Group Formed to Track, Thwart IM Threats
54799
A group of Internet security and instant messaging providers have teamed up to detect and thwart the growing threat of IM and peer-to-peer viruses and worms, they said this week.
4920
I.B.M. plans to begin releasing a monthly report of threats to computer networks in an effort to establish an indicator similar to the federal governmentÂs Homeland Security Advisory System.
502206
I.BM plans to begin releasing on Monday a monthly report of threats to computer networks in an effort to establish an indicator similar to the federal government&#39;s Homeland Security Advisory System.
469396
Internet security monitoring groups are warning MicrosoftÂ Windows users about new Internet attacks aimed at Windows NT, Windows 2000 and Windows Server 2003 machines running WINS (Windows Internet Naming Service).
663426
The Internet Engineering Task Force (IETF) has wound up its working group on Sender ID, the proposed spam-cutting standard. The purpose of Sender ID technology is to help verify the source of emails by authenticating domain addresses as valid.
152473
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was initially turned on in Jan. 2007, will relight its set of attack monitoring sensors on or about the first of the year after significantly scaling back its operations during the month of December.After its initial 11 months of data collection, the project undertook the month-long hiatus to give project researchers more time to examine results and plan for the year ahead.In addition to tweaking their tactics for tracking and luring malware distributors in 2008, WASC project leaders said they are also planning to add new honeypots to their existing network, which already spans locations in Europe, Russia, South America, and the United States.Unlike more traditional OS-level or SMTP-based honeypot applications -- systems designed to collect individual malware samples for subsequent examination by anti-virus researchers -- the WASC project utilizes a network of 14 specially-configured open proxy servers (or proxypots) to monitor traffic for nefarious activities carried out by everyone from botnet herders to adware purveyors.Traditional honeypots have proven useful for tracking widespread computer viruses and allowing AV companies to produce the signature files needed to protect machines against infection, but those targets are ill-suited to provide the level of real-time intelligence needed to protect against today's fast-moving customized threats, said Ryan Barnett, the WASC project's leader.By serving up an unprotected open proxy server to the larger Internet, and thereby advertising itself as exactly the type of anonymous conduit that attackers seek out to distribute their work -- rather than merely an undefended computer, the effort is already garnering new insight into cyber-criminals' methods, he said.Barnett, who is also director of application security training at Breach Security and an instructor for the SANS Institute, said that despite being pleased with the project's initial ability to identify attacks and test ways to thwart malware campaigns further upstream, he is hoping that 2008 will provide even greater rewards.Among the improvements the group is aiming to make to its system -- built around the ModSecurity open-source Web application firewall, for which Barnett also serves as development community manager -- are more effective ways for categorizing attacks, correlating anomalies, and applying forensics to trends that it charts over time.The security expert is hoping that the same open-source movement that has allowed ModSecurity to mature, with the firewall recently adding a range of new features in its late-December version 2.5 release, will also take hold with the honeypot effort and encourage more people to launch sensors or help research its data findings."Getting different versions of data analysis will be key, but we will need to get a lot more people onboard," Barnett said. "We feel that there's a whole symbiotic approach with the project and the open-source community already. We need to export more of the raw data into that community to help analyze the results -- there's simply too much data for us to churn through alone."The future of the proxypots What the use of the proxypot model allows the project to observe are the source IP addresses being used by attackers running over its sensors, along with the nature of their threats and their targets.For instance, out of the 8.9 million questionable transactions carried out over the group's servers in October, when the sensor network was last running at full bore, 2.6 million of the requests were related to advertising click fraud, the leading type of threat observed in the firewalls' logs.Further investigation of the results would allow WASC to figure exactly which sites were being pumped-up by those automated traffic hoarders and inform any companies involved of the illegal activity, Barnett said.For the record, more than three quarters of the traffic moving over the proxypots fails to trigger any of the firewall rules, meaning that it is either benign or unidentifiable as malware.While the WASC honeypot project could eventually be used to snuff out some malware sources or block the threats themselves, for now, the idea is to create an early warning system to help the security industry respond to emerging attacks.Along with finding more bodies to throw at analysis of its findings, the project is also considering how it will continue to move forward in relation to the matter of allowing its proxypots to be used to carry out actual attacks.Thus far, participants in the program have been sending spoofed information back to the attackers channeling traffic over their proxies to fool them into thinking that their campaigns are working and prevent detection of the honeypots.However, some researchers involved with the program have been asking to allow traffic to pass over their systems unrestricted under the belief that it would be the best way to screen for the newest and smartest threats.In most cases, project participants will need to defer to local laws governing their level of liability for allowing nefarious traffic flow over their servers if they decide to run wide open, said Barnett. Figuring out exactly how to tackle the issue is one of the WASC honeypot's other major goals in advancing its status during 2008."We're trying to regroup and figure out how to best address everything in the next twelve months, enough people are asking about the alternative of not blocking malicious traffic that it has become a question we seriously need to consider," said Barnett. "There are legal issues to study if we want to let real attack run through us, it could still happen anyways -- people can always get around rules, so, there is definitely still some risk involved."
285131
A security organization has suggested police use key-logging software to track communications between terrorists.
148267
Frontline internet-crime fighters from security companies, law enforcement agencies, banks and e-commerce sites huddle at a secretive conference to confer on new tactics to fight cybercrime. Participants field lots of strategies, but no one can quite agree on what do.
203258
An organization in Mumbai, India has proposed that police use key-logging software at cybercafis to keep track of communications between terrorists.
96436
Lycos vigilante attack on spammers has been hit by a vigilante attack. Spammers are suspected.
96829
Some people have started using registered e-mail systems to prove that specific documents were sent or received.
174035
A group of Internet security and instant messaging (IM) providers have teamed up to detect and thwart the growing threat of IM and peer-to-peer (P-to-P) viruses and worms, they said Tuesday.
43316
British net firms are starting to put in place defences that can spot and stop attacks on websites.
215836
Prompted by government regulations, endless spam, and increasingly potent e-mail viruses, many enterprises are looking to tighten the cinch around messaging security.
459314
Online giant teams up with RSA Security to keep users' account info safe.
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
553964
Pipeline A new worm spreading over AOL Instant Messenger seeks to built a botnet of zombie Windows PCs. The Pipeline worm packs an executable file disguised as a JPEG, which if executed, tries to download other strains of malware rootkits and Trojans. Pipeline uses the AIM Buddy List on infected computers to target other prospective marks.â¦