(ISC)² Blog

Of Mice and Men

I’ve noticed a number of articles recently based on historical summaries of threats past – for instance, a ‘brief history of Apple hacking’ (see also my commentary for Infosecurity Magazine) and SC Magazine’s Ten Devastating Computer Viruses. In general, I’m more fascinated by the fact that the media and the reading public are so taken with top ten lists – in fact, I’ve considered the phenomenon a couple of times with some seriousness, as in Perfect Ten: Truth and Prognostication – than I am by the prospect of putting my own lists together. Though I have done from time to... Read more →

The evolution of support scamming

Cold-call tech support scams. Didn't they go away when the Federal Trade Commission cracked down on them in the US? Actually, while the FTC crackdown wasn't quite as comprehensive as it might have seemed, there's no doubt that the number of classic "I'm-ringing-from-Microsoft-to-tell-you-that-you-have-viruses-but-I-can-help-you-for-a-small-fee" cold-calls has declined (round here at any rate, but maybe they just figured that ringing someone who wrote as extensively as I do about the scam wasn't much of a sales prospect). Still, it seems that what is happening here is evolution, not extinction. Last month, my colleague Jean-Ian Boutin reported malware that not only combined fake... Read more →

Flight risk

An amateur pilot has reportedly assembled and hacked real aircraft cockpit systems, demonstrating their vulnerabilities. "Security researcher Hugo Teso was able to "hijack" the systems to feed false navigation information to a simulated jet that made it change course." BBC It's not hard to think of scenarios where a well-resourced, competent and overtly malicious yet non-suicidal adversary could wreak havoc by redirecting aircraft, missiles, anti-missile-missiles, drones etc. using similar techniques, or simply interfere with them, hence one would have thought that information security was an obvious safety-critical requirement for their navigation and comms systems ... like for example the 30... Read more →

There’s Testing, Then There’s VirusTotal

From time to time, I find myself having to rail against the misuse of VirusTotal’s service as a sort of surrogate AV product test. Sadly, I feel the need to do it again here, in the light of a current news item. Read more →

Practice Safe Computing

by F. Gary Alu What is the first thing we should check when we turn on our computer? That’s a question I always pose to the kids when I present the (ISC)2 Safe and Secure Online Program. If your answer is Facebook or Email, you have a problem. Of course having a look at your anti-virus application is the place to start. Is it running? Are the databases current? (by current I mean no older than 24 hours). Even the best anti-virus (AV) solution will do one little good if it is not running because the subscription has expired or... Read more →

Android, Malware and Rehabilitation

With news breaking of a further wave of "fake malware-laden apps", let's hope that Google has seen ENISA's analysis of appstore security, and will not assume that Bouncer app review is enough... Read more →

2012: Redefining United States Cyber Security: Taking a Holistic View and Machiavellian Approach, part 1

By: Larry P. Bunch CISSP, CEH http://mysite.verizon.net/vze18ez5m/id3.html Twitter: https://twitter.com/#!/bunchlarryp Preface This article was originally intended to be a light reading OP/ED piece. However, it has slowly evolved into a hybrid OP/ED – Whitepaper dealing with Cyber Intelligence and Network Security. The opinions in this article do not represent the United States government or my employer (VortechX LLC.). This article is intended to generate discussion, collaboration, and interaction within the Intelligence and Network Defense communities of both the Public and Private sectors of the United States. The ideas and recommendations presented here reflect only my own opinions and may NOT be... Read more →

Focus on everything

I had the opportunity to visit several companies over the years and in many cases I could verify that their network and security teams suffered of a lack of network visibility, which let them unable to answer some important questions, per example: What's the average traffic in the network? What's the most used applications? Who are the top talkers? There are unknown applications running in the network? Why there are non HTTP traffic on TCP port 80 going out of the network? Many teams don't know the answers from the questions above and certainly, this make them blind to what's... Read more →

The APT Attack Surface

According to the FAS Project on Government Secrecy, using data tabulated in the report, 4,266,091 people held security clearances in the US for access to classified information. Read more →

Doom is Busting Out All Over

The cold war is back (if it ever really went away). Only now, anyone can play. Nations - including the UK, where I have the pleasure of residing - are queueing up to announce that they're developing cyberwarrior capabilities. Read more →

Epsilon Overkill and the Security Ecology

I'm not actually going to write about the Epsilon fiasco as such here. I can think of at least two journalists who will be grateful for that, but I'm not going to let them off quite that easily, even though I can empathise with their ennui. Larry Seltzer notes that he has received far too many pitches using Epsilon as a hook. I can sympathise with that: I'm bored out of my skull with it, and I don't do much more than skim Epsilon-related articles to see if they're worth flagging on a resources blog, with or without commentary. John... Read more →

Japan: Commentary and Resources

It probably hasn’t escaped your notice that there’s a lot of malware/SEO/scamming whenever a major disaster occurs. A few days ago I started to put together a list of commentary (some of it my own) and resources relating to the Japanese earthquake and tsunami, in anticipation of that sort of activity. Originally, I was using several of my usual blog venues, but decided eventually to focus on one site. As ESET has no monopoly on useful information, I wanted to use a vendor-agnostic site. Actually, I could have used this one, but for better or worse, I decided to use... Read more →

Raising the (Testing) Standard

After well over 20 years involved in some aspect or another of the security industry, several of them supplying services to the anti-malware industry, I can say with some confidence that AV product testing has given me more white hairs than any other security topic. Only a true obsessive, a hallucinating optimist or hopeless masochist would admit to being a Director of AMTSO, the Anti-Malware Testing Standards Organization, so I won't mention that... But I will mention that the next AMTSO members meeting is at San Mateo, California, on the 10th and 11th February, conveniently and non-coincidentally arranged just before... Read more →

Malware analysis

A collection of resources (mostly online) that will help those interested get started working towards an understanding of how to pick apart malware, see what it does, and how to protect against it. Read more →

Do you know Shodan?

Wellcome to Shodan. If you're thinking "What on Earth is it?", please read the lines below. If you're already familiar with, move to the next Section. So here’s the basic: SHODAN (Sentient Hyper-Optimized Data Access Network) is a search engine, but instead of indexing web page content, it indexes banners information. It indexes data on HTTP, SSH, FTP, TELNET and SNMP services for almost the whole Internet. You can find it at http://www.shodanhq.com. You can do basic searching for free. An account and credit are required for some features. What can I do with it? A lot of things. For... Read more →

Stuxnet, Suxnet

I've been in this business too long to be easily riled by hoaxes and semi-hoaxes, electronic Pearl harbours, rumours and gossip. But after enforced immersion into various aspects of the Win32/Stuxnet issue (from remediation-related discussion with SCADA sites to code analysis, to data mining from distribution data), I've become more than usually frustrated with articles and discussion threads adding two and two to make infinity. Here, briefly, is what we know. Stuxnet used an unusually rich selection of 0-day attacks, exploiting the LNK and print spooler vulnerabilities recently patched by Microsoft and a couple of Elevation of Privilege issues that... Read more →

Keeping net safe

This module from the UK's OpenLearning/LearningSpace centre is a fairly basic online safety piece. It concentrates on malware, and has numerous minor errors in terminology and definitions, but is reasonable for the general public. Read more →

Cyber Security Central

This blog entry focuses on introducing a new community focused resource designed to provide an avenue for the collaboration and sharing of information relating to Cyber Security. The Cyber Security Central website (www.cybersecuritycentral.com) seeks to extend the knowledge and best practices within the cyber security community. The overall goal of the site is to provide a platform to support the implementation of the National Cyber Security Strategy. Since the inception of the project a few months ago, I have tried to establish a site that seeks to demonstrate a broad view of the cyber security community from both the national... Read more →

They call it Cyber Monday (but Tuesday’s just as bad)*

In the US, the holiday season is approaching fast, with Thanksgiving a week away on 26th November. I guess most of us outside the US are aware of Thanksgiving if we work with Americans, since almost the entire country closes down on the 4th Thursday in November. (Apologies to the Canadians in the audience, who had their own Thanksgiving celebration back in October.) However, fewer people outside the US will be aware of Black Friday (the day after Thanksgiving) and Cyber Monday (the following Monday – that’s the 30th November this year) unless they’re in global retail. Black Friday isn’t... Read more →

Botnets? Not a problem...

An article in PC Pro by Asavin Wattanajantra quotes Dr Steve Marsh, who is deputy director at the Office of Cyber Security in the Cabinet Office, as saying (in respect of EU policy on protecting Europe from cyber attack, whatever you may understand by that term) that: "the main focus of botnets would be to target and extort money from private companies, rather than bring down public sector networks [and] .... in a sense [it is] not in their interest to bring down infrastructure which is earning them money." This isn't a million miles away from something I was saying... Read more →