Information Security News
At a community college where I'm helping out whenever they panic on security issues, I recently was confronted with the odd reality of a lingering malware infection on their network, even though they had deployed a custom anti-virus (AV) pattern ("extra.dat") to eradicate the problem. Of course, these days, reliance on anti-virus is somewhat moot to begin with, our recent tally of fresh samples submitted to VirusTotal had AV lagging behind about 8 days or so. If you caught a keylogger spyware, 8 days is plenty to wreak havoc. I usually compare today's AV to the coroner in CSI, he can probably tell what killed you, but won't keep you alive.
But back to the college. Turns out they verify on a weekly basis if all the PCs have a current pattern, and they also verified that all their PCs got the "extra" pattern. The only problem was, their definition of "all" relied on the AV-tool itself. Obviously, if a PC doesn't have anti-virus installed, it won't show up on the anti-virus console. Hence, if your AV claims you have 100% compliance, you might want to check an alternate repository, like for example your Active Directory, to compare numbers. When I ran this test at the college, I found that their network/AD had 51 more workstations than their AV knew about. No wonder they still had frequent hits on the IDS for the backdoor traffic.
Never rely on a single security tool to tell you that everything is fine. Throw two or more sets of data against each other, and investigate discrepancies. Like your fishing or drinking or training buddy, security tools lie. Get acquainted with the usual pattern of lies (or obfuscated truths :), and surprises and disappointments will become less frequent.
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Yesterday, a poster to the full disclosure mailing list described a possible new 0-day vulnerability against Plesk. Contributing to the vulnerability is a very odd configuration choice to expose "/usr/bin" via a ScriptAlias, making executables inside the directory reachable via URLs.
The big question that hasn't been answered so far is how common this configuration choice is. Appaerently, some versions of Plesk on CentOS 5 are configured this way, but not necessarily exploitable. The exploit is pretty easy to spot. It sends a heavily URL encoded POST request with a "Googlebot" user agent. Google typically doesn't send POST requests, so they are pretty easy to spot. I found a couple POSTS from "Google" (actually a "random" Chinese IP address, 188.8.131.52 ) in our web logs here.
Masquearding as Google is a common trick among exploit scripts.
Please verify that your Apache configuration does NOT include this line:
ScriptAlias /phppath/ "/usr/bin/"
In a coordinated takedown with the FBI and financial institutions, Microsoft on Wednesday dealt a powerful blow to an online fraud syndicate that siphoned more than $500 million out of bank accounts all over the world.
The takedown, dubbed Operation b54, disrupted more than 1,400 botnets based on Citadel, a powerful piece of banking malware available for sale in underground forums. Citadel has been in existence since 2011 and is based on leaked source code from the Zeus banking trojan. Citadel provides criminals with most of what they need to engage in wide-spread banking fraud, including exploits for infecting end users, keyloggers for stealing those end users' bank passwords, and backend code for running the command and control servers that issue malware updates and receive login credentials from infected computers.
Microsoft used civil seizure orders issued by a federal judge in North Carolina to simultaneously cut off communications between 1,462 Citadel botnets and the infected computers that reported to them. The company also filed suit against a currently unknown operator under the name of Aquabox who is suspected to be connected with one or more of the botnets.
by Casey Johnston
The smartcards used to pay for public transportation in the Netherlands may now be hacked with an Android phone, according to a report from NOS.nl. The crack requires two free apps that allow the cracker to load the card with money and travel without paying anything.
NOS carries little detail on the nature of the hack, but Dutch hackers appear to have a somewhat long and storied history of cracking Netherlands’ smartcard, the OV-Chipkaart. The chip inside the card has been modified repeatedly by the card creator, Trans Link, but there is no shortage of tutorials on how to hack them, and there are plenty of stories about hacks that have taken place. There are also less technical Android apps to circumvent paying for transport, like OV Hacker, which plays the tone a Chipkaart would make when successfully scanned in order to trick bus drivers.
A research article from 2009 laid out how the RFID chip inside the card can be read with an NFC reader, decrypted with one application, and then reloaded with the desired amount by another application. The chip has been modified since then, but there’s at least one thread on the xda-developers forums where a user notes that his Android smartphone was able to read out the (encrypted) contents of his OV-Chipkaart with the NFC reader inside his phone.
Sausage Love: Ethical Lennox-Addington eMarketing India Rope Data Mining ...
I've been fielding traffic regarding some deeper sources for the #InfoSec curious irregulars visiting here. There are a lot of great sites, but I recommend both Cyber War News and illSecure for top quality 21st century electric Sausage. Also, Friday ...
'InJustice' Review: Lawsuit Abuse Exposed in Must-See Documentary
The new documentary examines the damage tort lawyers, particularly the so-called King of Torts Dickie Scruggs, have had on our culture. In short, they've seriously damaged the public's trust in our courts, bludgeoned the economy and sent thousands of ...
How much would a security breach cost your business? – infographic
Infosec breaches 2013 infographic View larger picture. Click to enlarge the infographic above. An in-depth study of the state of information security by the Department for Business, Innovation & Skills (BIS) has highlighted the scale of information ...