Researchers seek cash for software flaws
166587
For some security researchers who uncover flaws in leading computer programs, a nod of appreciation from software companies is no longer enough.
274144
(InfoWorld) - They just don't make malware like they used to. Or at least like they did earlier this year. Even low-quality malware, however, is taxing the resources of security companies, since it is being detected in ever-higher numbers. Over the last six months, the technical creativity of malware has fallen along with the ability to cause massive damage, such as that created by the MyDoom and Sasser worms of years past, wrote Alexander Gostev, senior virus analyst for Kaspersky Lab, in a recent report. Gostev's lab intermittently sees highly technical malware, but most is "the same unending stream of Trojans, viruses and worms," he wrote. In many cases, hackers simply take existing malware and create variants, by tweaking the older code to evade antivirus software. At times, the process is simple trial and error. Malware writers use online scanners such as Virustotal , which check to see if their new code will be detected by antivirus software, said Mikko Hypponen, chief research officer for F-Secure. If the code is detectable, they can make a slight modification and run it through the scanner again. "I'd like to tell you that we're winning this war," Hypponen said. "But frankly, I'm not so sure. We need new kinds of solutions." Because much of the code is not new, it tends to remain effective for shorter periods of time before antivirus companies detect it. Still, the time it takes to identify and create a signature for a new virus, which can range from a few minutes to a few hours, is often long enough for hackers to infect computers. "Antivirus companies are working at the limits of their capabilities in terms of speed," Gostev wrote. To be sure, some malicious hackers are doing creative work. This year saw some sophisticated phishing attacks, and virus writers have been branching into relatively new areas like instant messaging and social networking sites, noted Christopher Boyd, security research manager for FaceTime Communications. But the trend overall, he said, has been "quantity over quality." Kaspersky Lab in Moscow is on the front lines of the battle. Its analysts added 2,000 signatures to their database in January 2005. Last month they added 10,000 signatures -- a five-fold increase, said Stanislav Shevchenko, head of the lab. The virus analysts work 12-hours shifts, pulling up screen after screen of rolling lines of code. Automated tools analyze some pieces of malware, but human analysis is still needed for others. A good analyst should process an average piece of malware within 5 minutes, Shevchenko said. But some of the rarer, more creative code is harder to crack. Polymorphic viruses -- ones that can change their byte sequences to throw off antivirus software -- can take up to a week to analyze, Shevchenko said. The signatures are added to a database used by Kaspersky's antivirus engine, which is licensed by other security vendors such as Juniper Networks, ClearSwift , and F-Secure. The increase in the volume of malicious code can be attributed in part to the impunity enjoyed by malware writers, said Eugene Kaspersky, head of antivirus research. Despite efforts by law enforcement agencies to strengthen international cooperation, most malware writers are never punished. "It's quite safe for them," Kaspersky said. "If they are clever enough, there is almost no risk for them at the moment." The U.S. Federal Bureau of Investigation and Russia's Federal Security Service (FSB), the successor to the country's KGB intelligence agency, frequently ask Kaspersky Lab for information, said Kaspersky spokesman Timur Tsoriev. The FSB, however, approaches Kaspersky less these days since the agency has bolstered its in-house expertise, Kaspersky said. Kaspersky said his lab focuses less on finding the root of criminal activity than protecting the company's customers. But the burden of rising online criminal activity directly impacts security companies, he said. "If there is no help from the police and if they don't reduce the number of criminals, I'm afraid the detection for all antivirus products will go down," Kaspersky said.
234545
A security research company is offering $20,000 for information on undisclosed security flaws in Microsoft&#39;s Windows OS.Digital Armaments, which doesn&#39;t list a phone number or a headquarters address on its Web site, is offering the money as part of the &quot;Hacker&#39;s Challenge&quot; through midnight EST, Feb. 29. The company is also soliciting for flaws in what they term &quot;Windows Diffuse Applications.&quot;Submitters need to illustrate a working exploit and document it, according to the company&#39;s Web site, which is filled with misspelled words.There&#39;s nothing illegal about paying security researchers for flaws, but it does tend to annoy software companies whose products are affected.Wabisabilabi, based in Switzerland,&#160;took the idea of compensating researchers a step further&#160;last year by opening a site for them to sell vulnerabilities in auctions. In response to criticism, company officials countered that researchers could sell zero-day vulnerabilities on the black market.Microsoft, whose security vulnerabilities are generally high profile, advocates that researchers discretely alert it to software problems so users aren&#39;t put at risk. Companies generally refuse to pay for software vulnerabilities.Digital Armaments says on its Web site its research team was founded in 2003, and offices were opened in the U.S. later that year.In addition to paying money for vulnerabilities, Digital Armaments will also apparently pay in stock or credits that can be exchanged for stock under its Digital Armaments Contribution Program.Efforts to reach Digital Armaments on Wednesday morning by e-mail were unsuccessful.
140510
A flaw in Snort, the popular open-source intrusion detection system, could be used by attackers to run malicious code on vulnerable machines, several security organizations reported Monday.
527510
Researchers looking to root out computer attacks hope that speed kills.
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
223868
Symantec researchers are working on reputation-based security systems to verify the trustworthiness of Web sites and downloads.
748053
Attackers have been exploiting a recently-revealed flaw in Adobe Reader since at least Jan. 20, with one security researcher estimating that "many thousands" of computers have been infected so far.
448507
An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.
72462
Security researchers are warning of a serious - and unfixed - security hole with the popular Winamp media player.
458563
Security-minded users can find out faster if their applications need to be patched with a free tool.
176135
Cash from chaos The market for software vulnerabilities just got even more complex with the arrival of a firm that offers security researchers a chance to profit from their work by patenting security fixes.â¦
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
443548
Flaws in Adobe Reader and Acrobat are being used to exploit computers; company urges customers to install the patch.
768290
The first example of a working program designed to exploit a bug in Microsoft&#39;s GDI+ libraryâwhich allows malicious code to be run simply by viewing a JPEG imageâhas been found in the wild.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the
97618
Code that claims to partially exploit a weakness in Microsoft software&#39;s handling of image files has been published on the Internet.