STE WILLIAMS

Last week, one of the partners in my firm (Bishop Fox) said something that rang true: “If you want to be a real penetration tester, you have to live it.”

In a similar vein, Paul Graham says, “To do something well, you have to love it. So to the extent you can preserve hacking as something you love, you’re likely to do it well. Try to keep the sense of wonder you had about programming at age 14. If you’re worried that your current job is rotting your brain, it probably is.”

A real hacker doesn’t see what he does as just a job or as just a hobby — he sees it as a lifestyle. No border exists between work and play, the line between the two made indistinguishable by countless cans of late-night Red Bull.

We’ve talked about how some pen testers will use checklists and methodologies when performing scans or doing their testing. These can be useful, but a real pen tester sees them as a baseline against which they begin to explore, like a jazz musician improvising a new and better tune. This experimentation allows a hacker to gain more knowledge and experience than any textbook can provide. In fact, this is where the argument arises about the overlearned not having the right, open mindset needed to pen test. Too much structure can inhibit the dynamic nature of true penetration testing. Having all of the knowledge in the world matters only if you also know how to apply it. Reading may get you far, but there’s no better teacher than real-world experience.

In his piece on “Great Hackers,” Paul Graham says, “I know a handful of super-hackers … Their defining quality is probably that they really love to program. Ordinary programmers write code to pay the bills. Great hackers think of it as something they do for fun, and which they’re delighted to find people will pay them for.” Now, Graham uses the term “hacker” to describe individuals with a passion for working on code, etc., but his observation rings true for penetration testers as well.

What sets real penetration testers apart is their motivation and willingness to lose themselves in something they love. Not just in hacking, but this applies to expertise in other fields, as well. From video games to photography, martial arts to musical instruments — it’s the ability to throw yourself into something entirely, no matter for work or play, which will take you to the next level.

When your girlfriend teases you that you’ve been ignoring her calls and texts for the past day, when you look out your window and realize the sun is coming up and you’ve hacked all night, when you suddenly remember you haven’t eaten yet, or you let the pizza burn in the oven because you’re finally hitting your stride in exploits — that’s when you know passion has taken over.

That it’s no longer what you do, but who you are.

Article source: http://www.darkreading.com/vulnerability/pen-testing-making-passion-a-priority/240162029

Popular fiction usually dictates that the primary cyberfoe of big business is a young, nerdish, and exceedingly smart computer hacker with a grudge against practically anyone and everyone. It may be this particular cliched (and false) stereotype of a hacker that many business analysts and executives have, in turn, used as justification for testing the defenses of their organizations in a particular way. While some may supplement this image of a hacker with concrete bunkers filled with uniformed cyberwarriors if they feel worthy of state-initiated attacks, it is a sad fact that many of the methodologies currently employed by organizations to evaluate their tiered defenses are tired and dated.

The reality of the situation is that organizations are much more likely to be breached through fairly average malware than through the deliberate and chained exploitation of system vulnerabilities. That’s not to say “classic” hacking isn’t a problem, but the scale of the threat today is like battling mosquitoes while ignoring the lion gnawing at your arm.

Modern penetration-testing methodologies continue to follow a very predictable pattern,and practically every assessment I’ve ever been involved in or have overseen during the past decade has yielded vulnerabilities that were critical in nature. While these vulnerabilities are flagged for remediation and are often fixed within days of identification, the organization is still left to battle a barrage of social-engineering attacks designed to install malware on victim devices and to serve as jump points into other sectors of the business.

In recent years, organizations have increased the number and sophistication of the defensive layers they use to battle malware-based intrusion. In general, these defenses have improved the security stature of those organizations that make the investment. However, the increased need for roaming user support, BYOD, encrypted communications, and third-party app markets has, in turn, exposed those same organizations to new kinds of attack vectors for which they have little appreciation of the dynamics of the threat or the ability to quantify the status of their recently deployed anti-malware defenses.

It has become necessary for penetration-testing methodologies to better reflect the true nature of the threat and to replicate the methods used by an attacker. In particular, penetration testers need to now incorporate malware and malware-specific delivery techniques into their testing routines.

As trivial as it may seem, including malware into a penetration test or security assessment is not a simple task. The variety of delivery vectors and the effort needed to stage an attack is something few penetration testers have had to involve themselves with in the past. There’s also the complexity of crafting malware-based payloads that not only report back their successes, but also provide for rapid cleanup after an engagement is over.

That said, it would be remiss of security consultants or ethical hackers to not test the robustness and capability of their clients’ networks to counter malware-based threat vectors. The choice to not employ malware for lateral movement and compromise within a client’s network may be a reflection of inadequate scoping or a poor understanding of the modern threat spectrum.

Regardless, the onus is on security consultants to duplicate the means and capability of a modern hacker — and, by foregoing malware, they are playing to outdated threats and past stereotypes.

— Gunter Ollmann, CTO, IOActive Inc.

Article source: http://www.darkreading.com/attacks-breaches/penetration-testing-with-honest-to-goodn/240162078

Even as security pros get better at tracing attacks, proper attribution in the world of cyberwar remains a tricky business.

So while a new report (PDF) from FireEye outlines how certain tactics can serve as fingerprints that tie individual targeted attacks to others from a given region of the world, it does so with a huge caveat: False flag operations are commonplace.

“I would wager my paycheck that they occur every day,” says Kenneth Geers, senior global threat analyst with FireEye. “A hacker never wants to be a zebra within a herd of horses. He or she would be wise to route their attack through a nation that is the most obvious guilty party. This leads to tunnel vision on the part of the victim.”

For this reason, a mix of both technical and nontechnical information must be used to identify the source of an attack.

“At the nation-state level, computer forensics, reverse-engineering, and log-file analysis are only one part of cyberattack attribution,” Geers says. “Governments have human and signals intelligence, ‘hack backs,’ law enforcement, diplomacy, economic pressure, political incentives, and much more. It is easy to forget how big the national toolbox really is.”

But attackers are also working from a metaphorical toolbox as well, and there are some common items inside it. This collection of tools, tactics, and procedures can tie together seemingly disparate attacks in ways that help nation-states determine who is behind an attack. For example, Russian cybercriminals typically include a heavier reliance on human intelligence sources, as well as command-and-control that uses custom embedded encoding.

“TTP [tools, tactics, and procedures] often includes the delivery of weaponized email attachments, though Russian cybercriminals appear to be adept at changing their attack patterns, exploits, and data exfiltration methods to evade detection,” according to the report. “In fact, one telltale aspect of Russian hackers seems to be that, unlike the Chinese, they go to extraordinary lengths to hide their identities and objectives. FireEye analysts have even seen examples in which they have run ‘false-flag’ cyber operations, designing their attack to appear as if it came from Asia.”

The Chinese malware that FireEye researchers have analyzed is not always the most advanced or created, but in many circumstances it is very effective, the report notes.

“China employs brute-force attacks that are often the most inexpensive way to accomplish its objectives,” according to FireEye. “The attacks succeed due to the sheer volume of attacks, the prevalence and persistence of vulnerabilities in modern networks, and a seeming indifference on the part of the cybercriminals to being caught.”

While Asia tends to be home to large, bureaucratic hacker groups such as the “Comment Crew,” Eastern European hacking groups tend to be more technically advanced and effective at evading detection, according to FireEye. Western attacks, such as Stuxnet and Gauss, also tend to be highly engineered, the report says.

Viewed outside its geopolitical context, a cyberattack offers little legal maneuvering for a defending state, says Professor Thomas Wingfield of the Marshall Center.

“False flag operations and the very nature of the Internet make tactical attribution a losing game,” he says in a statement. “However, strategic attribution — fusing all sources of intelligence on a potential threat — allows a much higher level of confidence and more options for the decision maker. And strategic attribution begins and ends with geopolitical analysis.”

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/cyberattack-attribution-requires-mix-of/240162098

October 1, 2013 – Malwarebytes today announces the launch of Techbench, a tool to help IT workers fix and restore even the most malware-infected computers. Dubbed ‘the technician’s best friend’, the 16GB USB simply needs to be plugged into the infected computer, before it automatically scans and removes even the most advanced Trojans, spyware, worms and other malicious software.

Techbench is designed to be a ‘plug-in-and-leave’ solution for technicians looking to address the growing volume of tenacious malware which is resistant to traditional anti-virus and hard to remove. Simply inserting the USB stick will automatically start a background scan of the entire machine, silently restarting when needed and installing Malwarebytes Anti-Malware on the cleaned computer if required.

Techbench automatically quarantines all malicious software on the USB stick to prevent reinfection. The software also uses Malwarebytes Chameleon, a product designed to neutralize modern malware’s automatic countermeasures.

The product was directly conceived by Malwarebytes’ founder and CEO Marcin Kleczynski, himself a former computer technician. Marcin’s many hours fixing infected computers at his local PC repair shop, even though they already had AV software installed, was what initially inspired him to set up Malwarebytes.

Commenting on the launch, Malwarebytes Chief Executive Officer, Marcin Kleczynski said: “Techbench is made by technicians, for technicians. As an IT support worker, there is nothing more frustrating than dealing with an endless line of computers infected with stubborn malware, each needing a different type of fix.

“Techbench will address this problem by providing something which can simply be plugged in and automatically remove the problem. Hopefully, it will make the lives of computer technicians that little bit better.”

Malwarebytes Techbench is available on a wearable lanyard and is debuting at a special introductory price of $399.95 per year. More information is available at http://www.malwarebytes.org/business/techbench/.

About Malwarebytes

Malwarebytes provides software designed to protect consumers and businesses against malicious threats that consistently escape detection by other antivirus solutions. Malwarebytes Anti-Malware Pro, the company’s flagship product, employs a highly advanced behavior-based detection engine that has removed over five billion malicious threats from computers worldwide. Founded in 2008, the self-funded company is headquartered in California, operates offices in Europe, and employs a global team of researchers and experts. For more information, please visit us at www.malwarebytes.org.

Article source: http://www.darkreading.com/management/malwarebytes-launches-new-technician-pro/240162053

NEW YORK, Oct. 1, 2013 /PRNewswire/ — Most people’s email just isn’t that interesting, but hackers compromise millions of computers a month in homes and offices nonetheless. So what are hackers really after? By putting “bots”–automation software, pretending to be human–on these millions of compromised computers, the bad guys are able to generate billions of fake ad views, resulting in staggeringly large cash payouts without detection or consequence. That is about to change. White Ops, a company launched by leaders in cyber-security and digital marketing, introduces today the first systematic solution for accurately isolating and eliminating bot-infected traffic from advertising campaigns.

(Logo: http://photos.prnewswire.com/prnh/20131001/NY88450LOGO )

“We have spent over a year tracking the bad guys attacking advertising,” says White Ops CEO, Michael Tiffany. “This code started out robbing online banks–but apparently, it’s easier, safer, and more profitable to steal from the $36 billion spent yearly on online advertising.”

Dan Kaminsky, Chief Scientist of White Ops and the well-known security researcher who led the all-time largest synchronized fix to the Internet, adds, “Ad fraud has become the primary cash out point for Internet fraudsters. This is what is getting average people’s computers broken into, compromising their privacy and undermining the very foundations of Internet safety. Something must be done, and we’re doing it.”

Kaminsky continues: “Some people assume fraud is just a ‘cost of doing business,’ and is evenly distributed at some affordable single digit rate. What we are actually finding is wide variability–some sites are remarkably clean, with less than a percentage point of fraud. Others have fraud rates exceeding 90%.” Tiffany concludes: “It’s not merely the ‘dregs of the Internet’ that get infested. Major properties are getting raided. They often don’t know. We’re helping them find out and stop paying these thieves.”

The fundamental consequence is that anyone who pays for advertising on the Internet is likely paying for ad impressions that never actually occur, rending the traditional advertising metric of CPM (cost per thousand impressions) meaningless.

The White Ops solution introduces the fundamental metric that matters: “Cost per Human,” the real cost of reaching humans that will ultimately buy products or services–not bots, which do nothing but falsely inflate metrics.

By applying the techniques of Side Channel Analysis (the practice of looking at specific characteristics of a signal to determine the nature of the signal

itself) to review several thousand variables in signals leaked during individual user sessions, White Ops is able to accurately differentiate, in real time, between a human and machine-driven ad request, regardless of the sophistication of the bot programmer. This approach varies from the methods generally employed by current fraud detection services, which rely on statistical and predictive analysis to detect impression fraud. While that type of anomaly detection has its strengths, it is usually dependent upon a large body of historical, static data that, at most, uncovers simple, unsophisticated methods of fraud. This makes it difficult to detect the more advanced bot types that incorporate randomness and change in their behavior models.

White Ops has leveraged an array of techniques, culled from the world of computer security, to develop what the company refers to as “botprints,” for the full spectrum of impression and click fraud techniques. This real-time detection algorithm determines, with a high level of confidence, whether the browser was under the control of a bot during the time of the ad or page request.

White Ops is a member of the Internet Advertising Board (IAB) and works closely with the advertising industry as partners and allies in the fight against fraud and for better content on the Internet. Chairman of White Ops, Jon Bond,

comments: “Bots have created a crisis of confidence in the online world that is threatening the entire ecosystem. We can’t keep sweeping it under the rug. If clients knew the facts, they wouldn’t stand for it.”

White Ops is made up of an elite team of scientists and engineers from outside the ad industry, with a deep and significant background in cyber defense and

security:

— CEO Michael Tiffany was Chief Software Architect at Mission Assurance

Corporation, a pioneer in space-based computing and Big Data, and is a

co-founder and lifetime Research Fellow of a DARPA-funded security lab.

— Chief Scientist Dan Kaminsky “saved the internet” (WIRED) by secretly

convening every major vendor affected by what is now known as the

Kaminsky Bug in DNS and coordinating a cooperative fix.

— CTO Tamer Hassan worked in Big Data analytics for advertising and white

shoe law firms, and is also a combat Search and Rescue helicopter pilot

in the U.S. Air Force.

— General Counsel Ash Kalb is a former Skadden, Arps MA lawyer with

experience providing legal expertise to a variety of companies in the

tech industry. He is also the founder of Singularity Co.

— Chairman Jon Bond is the co-founder of Kirshenbaum Bond + Partners, a

New York City advertising agency that pioneered guerilla marketing

techniques and is credited with being the first “modern” integrated ad

agency. Jon is currently the “Chief Tomorroist” at Tomorro LLC, a

company that provides financial and strategic advice for new and growing

companies of high potential value. Using his vast range of expertise and

experience, Jon advises White Ops on all aspects of the ad industry.

The White Ops team has pursued criminals across a variety of enterprises, from Defense projects to digital bank robbery, and is now focused on attacking ad fraud with its proprietary technology and methodology. White Ops works with brands and publishers to rank their advertising channels in terms of Cost per Human, allowing for more cost-efficient investment in digital advertising and dramatically improved results. White Ops allows clients to determine exactly how many humans are looking at their ads, and make informed decisions about how to avoid criminals and design the most impactful ad buys. A shadowy network of criminal programmers created bots to steal billions of advertising dollars.

White Ops gives honest agents the capability and tools to fight back.

About White Ops

White Ops is a pioneer in the detection of and systematic defense against ad fraud cyber criminals to provide advertisers with greater effectiveness in their online digital advertising spend. With the goal of making ad fraud unprofitable and unsustainable, White Ops employs its world-class expertise in cyber defense and security to attack the covert ecosystem of automated bots, disguised as human interaction, that fraudulently interacts with online advertisements to illegally divert advertiser revenue to cyber criminals. White Ops’ leading edge technology combats criminal activity in a significantly different and more comprehensive way, differentiating between bot and human interaction to reduce the number of fraudulent clicks an advertiser pays for and increase their conversion rate. White Ops delivers the only ad impression metric that matters:

Cost per Human.

Article source: http://www.darkreading.com/end-user/bots-beware-white-ops-launches-new-techn/240162103

In January 1991, a group of Dutch hackers attempted to break into a system at Bell Labs, only to be directed into a digital sandbox administered by one of the research groups at ATT. In an account of the five-month incident involving one of the first computer honeypots, Bill Cheswick echoed a complaint of the systems frequently made since the incident: “How much effort was this jerk worth? It was fun to lead him on, but what’s the point?”

Yet, increasingly, companies are seeing a point. Businesses are deploying honeypots focused specifically on alerting defenders to an attacker’s presence. Such systems tend to have a low false positive rate, can detect both insiders and external hackers and, best of all, should require little maintenance after setting up.

“If we look at the next generation of attacks, attackers are using less and less malware, they just find valid credentials online,” says John Strand, a pentester with consultancy Black Hills Information Security and an author of the book, Offensive Countermeasures: The Art of Active Defense. “They simply just log in and they can walk in the front door as a legitimate user.”

To detect such breaches, companies can use sophisticated anomaly detection or simply stand up some simple servers that should never be accessed. Those honeypots can alert the security team when someone is poking around where they should not, he says.

While honeypots have been used widely by researchers to study the methods of attackers, they can be very useful to defenders as well. Here are five advantages that the digital sandboxes can bring to companies.

1. Low false positives, high success
Every attacker worth their salt first tests their malware against the popular known security measures out there. Just by checking whether their program dodges detection by Symantec’s and McAfee’s anti-malware scanners, attackers have fooled systems that more than 80 percent of companies rely on, says Black Hill’s Strand.

“A lot of traditional defensive technologies don’t have a lot of value against advanced attackers, because the bad guys have the means and the resources to ensure that their attack is going to work,” he says.

Honeypots fill the gap, because attackers have a much more difficult time predicting their use and countering the defenses, Strand says. Because production honeypots are machines that no legitimate user should be accessing, they also have a low false positive rate.

2. Able to confuse attackers
Honeypots can also be used to slow down the attackers who successfully get into a company’s network. Using a virtual system, a company can create a variety of decoys that can distract the attackers and cause them to take more time to find the valuable data.

“Decoys are all about moving the threat from the real assets to the fake one, at the same time alerting you to the threats,” says Michael Davis, chief technology officer for CounterTack, a security firm that recommends more active defenses.

[A combination of traditional network security monitoring and recent advancements in honeypot and active defense tools is key to detecting today’s threats. See Tech Insight: Time To Set Up That Honeypot.]

Another approach is to use honey tokens, fake data seeded within database records that should not otherwise be accessed, he says. By placing rules in the firewalls to alert on the unique data, a company can detect whenever a user or hacker downloads the information.

3. Only a time sink, if you allow it
Companies can deploy one of two types of honeypots. The first is a research honeypot–an instrumented virtual system that hosts a vulnerable operating system and is put on a network accessible to the Internet. The problem with research honeypots is that they require a lot of time to set up, watch for threats and then analyze the resulting compromise. While companies can learn a lot about attackers from such systems, they typically require too much time to be of use in an enterprise whose business is anything other than security.

“Research honeypots tend to be the tool of choice for university students to observe attacker behavior,” Strand says. “That’s neat but for the rest of us, we have real compromises to take care of.”

Production honeypots, on the other hand, are systems that emulate something of business value to the company. They can be a Web server, workstation, database or just a document. They are low-interaction systems, which mean that the security team just sets them up and then can worry about other things until a user interacting with the honeypot sets off an alert.

4. Help train your security team
With technical security professionals still in short supply, honeypots can also be used a essential training tools, says CounterTack’s Davis. By using honeypots to watch the attackers actions, the defenders can learn about the latest techniques.

“A lot of security teams, when they start deploying honeypots, they really start understanding how these attackers work,” he says. “They see the steps the attackers takes, but also figure out how to stop the intermediary steps in their own network.”

5. Many free options
Finally, there are a lot of free option for companies to get started with honeypots. At the Black Hat Security Briefings in Las Vegas, Strand and three colleagues released a collection of active defense tools, wrapped in a single Linux ISO distribution dubbed the Active Defense Harbinger Distribution (ADHD).

For those who prefer Windows, KFSensor is a popular honeypot systems based on that operating system.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/advanced-threats/5-reasons-every-company-should-have-a-ho/240162106

About a year ago I wrote a post at Securosis describing the big changes I see in the practice of security over the next ten years. While there never seems to be a shortage of town criers singing out the doom of our industry, I actually think we are at the start of some insanely positive changes. I don’t mean nebulous concepts like “influencing the business,” “baking in security early,” or “getting a seat at the table.” I mean honest-to-goodness security technologies and techniques that will not only materially change how we approach security, but are pretty darn interesting and compelling.

These days many security professionals are relegated to roles that often are only tenuously related to directly improving the security of the organization. Now I’m drawing some big generalizations here, but if this doesn’t describe your job, the odds are you know someone it does describe. Managing directory servers, pushing user permissions, configuring firewalls, and other similar tasks aren’t the sorts of things you need security experience for. We have already seen those jobs, even some level of packet analysis, being handed off to operations teams.

On the other hand, security isn’t merely going to transition into a policy-building role. Get too far away from technology and the policies don’t reflect reality, and security gets the basement office. The one next to the boiler.

I’m running on the assumption that if you are reading this, you plan on staying in security for ten years, you enjoy the profession, and you don’t want to turn your brain off. There will still be plenty of those jobs out there, but they will keep decreasing over time. No, for those of you that care the future is bright.

First a few technology assumptions. These are the trends (detailed in the post linked above) that I believe will change the practice of security. The first is the growth of big data, and the ability of security teams to collect and analyze large stores of data in real time. The second is the increasing use of cloud computing, and the availability of application programming interfaces to manage everything from software defined networks to point security products. The third is a greater enablement of incident response, including use of tools like active defense and hyper-segregation to reduce attacker’s abilities to operate freely in our environments once they get in the front door.

That is probably a too-trite overview of where we are headed, but each trend is happening today, for real, as we see more and more of the boring stuff being handed over to Ops, who is better at it anyway. So what does this mean for those of us that don’t want to become clueless policy wonks?

There are three sets of skills I suspect will draw the big bucks in security. Security (Big Data) Analysts, Incident Responders, and Security Developers.

Despite the pretty vendor dashboards, winnowing out useful analysis from a big data repository is a significant challenge. It requires a sound understanding of security, the ability to program the analytics, and the common sense to figure out what matters, what doesn’t, and how to translate that for the non-statisticians (mere mortal) of the world. I won’t be surprised if this becomes one of the most sought after skills sets, especially among larger organizations and security service providers. If you did well in stats, this is where the big money will be.

Incident response is already a skills set in demand. The busy shops struggle to find qualified staff and keep them. Even mid size and smaller organizations will need either in house or outsourced incident response now that we have all realized we can’t completely keep all the bad guys out all the time. The less day to day operational adjustments we need to manage, the more time we can spend detecting and responding to incidents.

The last skills set is the one I find most interesting. As everything gains an API, we can build more dynamic and responsive security with code. Think your honeynet is cool? How about an active defense tool that detects and attacker hitting a honeypot, then spins out (using software defined network) a segregated copy of the subnet with same topology, but a bunch of dummy hosts to further identify and classify the potential attacker? Or using a few dozen lines of code to identify every unmanaged server in your cloud, determining the system owner, and potentially quarantining them or pushing out configuration updates? All of this is possible, today, with Software Defined Security. If you can code, understand security, and think DevOps is cool, the odds are you won’t have trouble finding work.

I’m not about to promise you full employment as a cloud security programmer next year, but it seems clear that over time these skills will only be more in demand. On the other hand, odds are the basic management and maintenance of existing security tools will slowly transition to other departments. Security will still set firewall policies, but it makes sense for network operations to implement them. Like any profession there will be a range of required skills, but the more you can align yours with the future, the better your odds of getting higher paying, more interesting work.

Article source: http://www.darkreading.com/views/security-skills-for2023/240162107

This week I’m writing to you from the Virus Bulletin conference in beautiful Berlin, Germany.

We have seven SophosLabs researchers all prepared to share their research and ideas with the world.

Our first paper (chronologically), Back channels and bitcoins: ZeroAccess’ secret CC communications”, will be delivered by James Wyke of SophosLabs UK.

Tomorrow Wyke will explain the rise and fall of illicit bitcoining mining as a profit tactic and the increasing devious command and control methods being hidden inside everyday network traffic.

Next up is “Between an RTF and OLE2 place: an analysis of CVE-2012-0158 samples”, presented by Paul Baccas (independent) and Vanja Svajcer (SophosLabs).

Their research dives into the numbers behind the exploitation of CVE-2012-0158 and the challenges posed to anti-malware researchers due to the complexity of Microsoft file formats.

Rowland Yu of SophosLabs Australia kicks off Thursday’s talks with “GinMaster: a case study in Android malware”.

Yu will show the parallel, yet accelerated path that Android malware is advancing as compared to PC malware in the early days. He will also hightlight techniques used to obfuscate, avoid detection and even root victim devices.

Gabor Szappanos from SophosLabs Hungary is up next with his last minute paper delving into the exploitation of legitimate apps to lend their trust to malicious ones called “Hide and seek – how targeted attacks hide behind clean applications”.

Immediately following Szappanos, Sean McDonald (SophosLabs Australia) and Vanja Svajcer (SophosLabs Croatia) are presenting “Classifying Potentially Unwanted Applications in the mobile environment” which Paul Ducklin described earlier this week.

The final paper is published, but the timing is a mystery. Numaan Huq and Peter Szabo from SophosLabs Canada had their paper, “Trapping unknown malware in a context web”, selected as a reserve paper to be presented by Huq.

Their research shows that when scanning the web for threats, context is everything. Huq and Szabo applied their techniques to a year’s threat data and found it improved the detection of zero-days, compromised sites and exploit kits.

If you are a malware research nerd, this is an exciting week. There is much work to be done to better protect ourselves and others.

If not, stop wasting so much time on sports, card games, time with your family, music, hunting, reading and exercising.

We need your help! If you can’t make it to Berlin, look into how you can help educate your friends and family during October, it’s National Cyber Security Awareness Month.

Break a leg guys…

Follow @sophoslabs
Follow @chetwisniewski

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/duLLxnU3xBU/

Supercharge your infrastructure

Stalkers and advertisers will be pleased to know that Facebook is now more searchable than it has ever been, after the social network confirmed that it was in the process of allowing users to dig much deeper into a “friend’s” past posts on the free content ad network.

The Mark Zuckerberg-run company has been chasing larger ad bucks in a move to cheer investors on Wall Street. And in recent months, the strategy has started to pay off.

Facebook unzipped its Graph Search feature at the start of this year. It came with limited functions at the time, but the system was Zuck’s first clear signal to advertisers that he was finally getting serious about search and – by extension – advertising, from which the billionaire derives around 85 per cent of his company’s revenues.

Significantly, while Facebook has a close working relationship with Microsoft, it had enough foresight to recognise that its search feature needed to be completely autonomous within the Menlo Park silo.

MS still powers external search requests for Facebookers. But the juicy stuff locked inside the network is controlled completely by Zuck’s engineers.

Facebook said of Graph Search on Monday:

Now you will be able to search for status updates, photo captions, check-ins and comments to find things shared with you.

But it was keen to add that a user’s privacy would not be violated on the network.

As with other things in Graph Search, you can only see content that has been shared with you, including posts shared publicly by people you are not friends with.

Fears about perverts using Graph Search to prey on teenagers on the network were raised earlier this year. Facebook was forced to say that controls would be in place to protect young people. But the system is flawed, because it relies on kids and adults to be honest about their age when signing up to Facebook – which is not robustly policed by the company.

The new function is slowly being rolled out to a small number of users for now. As Google and Twitter, the latter of which is prepping for its IPO, understand only too well, watching in near real-time which searches are popular on those services is key to satisfying hungry admen. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/01/facebook_graph_search_targets_all_data/

Supercharge your infrastructure

Symantec has claimed credit for luring a significant lump of the powerful ZeroAccess botnet into a sinkhole.

ZeroAccess has been active since 2011 and is one of the largest known botnets in existence: it has upwards of 1.9 million infected computers forming its army, all remotely controlled by miscreants. This swarm of PC robots is put to work generating tens of millions of dollars annually, it is estimated.

It’s claimed crooks make money from the infected Windows machines by instructing the computers to virtually (and fraudulently) click on web adverts, thus ramping up income for an affiliate ad network, or (to a lesser extent) mine for new Bitcoins.

By subverting the communications system used by the bots to organise, Symantec has sinkholed – gained control or disabled, in other words – more than half a million bots, we’re told.

This will have made a serious dent in the number of zombie drones under the thrall of the ZeroAccess gang. Symantec said it is working with ISPs and government computer security teams (CERTs) worldwide to help get infected machines cleaned up.

ZeroAccess infects Microsoft-powered computers caught up in drive-by-downloads: booby-trapped websites attempt to exploit security holes in web surfers’ machines to install the malware. It then uses a rootkit to hide itself from the operating system and the victim, set itself up on a secret file system, downloads yet more software nasties, connects to other infected systems and opens up backdoor access.

The ZeroAccess botnet is sophisticated and resilient, using a peer-to-peer architecture to communicate. Thus, it enjoys a high degree of redundancy and no central command-and-control server for the good guys to target. As a result nobody is under any illusions that Symantec’s action has finally put paid to the zombie network.

More details on the takedown effort can be found in a blog post by Symantec here. ®

5 ways to reduce advertising network latency

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/10/01/zeroaccess_botnet_sunk_sorta/