'Hacker Safe' Seal: Web Site Shield, or Target?
456097
More than 80,000 Web sites worldwide display a small green logo that proclaims them to be "Hacker Safe." Is it a promise or a target?
153843
Also: Radio tags could make jewelry more secure. Read these stories and more from around the Web on News.com Extra.
25491
A bank that guarantees its online users safety and security has direct evidence that its Web-based banking system is not bullet-proof. Should that bank tells its users?
710855
(InfoWorld) - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet's addressing system, prompting the software's maintainers to retire the affected version. The flaw within Berkeley Internet Name Domain 8 (Bind 8) software could misdirect users to a fraudulent Web site even if a user typed in the correct URL (uniform resource locator), wrote Amit Klein, chief technology officer for security vendor Trusteer. Klein discovered the problem. Users are being advised to upgrade to Bind 9.4, the latest version of the software, which underwent an architectureÂ rewrite to improve security. The software, looked after by the Internet Software Consortium (ISC), is free to download. ISC issued an interim patch, but due to other weaknesses in the software, ISC is also ending support for Bind 8. "It's never easy to retire a product," wrote the organization in an advisory. "The security issues of Bind 8 are many, and seven years after the release of Bind 9, ISC must devote our efforts to maintaining and enhancing the current version." About 14 percent of the DNS servers on the Internet in 2006 were still using Bind 8, according to Infoblox, which conducts an annual survey of DNS servers. "Bind 8 is still a very popular DNS server nowadays, thus this attack applies to a big part of Internet users," Klein wrote. In a research paper, Klein described a weakness in the algorithm Bind 8 uses to generate transaction IDs, apparently random serial numbers that allow it to spot whether someone is trying to supply it with false information in respose to queries. The weakness makes it possible to observe a few queries and then predict the transaction ID in the sequence, Klein wrote. Using that information, an attacker can then send erroneous information to the DNS server, "poisoning" the address stored against a particular domain name in its memory cache. Thus, traffic intended for a certain Web site from users of that DNS server can be diverted to another server containing a fraudulent site, a deception known as "pharming." Although Bind 9 has a better transaction ID algorithm, it could also be vulnerable, Klein wrote. Â
647793
(InfoWorld) - If hijacked sites and hosting companies that fail to police malware distribution sources represent two of the most serious threats to Internet security, there may be hope for improvement, according to researchers working with Harvard Law School's StopBadware.org. After publishing a list of rogue Web site hosting companies and launching a campaign to label every malicious site they can find on the Internet, an effort that has filtered out over 600,000 nefarious applications thus far, the StopBadware team says that people are responding.Â  The project currently counts less than 250,000 Web sites that it classifies as distributors of programs that qualify as badware -- any application that either tries to hide itself or any of its intentions, based on the parameters of the effort. StopBadware also announced that Internet mainstays Paypal and VeriSign have joined its influential cast of sponsors, which includes Google. By inserting warnings into Google's search results that steer end-users away from malware and adware sources, while communicating with those responsible for creating or handing out the suspicious programs, progress is being made, according to StopBadware's lead researchers. "The interstitials delivered with Google search results are working, and we've been able to communicate with a lot of Webmasters. It's having a neighborhood effect," said Prof. John Palfrey, executive director of Harvard Law School's Berkman Center for the Internet and Society. "We're reaching out to hosting companies and Webmasters and filtering the complaints where it seems useful, and we've seen many people change their behavior." In addition to all the people who have no idea that their sites are being used to pass out malicious programs and those who misunderstand the nature of the applications they're distributing, StopBadware researchers say that even those who create many of the programs are engaging in the give and take. For those who can be reached, the debate over whether or not a particular program qualifies as badware typically can be resolved, with very few of those who agree to modify their applications going on to repeat their behavior, said Jason Callina, one of the StopBadware researchers. "We're seeing a low recurrence of people coming back on the lists once we've gone through the testing and communications process. People are actually helping each other move off the lists," Callina said. "When there's ever any serious disagreement, it's always an argument of our definition of spyware versus theirs." Most Webmasters complain about the interstitials on Google -- which they are notified of 24 hours in advance and given the opportunity to appeal. But the immediate drop in search-driven traffic that the warnings produce quickly convinces people to either take any questionable applications offline or kill their sites altogether, Callina said. Meanwhile, StopBadware's list of hosting companies responsible for supporting the largest number of malware sites resulted in at least one leading culprit -- iPower Technologies --Â  changing its ways, while two others have disappeared completely. Others have also begun to modify their behavior, Palfrey said. "The best measure of our success is when any of these companies change their business process and we're seeing them adjusting," said Palfrey. "At the same time, we're trying to enable [end users] to make better choices with their using habits." So many of the people who end up on StopBadware's list need help understanding what it is that they're doing wrong that the team feels its ability to mete out advice is being overwhelmed, he said. At the same time, StopBadware admits that sophisticated hackers are still advancing their efforts at an alarming pace and the organization can't keep up with the ever-growing volume of online malware programs. In addition to tracking down the programs, StopBadware is also charting regional trends, and the researchers contend that a growing number of suspicious applications are originating in China. The level of interaction between malware authors in the region and their Western counterparts is also becoming more prevalent, with a fair share of distribution still emanating from former Soviet-bloc regions as well, the team said. The key for legitimate businesses to steer clear of the entire problem is to be careful with the companies they partner with, said Palfrey, who served as host of an Anti-Spyware Coalition conference held at Harvard in June. The security consortium is backed by influential industry players including AOL, Dell, Google, McAfee, Microsoft, and Yahoo. "The biggest concern for legitimate businesses at this point is related primarily to software bundling," said Palfrey. "There's often a complicated chain between the original purveyor of a program and the consumer, so companies need to be explicit about what they would qualify for badware-type behavior themselves and hold their partners to that."
360875
The Web site for Indian antivirus vendor AvSoft Technologies has been hacked and is being used to install malicious software on visitors&#39; computers, security researchers said Thursday.The download section of AvSoft&#39;s S-cop Web site hosts the malicious code, according to Roger Thompson, chief research officer with security vendor AVG. &quot;They let one of their pages get hit by an iFrame injection,&quot; he said. &quot;It shows that anyone can be a victim.... It&#39;s hard to protect Web servers properly.&quot;The technique used on the site has been seen in thousands of similar hacks over the past few months. The attackers open an invisible iFrame Window within the victim&#39;s browser, which redirects the client to another server. That server, in turn, launches attack code that attempts to install malicious software on the victim&#39;s computer.The malicious software is a variant of the Virut virus family.The iFrame pages are commonly used by Web developers to insert content into their Web pages, but because it is possible to create an invisible iFrame window, the technology is often misused by hackers as a way to silently redirect victims to malicious Web sites.AvSoft, based in New Delhi, sells an antivirus product called SmartCOP and has sold a second antivirus product called Smartdog. The company, which is not well-known in the U.S., also specializes in recovering data lost due to virus attacks. The company could not be reached for comment Thursday afternoon.That data recovery service could come in handy for some, as Virut is known as a &quot;parasitic infector&quot; virus that is extremely difficult to remove. &quot;It infects all of your programs on your local hard drives, and then it starts hitting your network drives as well the first time you run,&quot; Thompson said.Fortunately, the malware used to install Virut exploits only well-known bugs, meaning that users who are running antivirus software on fully patched systems will probably not be infected by the attack in its current state, security experts say.Nobody knows how the malware got onto the Web site in the first place. News of the hack was reported on the Full Disclosure security discussion list on Thursday.McAfee Security Research Manager Dave Marcus believes that the site was compromised by exploiting a Web programming error, most likely in the site&#39;s SQL or PHP code. Security experts say that criminals have written automated programs that scour the Web for these types of flaws and then automatically infect sites, making this an increasingly common problem.
420901
Most users think their computer is safe from adware and spyware--but they're wrong.
754394
Surfing the Web has never been more risky. Simply connecting to the Internet - and doing nothing else - exposes your PC to non-stop, automated break-in attempts by intruders looking to take control of your machine surreptitiously.
512433
Internet-ready schools do little to protect kids from seemingly safe sites whose only reason to exist is invasive marketing aimed directly at young web surfers. These corporate-sponsored 'advergames' look interactive but the endgame is 'buy.'
732894
(InfoWorld) - A hacker successfully attacked a Web page within Microsoft's U.K. domain on Wednesday, resulting in the display of a photograph of a child waving the flag of Saudi Arabia. It was "unfortunate" that the site was vulnerable, said Roger Halbheer, chief security advisor for Microsoft in Europe, the Middle East and Africa, on Friday. The problem has since been fixed. However, the hack highlights how large software companies with technical expertise can still prove vulnerable to hackers. The hacker, who posted his name as "rEmOtEr," exploited a programming mistake in the site by using a technique known as SQL (Structured Query Language) injection to get unauthorized access to a database, Halbheer said. The site took SQL queries of a particular form, embedded in URLs (uniform resource locators), and passed them to a database. By embedding a query with an unexpected form in the requested URL, the hacker prompted the server to return error messages, Halbheer said. From those error messages, a hacker can get an idea of how the database is structured and refine a SQL query that the database will process as an instruction to insert, rather than retrieve, data. Eventually, the hacker found the right combination and inserted a link to an external Web site into the database. That meant when the normal Web page was called into a browser, the database would download data from an external link. In this case, it was two photos and a graphic, a screen shot of which is available on Zone-H.org , which tracks hacked Web sites. There are two ways to avoid this style of attack. First, the database should not be allowed to return error messages, Halbheer said. Secondly, the Web application should have validated the URL the hacker entered and rejected ones that should not be processed, he said. If a programmer makes a mistake, "the bad guy can leverage it," Halbheer said. SQL injection attacks are on the rise, overall, since valuable data is held within databases, said Paul Davie, founder and chief operating officer of Secerno, a security vendor that develops technology to protect databases from SQL attacks. "I don't think Microsoft are unique in this respect and shouldn't be held up as particularly slipshod," Davie said. "This could have happened to practically anybody."
648643
This article discusses current trends in penetration testing for web application security, and in particular discusses a framework for selecting the best tool or tools to use for these increasingly common type of application.
392093
(InfoWorld) - Security has been a bit of a black art at Google. Unlike rival Microsoft, which publishes detailed information on its monthly patches and has openly evangelized the steps it takes to secure software, Google has generally been quiet when it comes to talking about security, and it has kept the team that keeps Google's Web sites secure under wraps. Not so anymore. In April, Google researchers presented a paper on Web security at a technical conference in Cambridge, Massachusetts, discussing the results of the company's ongoing effort to "identify all Web pages on the Internet that could potentially be malicious." A month later, Google started its first-ever security blog, and since then, observers have had their first glimpse into the lives of Google's 100-person security team. That team is managed by Douglas Merrill, Google's vice president of engineering and CIO, who spoke with IDG News Service recently. Merrill wouldn't say anything about Google'sÂ recent acquisition of secure browsing software vendor GreenBorder, but he did explain what Google gets from its security investments, and why his company believes that locking down the enterprise PC is not the way to go. Following is an edited transcript of the interview. IDGNS: Google is trying to identify all of the malicious Web pages on the Internet. Can you tell me about that effort? Merrill: We believe that by trying to find badware out there, we can materially help our users. We can do it by flagging it in Toolbar, we can do it by using things like Stopbadware.org to try and help people address them. Information is power in this context, and our goal is to make all the information in the world accessible and useful. That set of work by Niels [Google security specialist Niels Provos] and others is a really great scientific advance toward understanding what the world looks like. And in fact, the coverage of that line of work is part of what led us to step over the curb and start the Google security blog. Because some of the coverage in the [press], Dr. Provos found misleading. He actually got so energized about it that he came to Barry, [Google spokesman Barry Schnitt] and said, "I want to start a malware blog." And Barry said why don't we just do this security blog. We'd been talking about it forever, we just never got around to doing it. So we had a long internal conversation, and our initial worry was we wanted to be transparent and engage our users in a discussion about security, but we didn't want to have one posting and have the thing die. We want to have an ongoing discussion. IDGNS: Does Google ever think of security as something it could turn into a product? Merrill: In some sense, the answer is clearly "yes" because part of Checkout is a security product. But fundamentally, we are a search company. We do search. We want to do things that make users feel safe and secure on the Internet to do searches. I have no idea what we'll do in the future. I don't have a crystal ball. But we're a search company, and what we want to do is help people be able to do searches and learn things and make all the world's information universally accessible and useful. And part of being useful is being secure. IDGNS: Niels Provos was quoted recently as saying that the firewall is dead. What are your thoughts on that? Merrill: Niels's point was that, increasingly, business technology and enterprise technology can't be separated from the Internet and can't be separated from what consumers do. And businesses, increasingly, are using partnerships to get things done. Increasingly, when I go off and I give discussions to other CIOs, what we talk about is the consumerizaiton of enterprise technology. The increasing integration of consumer technology into the enterprise space. So what Niels was talking about was this idea that you can't live your whole life behind one set of walls anymore. Everything that your employees do every day will include stuff they do at home, stuff that other companies have done. We obviously believe in this idea of the Web 2.0, where you're collecting different kinds of applications together to meet consumer needs. The firewall is one line of defense, and it's still useful, just like locks on front doors are still useful. But you need other kinds of defenses as well. You may need application development standards, you may need inter-organizational understanding of things like Stopbadware.org. It's no longer that security is something you can write a check for. Security is a process. There are no lasting technical solutions to social problems. You can't write a check to solve a social problem. So Niels is absolutely right. We think security of the future is a far more complex community based activity. It takes a village. We want to be part of the village. IDGNS: That's interesting because it is in opposition to the trend of locking out social networking sites and locking down the functionality of the PC. It sounds like you guys believe that that's not going to work. Merrill: We believe that in the long run, enterprise technology will be consumerized. We have more than 100,000 domains in Google Apps so far. So 100,000 different domains have decided that the right way for them to run their enterprise applications is to have us do it. And to have us do it with consumer-grade applications because the consumer-grade application involving search, free text unstructured search, involving things like conversation views and connections of threads in e-mails, involving secure document storage and access control, those things are so powerful that enterprises can use them. IDGNS: But do you see yourself in opposition to the trend of locking down the PC? Merrill: I think we see ourselves in opposition to that trend. Obviously, you have to manage things like bandwidth utilization. So in some sense, some of the locking down is done for that reason. Sometimes it's done for regulatory or other reasons. But in general we believe that the world where your business computer is very tightly coupled only to business use and business applications are very complex and really rich and complicated and are very hard to use, we believe that those days are coming to an end.
31340
Consider anti-reconnaissance tools Hurwitz &amp; Associates has been running an IT security campaign: "AVID: Anti-Virus Is Dead" for some time. The argument is based on the principle that blacklists of signaturesâsmall files that contain a unique string of bits, or the binary pattern, that identifies all or part of a virusâdo not, and cannot, provide adequate protection against viruses. This is because the signature files can only be written once a virus or other form of malicious software program has been identified. When a new malware program is discovered, the race is on to write a signature file for protecting against that virus. It's like putting a plaster on an open wound, rather than taking care not to get cut in the first place.â¦
538641
Worried about catching viruses, spyware, or other malicious software while surfing the Web?
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
336252
Issue #8 of the (IN)Secure Magazine has been posted today and includes articles like:  Payment Card Industry demystified Computer forensics vs. electronic evidence SSH port forwarding - security from two perspectives, part two Airscanner vulnerability summary: Windows Mobile security software fails the test Introducing the MySQL Sandbox   Check out insecuremag.com for more or just download the issue directly.
148612
Attackers can trick browsers into releasing password information.