STE WILLIAMS

The business case for a multi-tenant, cloud-based Recovery-as-a-Service solution

A Slovenian virus writer who created an infamous strain of malware used to infect an estimated 12 million computers worldwide has been jailed for almost five years.

Matjaž Škorjanc (who operated under the handle Iserdo) was sentenced by a Slovenian court for writing the code used to create the infamous Mariposa botnet.

The virus writer, 27, was arrested in 2010 following a two-year-long investigation by the FBI as well as Spanish and Slovenian police. He had been a student of medicine and, later, computing.

He was sentenced in late December for offences related to the creation of Rimecud, a malware starter pack that spreads by copying itself to removable storage devices, instant messaging and P2P file-sharing systems. Once infected, compromised computers became part of an information-stealing botnet which hoovered up passwords and credit card details from victims.

Škorjanc’s code was sold through underground forums to other cyber-criminals, including a trio of chancers in Spain who proved especially adept at spreading the malware. Their actions earned the whole malware outbreak a Spanish name – Mariposa being Spanish for “butterfly” – even though it spread worldwide.

The network of compromised PCs established using the Mariposa code was taken down back in 2009.

A regional court in the Slovenian city of Maribor convicted Škorjanc of malware creation and money laundering, jailing him for 58 months (four years and 10 months) in total. In addition, he was fined €3,000 and had his apartment and car, which were judged as being bought with the proceeds of crime, confiscated. Prosecutors claim that Škorjanc earned up to €114,000 from his crimes, while estimating the damage caused by Mariposa to run into tens of millions of euros.

Škorjanc’s ex-girlfriend, Nuša Čoh, also received a punishment of eight months’ probation for-money laundering as part of the same prosecution.

Škorjanc plans to appeal against his conviction. ®

2014 predictions: Top technology trends

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/03/mariposa_botnet_mastermind_jailed/

FireEye today announced today that it has purchased privately held incident response (IR) and endpoint security firm Mandiant in a $1 billion deal consisting of 90 percent in stock and 10 percent in cash transactions.

The two firms already had close ties. In April 2012, they said they would integrate FireEye’s network detection with Mandiant’s host-based detection features to offer more comprehensive protection against advanced attacks. The goal was to correlate FireEye’s malware analysis with Mandiant’s endpoint view for a more complete picture of an attack, the companies said at the time.

The acquisition created quite a buzz around the industry today, with two leading-edge and widely respected security firms now under one roof. Mandiant will become a global services and cloud solutions arm of FireEye, offering security consulting, incident response, and managed services. Its endpoint threat detection and response line will be incorporated into FireEye’s new Oculus continuous monitoring platform.

Kevin Mandia, founder and CEO of Mandiant, was named senior vice president and chief operating officer of FireEye. “This is an exciting day,” Mandiant said in an investor call about the acquisition. “What I’ve learned … is that every customer wants host-based protection and a network-based product. We want to bridge these so when there’s a network alert” it’s handled quickly at the affected endpoints, he said. “People have been asking us for this for years, and we’re going to provide it.”

David DeWalt, chairman of the board and chief executive officer of FireEye, called Mandiant the “gold standard” in security. “They often get the first call when a serious breach occurs in an organization,” he said. “Strategically, Mandiant brings us closer to the breach when it occurs.”

DeWalt said the acquisition of Mandiant, which made $100 million in revenue last year, fits with the company’s stated strategy during its IPO tour last year. He said the addition of Mandiant’s family of products allows the company to leverage the endpoint management framework for its virtual machine (VM)-based technology in its Multi-Vector Virtual Execution engine, which supports real-time threat protection for Web, email, data center, and mobile and is used by some 1,500 customers in the government and private sector.

One of the first fruits of the acquisition: a VM-based next-generation intrusion prevention system (IPS) that will roll out in the first quarter of this year, DeWalt said. “There are other products in our pipeline that we are not announcing today” as well, he said.

Mandiant’s around 500 employees bring the FireEye employee count to around 2,000, he said, spanning more than 40 countries. Mandiant traditionally has had a tiny international presence, with less than 5 percent of its sales outside the U.S., so the acquisition will give the firm global exposure. “We will deliver a full array of services in vulnerability assessment, incident response management, and continuous monitoring,” DeWalt said.

Mandiant became more of a household name early last year when it published a detailed report exposing APT-1, a Chinese cyberespionage unit associated with the Chinese military. The firm’s report on APT-1 said the unit had been behind targeted attacks on hundreds of companies across 20 major industries, mainly in English-speaking countries.

“We have been on the frontlines of the cyberbattle field. Who are you gonna call? Mandiant owns that space, and it’s an important space to own,” Mandia said of his 9-year-old company. “We started building footprints of an attacker … FireEye’s virtual detection is the best detection” of advanced malware, he said.

“It was a natural fit with our responding and containing” of the threat strategy, said Mandia, who noted that Mandiant has worked with 33 percent of the Fortune 100, and its 500 customers represent 13 different industry sectors. About half of its sales come from endpoint products and subscriptions, he said, and the other half from incident response engagements.

Mandiant competitor Access Data says the acquisition demonstrates how IR and forensics are becoming “hot.” Craig Carpenter, senior vice president of strategy for AccessData, says forensics and IR are now part and parcel of cybersecurity. “The reason for this deal is that we now live in a world of constant compromise. When you know you will be compromised, you can’t just continue trying to keep the bad guys out — you also need to investigate every compromise, figure out what happened, prevent it from ever happening again, and clean up the mess,” he says.

But Carpenter says Mandiant’s approach to IR “only makes sense if a customer will only get compromised once” — which is obviously not the case for virtually anyone — “or where the compromise is a bespoke event that must be dealt with as a one-off.”

And “for every other compromise, companies need and want to be able to handle things in-house as much as possible,” Carpenter says.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/attacks-breaches/fireeye-buys-mandiant-in-1-billion-deal/240165101

Snapchat, a mobile photo-messaging app created for wiping out traces of the messages for privacy reasons, this week was hit with a major breach of its users’ privacy that exposed names and phone numbers of some 4.6 million of its customers. The data dump came after security researchers published a proof-of-concept for a weakness associated with the “Find Friends” feature.

The app provider late today announced that it would update Snapchat to better protect its users. “We will be releasing an updated version of the Snapchat application that will allow Snapchatters to opt out of appearing in Find Friends after they have verified their phone number. We’re also improving rate limiting and other restrictions to address future attempts to abuse our service,” Snapchat said in a blog post.

Snapchat also said researchers could email the firm at [email protected] for any vulnerability discoveries. “We want to make sure that security experts can get ahold of us when they discover new ways to abuse our service so that we can respond quickly to address those concerns. The best way to let us know about security vulnerabilities is by emailing us: [email protected],” Snapchat said.

The blog post came in response to criticism by the researchers who first reported and then published details on the flaw in Snapchat’s app after saying they had not gotten a response from Snapchat. A hacker group yesterday exploited the flaw and posted online to a site called SnapchatDB the names and phone numbers, with the final two digits obscured, on some 2.6 million Snapchat users.

“As much as we were hoping it wouldn’t be exploited, we did expect at least something to come of it. We don’t condone the SnapchatDB leak, and feel that it’s a pretty reckless way to get across the point to Snapchat,” researchers at Gibson Security told Dark Reading in an email interview. ”

The researchers say they tried to contact Snapchat in August electronically before their original post about the flaw. On December 27, Snapchat posted a blog basically dismissing the vulnerabilities. “This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers,” Snapchat said in that post. “Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse.”

Find Friends basically lets users upload their contacts list to Snapchat so that Snapchat can display the accounts of users that match those phone numbers.

Gibson Security said Snapchat’s director of operations contacted them via email, but that they hadn’t heard anything since then as of this morning.

The breach of user information is another example of the risks associated with many mobile apps today, security experts say. “In a rush for growth, companies often put security on the back burner. Snapchat here is no exception. What we see here is a classic example of how the intersection of social media, mobile platforms, and cloud create new entry doors for the hackers to exploit. Today’s rapid moving parts and the plethora of connections make it all too easy for the attackers,” says Bala Venkat, CMO at Cenzic.

Kevin O’Brien, director of product marketing at CloudLock, says this low bar of entry into the mobile app space basically complicates security. The Snapchat customer data dump has damage potential to the users, he says.

“Spoofed phone calls” are one potential abuse, he says, as well as criminals using the phone numbers and geographic information and usernames for identity theft or to escalate victims’ user privileges elsewhere. “PII [personally identifiable information] is valuable. It allows you to get closer to the target,” O’Brien says.

Gibson Security, meanwhile, suggests users delete their Snapchat accounts or contact their mobile phone network provider to change their phone numbers if they are especially concerned those numbers could be fully discerned by prospective attackers. “They should definitely ensure their security and privacy settings are up to date and well adjusted in all their social media accounts. Users should perform due diligence when registering for new social media accounts – if a site doesn’t deserve (or shouldn’t have) your phone number, don’t give it to them,” the researchers say.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/attacks-breaches/snapchat-to-update-app-in-wake-of-breach/240165103

Disaster recovery protection level self-assessment

Entities claiming to represent the Syrian Electronic Army (SEA) have hacked Skype’s social media presences and used them to post anti-Microsoft messages.

Here’s one of the defacements, from Skype’s Twitter account.

Hi! Microsoft here. Don’t use our stuff. Really. Take our word for it.

Skype’s blog was also accessed and quickly became host to posts calling for Skype to stop allowing the NSA to access its back end, as has recently been alleged Edward Snowden.

The fun lasted a few hours before Skype wrestled control of its social media properties back from the alleged SEA members. The VoIP service has since posted the following all-clear to Twitter.

You may have noticed our social media properties were targeted today. No user info was compromised. We’re sorry for the inconvenience.

— Skype (@Skype) January 2, 2014

That the Skype blog was accessed makes the incident considerably embarrassing to Skype and therefore to Microsoft, as it shows neither is drinking strong password kool-aid. With Skype being baked into all manner of Redmondware, questions about just how it was possible for the company blog to be accessed may well be worth asking before adopting the service in-house. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/02/skype_social_media_hacked_to_spread_antimicrosoft_messages/

Disaster recovery protection level self-assessment

Entities claiming to represent the Syrian Electronic Army (SEA) have hacked Skype’s social media presences and used them to post anti-Microsoft messages.

Here’s one of the defacements, from Skype’s Twitter account.

Hi! Microsoft here. Don’t use our stuff. Really. Take our word for it.

Skype’s blog was also accessed and quickly became host to posts calling for Skype to stop allowing the NSA to access its back end, as has recently been alleged Edward Snowden.

The fun lasted a few hours before Skype wrestled control of its social media properties back from the alleged SEA members. The VoIP service has since posted the following all-clear to Twitter.

You may have noticed our social media properties were targeted today. No user info was compromised. We’re sorry for the inconvenience.

— Skype (@Skype) January 2, 2014

That the Skype blog was accessed makes the incident considerably embarrassing to Skype and therefore to Microsoft, as it shows neither is drinking strong password kool-aid. With Skype being baked into all manner of Redmondware, questions about just how it was possible for the company blog to be accessed may well be worth asking before adopting the service in-house. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/02/skype_social_media_hacked_to_spread_antimicrosoft_messages/

Disaster recovery protection level self-assessment

Miscreants have brewed up a variant of the infamous CryptoLocker ransomware that uses worm-like features to spread across removable drives.

The recently discovered CRILOCK-A variant can spread more easily than previous forms of CryptoLocker. The latest nasty is also notable because it comes under previously unseen guises – such as fake Adobe Photoshop and Microsoft Office software activators that have been seeded on P2P sites, a security blog post from Trend Micro warns.

Analysis of the malware, detected as WORM_CRILOCK.A, shows that this malware can spread via removable drives. This update is considered significant because this routine was unheard of in other CRILOCK variants. The addition of propagation routines means that the malware can easily spread, unlike other known CRILOCK variants.

Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware — often UPATRE — to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages.

CryptoLocker, the Bitcoin demanding ransomware menace, has infected as many as a quarter of a million machines since it first surfaced last September, according to research from Dell SecureWorks’ Counter Threat Unit.

Earlier versions of CryptoLocker typically arrived in email as an executable file disguised as a PDF, packed into a .zip attachment. A spam run targeting millions of UK consumers prompted a warning from the UK National Crime Agency back in November. Only Windows machines can be infected by the malware.

If it successfully executes, CryptoLocker encrypts the contents of a hard drive and any connected LAN drives before demanding payment of up to 2 Bitcoins (payable within 72 hours) for a private key needed to decrypt the data. The malware uses a well-designed combination of 256-bit AES and 2048-bit RSA crypto that mean that without backups victims have little choice but to pay up if they ever want to see their data again.

It’s unclear whether the latest worm-like variant is a copycat or the work of the regional CryptoLocker crew. The latest variant uses hardcoded command and control nodes and omits the use of domain generation algorithm (DGA) routines to create multiple potential command points, a more sophisticated feature common in earlier variants.

“Hardcoding the URLs makes it easier to detect and block the related malicious URLs,” explain Trend Micro researchers Mark Manahan and Jimelle Monteser. “DGA, on the other hand, may allow cybercriminals to evade detection as it uses a large number of potential domains. This could mean that the malware is still in the process of being refined and improved upon. Thus, we can expect latter variants to have the DGA capability.”

Trend Micro’s blog entry, Defending Against CryptoLocker, outlines various ways of protecting a computer and a network against CryptoLocker malware. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/02/cryptolocker_worm/

Disaster recovery protection level self-assessment

Miscreants have brewed up a variant of the infamous CryptoLocker ransomware that uses worm-like features to spread across removable drives.

The recently discovered CRILOCK-A variant can spread more easily than previous forms of CryptoLocker. The latest nasty is also notable because it comes under previously unseen guises – such as fake Adobe Photoshop and Microsoft Office software activators that have been seeded on P2P sites, a security blog post from Trend Micro warns.

Analysis of the malware, detected as WORM_CRILOCK.A, shows that this malware can spread via removable drives. This update is considered significant because this routine was unheard of in other CRILOCK variants. The addition of propagation routines means that the malware can easily spread, unlike other known CRILOCK variants.

Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware — often UPATRE — to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages.

CryptoLocker, the Bitcoin demanding ransomware menace, has infected as many as a quarter of a million machines since it first surfaced last September, according to research from Dell SecureWorks’ Counter Threat Unit.

Earlier versions of CryptoLocker typically arrived in email as an executable file disguised as a PDF, packed into a .zip attachment. A spam run targeting millions of UK consumers prompted a warning from the UK National Crime Agency back in November. Only Windows machines can be infected by the malware.

If it successfully executes, CryptoLocker encrypts the contents of a hard drive and any connected LAN drives before demanding payment of up to 2 Bitcoins (payable within 72 hours) for a private key needed to decrypt the data. The malware uses a well-designed combination of 256-bit AES and 2048-bit RSA crypto that mean that without backups victims have little choice but to pay up if they ever want to see their data again.

It’s unclear whether the latest worm-like variant is a copycat or the work of the regional CryptoLocker crew. The latest variant uses hardcoded command and control nodes and omits the use of domain generation algorithm (DGA) routines to create multiple potential command points, a more sophisticated feature common in earlier variants.

“Hardcoding the URLs makes it easier to detect and block the related malicious URLs,” explain Trend Micro researchers Mark Manahan and Jimelle Monteser. “DGA, on the other hand, may allow cybercriminals to evade detection as it uses a large number of potential domains. This could mean that the malware is still in the process of being refined and improved upon. Thus, we can expect latter variants to have the DGA capability.”

Trend Micro’s blog entry, Defending Against CryptoLocker, outlines various ways of protecting a computer and a network against CryptoLocker malware. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/02/cryptolocker_worm/

Disaster recovery protection level self-assessment

Hackers claim to have lifted millions of Snapchat usernames and phone numbers, apparently taking advantage of a vulnerability that the messaging service last week dismissed as mostly theoretical.

A partially redacted database of 4.6 million usernames and phone numbers (minus two digits) – purportedly of Snapchat users – have been released by the miscreants through a site called SnapchatDB.

The Snapchat app is designed to allow users to send photos that are only supposed to be viewable for a few seconds before they are automatically deleted. A flaw in a feature of the photosharing app, originally designed to allow users to locate their friends on Snapchat through their name and phone number, emerged last week.

As previously reported, Australian security outfit Gibson Security explained how to access any phone number and username from the smartphone photo-sharing service to underline its concerns.

There was no limit on how many lookups someone could carry out each minute, a shortcoming that made it possible to do a brute force attack. In response, Snapchat put out an advisory dismissing the lack of rate-limiting as no great concern:

Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse.

Describing a vulnerability as “theoretical” is the net security equivalent of waving a red flag at a bull. Sure enough, hackers picked up the implied challenge to prove Snapchat wrong. The “additional counter-measures” and “safeguards” came too late to prevent third-party hackers from lifting the usernames and number of millions of users of the smartphone app. Snapchat has yet to confirm the leak, but the contents of the database look authentic, so caution is advised.

Gibson Security only went public with its discovery last week months after it discovered the problem in August 2013 after growing increasingly frustrated by Snapchat’s perceived lack of action on the security hole. The third-party hackers behind the breach are offering to share full details of the leak under unspecified conditions:

This database contains username and phone number pairs of a vast majority of the Snapchat users. This information was acquired through the recently patched Snapchat exploit and is being shared with the public to raise awareness on the issue. The company was too reluctant at patching the exploit until they knew it was too late and companies that we trust with our information should be more careful when dealing with it. For now, we have censored the last two digits of the phone numbers in order to minimize spam and abuse. Feel free to contact us to ask for the uncensored database. Under certain circumstances, we may agree to release it.

Commentary on the security implications of the incident can be found in blog posts by Graham Cluley (here) and Paul Ducklin on the Sophos Naked Security blog here. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/02/snapchat_leak/

Ever since Barnaby Jack leapt on stage at Blackhat USA and had ATMs spew money like it was going out of style, hackers around the globe have been busy trying to replicate the research before the banks and ATM vendors get the vulnerabilities fixed. You’d have thought that, after three and a half years, both the vendors and banks would have fixed the bugs and dealt with the physical attack vectors long ago. Unfortunately, that doesn’t seem to be the case.

A pair of security researchers speaking in Hamburg at last week’s Chaos Communication Congress provided new insight and demonstrated some USB-based malware that had been crafted by criminals and used earlier in the year to siphon money from several unpatched ATM’s. The original malware authors had taken steps to remove many of the installation traces that forensic investigators would have found useful, so the researchers had to piece together many parts of a complex puzzle.

While it hasn’t been disclosed which type of ATM were targeted (nor which bank was affected), it seems that the criminals had uncovered physical flaws in the bank’s ATM devices that allowed them to cut access holes through which they could slip in their infector USB device. Once the USB device was in place, the ATM’s could be rebooted and the malware automatically installed.

I’d have thought that with all the hoopla that followed Blackhat in 2010 and the personal visits that Barnaby Jack (and IOActive – the consulting company he worked for at the time) made to the ATM manufacturers and high-street banking organizations at the time, that everyone would have at least disabled the “boot from USB” functionality. Apparently this particular bank hadn’t acted on the memo.

The ATM malware appears to have had a number of interesting features designed to protect it from both investigators and fellow criminals or mules. After supplying a 12-digit magic number to bring up a built-in menu, the money mules were provided direct manual access to the machines money-dispensing functions. However, before money could be extracted, a second code was required… a challenge-response code… most likely added to prevent mules from operating independently of the malware authors.

Given the relative sophistication of the malware and the efforts involved in protecting it from both bank investigators and other criminals, I wouldn’t be surprised to learn that the malware is already in use by other organized crime gangs around the world. It would be a rare occurrence for any bank targeted by this malware to openly disclose they were a victim – as it’s not good for business and customer confidence.

While the attack vector – booting from an infected USB stick – will have many security veterans rolling their eyes in disbelief that the targeted bank hadn’t already mitigated the threat, I’ve heard several people argue that writing code (malicious or otherwise) for ATMs is difficult. Unfortunately it’s simpler than most realize. Anyone with an understanding of CEN/XFS, or the time to peruse the online manuals, will quickly master the fundamentals.

This USB infector process is the low hanging fruit for criminals targeting ATM machines. Banks that haven’t already mitigated the attack vector are, for want of a better word, “negligent”. There can be no excuses for not disabling the “boot from USB” functionality – especially now with the public disclosure of criminal abuse.

— Gunter Ollmann, CTO, IOActive Inc.

Article source: http://www.darkreading.com/attacks-breaches/sticking-it-to-the-atm/240165074

Tags: 2013, Adobe, Android, APK, backup, chet chat, cryptolocker, Cupid Media, data breach, EC-DRBG, elliptic curve, nist, one time pad, openssl, password hints, PRISM, randomness, ransomware, review, Snowden, sophos security chet chat, sscc, target, two time pad, unhashed passwords, vulnerability, WhatsApp, XP, Zero Day, ZIP exploit

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sR7dhz4GoEo/