Symantec eGuide: 2013 - Year of the Mega Breach, Fight Back with a Layered Defense: With attacks becoming more common, more serious and harder to detect, traditional antivirus software isn't enough. A layered defense approach is needed -- companies must use multiple tactics at the same time to maintain data security. This paper will discuss the kinds of attacks corporations face and how multilayered defenses can help.
- --SANS Boston 2014 | Boston, MA | July 28-August 2, 2014 11 courses. Bonus evening presentations include APT: It is Time to Act; Continuous Ownage: Why You Need Continuous Monitoring; and The Bot Inside the Machine.
The Russian government is offering a 3.9 million rubles (US $109,500) contract for a technology that can be used to identify Tor users. Tor was initially developed by the US Naval Research Laboratory and DARPA, but is now developed by The Tor Project, a non-profit organization. Tor is used by journalists and others who need to keep their identities hidden for their own safety; it is also used by criminals for the same purposes. The entrance fee for the competition is 195,000 rubles (US $5,500).
A federal court in New York has issued default judgments against 14 companies for selling phony antivirus products. The companies have been ordered to pay a total of US $5.1 million in fines. The schemes involved selling so-called antivirus products over the phone. Once the targets had paid for the fake product, they were told to install software that actually gave those running the scheme remote access to their computers.
According to a report from the US Department of Commerce's office of inspector general, satellite data were stolen from a National Oceanic and Atmospheric Administration (NOAA) contractor's personal computer last year, but there has not been an investigation because the employee refused to allow NOAA to conduct a forensic investigation on the laptop. The report also noted other "significant security deficiencies" at NOAA, including unauthorized use of smartphones and thumb drives on sensitive systems.
[Editor's Note (Pescatore): This report reads like a "How to *Not* Implement the Critical Security Controls" tutorial - the deficiencies are pretty much the security 101 controls focused on by the Critical Controls. However, the systems looked at are legacy applications that have been in use for more than a decade and poorly managed/maintained - sprinkling security on top of that doesn't work and it sure wasn't built in. The report also points out that the assessments done to give Authority to Operate were very lightweight.
(Murray): "Finding significant security issues" is what auditors do. "Inspectors general" publish theirs in the newspaper. These reports have become so routine and generic as to be interchangeable. Even the examples happened in your enterprise too.
Attackers have discovered a way to use Amazon cloud services to launch distributed denial-of-service (DDoS) attacks on other websites by exploiting flaws in Elasticsearch, an open-source analytics application.
Siemens has released security updates for two SIMATIC builds to address five vulnerabilities, four of which can be exploited remotely. The flaws could be exploited to gain elevated privileges and access data without authorization.
Diagnostic services built into Apple's iOS mobile operating system could be used to access personal data in iPhones. The services, which Apple says are designed for engineers, are not documented. Apple says that the feature was not designed to let the NSA access data in the devices.
[Editor's Note (Murray): If an attacker has physical control of your device for a sufficient time, it will leak. Tools provided for a benign purpose can be misused. Poor or incomplete documentation will embarrass you. However, in the light of the leaked NSA boast, this goes beyond merely embarrassing. Still one should not attribute to malice that which can be explained by stupidity.
As governments have moved to cloud services, they have saved money and improved efficiency, but the technology holds some challenges to forensic investigations. A draft report from the National Institute of Standards and Technology (NIST) describes 65 "challenges" forensic investigators encounter when dealing with cloud computing. The report classifies the challenges into nine categories, including data collection, analysis, and architecture. One example of a challenge is email. On non-cloud systems, deleted email messages can often be recovered because they are not truly deleted until they are over-written. Because of the shared nature of the cloud, deleted files are more likely to be overwritten.
The Cyber Warfare Lexicon, published by the US Strategic Command in 2009, defines terms normally used to describe physical combat in ways that make sense in the context of cyber warfare. The document was recently obtained by research group Public Intelligence.
Australian daily bargain website Catch of the Day recently revealed that it suffered a security breach in 2011. The incident compromised user passwords and payment card data. While the breach was reported to police, banks, and credit card issuers shortly after it occurred, the company delayed informing the Australian Privacy Commissioner. Customers with accounts created before May 7, 2011 are now being advised to change their passwords.