Global Security Newswire
157996
WASHINGTON - US President George W. Bush signed into law today legislation that will enact some of the most far-reaching changes to the US intelligence community in decades (see GSN, Dec. 9).
758171
Multifactor authentication is all the rage these days, thanks to increasingly sophisticated trojans and phishing attacks and even rootkits aimed at stealing passwords and sensitive data. High-stakes online crime has even spurred financial services companies and some enterprises to consider new, "risk-based authentication" solutions, which examine behavioral patterns and session characteristics to identify rogue users.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
362477
Denial-of-service attacks and bots are the top threats to network security, according to Arbor Networks' second annual Worldwide Infrastructure Security Report. The survey compiled information from 55 network operators.
694508
(InfoWorld) - In the five years since terrorists attacked the U.S., Europe has been the target of extremist attacks, as has India. Bombings in London and Madrid and a recent failed attempt to blow up passenger trains in Germany have prompted a security clampdown never seen on the Continent. Throughout the European Union, governments are grappling with how to guard against terrorist attacks. Meanwhile, Indian IT services companies have beefed up efforts to protect data. The discovery of bombs in two German trains in July pushed up several security measures on the political agenda there. In September, the German government agreed to a new antiterror database, which will be available to authorities across the country and contain information such as a person's religion, travel history, telephone number and Internet data and bank details. It also approved increased use of video surveillance in public areas. These measures reflect a gigantic shift in thinking about privacy in Germany, which has been highly sensitive about data protection and surveillance because of its Nazi history and, more recently, the Stasi secret police in the former communist-run East Germany. The need to tighten security has created demand for new technologies to help authorities combat terrorism. The German subsidiary of IBM Corp., for instance, is working on new technology that will enable computers -- not human beings -- to filter information from the cameras monitoring public areas and other locations. Two German companies have developed a new biometric system for identifying airline passengers. Lufthansa Systems Group GmbH, the IT services arm of German airline Lufthansa AG, and high-security document producer Bundesdruckerei GmbH have developed the SecBoard system. The companies hope that the system, designed to conduct biometric checks on passengers prior to boarding an aircraft, will play a significant role in "trusted passenger" programs planned by the airline industry to increase security. In the U.K., the government is close to activating part of the Regulation of Investigatory Powers Act (RIPA) of 2000 that deals with encrypted data, one in a set of powers covering electronic surveillance and wiretapping. Authorities say the increased use of encryption is hampering their access to information on suspectsâ computers. RIPA would allow police to demand that a suspect decrypt data or face up to two years in jail. The encryption measure in RIPA has remained dormant since the techniques werenât widely used when the law was passed, according to the U.K. Home Office. Terrorist suspects already face up to five years for failing to decrypt data or provide an encryption key. But critics contend the law, which would apply in more than terrorism-related investigations, gives too much power to law enforcement and has the potential for abuse. High-ranking officials could demand the decryption of data without a court order, and the law binds to secrecy those served with a request. Experts say the law could increase the chance that, if seized, a companyâs mission-critical data could be mishandled. Elsewhere in Europe, heads of state met to discuss 57 antiterrorism measures two weeks after the March 11, 2004 bombings of four crowded commuter trains in Madrid. Among the measures discussed were the surveillance of telecommunications, Internet communications and air transportation. Civil liberties groups accused them of using the fight against terrorism as an excuse to increase police powers. E.U. legislation was slow to follow but, from September 2007, telecom carriers and ISPs (Internet service providers) must keep data on all mobile and fixed-line calls for between six months and two years. From March 2009, they must keep data on VOIP (voice over Internet Protocol) calls, Internet connections and e-mail messages. Law enforcement officials will be able to demand the date and time of calls and messages, but not their content, and identifying information of the calling or sending and receiving parties. In India, the Sept. 11 attacks were not a watershed event because the country experienced frequent attacks by Kashmiri separatist groups demanding independence. Even before Sept. 11, some of the large Indian IT services companies had hardened data centers supporting their offshore businesses, said T. R. Madan Mohan, an analyst at Frost & Sullivan Inc. After Web sites of a ministry of the Indian government and an Indian atomic energy agency were hacked, and anti-India messages posted on these sites, Indian businesses showed increased concern about the need for intrusion detection and related security measures, he added. Infosys Technologies Ltd., Indiaâs second largest outsourcer, already had disaster recovery and business continuity plans in place before Sept. 11, said a spokeswoman for the company in Bangalore. However, those attacks brought the threat of terrorism into sharp focus for Indiaâs export-oriented industries, such as software outsourcing, because U.S. and European customers began worrying about the preparedness of their Indian suppliers for terrorist attacks. (Reported and written by John Blau in Dusseldorf, Germany; Peter Sayer in Paris; Jeremy Kirk in London; and John Ribeiro in Bangalore, India, and assembled by Grant Gross in Washington, D.C.)
454368
Chinese nationals face increasing security risks overseas due to the country's growing global presence, a senior official was quoted as saying on Thursday.
670970
roundup Plus: Push-to-talk wiretaps on feds' speed list...Tellabs scales back AFC buy...Top McAfee exec to step down...IDC says external disk storage up.
91755
Also: Crippled spy satellite threatens Earth. See what people are saying on News.com Extra.
654323
Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday.
513788
The practice of cyber-espionage is rapidly moving beyond the government sector and finding its way into the world of international business, according to experts with SANS Institute, one of the world's top IT security training organizations.While the United States and Chinese governments, most notably, have accused each other in recent years of carrying out surreptitious hacking campaigns aimed at stealing strategic information from their respective IT systems -- and many security experts believe that both countries, and many others, are actively engaging in such electronic warfare -- leaders with SANS maintain that the practice has recently begun to spill over into the private sector with greater frequency.According to the training institute's latest research, cyber-espionage efforts funded by "well-resourced organizations" -- including both government-backed and private efforts -- will expand significantly during 2008, in particular as overseas companies look to gain an upper hand in negotiating business deals with large companies based in the U.S. and Europe.In one common scenario, said Alan Paller, director of research for SANS, organizations in the process of establishing legitimate partnerships with such companies are willing to pay hackers to break into those firms' IT systems to gather competitive information to gain an advantage at the bargaining table.More companies than ever before are finding out that they have been victimized in such a manner based on the discovery of their sensitive data in the hands of hackers and other fraudsters who have been apprehended by law enforcement officials, the expert contends."Cyber-espionage is clearly growing across the board. It was much bigger in 2007 than in previous years, and it is expanding slowly into economic espionage involving both businesses and government entities," Paller said. "This really has a lot of significant implications because people who have never thought of themselves as targets for this type of attack have suddenly become a sweet spot, and many are not prepared to defend themselves."Paller said that federal law enforcement agencies have been contacting private industry firms directly to inform them that their data may have been compromised. From closely-protected product designs to company financials, the expert said that cyber-espionage is already working its way into many different areas of business."If you live in a foreign country and you want to do business with a big American company, you want to negotiate the best possible deal, and we're seeing more evidence of instances where parties have clearly been paid to break into a companies' computers, as well as those of their accountants, consultants and lawyers, to find information that can be used to tilt deals in their favor," Paller said. "In some cases, it's fair to say that the people who are negotiating these deals overseas end up with more information than the people that are being paid to negotiate with them."Paller said that while in many cases the business data being stolen is being used to the advantage of private industry players, the training organization believes that a fair amount of the corporate espionage activity may be backed by government sponsors.While such attacks have been somewhat common among government and defense contractors for years, he said, the process is highlighting a lack of perception regarding security risks inside other major U.S. businesses.SANS reported that the attack of choice in many cases of cyber-espionage is a targeted spear phishing campaign that attempts to dupe workers into opening tainted attachments made to appear as if they come from people they work with.The content of the virus-laden attachments is often tailored to look exactly like legitimate materials that the employees involved might send to each other, making it more likely that users will open the messages and remain unaware that they may have been compromised, Paller said.Attackers crafting the messages most often use newly discovered Microsoft Office vulnerabilities, also known as zero day flaws, to further hide their activities and to circumvent anti-virus systems, according to the expert."This type of business-driven cyber-espionage is already happening a lot more frequently than some people might think," said Paller. "We're only finding real evidence because more companies are hearing from law enforcement when someone finally discovers the stolen data."On the flip side, SANS is also predicting that so-called insider data theft carried out against U.S. businesses by trusted employees will also continue to flourish.One of the factors accelerating that trend is the ability for attackers to attempt to attack their employers both from inside their networks and from the outside using known vulnerabilities they discover in their work, the group said.With traditional security perimeters increasingly being taxed by the use of mobile devices that are allowed to come onto corporate networks from outside the workplace, SANS said that workers are finding many new opportunities to sneak information out the door and sell for a profit.One of the key strategies that organizations need to embrace to thwart the insider problem is to put into place more substantial defenses that limit access to various IT systems and data stores based on the specific level of admission to those assets that individuals need to do their jobs, the training group said.
309307
Newly updated. This article provides insight into the Metasploit Framework, a very useful tool for the penetration tester. Part two of three.
230365
Also: Army expects 'suicide hacker' attacks. Read these stories and more from around the Web on News.com Extra.
522653
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.
152473
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was initially turned on in Jan. 2007, will relight its set of attack monitoring sensors on or about the first of the year after significantly scaling back its operations during the month of December.After its initial 11 months of data collection, the project undertook the month-long hiatus to give project researchers more time to examine results and plan for the year ahead.In addition to tweaking their tactics for tracking and luring malware distributors in 2008, WASC project leaders said they are also planning to add new honeypots to their existing network, which already spans locations in Europe, Russia, South America, and the United States.Unlike more traditional OS-level or SMTP-based honeypot applications -- systems designed to collect individual malware samples for subsequent examination by anti-virus researchers -- the WASC project utilizes a network of 14 specially-configured open proxy servers (or proxypots) to monitor traffic for nefarious activities carried out by everyone from botnet herders to adware purveyors.Traditional honeypots have proven useful for tracking widespread computer viruses and allowing AV companies to produce the signature files needed to protect machines against infection, but those targets are ill-suited to provide the level of real-time intelligence needed to protect against today's fast-moving customized threats, said Ryan Barnett, the WASC project's leader.By serving up an unprotected open proxy server to the larger Internet, and thereby advertising itself as exactly the type of anonymous conduit that attackers seek out to distribute their work -- rather than merely an undefended computer, the effort is already garnering new insight into cyber-criminals' methods, he said.Barnett, who is also director of application security training at Breach Security and an instructor for the SANS Institute, said that despite being pleased with the project's initial ability to identify attacks and test ways to thwart malware campaigns further upstream, he is hoping that 2008 will provide even greater rewards.Among the improvements the group is aiming to make to its system -- built around the ModSecurity open-source Web application firewall, for which Barnett also serves as development community manager -- are more effective ways for categorizing attacks, correlating anomalies, and applying forensics to trends that it charts over time.The security expert is hoping that the same open-source movement that has allowed ModSecurity to mature, with the firewall recently adding a range of new features in its late-December version 2.5 release, will also take hold with the honeypot effort and encourage more people to launch sensors or help research its data findings."Getting different versions of data analysis will be key, but we will need to get a lot more people onboard," Barnett said. "We feel that there's a whole symbiotic approach with the project and the open-source community already. We need to export more of the raw data into that community to help analyze the results -- there's simply too much data for us to churn through alone."The future of the proxypots What the use of the proxypot model allows the project to observe are the source IP addresses being used by attackers running over its sensors, along with the nature of their threats and their targets.For instance, out of the 8.9 million questionable transactions carried out over the group's servers in October, when the sensor network was last running at full bore, 2.6 million of the requests were related to advertising click fraud, the leading type of threat observed in the firewalls' logs.Further investigation of the results would allow WASC to figure exactly which sites were being pumped-up by those automated traffic hoarders and inform any companies involved of the illegal activity, Barnett said.For the record, more than three quarters of the traffic moving over the proxypots fails to trigger any of the firewall rules, meaning that it is either benign or unidentifiable as malware.While the WASC honeypot project could eventually be used to snuff out some malware sources or block the threats themselves, for now, the idea is to create an early warning system to help the security industry respond to emerging attacks.Along with finding more bodies to throw at analysis of its findings, the project is also considering how it will continue to move forward in relation to the matter of allowing its proxypots to be used to carry out actual attacks.Thus far, participants in the program have been sending spoofed information back to the attackers channeling traffic over their proxies to fool them into thinking that their campaigns are working and prevent detection of the honeypots.However, some researchers involved with the program have been asking to allow traffic to pass over their systems unrestricted under the belief that it would be the best way to screen for the newest and smartest threats.In most cases, project participants will need to defer to local laws governing their level of liability for allowing nefarious traffic flow over their servers if they decide to run wide open, said Barnett. Figuring out exactly how to tackle the issue is one of the WASC honeypot's other major goals in advancing its status during 2008."We're trying to regroup and figure out how to best address everything in the next twelve months, enough people are asking about the alternative of not blocking malicious traffic that it has become a question we seriously need to consider," said Barnett. "There are legal issues to study if we want to let real attack run through us, it could still happen anyways -- people can always get around rules, so, there is definitely still some risk involved."
504512
GlobalSecure Holdings Ltd. , a District-based private-equity investment firm that has bought three homeland security companies in the past year, last week wrapped up raising $23.5 million. Armed with this cash, it's aggressively searching for more companies in this field.
185711
Also: High security built right into $100 laptop's OS. Read these stories and more from around the Web at News.com Extra.
81628
Internet-based assaults continue to be a major concern, according to a new report from security software maker Symantec. The time from discovery of a vulnerability to attacks exploiting that vulnerability is shrinking.
398332
Russian roulette Webpages of the US Consulate General in St. Petersburg, Russia, were infected by malware earlier this week. The US consulate site was caught up in a much larger hack attack and is not thought to have been targeted as such.â¦