SANS names top hacker targets
505835
Microsoft's IE and Office, Apple's Mac OS X and people themselves are among the Internet's weak links, the security group says.
724562
Until just a few months ago, Gary Warner did not have the kind of day job you&#39;d expect from an antiphishing crusader. He didn&#39;t work for a security vendor or a bank, or any kind of company you&#39;d expect to care about phishing.Warner&#39;s career as a cyber-sleuth began on Halloween 2000. That&#39;s when his company&#39;s Web site was defaced by a hacker named Pimpshiz as part of a pro-Napster Internet graffiti campaign.&quot;My boss came to me and said, &#39;Find out who did this and put them in jail,&#39;&quot; said Warner, who was at the time an IT staffer with Energen, a Birmingham, Alabama oil and gas company.It was an eye-opening experience. &quot;I called the police and they were like, &#39;What do you want us to do?&#39;&quot; he said.Months later, when Pimpshiz struck servers at NASA, Warner reached out, calling staff there and saying &quot;Hey, we know who this guy is. Here&#39;s his name and address.&quot;Since then, Warner has quietly become one of the most-respected authorities on phishing in the U.S. -- the kind of guy that federal agents and banking IT staff call when they want to know how to catch the bad guys and shut down their credit-card-stealing Web sites.With Warner&#39;s help, authorities eventually arrested Pimpshiz, whose real name is Robert Lyttle,&#160;in connection with the hacks.Fishing for PhishersWarner said that the Pimpshiz case was formative, underlining how hard it is for law enforcement to catch the bad guys on the Internet.&quot;The experience showed me that it&#39;s not that they don&#39;t care,&quot; Warner said.&#160;&quot;Their hands are tied by the legal process.&quot;Soon, Warner found himself spending dozens of hours each week compiling data on spammers and phishing attacks. &quot;I would sit for a couple of hours every morning and find all the new phishing sites that I could,&quot; he said.He&#39;d take screenshots of the sites, e-mail the Webmasters who were hosting them and ask them for Web logs, and eventually he started making connections -- he&#39;d connect one phishing group with several different attacks -- and learn who he needed to call to get Web sites removed, no matter where in the world they were hosted.He&#39;d get calls from IT staff at small credit unions asking for help taking down fraudulent sites, every day, all day long. It was cutting in on his work. Late last year, he decided to make a change. &quot;I went to my boss and told him that I&#39;m going to look for a way to do this full time.&quot;Helping the Feds Crack Down on Online FraudIn July, with recommendations from FBI and Secret Service agents,&#160;Warner took a job as Director of Research in Computer Forensics with the University of Alabama at Birmingham (UAB).He also began working with law enforcement, not only educating FBI and Secret Service agents on how crimes were committed, but also helping to track down the criminals and helping with take-downs.&quot;He&#39;s an outstanding resource for the FBI,&quot; said Dale Miskell,&#160;supervisory special agent with the FBI&#39;s Birmingham Cyber Crime unit, who has worked with Warner since 2005.Miskell said Warner has helped the FBI with investigations and taught staff about his antiphishing techniques.&quot;He could be a multimillionare by his skillsets... he&#39;s a very gifted speaker, he can talk to the techies, and then he can turn around and talk to the non-techies and everyone will understand.&quot;Warner is now focusing on fighting cyber-crime full-time and on training a new generation of network forensics investigators. &quot;You wouldn&#39;t believe the looks on their eyes the first time they got an e-mail back from a Webmaster saying, &#39;Thanks for letting me know. I just shut that down.&#39;&quot;When he spoke with IDG News, it was five days after final exams at the University of Alabama at Birmingham and though it would have no effect on their marks, four students were still coming into the labs to help shut down phishers.&quot;That idea that as a private citizen, you can help, that&#39;s the kind of thing we&#39;re trying to inspire,&quot; he said.The Future of Phish-bustingAt the University, Warner is building up a 256-node supercomputer which could eventually become the largest collection of spam email on the planet, processing as many as 100 million email messages per day and providing researchers and law enforcement with valuable analysis data.For Warner, the work isn&#39;t so much a job, as it is his moral responsibility as a computer scientist. &quot;One of the things that really bothered me from the very beginning was people who were using my field to attack other people,&quot; he said. &quot;The way I see it, this is our Internet. I&#39;m going to stand at the end of my driveway and protect what&#39;s mine.&quot;He says that his anti-phishing work hardly feels like work at all. &quot;This is what I like to do,&quot; he said. &quot;It&#39;s cheaper than golf, and you can do it when the weather&#39;s bad.&quot;What You Can Do to Protect Yourself&quot;The best people that help law enforcement have no motive other than to catch the bad guy,&quot; said one law enforcement official who declined to be identified because he hadn&#39;t been authorized to speak with the press.But even if you&#39;re not a cyber sleuth, if you get hit by a computer criminal there are some things you can do to help police catch the criminal. What you should do depends a little bit on the crime. If you&#39;re the victim of identity theft, it&#39;s worth filing a report with state and local police so that you have a record of the crime.That comes in handy later, in case you need to prove that it was the thief, and not you, that incurred any subsequent charges. Another good place to stop is the Federal Trade Commission (FTC) site, which has a variety of tools to help identity theft victims get organized and set their credit back on track. And if things get really bad, the Social Security Administration can help you, too. This site has instructions on how to report social security fraud and get a new social security number.You can file a report with the FTC, but if you want your data to be used to catch the bad guys, the Internet Crime Complaint Center (IC3) is a better bet. Run in part by the FBI, the IC3 data is used regularly by law enforcement to link together large schemes. The more factual data you can report about your crime, the more useful it will be to police. Sometimes a single fax number or eBay ID can help crack open an entire case.The FBI is most interested in crimes that involve malicious software, phishing, and child pornography. Spam and auction fraud get a lower priority and, worse, if you&#39;re the victim of an auction fraud, the odds of you ever getting your money back are very low.Still, if you&#39;re rigorous about documenting the crime, and you fill out that IC3 complaint, you just may be helping to bring down your criminal -- some day.
598026
InfoWorld - Just one day after hackers showed how to exploit a number of flaws in the ActiveX software used by Internet Explorer, Symantec has spotted online criminals using one of the attacks.
480693
Popular Web sites like MySpace and Photobucket has banner ads containing malicious code that could lead to the compromise of a computer.
3099
Also: Vigilante hackers target the wrong guy. See what people are saying on News.com Extra.
324151
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.The nonprofit industry group released the findings of its annual Hacking Incidents Database report this week, and despite the fact that cyber-criminals are still capable of using familiar means like SQL injection to victimize e-commerce sites and other transactional systems, a growing number of assailants are broadening their efforts and capabilities and going after new sets of targets, the research contends.Based on WASC's in-depth investigations into roughly 80 individual attacks carried out during calendar 2007, the group concludes that data theft remains the primary goal of most incidents, representing 42 percent of all the events.Surprisingly, site defacement -- thought to be a dying art in the world of profit-driven hacking -- actually still accounted for 23 percent of the attacks covered in the report, followed by exploits aimed at planting malware on sites at roughly 15 percent.And while the lion's share of the incidents studied by the group revolved around the attempted theft of sensitive data that could be sold on the underground market or used to carry out fraud, the phishing threats of years past are increasingly becoming outnumbered by attacks that utilize malware code hidden on legitimate Web applications to victimize unsuspecting end-users, the group said.Of all the threats studied by WASC in its report, 67 percent were designed specifically to derive some form of profit -- pointing to continued growth in the professionalism of those responsible for the attacks, researchers said."One of the biggest issues is that so much of this activity is being delivered directly though legitimate Web sites that are being hacked," said Ryan Barnett, a project leader at WASC who also serves as director of application security training at applications firewall vendor Breach Security, which sponsored the 2008 report."It used to be that as long as users didn't go to certain Web sites they'd be safe, but obviously, that's changing," he said. "SQL injection still works surprisingly well, so we're seeing plenty of those across the board, but you do also begin to see more use of things like cross-site request forgery, to which even greater numbers of sites might be vulnerable."SQL injection, which attempts to use security vulnerabilities occurring in the database layer of applications to compromise them, still remains a weak point in some widely-used Web systems, in particular e-commerce sites, a reality that the researcher views as surprising based on the well-established history of the technique. However, CSRF threats, which attempt to hijack authenticated Web sessions to carry out their ploys, are becoming more common, while still far less frequent than SQL injections, according to the expert. Indeed, CSRF threats accounted for only 2 percent of the incidents tracked by WASC for the 2007 report, while SQL injections represented 20 percent, the most popular format for exploit.Unintentional information disclosure, which involves sites that emanate such detailed authentication failures that hackers may use them to find a way in, was the second most popular format for attackers to break into applications at 15 percent, followed by cross-site scripting exploits, which use malware planted on legitimate sites to subvert end-users' machines, at 12 percent of the incidents.In terms of the types of organizations being assailed by the attacks tracked by WASC, the group found that government agencies actually represented the largest group of targets.Perhaps because financial services companies and retailers have improved their applications defenses, hackers have moved on to the government set as well as educational institutions, the report contends.Some 29 percent of the incidents covered in the report targeted government agencies, followed by education at 15 percent, and retailers and media outlets tied at 12 percent.In addition to attempts to steal data, WASC contends that government agencies may also be getting hacked by parties looking to embarrass or disable the organizations' sites based on ideological goals. Because government agencies are forced to report more of their security incidents publicly, hackers may merely be trying to force the organizations to admit that they have been exploited in public, the researchers said.
36812
In a twist, security researchers have discovered a group of hackers who are exploiting a new category of victims -- aspiring Internet scammers.A Moroccan group called &quot;Mr. Brain&quot; is offering free phishing kits on a Web site hosted in France, said Paul Mutton, Internet services developer at Netcraft, a security company in Bath, England.The software packages make it easy to quickly set up a fraudulent Web site mimicking a known brand in order to trick people into divulging credit card details or bank account numbers. Templates for spam e-mail are also included, targeting brands such as Bank of America, eBay, PayPal, and HSBC.Mr. Brain&#39;s Web site lists the kits and what kind of details each one is capable of collecting, such as usernames, passwords or Social Security numbers. Netcraft posted screenshots on its Web site.But what the aspiring scammer doesn&#39;t know is that the phishing kits are designed to send any sensitive information that&#39;s collected back to e-mail accounts controlled by Mr. Brain, Mutton said.&quot;Obviously, that&#39;s why they are offering this stuff for free,&quot; Mutton said. &quot;I was impressed by it.&quot;Mr. Brain hides the special e-mail function in a blend of PHP scripts, one of which is encrypted, Mutton said. Just in case someone decrypts it, Mr. Brain has written at the top of the file &quot;Don&#39;t need to change anything here. Created by Mr. Brain Morocco Team.&quot;The scheme seems to be targeted at new phishers, Mutton said. Mr. Brain benefits since other wannabe scammers shoulder the cost and risk of finding an ISP (Internet Service Provider) to host the phishing site, Mutton said.&quot;Essentially, they&#39;re exploiting all these novice phishers -- basically getting them to do all the hard work,&quot; Mutton said.It&#39;s difficult to tell without further research how many of the free phishing kits linked with this latest scam are live on the Internet, but Mutton said Netcraft noticed one earlier this month targeting Bank of America.&quot;Clearly, these are actively being used in phishing attacks,&quot; Mutton said.
71162
A list of the worst 20 security vulnerabilities bedevilling Windows and *Nix systems was unveiled last Friday by the SANS (SysAdmin, Audit, Network, Security) Institute.
457591
Hackers revealed exploit code for JavaScript vulnerability.
360275
ANTI VIRAL firm Sophos released its monthly figures for the top viral attacks detected during October. And out of the top 10 threats to peace, quiet, and to Windows operating systems, different variants of the Netsky pesky took six out of the 10 placings.
169088
(InfoWorld) - An attack this week that targeted online customers of at least 50 financial institutions in the U.S., Europe, and Asia-Pacific has been shut down, a security expert said Thursday. The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike Web site for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense Inc. To be infected, a user had to be lured to a Web site that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said. The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a Web site rigged with the malicious code. Once lured to the Web site, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The Web sites displayed only an error message and recommended that the user shut off their firewall and antivirus software. If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's Web site that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible. The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike Web sites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser. "It takes a lot of work but is quite clever," Gonzalez said. "The job is well done." The Web sites hosting the malicious code, which were located in Germany, Estonia, and the U.K., had been shut down by ISPs as of Thursday morning, along with the look-alike Web sites, Gonzalez said. It was unclear how many people may have fallen victim to the attack, which went on for about three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said. The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller. The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the U.S. and Australia. Â
35770
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
129867
From Russia without love Security watchers have discovered a string of malicious websites that install Trojan code, allowing hackers to compromise end-user banking credentials for more than 50 financial institutions and ecommerce websites.â¦
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
691931
Several major websites are brought down by the largest denial-of-service attacks ever staged. Compiled by Tony Long.
181345
com October 29, 2004, 8:21 AM PT. Cyber threats, chiefly viruses like NetSky and Sasser, make security an ongoing concern as it holds steady over software infrastructure as the third top priority.