2006: The year in security
626134
(InfoWorld) - Though Internet-crippling virus attacks now seem to be a thing of the past, PC users didn't feel a lot more secure in 2006. That's because online attacks have become more sneaky and professional, as a new breed of financially motivated cybercriminals has emerged as enemy No. 1. MicrosoftÂ patched more bugs than ever and whole new classes of flaws were discovered in kernel-level drivers, office suites, and on widely used Web sites. Vendors' chatter about security is at an all-time high, but the bad guys are still finding lots of places to attack. And, oh yes, spam is back. Following are five of the top computer security stories in 2006. Cybercrime dividends Hackers teamed withÂ professional criminal gangsÂ in increasingly sophisticated computer crime operations aimed purely for profit. Much of the trouble centered on phishing, a type of attack where fake Web pages are constructed to harvest log-in details, credit card numbers, or other personal information. Credit card numbers are often sold online to others for illicit gain. In May, 20,000Â phishing complaintsÂ were reported, a 34 percent increase over the previous year, according to U.S. Department of Justice report. The U.S. hosts the largest percentage of phishing sites, it said. But law enforcement agencies are getting more organized and cooperating better, particularly in international investigations. At least 45 countries participate in the G8 24/7 High Tech Crime Network, which requires nations to have a contact available 24 hours a day to aid in quickly securing electronic evidence for trans-border cybercrime investigations. The private sector has also helped. Microsoft filed dozens of civil suits and gave information to law enforcement for criminal cases in Europe, the Middle East, and the United States against alleged phishers throughout 2006. It's a brand new 0day With automatic software updates now the norm, hackers have been forced to look a little harder for ways to put their malicious software on unsuspecting victims' PCs. In 2006 they turned to zero-day attacks as never before. These attacks take advantage of previously unreported flaws in software, and in 2006 they became a top concern, according to the SANS Institute. In fact, hackers kicked off the new year in 2006 by releasing zero-day attack code based on a flaw in the way Internet Explorer handled WMF (Windows Meta File) documents. This was followed, later in the year, by a rash of very targeted online attacks that exploited unpatched flaws in Microsoft's Office software. In fact, MicrosoftÂ warned of the latest such attackÂ -- this one targeting a flaw in Word -- just this Tuesday. To underline the scope of the zero-day problem, security researchers launched widely publicized "Month of Kernel Bugs" and "Month of Browser Bugs" projects, during which they exposed a new, unpatched vulnerability in browsers and operating systems every day for a month. Spam avalanche Microsoft's Chief Software Architect Bill Gates predicted two years ago that spam would be gone by 2006. He should check his in-box. Rising volumes of junk mailÂ nagged IT administrators throughout 2006. Up to 90 percent of all e-mail was spam, depending on the vendor recording the statistics. Spammers found creative ways to circumvent security software. Image-based spam, where individual messages appear to be unique by subtracting or adding pixels, foiled some security techniques. Spammers also put messages in the images themselves, a tougher challenge to stop since it requires processor-intensive optical character recognition (OCR) techniques. Spam remained the delivery vehicle for other malicious software such as keystroke loggers and rootkits in addition to promoting links to phishing sites, which often aim to steal financial data or log-in credentials. Web 2.0 gets Hacked 1.0 MySpace.com may be a poster child for Web 2.0, but from a security perspective, it hasn't been looking so pretty. That's because the popularÂ social networking site was hit hardÂ this week by a password-stealing worm that exploited a scripting vulnerability on the Web site. And this was not even the first worm to hit MySpace. In October another more benign worm, called Samy, automatically added a Los Angeles teenager's name to visitors profiles, quickly making him appear to be the most popular member of the MySpace community. Security experts say that the kind of cross-site scripting attack used in the recent MySpace worm has become much more prevalent in the past year, as hackers have discovered just how much can be done with these attacks. These bugs can be used to do far more harm than many people realize, security experts say, including forcing PCs to download illegal content, hack other Web sites or send e-mail. Vista lockout irks vendors MicrosoftÂ rankled security vendorsÂ by saying it wouldn't allow their software to access the kernel of the 64-bit version of Windows Vista. Patch Guard, Microsoft's kernel security technology, blocks access to prevent unauthorized modifications by malicious software. Vendors, led by Symantec andÂ McAfee, arguedÂ they needed access to the kernel to detect malicious software such as rootkits, which burrow deep into the OS. After a flurry of public statements and pressure from the European Commission, Microsoft agreed to make APIs (application programming interfaces) available. The APIs will allow host intrusion prevention technologies used by vendors to function without hooking the kernel. But Microsoft said the APIs wouldn't be ready until the release of Service Pack 1 for Vista.
119512
The SANS Institute identifies the top 20 Internet vulnerabilities of the year.
291422
(Source: Ironport)  For a time, security controls designed to manage spam, viruses, and malware were working. Loud, high-impact attacks abated. But, as a result of this success, the threats they protected against were forced to change. In 2007, many of these threats underwent significant adaptation. Malware went stealth, and the sophistication increased.
488690
Legal tussles, format wars, and (of course) the iPhone dominated technology news in 2007. Here are the biggest tech headlines of the year--including some we'd like to forget.
53247
A survey of Internet vulnerabilities to be released Monday shows a sharp jump in attacks on Windows-based personal computers during the first six months of 2004, along
174866
Monthly security updates include IE, Windows Media, and Visual Studio fixes.
59222
: Indonesia is mounting its largest security operation in four years after it received intelligence from the US and Australia on possible terrorist attacks during the Christmas and New Year season.
191746
In the three years since the attacks on America, has the world become less safe? Send us your views.
402056
It's the time of year to reflect on the good security choices you've made over the year, the defense-in-depth strategy that you've decided to follow, and plan for your response to future threats and virus outbreaks.
585361
In the months after the Sept. 11, 2001, terrorist attacks, government officials and industry leaders talked excitedly about how they expected technology to plug many of the gaps in airport security.
606239
year in review Phishing scams and PC-compromising viruses were the dominant security threats in 2004.
478110
Company is readying security software or cell phones and handheld devices.
405976
Letters: Going deeper on the question of security and operating systems.
632672
Bad guys looking for shiny new botnets, Trojans, rootkits, and spyware this holiday season have plenty to choose from.
722289
(InfoWorld) - It happens every year: as the calendar gets ready to turn over, we get an itch to pause, to be quiet, to reflect. Thatâs probably why âyear in reviewâ stories are so popular at this time of year: they channel a seasonal compunction among editors and readers alike. But what to make of 2006? Itâs a year in which some enterprises and IT firms made bold moves to set themselves on a new course, while others failed, in spectacular fashion, to learn the lessons of the past. For this penultimate Tech Watch, we review the year with the aid of some pithy quotes. âIf I knew then what I know now, Iâd have done things differently.â -- Patricia Dunn, former Hewlett-Packard chairwoman Sometimes you come across a product or corporate initiative -- letâs take Sonyâs recent DRM spyware as an example -- that is so patently wrongheaded you canât imagine how it ever came to see the light of day. When you dig into the history of those decisions, you often find that they were made by people who were trying, earnestly, to solve a very specific problem without seeing how their âsolutionâ might affect the company as a whole. Thatâs what makes the scandal that led to the resignation of HP Chairman Patricia Dunn and the criminal charges against her, HP legal counsel Kevin Hunsaker, and three outside investigators all the more exceptional. These were the folks at the top of the totem pole. The dispute arose over the handling of an investigation by HP to see which members of its board of directors leaked information, including arguments about the ouster of former CEO Carly Fiorina, to the press. Hurd and other board members, it seems, became distracted by a âplumbingâ expedition, as it was called in the Nixon White House, and contracted with a company to use âpretexting,â a controversial technique where investigators pretend to be the people being investigated in order to access private information. Despite intense media and legal scrutiny, though, the squabble has not fazed HP shareholders or customers. Under Mark Hurd, CEO and newly appointed chairman, the company is fulfilling the promise of the controversial HP-Compaq merger engineered by Fiorina: It has overtaken Dell as the leading PC maker and IBM as the biggest IT company. The spy scandal has broad implications, however. Congress is now considering federal laws against pretexting, and increased oversight of corporate governance is becoming a shareholder rallying cry. --Marc Ferranti, IDG News Service ââFree has to have a price?â Thatâs nonsense.â -- Sun CEO Jonathan Schwartz After years of staving off open source proponents, Sun Microsystems in November 2006 bit the bullet and made Java available via open source, and doubled down on that by offering up Java to the GNU General Public License, ensuring that revisions to Java are submitted back to the community at large. Naturally, the move raised as many questions as it answered. Chief among them: Can Sunâs Java gurus adapt to the new paradigm and relinquish some degree of control? Looking at the evidence, it seems likely that Sun can. Java already has spawned a whole industryâs worth of open source projects such as the popular Spring Framework. Sunâs Solaris OS has thrived under open source. Inside Sun, however, not everyone shared Schwartzâs optimism. Graham Hamilton, a Sun Fellow for the Java team, departed the company over the momentous announcement, according to one insider. Outside Sun, IBM protested that it wanted Java placed under the jurisdiction of the Apache Software Foundation. Schwartzâs decision regarding Java will be remembered as a high point of 2006, and further proof that commercial vendors must find a way to ride, not fight the open source wave. -- Paul Krill âI am having personal difficulty looking veterans in the eye.â -- VA CISO Pedro Cadenas With mega blow-ups like the hack of CardSystems, many labeled 2005 the âYear of the Data Breach.â But that year seemed to extend, seamlessly, into 2006, as well. No incident epitomized the bumbling of sensitive data than the U.S. Department of Veterans Affairsâ loss of a laptop containing personal data of more than 26 million vets. The device in question was stolen from the home of a VA analyst, and was later recovered. Stories like the VAâs were sadly common this year. Chevron, GE, AT&T, Starbucks, and Wells Fargo all reported losing customer or employee data. One of the common themes in many cases was that data was being carried around, unencrypted, on portable PCs stolen from or lost by employees of third-party companies. That troubling trend bears out in a study that Vontu and the Ponemon Institute conducted this year, which found that 81 percent of the 500 companies surveyed âreported the loss of one or more laptops containing sensitive information during the past 12 months.â --Ted Samson âI wouldnât be surprised to see SaaS services (at) $5 per month, per user.â -- Josh Greenbaum, EAConsult 2006 didnât quite make it as âThe Year of SaaS,â but it came darn close. Spurred by the success of firms such as Salesforce.com, Microsoft, Oracle, and SAS created SaaS CRM products with integration to their on-premises software as a differentiator. Even more important: SaaS providers, led by Salesforce, laid down a solid foundation on which to build new services in 2007 and beyond. Take, for example, AppExchange, an online market of sorts that Salesforce launched in October. AppExchange allows third-party providers to post their wares, and gives users the ability to pick and choose from applications and features that enhance the Salesforce.com software. AppExchange implies a recognition by Salesforce and, we can now assume, other SaaS providers that if enterprise-level companies are to adopt SaaS, then SaaS solutions canât be siloed. Integration of CRM with ERP, business intelligence and product lifecycle management are a must for the enterprise. -- Ephraim Schwartz âthe best season to visit Italyâ -- search query by Thelma Arnold, aka AOL user No. 4417749 Connect users to the world of information â¦ then betray their trust. Itâs not exactly the long-term strategy AOL had in mind, nor one to stay on top in todayâs Web 2.0-influenced Internet. Yet AOLâs infamous search data leak in August, which resulted in the ousting of CTO Maureen Govern, was just one headline head-scratcher involving the online giant this year. AOL, with its huge user base, has a track record of developing innovative new services to keep users loyal. That should have put the company at the forefront of the Web 2.0 wave that gave birth to sites such as FaceBook. But AOL, like other âold lineâ dot-coms Yahoo and Microsoft, proved too slow on the uptake, as firms with bigger visions and faster feet cherry-picked hot properties and left them standing on the sidelines. AOL hurt itself, too, with news reports of horror stories from customers who tried to cancel accounts, and a âbadwareâ label for AOL 9.0. By the time The New York Timesâ triangulated Thelma Arnold, a 62-year-old widow from Lilburn, Ga., from the search record of AOL user No. 4417749, it was merely putting a face on AOLâs already eroding relationship with its expansive user base. By yearâs end, firms such as AOL and Yahoo were taking bolder steps to right their listing vessels: AOL dropped its subscription-services model and a quarter of its workforce, including CEO Jonathan Miller. Yahoo also shook up its boardroom, amid disappointing earnings and signs of discontent from senior management. Shortly before he lost his job, CEO Miller had observed in a keynote speech that âthe big companies will stay big companiesâ as the Internet evolves. Going into 2007, AOL isnât alone among big companies that are praying that adage rings true. -- Jason Snyder
130078
com December 2, 2004, 7:48 AM PT. While its neighbors, software infrastructure and hardware upgrades, switched places this month, security held its spot at number three.
30623
By James Derk Scripps Howard News Service  If you weren't worried enough about the security of your home computer and network, it may be time to step it up.