Archive

Archive for the ‘IT Security News’ Category

Windows 7 Professional Vs Windows 7 Enterprise

September 17, 2012 3 comments

The information in the slide above will definitely prove valuable to the choice of the windows OS to deploy in your Organisation. It highlights in details all aspects of both OS for Your consideration. Take time to go through the ten (10) page slide and you’ll simply fall in love with it.
Advertisements

Flame virus can hijack PCs by spoofing Windows Update | Microsoft – CNET News

June 8, 2012 1 comment

The infamous Flame virus can infect even secure PCs by tricking them into believing its malicious payload is actually an update from Microsoft.

As we already know, Flame has gained traction by tapping into security certificates for Microsoft’s Terminal Server. Though they appear to be digitally signed by Microsoft, the certificates are actually cooked up by the people behind Flame, thereby tricking PCs into accepting them as legitimate.

Microsoft and Symantec revealed yesterday that the virus can up the ante by using the fake certificates to spoof Microsoft’s own Windows Update service. As such, Windows PCs could receive an update that claims to be from Microsoft but is in fact a launcher for the malware.

Symantec described the method behind Flame’s madness: The virus, also known as Flamer, uses three applications to infect PCs — Snack, Munch, and Gadget. Collectively, this trio can trick PCs into redirecting Internet traffic to an infected computer with a fake Web server,. Once infected, a PC thinks the file that loads Flame is actually a Windows Update from Microsoft.

And as Symantec explained in its blog, spoofing Windows Update is not a trivial matter.

Hijacking Windows Update is not trivial because updates must be signed by Microsoft. However, Flamer bypasses this restriction by using a certificate that that chains to the Microsoft Root Authority and improperly allows code signing. So when a Windows Update request is received, the GADGET module through MUNCH provides a binary signed by a certificate that appears to belong to Microsoft.

The unsuspecting PC then downloads and executes the binary file, believing it to be a legitimate Windows Update file, Symantec added. The binary is not the Flame virus itself but a loader for Flame.

Microsoft also confirmed the risk to Windows Update, explaining that the vulnerability could be used to attack customers who weren’t the focus of the original Flame virus.

“In all cases, Windows Update can only be spoofed with an unauthorized certificate combined with a man-in-the-middle attack,” Microsoft said. The Flame virus itself has employed a man-in-the-middle attack to steal data, listen in on audio conversations, and take shots of screen activity.

Microsoft has already taken action by issuing a Security Advisory on how to block software signed by the unauthorized certificates, releasing an update to block the rogue certificates, and cutting off the ability of the Terminal Server Licensing Service to issue certificates that allow code to be signed.

To further protect its customers, the software giant is promising to harden its Windows Update service.

“We will begin this update following broad adoption of Security Advisory 2718704 in order not to interfere with that update’s worldwide deployment,” Microsoft said. “We will provide more information on the timing of the additional hardening to Windows Update in the near future.”

Some security experts have downplayed the danger of Flame, claiming it’s not as huge a threat as feared.

So far, the virus has targeted just the Middle East. But security vendor Kaspersky, which discovered the virus, is at the very least increasingly amazed by the complexity of it.

“As we continue our investigation of Flame, more and more details appear which indicate our initial statement: this is one of the most interesting and complex malicious programs we have ever seen,” Kaspersky said in a blog yesterday.

via Flame virus can hijack PCs by spoofing Windows Update | Microsoft – CNET News.

New App Grades Facebook Apps on Privacy


By Tony Bradley, PCWorld

When someone plays Zynga’s Words with Friends on Facebook they obviously expect to share that experience with whichever Facebook contact they play against. However, by authorizing Words with Friends–or other Facebook apps–users might be sharing much more than they’re aware of.

Facebook is a social network. By definition, the point of being on Facebook at all is to share with others. However, people like to choose which information to share, and who to share it with–they’re funny that way. Apps that collect or share information without the explicit consent of the user are shady, and infringe on the privacy users expect.

Some app developers do a much better job than others at protecting user privacy.Jim Brock, founder and CEO of PrivacyChoice, explains in a blog post, “Facebook doesn’t control or enforce app privacy practices, so it’s up to users to know the privacy risk

To help users help themselves PrivacyChoice has launched PrivacyScore–a privacy report card that grades Facebook apps on how well they respect the user’s privacy. PrivacyScore is a Facebook app as well. You simply type in the name of the app you want to check, and PrivacyScore will return a grade between 1 and 100. The PrivacyScore rating considers a variety of factors, including the privacy policies of the app vendor, and how the app handles personal data.

Don’t bother trying to get a grade on PrivacyScore itself. The PrivacyChoice started out indexing and rating the most popular apps, and does not have comprehensive coverage of all Facebook apps. Its FAQ claims that it is continuing to expand its app coverage.

via New App Grades Facebook Apps on Privacy | PCWorld Business Center.

Most IT, security pros see Anonymous as serious threat

April 30, 2012 Leave a comment

Anonymous Español: Anonymous

Anonymous Español: Anonymous (Photo credit: Wikipedia)

By Lucian Constantin

April 23, 2012 10:12 AM ET

IDG News Service – The majority of IT and security professionals believe that Anonymous and hacktivists are among the groups that are most likely to attack their organizations during the next six months, according to the results of a survey sponsored by security vendor Bit9.

Sixty-four percent of the nearly 2,000 IT professionals who participated in Bit9’s 2012 Cyber Security Survey believe that their companies will suffer a cyberattack during the next six months and sixty-one percent of them chose hacktivists as the likely attackers.

Respondents had the option to select up to three groups of attackers who they believe are most likely to target their organizations. The choices were Anonymous/hacktivists, cybercriminals, nation states, corporate competitors and disgruntled employees.

Anonymous was chosen by the largest number of IT professionals overall, but there were some differences based on the type of organization. For example, nation states was the top choice for people working in the government sector, while those working in retail selected cybercriminals as the top threat.

According to Verizon’s 2012 Data Breach Investigations Report, hacktivists stole the largest quantity of data in 2011, but they were responsible for only 3 percent of the total number of breaches.

Respondents choosing hacktivists as a more likely source of cyberattacks than cybercriminals is similar to how most people fear flying more than driving, even though, statistically speaking, it’s far more likely for someone to be involved in a car accident than in a plane crash, said Bit9 chief technology officer Harry Sverdlove.

The truth is that you are less likely to be attacked by Anonymous or hacktivists — depending on what public statements you make — than to be attacked by a cybercriminal enterprise or a nation state, he said.

Despite considering Anonymous the top threat, when selecting the method of attack they are most worried about, 45 percent of respondents chose malware, which is generally associated with cybercrime rather than hacktivism.

Distributed denial-of-service (DDoS) and SQL injection, two attack types most commonly favored by hacktivists, worried only 11 percent and 6 percent of respondents, respectively.

Sverdlove believes that the reason why most IT professionals fear attacks from Anonymous is the bad publicity such attacks generate. If you’re attacked by Anonymous the world is going to know because the announcement will be on Pastebin in 24 hours, whereas if you’re attacked by cybercriminals, people might never find out, he said.

Despite this, almost 95 percent of respondents feel that data breaches should be disclosed to customers and the public. Forty-eight percent believe that companies should disclose the breach occurrence as well as what was stolen, while an additional 29 percent believe that companies should also disclose how the breach occurred.

Next >>

Most IT, security pros see Anonymous as serious threat

April 30, 2012 1 comment

Over half of those surveyed, 54 percent, believe that the most important machines in their business environment are the infrastructure servers. Forty-eight percent selected file and database servers, 46 percent selected Web and application servers and 45 percent chose email servers. Multiple choices were allowed.

When asked on which business machines they believe their cybersecurity protections to be most effective, the surveyed IT professionals chose them in a similar order. Forty percent believe their cybersecurity is strongest on infrastructure servers and only 26 percent believe it’s strongest on endpoint machines.

Sverdlove thinks that respondents over-evaluated the strength of cybersecurity on their Web and database servers. As validated by a recent report from Hewlett-Packard, a lot of companies are far more vulnerable on their servers than IT professionals realize, he said.

HP’s 2011 Top Cyber Security Risks Report, which was published on Wednesday, said that 86 percent of Web applications used by businesses are vulnerable to some type of injection attack that can be exploited by hackers to access internal databases.

More than half of IT professionals who participated in Bit9’s survey believe that implementing best security practices and better security policies can have the biggest impact on the strength of an organization’s cybersecurity. Only 15 percent of respondents felt that better technology will have a better impact and only 6 percent favored government regulation over other actions

1 <<

Facebook hacker comes clean – Computerworld

April 26, 2012 5 comments

Glenn Mangham of York, England, said he meant no harm and hoped Facebook would let him off the hook

By Jeremy Kirk

April 26, 2012 12:00 PM ET1

What’s this?IDG News Service – The hacker who stole Facebook’s source code has gone public with a deeper explanation of how he penetrated the world’s most popular social network.

Glenn Mangham, of York, England, posted a lengthy writeup on his blog and a video, saying that he accepts full responsibility for his actions and that he did not think through the potential ramifications.

“Strictly speaking what I did broke the law because at the time and subsequently it was not authorized,” Mangham wrote. “I was working under the premise that sometimes it is better to seek forgiveness than to ask permission.”

Mangham implied he meant to contact Facebook once he had noticed the social-networking site had observed his intrusions, which he did little to hide. He didn’t use proxy servers because he said it made auditing take longer due to the time delay between each request made to a server. He was also hoping that even when he got caught, Facebook would let him off the hook.

That didn’t happen.

via Facebook hacker comes clean – Computerworld.

Anonymous Hacker Claims Credit For VMware ESX Code Leak

April 26, 2012 Leave a comment

Comparison of VMware Fusion and Parallels Desktop

Comparison of VMware Fusion and Parallels Desktop (Photo credit: Wikipedia)

By Kevin McLaughlin, CRN

April 24, 2012 7:17 PM ET VMware‘s ESX hypervisor source code leak may stem from an attack on a Chinese import-export firm last month in which an anonymous hacker claims to have made off with more than one terabyte of confidential documents.

On Tuesday, Kaspersky Lab‘s Threatpost blog reported the details of its recent IRC conversation with “Hardcore Charlie,” the anonymous hacker who posted the purported VMware ESX source code online on April 8.

Hardcore Charlie claims to have obtained the VMware ESX source code after breaching the corporate network of the China National Electronics Import-Export Corporation (CEIEC), a Beijing-based firm. He also broke into and stole documents from the networks of China North Industries Corporation (Norinco) WanBao Mining Ltd, Ivanho and PetroVietnam, according to the Threatpost report.

VMware could not be reached for comment.

In a security bulletin issued earlier on Tuesday, VMware warned that a single file from its ESX server hypervisor source code had been posted online and said it is possible that more proprietary files could be leaked.

The leaked ESX code is from the 2003 to 2004 period, and security experts told CRN the potential impact of the breach depends on how much VMware

via Anonymous Hacker Claims Credit For VMware ESX Code Leak.

%d bloggers like this: