Cyberspies Target Silent Victims
294963
Military contractors may be concealing data breaches by international cyberspies.
152473
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was initially turned on in Jan. 2007, will relight its set of attack monitoring sensors on or about the first of the year after significantly scaling back its operations during the month of December.After its initial 11 months of data collection, the project undertook the month-long hiatus to give project researchers more time to examine results and plan for the year ahead.In addition to tweaking their tactics for tracking and luring malware distributors in 2008, WASC project leaders said they are also planning to add new honeypots to their existing network, which already spans locations in Europe, Russia, South America, and the United States.Unlike more traditional OS-level or SMTP-based honeypot applications -- systems designed to collect individual malware samples for subsequent examination by anti-virus researchers -- the WASC project utilizes a network of 14 specially-configured open proxy servers (or proxypots) to monitor traffic for nefarious activities carried out by everyone from botnet herders to adware purveyors.Traditional honeypots have proven useful for tracking widespread computer viruses and allowing AV companies to produce the signature files needed to protect machines against infection, but those targets are ill-suited to provide the level of real-time intelligence needed to protect against today's fast-moving customized threats, said Ryan Barnett, the WASC project's leader.By serving up an unprotected open proxy server to the larger Internet, and thereby advertising itself as exactly the type of anonymous conduit that attackers seek out to distribute their work -- rather than merely an undefended computer, the effort is already garnering new insight into cyber-criminals' methods, he said.Barnett, who is also director of application security training at Breach Security and an instructor for the SANS Institute, said that despite being pleased with the project's initial ability to identify attacks and test ways to thwart malware campaigns further upstream, he is hoping that 2008 will provide even greater rewards.Among the improvements the group is aiming to make to its system -- built around the ModSecurity open-source Web application firewall, for which Barnett also serves as development community manager -- are more effective ways for categorizing attacks, correlating anomalies, and applying forensics to trends that it charts over time.The security expert is hoping that the same open-source movement that has allowed ModSecurity to mature, with the firewall recently adding a range of new features in its late-December version 2.5 release, will also take hold with the honeypot effort and encourage more people to launch sensors or help research its data findings."Getting different versions of data analysis will be key, but we will need to get a lot more people onboard," Barnett said. "We feel that there's a whole symbiotic approach with the project and the open-source community already. We need to export more of the raw data into that community to help analyze the results -- there's simply too much data for us to churn through alone."The future of the proxypots What the use of the proxypot model allows the project to observe are the source IP addresses being used by attackers running over its sensors, along with the nature of their threats and their targets.For instance, out of the 8.9 million questionable transactions carried out over the group's servers in October, when the sensor network was last running at full bore, 2.6 million of the requests were related to advertising click fraud, the leading type of threat observed in the firewalls' logs.Further investigation of the results would allow WASC to figure exactly which sites were being pumped-up by those automated traffic hoarders and inform any companies involved of the illegal activity, Barnett said.For the record, more than three quarters of the traffic moving over the proxypots fails to trigger any of the firewall rules, meaning that it is either benign or unidentifiable as malware.While the WASC honeypot project could eventually be used to snuff out some malware sources or block the threats themselves, for now, the idea is to create an early warning system to help the security industry respond to emerging attacks.Along with finding more bodies to throw at analysis of its findings, the project is also considering how it will continue to move forward in relation to the matter of allowing its proxypots to be used to carry out actual attacks.Thus far, participants in the program have been sending spoofed information back to the attackers channeling traffic over their proxies to fool them into thinking that their campaigns are working and prevent detection of the honeypots.However, some researchers involved with the program have been asking to allow traffic to pass over their systems unrestricted under the belief that it would be the best way to screen for the newest and smartest threats.In most cases, project participants will need to defer to local laws governing their level of liability for allowing nefarious traffic flow over their servers if they decide to run wide open, said Barnett. Figuring out exactly how to tackle the issue is one of the WASC honeypot's other major goals in advancing its status during 2008."We're trying to regroup and figure out how to best address everything in the next twelve months, enough people are asking about the alternative of not blocking malicious traffic that it has become a question we seriously need to consider," said Barnett. "There are legal issues to study if we want to let real attack run through us, it could still happen anyways -- people can always get around rules, so, there is definitely still some risk involved."
571071
Could a concerted cyber attack by hackers and bloggers bring the government to its knees? A mock array of cyber catastrophes suggests that it could. That's the official, if heavily censored, word.
135753
In March 1990, when few people had even heard of the Internet, U.S. Secret Service agents raided the Texas offices of a small board-game maker, seizing computer equipment and reading customers&#039; e-mail stored on one machine. A group of online pioneers already worried about how the nation&#039;s laws were being applied to new technologies became even more fearful and decided to intervene.
760875
Nearly a third of online teens say they have been harassed on the Internet, with girls and participants of social-networking sites more likely to be targets, a study finds.
523103
Online extortion is quietly affecting thousands of businesses, for a very simple reason: it works. The big question then becomes, how will you and your company decide to respond?
392900
Spammers are suspected of hacking into and downing Lycosâs anti-spam Web site just hours after it went live. The Web site is currently inaccessible and could also be the victim of a DDoS attack.
677442
Security researchers have released code showing how a pair of widely used technologies could be misused to take control of a victim&#39;s Web browsing experience.The code, published over the weekend by researchers Adrian Pastor and Petko Petkov, exploits features in two technologies: The UPnP (Universal Plug and Play) protocol, which is used by many operating systems to make it easier for them to work with devices on a network, and Adobe Systems&#39; Flash multimedia software.By tricking a victim into viewing a malicious Flash file, an attacker could use UPnP to change the primary DNS server used by the router to find other computers on the Internet. This would give the attacker a virtually undetectable way to redirect the victim to fake Web sites. For example, a victim with a compromised router could be taken to the attacker&#39;s Web server, even if he typed Citibank.com directly into the Web browser navigation bar.&quot;The most malicious of all malicious things is to change the primary DNS server,&quot; the researchers wrote. &quot;That will effectively turn the router and the network it controls into a zombie which the attacker can take advantage of whenever they feel like it.&quot;Because so many routers support UPnP, the researchers believe that &quot;99 percent of home routers are vulnerable to this attack.&quot;In fact, many other types of UPnP devices, such as printers, digital entertainment systems, and cameras are also potentially at risk, they added in a Frequently Asked Questions Web page explaining their research.The attack is particularly worrisome because it is cross-platform -- any operating system that supports Flash is susceptible -- and because it is based on features of UPnP and Flash, not bugs that could be easily fixed by Adobe or the router vendors.Users could avoid this attack by turning UPnP off on their routers, where it is normally enabled by default, but this would cause a variety of popular applications, such as IM software, games, and Skype, to break and require manual configuration on the router.Adobe could make changes to Flash to mitigate the problem, but attackers could most likely also launch this attack using another technique, known as DNS pinning, said Aviv Raff, a researcher who has also blogged about the attack.&quot;This is a critical issue,&quot; he said in an IM interview. &quot;People should turn off UPnP in their devices, and vendors should put UPnP disabled by default in the devices they deliver.&quot;Although this could make life difficult for nontechnical users, Raff believes it would be worth the effort. &quot;It&#39;s better than having your traffic owned by malicious people,&quot; he said.However, another security expert said that turning off UPnP would be overkill, considering that online criminals have not even begun using this attack. &quot;Look... if you get hit by a meteor, it&#39;s devastating,&quot; said Roger Thompson, chief research officer with Grisoft. &quot;But no one goes around building meteor shelters.&quot;
375298
Sex offenders could be forced to register their e-mail addresses and chatroom names, the government says.
630327
Spammers aren't ducking antispam laws by operating offshore, they're just ignoring it.
361227
The Internet has emerged as a prime tool for Islamic radicals, who use its anonymity to coordinate secret operations and get their message to the public without fear of detection.
734520
Hackers may have targeted DNS servers that form the backbone of the Internet--but no damage was done, experts believe.
293609
Police and internet companies launch a website for children to report possible paedophile activity.
489260
It started as privacy protection for the abused, the oppressed and the bashful. Now it shields creeps, criminals and malicious mobs. How to fix it?
174682
A new study from the National Cyber Security Alliance (NCSA) and America Online (AOL) paints a dire picture of the state of security in the land of the home PC.
465274
Several incidents highlight the dangers life online presents to preserving your privacy.
96436
Lycos vigilante attack on spammers has been hit by a vigilante attack. Spammers are suspected.