals globally believe their employees obey IT policies, but nearly 3 out of 4 (71 percent) of the Gen Y workforce say that they don’t obey policies. In other words, Gen Y is less averse to complete strangers at retail sites monitoring their activity than their own employers’ IT teams – teams that are there to protect them and their companies’ information.

Link: http://www.net-security.org/secworld.php?id=14334

Read more

DDoS attack sizes plateau, complex multi-vector attacks on the rise

Posted on by admini

DDoS: Attack sizes plateau; complex multi-vector attacks on the rise – The largest attack reported was 60 Gbps, same as 2011; and 46 percent reported multi-vector attacks.

This year’s results confirm that application-layer and multi-vector attacks are continuing to evolve while volumetric attacks are starting to plateau in terms of size. … Attackers have now turned to sophisticated, long-lived, multi-vector attacks – combinations of attack vectors designed to cut through the defenses an organization has in place – to achieve their goals. … This year’s report includes a case study on the ongoing attacks against U.S. financial services organizations, a great example of a multi-vector attack.

Data centers and cloud services are increasingly victimized – 94 percent of data center operators reported attacks, and 90 percent of those reported operational expenses as a business impact.

As more companies move their services to the cloud, they now have to be wary of the shared risks and the potential for collateral damage. DNS infrastructure remains vulnerable – 27 percent experienced customer-impacting DDoS attacks on their DNS infrastructure—a significant increase over the 12 percent of respondents from last year’s survey. 71 percent of respondents reported good visibility at Layers 3 and 4 but only 27 percent reported Layer 7 visibility.

Link: http://www.net-security.org/secworld.php?id=14323

Read more