Date: Sat, 3 Jul 2010 12:31:23 +0530
From: sysman01@mtnl.net.in
Subject: [CCCNews] CCCNews Newsletter - dated 2010 July 02
To: sysman01@mtnl.net.in
July 02, 2010
Editor - Rakesh Goyal (rakesh@sysman.in)
In today's Edition - (This is a news-letter and not a SPAM)
CONCERN : BlackBerry and Skype in trouble in India
TREND : Trojans Account for Half of New Malware
UNAWARE : Organisations in dark about advance cyber attacks
IT Term of the day
Quote of the day
* Direct Circulation in 4 Google groups (control-computer-crimes@googlegroups.com and IT-Sec-NSE@googlegroups.com) and 2 more groups
--
You received this message because you are subscribed to the Google Groups "control-computer-crimes" group.
To post to this group, send email to control-computer-crimes@googlegroups.com.
To unsubscribe from this group, send email to control-computer-crimes+unsubscribe@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/control-computer-crimes?hl=en.
--Forwarded Message Attachment--
IT and Related Security News Update from
Centre for Research and Prevention of Computer Crimes, India
Courtesy - Sysman Computers Private Limited, Mumbai (www.sysman.in)
July 02, 2010
Today�s edition ��
CONCERN : BlackBerry and Skype in trouble in India
TREND : Trojans Account for Half of New Malware
UNAWARE : Organisations in dark about advance cyber attacks NOVICES : Russian spy ring needed some serious IT help
(Click on heading above to jump to related item. Click on �Top� to be back here)
CONCERN : BlackBerry and Skype in trouble in India
BlackBerry has to pass security muster in 15 days
Joji Thomas Philip
ET Bureau
01 Jul 2010
NEW DELHI: Security concerns associated with the services of BlackBerry, the smartphone used by nearly a million customers in India, have come to the fore again, raising the possibility of a fresh standoff between the Canadian service provider and the government.
The government plans to give BlackBerry maker Research in Motion (RIM) 15 days to ensure that its email and other data services comply with �formats that can be read by security and intelligence agencies� after its spooks recently raised a red flag against the popular handset, said department of telecom (DoT) officials familiar with the matter.
Senior officials of key security agencies in a recent meeting argued that the continuation of BlackBerry services in the present format presents a danger to the country, said these persons who were part of the discussions. The meet was chaired by home secretary GK Pillai and attended by representatives of the home ministry, DoT, intelligence agencies and the National Technical Research Organisation (NTRO).
The government�s move is surprising because it had said in late 2008 that all security concerns associated with these devices have been resolved. The government had then, too, threatened to ban the Canadian company�s services in India.
The latest development indicates that security agencies are again finding it difficult to intercept or decipher messages sent through BlackBerry phones, which use codes with an encryption of 256 bits. This encryption code first scrambles the emails sent from a BlackBerry device and unscrambles it when the message reaches its target.
DoT officials said popular internet telephony firm Skype would also be given a 15-day deadline to ensure that calls carried by it to and from India are in formats that could be intercepted by law enforcement agencies here.
Security agencies here fear that internet-based telephony servies like Skype are being misused by terrorists to bypass monitoring systems linked to mobile phone services. The security meet also decided to ban or block BlackBerry and Skype services in India, if these companies failed to adhere to the 15-day timeline that ends in July, the persons said. ET has a copy of the minutes of this meet.
TREND : Trojans Account for Half of New Malware
Viruses also on the rise
By Lucian Constantin,
Security News Editor
July 1st, 2010
http://news.softpedia.com/news/Trojans-Account-for-Half-of-New-Malware-145941.shtml
According to a report released by Panda Security, computer trojans accounted for almost 52% of new malware created in the past three months. Meanwhile, the number of traditional virus samples received by the antivirus vendor during the last quarter has almost doubled.
Computer trojans remain the malware type most preferred by cybercriminals. This is no surprise, considering that threats like Zbot or Clampi, which were used to steal millions of dollars from users and companies in the past year alone, fall in this category. Additionally, most of today's spam is generated by trojan-infected computers, which are controlled en mass as botnets.
Panda reports that 51.78% of new malware samples it analyzed in the second quarter of 2010 were trojans. As far as distribution go, the number of infections with this type of malware accounted for 53,14% of the total registered during the same period.
The antivirus vendor points out that a spike in the number of traditional virus samples has also been recorded. Viruses �totaled just over 24.35%. Comparing this figure with the previous quarter (15.13%), it is clear that viruses continue to gain ground,� the Panda researchers say. However, this spectacular growth is not also reflected in the number of new infections, where viruses represent only 13,42% of the total.
When it comes to regional distribution, Taiwan was the most troubled country, with at least one infection present on over half of scanned computers. Russia also came close with a bit under 50%, while Turkey completes the top 3 with around 45%. Another interesting aspect is that first 15 countries on this list all registered rate of over 30%, meaning that one in three computers was infected.
Meanwhile, Brazil takes the lead in the top of most spamming countries, accounting for around 10% of all registered spam. India with a bit over 8% and Russia with around 6% follow. The United States is in the 5th position, being responsible for around 5% of the world's junk mail traffic during the last three months.
UNAWARE : Organisations in dark about advance cyber attacks
Warwick Ashford
30 June 2010
Many organisations are unaware they are being targeted by advanced cyber attacks and are failing to respond effectively, according to the Ponemon Institute.
Some 41% of more than 500 US organisations polled said they were unable to determine if they were being targeted by zero-day and other advanced cyber threats designed to evade countermeasures.
Most respondents (83%) said their organisations had been targeted recently by advanced attacks and 71% said such attacks have increased in the past year.
According to Ponemon, zero-day attacks are the most prevalent form of advanced threat, but there is an increase in the number of known attacks that are being re-engineered to extend their use.
Half of all advanced attacks target proprietary data, while 48% are aimed at personal information, including customer and employee records, respondents said.
But IT security professionals said they are finding it difficult to respond effectively and quickly enough to defend against these attacks.
Some 80% of security managers said it takes at least a day or longer to detect such attacks. Of these, 46% said it requires at least 30 days.
Ponemon said this delay is often the result of organisations not having the right technology or training despite having the appropriate policies and procedures in place.
More than half of respondents said they have sufficient policies and procedures, but only 26% said they have adequate skills in-house and only 32% said they have the necessary defence technology.
Ponemon found that 69% of respondents use anti-virus tools and 61% use an intrusion detection system, but 90% said exploits or malware have evaded these tools, or that they are not sure.
Only 19% said their IT leaders are fully aware of the challenge of, and requirements for, defending against advanced attacks.
NOVICES : Russian spy ring needed some serious IT help
A 27-word password is left on a piece of paper
By Tim Greene
June 30, 2010
Network World - The Russian ring charged this week with spying on the United States faced some of the common security problems that plague many companies -- misconfigured wireless networks, users writing passwords on slips of paper and laptop help desk issues that take months to resolve.
In addition, the alleged conspirators used a range of technologies to pass data among themselves and back to their handlers� in Moscow including PC-to-PC open wireless networking and digital steganography to hide messages and retrieve them from images on Web sites.
They also employed more traditional methods including invisible ink, Morse Code and ciphers, according to assertions made by federal agents in court papers seeking arrest warrants for the suspected spies.
One of the most glaring errors made by one of the spy defendants was leaving an imposing 27-character password written on a piece of paper that law enforcement officers found while searching a suspect's home. They used the password to crack open a treasure trove of more than 100 text files containing covert messages used to further the investigation.
"[T]he paper said "alt," "control" and set forth a string of 27 characters," the court documents say. "Using these 27 characters as a password, technicians have been able successfully to access a software program ("Steganography Program") stored on those copies of the Password-Protected Disks that were recovered�"
This sticky-note problem is common, says John Pironti, president of IP Architects, a security consulting firm. "Humans don't really do well remembering passwords beyond six characters, so they write them down someplace," he says. The real mistake was thinking that the home was secure enough to leave the password lying around.
Pironti says the use of steganography is also common, taking data and subtly inserting it into images so the changes aren't very noticeable to the naked eye. One notable aspect was that the steganography program used by the Russians is not commercially available, he says.
Without the program and without knowing what images might contain messages, it would have been nearly impossible to find the messages, Pironti says.
But a computer hard drive copied during one of the searches revealed a store of Web sites that agents visited and from which they downloaded images. Running the steganography program on some of those images revealed text files.
A Boston search yielded a hard drive that contained what investigators believe are drafts of messages to be embedded in images. The messages had been deleted, but investigators were able to recover them.
Some of the communications federal agents gathered indicate the spies weren't comfortable with the technology. One message shows a suspected spy trying to figure out how to embed a message in an image, and an audio recording inside one suspects home picked up a voice saying, "Can we attach two files containing messages or not? Let's say four pictures�"
The spy ring had numerous technical problems, including file transfers that hung and wouldn't go through and difficulty replacing laptops when necessary. In one case, an agent was so frustrated by laptop issues that she unwittingly turned it over to an undercover FBI agent.
In another case, replacing a laptop took more than two months. A suspect bought an Asus Eee PC 1005HA-P netbook, flew with it to Rome, picked up a passport in another name, flew on to Moscow and returned with it -- a process that took from January this year to March. Presumably Moscow headquarters configured the device.
When the courier spy delivered it to another suspect, he described what to do if the laptop had problems. "�if this doesn't work we can meet again in six months," one suspect was overheard saying to another, "they don't understand what we go through over here."
Pironti says spies try to use off-the-shelf hardware and software so they don't have to rely on their spymasters for replacements, and with the possible exception of the steganography application, this ring could have done that.
One of the technical issues the ring faced was described by one suspect in a message to Moscow reporting on a meeting between two spies "A" and "M": "Meeting with M went as planned � A passed to M laptop, two flash drives, and $9K in cash. From what M described, the problem with his equipment is due to his laptop "hanging"/"freezing" before completion of the normal program run."
"They must have been running [Windows] XP," Pironti says. "That's all netbooks were running at that time, and who hasn't found running custom stuff on XP to be challenging?"
A spy suspect in New York City used her laptop to communicate with a Russian government official via an ad-hoc, peer-to-peer wireless network on six occasions this year -- always on Wednesdays. She set herself up in a coffeeshop, a book store and other unspecified locations with her laptop. U.S. agents sniffed her wireless network and identified two devices -- the same two MAC addresses each time -- establishing connections that U.S. agents think were used to communicate, the court papers say.
Apparently she was having trouble making connections with the other laptop, and in frustration turned it over to a U.S. undercover agent for repairs.
At a meeting with that undercover agent, she indicated that she was having trouble setting up the wireless connection. "Everything is cool apart from connection," she says on a recording made of the meeting.
The U.S. undercover agent responds, "I am not the technical guy�I don't know how to fix it, but if you tell me, I can pass it up." He then offers to take the laptop to the consulate for repair, and points out that she could take it with her to Moscow when she goes and get it fixed there. "It would be more convenient if I gave you it," she responds.
That was last Saturday. The same day in Washington, a second undercover U.S. agent -- UC-2 -- met with another suspected Russian spy -- SEMENKO -- and discussed his experience with ad hoc wireless networking. "SEMENKO responded that he wanted UC-2 to "figure out" the problems with the communications via the private wireless network."
Earlier, in describing his reaction to a successful wireless transfer, SEMENKO said he was, "like � totally happy."
The spies also used radiograms to communicate -- with messages being sent over short-wave frequencies in cipher and then decoded using a key written by hand in a spiral notebook U.S. officials found during a search of a suspect's home.
Audio recordings in one spy suspect's home picked up his voice saying: "I am going to write in invisible," referring to a message he planned to send to Russian officials in South America.
New IT Term of the day
NIC bonding
Short for network interface card (NIC) bonding it is a term used to describe a way to increase available bandwidth. When bonded, two NICs appear to be the same physical device and they also have the same MAC address. Linux uses a special kernel module called bonding to allow users to bond multiple network interfaces into a single channel. NIC bonding may also be called NIC Teaming.
A great pleasure in life is doing what people say you cannot do.
Walter Bagehot
1826-1977
Note -
- As a member of this group, you get useful information to protect yourself and your IT assets and processes from various Computer and Related Crimes.
- If you think that your other friends/colleagues/acquaintances/relatives/foes/enemies also needs this information, forward the mail to them and request them to send their e-mail addresses and names to us with subject as "Subscribe".
- If you or someone has become victim of Computer Crimes or has any query on prevention, you are welcome to write to us.
- If you are not interested in it and would like to unsubscribe - send a reply mail with subject as "Unsubscribe".
- Disclaimer - We have taken due care to research and present these news-items to you. Though we've spent a great deal of time researching these matters, some details may be wrong. If you use any of these items, you are using at your risk and cost. You are required to verify and validate before any usage. Most of these need expert help / assistance to use / implement. For any error or loss or liability due to what-so-ever reason, CRPCC and/or Sysman Computers (P) Ltd. and/or any associated person / entity will not be responsible.
Make the world eco-friendly through MSN Green Drag n' drop
Posts
No comments:
Post a Comment