Code Green gives red light to data leaks
234760
(InfoWorld) - Reports of corporate data leaks, lost laptops, and misplaced backup tapes are so commonplace that many no longer warrant a mention in the press. So common are corporate data leaks of one form or another that only the multimegaton events -- TJX, the Veterans Administration, or DuPont -- get covered. But the data leak problem sure has gotten the attention of corporate boardrooms, even if the media has moved on. For proof of that, look no further than the gaggle of data leak prevention companies that has popped up in recent years. We've already heard this month about startup Provilla, as well as Varonis. Code Green Networks is another aspiring startup that hopes to bring high-end data leak prevention technology to smaller and midsize corporations. Founded in late 2004, Code Green is the brainchild of Shreekampt and Sudhakar Ravi, both co-founders of security appliance maker Sonicwall. Started with seed money from its two founders, the company has taken in $32 million in venture funding to date and now has 65 employees, says Chip Hay, senior vice president for marketing and customer care at Code Green. Data leaks aren't just bad publicity for companies, they're also expensive, Hay says. Citing a recent study by the Ponemon Institute, Hay says that lost customer records can cost as much as $182 each to remediate, not counting penalties and legal ramifications from the growing matrix of state and federal data protection and consumer privacy laws. Those factors have stoked enterprise interest in data protection products. "The big change for us in the last nine months is that we've gone from talking to companies who want to get educated, and now they've decided that [they] want to put data leak prevention in place," Hay says. Companies -- especially in fields such as high technology -- are also paying attention to protecting their core intellectual property, especially with outsourcing and complex business partner relationships exposing more and more data, he says. Code Green's flagship product is a content inspection appliance that's installed at egress points on customer networks. The device can inspect SMTP, e-mail, FTP, and IM traffic, among others, and can run in-line to block suspicious traffic or in asynchronous mode to monitor actions and policy enforcement, Hay says. At the heart of Code Green's technology are algorithms that were originally designed to spot plagiarism in different samples of writing, Hay says. That technology, which analyzes content bit patterns, allows Code Green to spot sensitive information without relying on fallible dictionaries of terms, and without regard to the language used to express the sensitive information. That, and the product's support for more than 400 document formats, allows Code Green to sell into markets like Japan and China, Hay says. That's increasingly important, amid concern about rampant intellectual property theft -- some of it state sponsored. For example, one Code Green customer recently reported finding proprietary manufacturing process documents published in a Chinese language publication, Hay says. The company also prides itself on its product's capability to parse message traffic from the sea of Web-based e-mail providers, where no standard message formats are used. Code Green has also forged strategic partnerships with vendors such as Voltage Security for e-mail encryption and with Centennial Software to reach the SMB market. A new version of the Code Green appliance due out soon will offer enhanced data fingerprinting for reading data in relational databases, and structured and flat files -- as well as better content discovery features. The product already sports connectors to Oracle and Microsoft SQL server and EMC's Documentum content management platform.
235239
Red Hat is warning users that an email purporting to be a security update may contain malicious code. The email - which began appearing last Friday - uses a security@redhat
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
505484
InfoWorld - Anti-virus firm Symantec warned today that exploit code is circulating for a known security hole in Computer Associates' BrightStor ARCServe Backup software, which provides data backup and restore for a variety of operating systems including Windows, Netware, Linux, Unix, and Mac.
9583
Does a near miss on earnings flash a green or red light?
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.
93568
Well, maybe not yet. But what does the future hold for those who consider their source code an important proprietary asset? Halloween this year featured more scary stuff than just ghosts and ghouls.
427785
Copycats are keeping busy. Security researcher says the Net threat's source code is "hot stuff."
511916
A vulnerability in OpenOffice could allow attackers to remotely execute code on computers running Windows, Linux or Mac OS.
426599
Veracode launched a new version of its binary code analysis service on Monday that focuses specifically on helping software engineers find potential backdoor vulnerabilities in their programs.While some applications security companies scour source code for flaws, such as Fortify, and others specialize in testing programs already running in production, such as Cenzic, Veracode is spinning itself as an alternative by channeling its efforts into looking for vulnerabilities in binary code and offering the capabilities as a fully-hosted service.Officials with the applications security startup -- which was originally spun out of Symantec and launched its initial analysis service in Feb. 2007 -- claim that the company's unique ability to find backdoors could be one of the differentiators that allow Veracode to grow its presence in the applications security sector.With backdoor vulnerabilities in particular, said company officials, the use of binary code analysis is ideal for finding potential flaws that are hard to predict or address in other stages of development."There are a lot of advantages to looking at binaries versus looking at source code, and it turns out that finding backdoors is one of those, and there hasn't been anything on the market that really addresses the problem in general," said Chris Wysopal, CTO at Veracode. "Some static analysis tools may look for static passwords, but if the code is even slightly obfuscated, they can't, and they don't, look for hidden keys or rootkit behavior, so this is truly something new that we're offering."Along with special credentials, which are most often embedded in applications code by developers as a means to get back into the programs, Veracode is also promising to chase down any hidden functionality, or secret sets of commands left inside many software systems by their authors.The service also promises to look for warning signs of malicious code behavior, such as evidence of any rootkits built into a program, and unusual network activity, such as functionality that causes an application to mail out data to a predestined recipient.As more companies outsource elements development of their applications, it will be vital for them to run such scans against their programs to look for the potential weak points, the CTO said.Leaving backdoors in code is one of the oldest tricks on the book for developers looking for easy ways to get back into their programs to either fix them or carry out malicious schemes, Wysopal contends."Sometimes it's just something that is meant to be left in for debugging purposes, other times its code that was meant to be removed but simply slipped through the cracks, either way these are vulnerabilities that need to be addressed," said Wysopal. "Most customers want a third-party review in this day, and we can offer that as a hosted service, so we think there's a lot of potential for how much interest backdoor scans can drive uptake of our services."Veracode targets financial services, commercial software markets Financial services firms in particular are very concerned that outsourced code developers may be leaving backdoors in place to sell to malware code writers or use to break into applications on their own for the purpose of stealing data, said the expert.While some industry watchers have questioned how many firms will be willing to hand over their proprietary code to Veracode for testing, the CTO said that with businesses outsourcing more software development than ever, most large companies are already conditioned to working with third parties on that level -- and willing to give someone a chance to examine their software for security purposes.Commercial software vendors represent another significant opportunity for Veracode, and it has already run scans for three or four of the largest ISVs in the world, Wysopal said. The executive claims that the company is also currently serving four of the world's top ten financial services companies with its vulnerability discovery services.The increasing popularity of open-source software in the business setting is another reason why Veracode's services make sense, he said. However, the problem is even more acute for proprietary programs."When we did our research, we found that if a backdoor was placed in an open-source project, the lifetime was typically weeks, but for commercial products, the backdoors lived for years," said Wysopal. "Maybe you could find these problems if you did manual code reviews, but we know that is becoming harder than ever with shared libraries and outsourcing; we think that by becoming the leading experts in backdoors, we can grow our business even faster."Industry analysts downplayed the notion that binary analysis is the best way to look for backdoors, pointing out that source code scanning specialists like Ounce Labs and Fortify have just as good an opportunity to find the flaws.However, the industry watchers said that Veracode might have an advantage in the process of finding the backdoor bugs compared to so-called "black box" vendors, including Cenzic."I don't think it is as large of an advantage as they might claim, but it does help them differentiate over the black box crowd," said Dr. Chenxi Wang, analyst with Forrester Research. "But with the issue of people being afraid to hand over their code to Veracode, I don't think that's as big of a deal as some have made it out to be either."The analyst said that Veracode is winning interesting deals with banks like Barclay's -- which is using the company's scanning services to test the applications of its business partners that want to link to its own software systems.Binary analysis and the ability to utilize Veracode's hosted model in such a fashion may in fact help the company grow the applications security space in general, she said."Their approach so far has been pretty smart, you can see how the model being used with the banks may drive great interest in applications scanning, it's not that the market is flat but there's a lot of room for growth," Wang said. "We'll have to wait to see if Veracode can draw more customers, and see the size of those deals, but they do have an opportunity to shake things up."
273886
A Windows vulnerability has been announced after it was discovered that malicious code could be run by simply viewing a JPEG image file.
744409
Security researchers release code that shows how a pair of widely used technologies could be misused to take control of a victim's Web browsing experience.
676591
Ziff Davis - Holes in KOffice and RealPlayer allow attackers to take over a user's system.
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.
520541
Exploit code targets a flaw that generated a government warning last week.
360592
Exploit code affecting an unpatched flaw in an image uploader used by both Facebook and MySpace is circulating publicly.
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.