Q1 Labs tackles intrusion prevention
87501
Q1 Labs this week plans to release the latest version of its flagship software as well as add-on software that the company says enables its security management tool to not only detect security issues but also prevent them.
349580
This article provides an overview of ITIL, a management-level set of best practices and guidelines for an integrated and process-based approach to IT and security.
38008
Vulnerabilities could allow attackers to gain remote control of a system, security company says.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
598197
Technique lets intruders exploit flaws previously thought to be insignificant, says security researcher.
444758
Although companies need to protect against the flaws, many of the related information security risks and costs could be removed if businesses forced vendors to test systems before rollout, according
710136
This paper looks at the evolution of firewall technology towards Deep Packet Inspection, and then discusses some of the security issues with this evolving technology.
696623
(InfoWorld) - WabiSabi Labi, a Swiss startup that caused a stir with the creation of an eBay-like marketplace for software vulnerabilities, plans to offer an intrusion-detection system and will open up its auction site to a wider range of intellectual property, according to a company executive. "We are signing an agreement with a hardware producer and we are building, I can't say by when, but we will provide an intrusion detection system device based on zero-day signatures," said Roberto Preatoni, the company's strategist, during an interview on the sidelines of theÂ Hack In The Box conferenceÂ in Kuala Lumpur, Malaysia. WabiSabi Labi allows security researchers to submit unpatched software vulnerabilities, called zero-days, for sale on the company's auction site where qualified buyers can bid on them. The vulnerabilities can be purchased using an exclusivity option, which prevents them from being sold to anyone else, or they can be sold repeatedly to different buyers. In addition, WabiSabi Labi is close to announcing an alliance with "a very well-known security research company" to market its products through the auction site, Preatoni said. He declined to name the company before the deal is made public. "The next step will be to open up the marketplace to any sort of intellectual property, not just security research," he said. The premise behind WabiSabi Labi's zero-day marketplace is that ethical disclosure -- in which security researchers warn vendors about vulnerabilities in their software before disclosing them -- is unfair, because the researchers are not compensated for the work they do. The startup wants to end the "free ride" that software vendors have enjoyed and see that hackers and researchers get paid a market rate for their efforts. WabiSabi Labi isn't the first to offer hackers and researchers a way to earn money for the vulnerabilities they discover. Several security companies, including 3Com's TippingPoint division, VeriSign's iDefense Labs, and Immunity, pay researchers for zero-days. WabiSabi Labi now hopes to combine its efforts to see researchers compensated for the work they do with aspirations of being a security vendor in its own right. Its planned intrusion detection system, a tool that monitors a network or server for suspicious activity, will be based on a database of zero-days sold through the company's auction site, and researchers will receive continuing payments when vulnerabilities they discover are included, Preatoni said. The only vulnerabilities that won't be included are those that are purchased using the exclusivity option. Getting to the point where WabiSabi Labi's zero-day database contains enough signatures for an intrusion detection system will take a couple of years, and requires the company to convince security researchers to sell vulnerabilities they discover through its auction site. That won't be easy. WabiSabi Labi executives face an uphill struggle to win over skeptics who believe ethical disclosure is still the best way to report software vulnerabilities and protect users. "By releasing this zero-day information you put customers at risk," said Alexander Kornbrust, the managing director of Red Database Security and a researcher credited with uncovering dozens of security holes in Oracle databases. Others are worried about how zero-day sales will affect public perceptions of security researchers and hackers. "Having a zero-day eBay is dangerous for the community because it will enforce the idea that hackers are criminals," said Alessio Pennasilico, a security evangelist at Alba S.T. who has uncovered vulnerabilities in the software used to control industrial equipment found in factories and power plants. "I will never buy or sell a zero-day on a site like that," Pennasilico said. But some people are willing to give WabiSabi Labi a try, at least under certain circumstances. "If the vulnerability affects an open-source project, I wouldn't sell it. But if a vulnerability affects a big commercial vendor, and I know that vendor is usually not responsive on security bugs, then I would probably sell it," said Andrea Barisani, chief security engineer at Inverse Path. But Barisani, who discovered a vulnerability that allows false messages to be injected into satellite navigation systems, knows the people behind WabiSabi Labi personally and trusts them. He's quick to acknowledge others may not share that trust. "If I'm a random researcher, and I know I have a very important vulnerability -- and ideally you would sell only vulnerabilities that are very important -- my primary concern would be not to leak that vulnerability. Since most people in the security industry are very paranoid, I wouldn't trust a middleman," Barisani said. Preatoni rejects the notion that selling vulnerabilities through WabiSabi Labi puts users at risk, saying buyers are carefully vetted to prevent zero-days from falling into the hands of criminals. But he acknowledges the company must work hard to win over security researchers by ensuring they get paid for their work and that agreements over how vulnerabilities should be handled are respected. "It's all a matter of trust and we have a long road ahead. We have to build that trust," Preatoni said.
478726
BOXBOROUGH -- Design engineer Alan Lear has rolled up his sleeves. His lab is crammed with motherboards and oscilloscopes. He scans a screen showing the signal quality of the transmission between a pair of Advanced Micro Devices' prototype chips.
522524
Four vendors of application security products have created an alliance to challenge the ability of large-scale vendors--such as Check Point Software Technologies, Cisco Systems, Juniper Networks
15069
Security researchers discover a serious vulnerability in older version of ICQ IM software.
478110
Company is readying security software or cell phones and handheld devices.
484982
Check Point Software has beefed up its enterprise security gateways.
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
559684
Shimon Systems, Inc., a leading provider of fingerprint-based access control solutions, has re-defined security for enterprise WiFi networks via its Bio-NetGuard(TM) WiFi Security Solution.
681077
The purpose of this article is to analyze a public exploit in a lab environment, see the alerts generated by an intrusion detection system, and then do some packet analysis of the malicious binary in order to better understand what it does and how you may have been compromised. Part 2 of 2.
687267
BEVERLY, Mass., Feb. 16  /PRNewswire/ -- If you are in charge of testing an IMS network, service or product, you have a lot to worry about.