STE WILLIAMS

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.

Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant. The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.

According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.

The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/stuxnet_hit_russia_claim/

Email delivery: Hate phishing emails? You’ll love DMARC

Security researchers have discovered new zero-day vulnerabilities in Internet Explorer that are already being harnessed by hackers to run a new type of drive-by attack.

FireEye, the security firm that discovered the attack method, said that the flaw is present in various versions of Internet Explorer 7, 8, 9 and 10, while running Windows XP or Windows 7.

“The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution,” FireEye explains. “It is one vulnerability being exploited in various different ways.”

The IE flaw is unpatched and separate from the TIFF image-handling zero-day vulnerability that surfaced late last month – which is also under active attack.

Malware slung via the latest exploit is designed to load directly into the memory of victimised Windows PC, bypassing the hard drive. The tactic makes it harder for antivirus software or similar security tools to detect and block the attack.

However, simply rebooting compromised machines would appear to remove them from the botnet, so what this new type of attack gains in stealth, it loses in persistence. FireEye posits that “the use of this non-persistent first stage may suggest that the attackers were confident that their intended targets would simply revisit the compromised website and be[come] re-infected”.

One of the sites spreading the exploit covers national and international security policy, according to FireEye. This, and other instances of the attack method, make it more than likely we are looking at some type of state-backed cyber-espionage campaign, it says.

The infrastructure used in the attack shares similarities with the earlier Operation DeputyDog assaults against targets in Japan and China, claims FireEye. The same hacking crew is suspected of involvement in a high profile hack against whitelisting firm Bit9.

If anything, the latest assaults are even more sophisticated.

“By utilising strategic web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive,” FireEye concludes. “APT actors are clearly learning and employing new tactics.”

FireEye has notified Microsoft about the vulnerability. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/ie_0day_menace/

Email delivery: Hate phishing emails? You’ll love DMARC

Security researchers have discovered new zero-day vulnerabilities in Internet Explorer that are already being harnessed by hackers to run a new type of drive-by attack.

FireEye, the security firm that discovered the attack method, said that the flaw is present in various versions of Internet Explorer 7, 8, 9 and 10, while running Windows XP or Windows 7.

“The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution,” FireEye explains. “It is one vulnerability being exploited in various different ways.”

The IE flaw is unpatched and separate from the TIFF image-handling zero-day vulnerability that surfaced late last month – which is also under active attack.

Malware slung via the latest exploit is designed to load directly into the memory of victimised Windows PC, bypassing the hard drive. The tactic makes it harder for antivirus software or similar security tools to detect and block the attack.

However, simply rebooting compromised machines would appear to remove them from the botnet, so what this new type of attack gains in stealth, it loses in persistence. FireEye posits that “the use of this non-persistent first stage may suggest that the attackers were confident that their intended targets would simply revisit the compromised website and be[come] re-infected”.

One of the sites spreading the exploit covers national and international security policy, according to FireEye. This, and other instances of the attack method, make it more than likely we are looking at some type of state-backed cyber-espionage campaign, it says.

The infrastructure used in the attack shares similarities with the earlier Operation DeputyDog assaults against targets in Japan and China, claims FireEye. The same hacking crew is suspected of involvement in a high profile hack against whitelisting firm Bit9.

If anything, the latest assaults are even more sophisticated.

“By utilising strategic web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive,” FireEye concludes. “APT actors are clearly learning and employing new tactics.”

FireEye has notified Microsoft about the vulnerability. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/ie_0day_menace/

Email delivery: Hate phishing emails? You’ll love DMARC

Security researchers have discovered new zero-day vulnerabilities in Internet Explorer that are already being harnessed by hackers to run a new type of drive-by attack.

FireEye, the security firm that discovered the attack method, said that the flaw is present in various versions of Internet Explorer 7, 8, 9 and 10, while running Windows XP or Windows 7.

“The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution,” FireEye explains. “It is one vulnerability being exploited in various different ways.”

The IE flaw is unpatched and separate from the TIFF image-handling zero-day vulnerability that surfaced late last month – which is also under active attack.

Malware slung via the latest exploit is designed to load directly into the memory of victimised Windows PC, bypassing the hard drive. The tactic makes it harder for antivirus software or similar security tools to detect and block the attack.

However, simply rebooting compromised machines would appear to remove them from the botnet, so what this new type of attack gains in stealth, it loses in persistence. FireEye posits that “the use of this non-persistent first stage may suggest that the attackers were confident that their intended targets would simply revisit the compromised website and be[come] re-infected”.

One of the sites spreading the exploit covers national and international security policy, according to FireEye. This, and other instances of the attack method, make it more than likely we are looking at some type of state-backed cyber-espionage campaign, it says.

The infrastructure used in the attack shares similarities with the earlier Operation DeputyDog assaults against targets in Japan and China, claims FireEye. The same hacking crew is suspected of involvement in a high profile hack against whitelisting firm Bit9.

If anything, the latest assaults are even more sophisticated.

“By utilising strategic web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive,” FireEye concludes. “APT actors are clearly learning and employing new tactics.”

FireEye has notified Microsoft about the vulnerability. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/ie_0day_menace/

Email delivery: Hate phishing emails? You’ll love DMARC

Security researchers have discovered new zero-day vulnerabilities in Internet Explorer that are already being harnessed by hackers to run a new type of drive-by attack.

FireEye, the security firm that discovered the attack method, said that the flaw is present in various versions of Internet Explorer 7, 8, 9 and 10, while running Windows XP or Windows 7.

“The exploit leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to achieve code execution,” FireEye explains. “It is one vulnerability being exploited in various different ways.”

The IE flaw is unpatched and separate from the TIFF image-handling zero-day vulnerability that surfaced late last month – which is also under active attack.

Malware slung via the latest exploit is designed to load directly into the memory of victimised Windows PC, bypassing the hard drive. The tactic makes it harder for antivirus software or similar security tools to detect and block the attack.

However, simply rebooting compromised machines would appear to remove them from the botnet, so what this new type of attack gains in stealth, it loses in persistence. FireEye posits that “the use of this non-persistent first stage may suggest that the attackers were confident that their intended targets would simply revisit the compromised website and be[come] re-infected”.

One of the sites spreading the exploit covers national and international security policy, according to FireEye. This, and other instances of the attack method, make it more than likely we are looking at some type of state-backed cyber-espionage campaign, it says.

The infrastructure used in the attack shares similarities with the earlier Operation DeputyDog assaults against targets in Japan and China, claims FireEye. The same hacking crew is suspected of involvement in a high profile hack against whitelisting firm Bit9.

If anything, the latest assaults are even more sophisticated.

“By utilising strategic web compromises along with in-memory payload delivery tactics and multiple nested methods of obfuscation, this campaign has proven to be exceptionally accomplished and elusive,” FireEye concludes. “APT actors are clearly learning and employing new tactics.”

FireEye has notified Microsoft about the vulnerability. ®

Email delivery: Hate phishing emails? You’ll love DMARC

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/11/11/ie_0day_menace/