Anti-botnet vendors plug in
641744
A small group of IT security startups are hoping to cash in on the rise of the botnet scourge as businesses -- telecommunications carriers and Internet service providers, in particular -- seek new methods for stopping the attacks.
635804
(InfoWorld) - Enterprise companies will soon begin offloading many of their network security responsibilities to telecommunications and Internet service providers and save vast amounts of time and money doing so, if AT&T has its way. Speaking to the assembled crowd at the IDC Security Forum in New York on Wednesday, Edward Amoroso, chief security officer for AT&T's services division, predicted that enterprises will begin adopting more "virtual" security capabilities from their ISPs and bandwidth providers in the coming years as those companies are better positioned to do battle with botnets, spam, and denial-of-service )DoS) threats. Based on the bandwidth-providers' existing abilities to see spikes in traffic that are tell-tale signs of botnet, spam, or other malware activity -- long before enterprises can see evidence of the attacks on their own -- Amoroso contends that companies will soon concede the process of fighting the threats and turn to companies such as AT&T for help. "We think that security at the perimeter should be virtual, which is a somewhat controversial concept, because a lot of time, effort, and career capital has already been spent securing the perimeter," Amoroso said. "But we think a lot of existing technologies there are running out of legs, and simply running firewalls at the gateway is no longer a valuable proposition." The United States government's Telecommunications act of 1996 prevents carriers from approaching customers and marketing services to them based on any trends they observe on the end users' network connections. However, the companies can already identify much of the spam and malware activity being carried out in the pipe, based on their massive infrastructure, and should be enlisted to help solve security issues, he said. For threats such as distributed DoS that can easily be thwarted upstream, the CIO said, it makes little sense for companies to continue to invest in new technologies and staff when the carriers could easily detect and snuff out the campaigns ahead of time. "How do you stop DDoS at the edge? The physics just don't make sense. When these attacks happen, the customers' routers will already be dead," said Amoroso. "We think the idea that the pipe should be dumb is strange; with spam accounting for 90 percent of all traffic on the e-mail pipe, we're delivering nothing but more attacks, malware, and junk. If people want us to keep doing that we can, but why would they want us to keep doing that when we can see it, scoop it, study it, and stop it?" Lest someone should contend that AT&T and other carriers are merely licking their chops at the prospect of adding pricey new security services to their products, the expert said security services should eventually become a set of non-optional capabilities included with the purchase of ISP and telephony services. Much as the carrier community focused on providing faster services in the 1980s and added tools to improve quality to their products in the 1990s, the CIO said that security services will become a de facto element of all the capabilities that the firms market. While early adopters are already paying a premium to use the security capabilities offered by carriers today, eventually the price should be blended into the packages of capabilities that companies buy from providers such as AT&T, the expert predicted. At the same time, AT&T and other carriers would have to sacrifice their existing businesses of selling firewall management and intrusion detection-type systems into enterprises, he said. But the move to push security tools to the bandwidth providers is one that has been made even more likely by the complexity of those technologies. "I think we'll come out of this decade thinking it was silly to have separate perimeter security systems, it doesn't make sense to build the network and overlay security as an afterthought," Amoroso said. "We have as large of a managed security services business as anyone, but this work is better off embedded in the pipeline." Emerging mobile and Voice over Internet Protocol (VoIP) services will also include integrated security capabilities that replace many of the systems being implemented to protect those technologies today, according to the AT&T CIO. "We can virtualize these things, and any carrier can do it; this is the direction that perimeter security is headed in. It's not a collision course, but rather something very pleasant, as finally there's something smooth and simple to solve these problems," he said. "It's absurd that all we hear today is that the carrier plays no role in all of this, that companies should do it at the edge. We know it's a lot of work, but we're already prepared to do it."
173824
Check Point and McAfee unveil products designed to help companies protect their networks.
541857
A new device capable of detecting and throttling encrypted BitTorrent traffic hits the shelves. The game of cat and mouse between ISPs and BitTorrent users continues. In Monkey Bites.
196490
Web villains post do-it-yourself phishing kits to help any amateur become an online con artist.
43316
British net firms are starting to put in place defences that can spot and stop attacks on websites.
464392
Traceroute Security researcher Jose Nazario has uncovered circumstantial evidence of the use of botnets in politically-motivated denial of service attacks.â¦
52703
New service offers spam, virus filtering for small and mid-sized businesses.
686457
Ziff Davis - Protections against phishing schemes such as Evil Twin exist but have yet to be implemented in many public hot spots. In their absence, aggregator services help to secure enterprise users.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
105425
Marks host malware Booby-trapped web pages are growing at an alarming rate with unsuspecting firms acting for nurseries for botnet farmers, according to a new study.â¦
111159
The botnet deluge is providing -- what else? -- business opportunities for a handful of firms who think they're got what it takes to fight back the onslaught.
98494
This paper discusses the use of NetFlow, a traffic profile monitoring technology available on many routers, for use in the early detection of worms, spammers, and other abnormal network activity in large enterprise networks and service providers.
762204
Science & environment: Creators of malware are no longer script kiddies after kudos - they're criminals after your cash. Wendy M Grossman asks if protection can keep pace with them.
129780
The latest variant of the SDbot worm contain network-sniffing software that enables it to retrieve passwords from other computers connected to the target PC.
705475
Anti-phishing applications, smart cards, and new authentication technologies are vying for your support.
537303
Rust never sleeps, the wise man said, and neither do malware purveyors. After "treating" potential botnet inductees to strippers on Christmas, the keepers of Storm have switched tactics and unleashed a New Year's greeting.