Last weekend, the New York Times website suffered a security breach through advertising. According to an article on the Times website regarding the breach, "an unknown person or group sneaked a rogue advertisement onto the web site's pages." Much like the advertisements RR mentioned in his post on September 20, these ads informed users that their computers were infested with viruses, and that they needed to purchase antivirus software to protect themselves.
According to the Times, ads on any website are generally approved either by the owner of the web site itself, or by ad networks, the middlemen of the advertising world. When the Times staff was informed of malicious pop-ups, they immediately stopped displaying ads from these ad networks, but the ad in question had in fact been approved by the advertising department of the Times itself -- by posing as a legitimate ad for Vonage. The ad even "initially appeared as real ads for Vonage" before switching to the malicious ad.
The Times does not believe at this time that the software the ad offered to install was inherently malicious, so much as a kind of snake oil. The Times also received a large number of complaints regarding the ads, implying that a large proportion of the Times's audience was internet savvy enough not to immediately install any antivirus program they are offered.
The cause of this breach is interesting. The group of hackers didn't only pose as a legitimate company, but as Vonage, a well-known company with whom the Times had a long-standing relationship. Because of this relationship, the ad was passed directly by a member of the Times' advertising staff. As a result, the ad stayed up for a few extra hours over the weekend, while the staff at the Times was occupied with the ads approved by ad networks.
The Times did a good job of responding to the breach. They did not go as far as The Register in the UK, which "took down all its ads for several days" following a similar breach. However, the Times did address the complaints of their users quickly, taking down first the ad network ads, and then the directly approved ads. The readership of the Times was informed almost immediately (the story itself was posted on the Monday following the events). The Times article also attempted to explain exactly what the software was likely to do, and what readers could do to remove it. Finally, in the article, The Times stated that it would be enforcing new advertising policies to prevent future occurrences.
Source:
http://www.nytimes.com/2009/09/15/technology/internet/15adco.html
Tuesday, September 29, 2009
Monday, September 28, 2009
Security Firms Having Trouble Detecting World’s Biggest Spam Campaign
Recently there is a huge problem for Americans who fear tax authorities. It is said that criminal gangs have been plotting particularly on these groups of people, and have been convincing them to download malicious software. This spamming campaign is currently entering its 3rd week and things seem to be only getting worse. According to some researchers this could be the most prominent spam-delivered virus in the world as of right now.
The first spotting of the spam happened to be on September 9. It was picked up by the security firm’s anti-spam vendor known as Cloudmark. Security researchers have said that Cloudmark has recently counted 11 million messages sent to the security’s nearly 2 million desktop users. What the message displays is a subject line that reads, “Notice of Underreported Income,” and it tries to encourage victims to install the Trojan virus or click on a website link in order to show their “tax statement.” The link only takes the victims to a site that is malicious.
The biggest issue with this spam is dealing with what is known as malware. Malware is software designed to infiltrate or damage a computer system without the owner’s consent. The malware involved with this spam is known as the Zeus Trojan. This type of malware is extremely hard to detect. What the software is built to do is hack into victims accounts and take as much if not all of their money out. There are estimates that criminals could be taken out as much as a million a day from victims. Recently, small businesses have been taken the biggest loss because banks are choosing not to back them up in this situation. Banks are choosing to place the blame on the small businesses for not being responsible.
There are techniques for blocking malware but the biggest issue is there isn’t a way to stop people from going to sites and downloading. Another issue is that out of the 41 anti-virus systems that the security firm has; only five have been able to detect the Zeus Trojan.
According to Paul Ferguson a researcher with Trend Micro, “It’s difficult to stay ahead of it because the Zeus binaries are changing a few times a day.” “It’s definitely a problem.”
This biggest problem in this event seems to be that people aren’t well informed enough to know not to pay attention to such spams. It seems that people generally panic when they read things that have to do with their money. Spams that deal with the loosing of money tend to work the best and have the most success. Sometimes it seems that if you create a spam that will say “Tomorrow your money will be gone if you don’t do A, B, or C,” people most likely will do it because of panic. The only way this spam can be contained is if people just delete it, and security firms get enough time to detect it more. Firm’s still need the help of the people more than anything to slow the breaching down.
Sources:
http://news.techworld.com/security/3202748/security-firms-battle-worlds-big...
The first spotting of the spam happened to be on September 9. It was picked up by the security firm’s anti-spam vendor known as Cloudmark. Security researchers have said that Cloudmark has recently counted 11 million messages sent to the security’s nearly 2 million desktop users. What the message displays is a subject line that reads, “Notice of Underreported Income,” and it tries to encourage victims to install the Trojan virus or click on a website link in order to show their “tax statement.” The link only takes the victims to a site that is malicious.
The biggest issue with this spam is dealing with what is known as malware. Malware is software designed to infiltrate or damage a computer system without the owner’s consent. The malware involved with this spam is known as the Zeus Trojan. This type of malware is extremely hard to detect. What the software is built to do is hack into victims accounts and take as much if not all of their money out. There are estimates that criminals could be taken out as much as a million a day from victims. Recently, small businesses have been taken the biggest loss because banks are choosing not to back them up in this situation. Banks are choosing to place the blame on the small businesses for not being responsible.
There are techniques for blocking malware but the biggest issue is there isn’t a way to stop people from going to sites and downloading. Another issue is that out of the 41 anti-virus systems that the security firm has; only five have been able to detect the Zeus Trojan.
According to Paul Ferguson a researcher with Trend Micro, “It’s difficult to stay ahead of it because the Zeus binaries are changing a few times a day.” “It’s definitely a problem.”
This biggest problem in this event seems to be that people aren’t well informed enough to know not to pay attention to such spams. It seems that people generally panic when they read things that have to do with their money. Spams that deal with the loosing of money tend to work the best and have the most success. Sometimes it seems that if you create a spam that will say “Tomorrow your money will be gone if you don’t do A, B, or C,” people most likely will do it because of panic. The only way this spam can be contained is if people just delete it, and security firms get enough time to detect it more. Firm’s still need the help of the people more than anything to slow the breaching down.
Sources:
http://news.techworld.com/security/3202748/security-firms-battle-worlds-big...
Saturday, September 26, 2009
UNC Data Breach
Another article about a university's system being compromised by a malicious hacker. According to this article, released today, UNC-Chapel Hill has started informing about 163,000 women that their Social Security numbers and other personal information may have been compromised in a security breach that occurred in the University's School of Medicine server; this server was holding the records of about 236,000 women whose information was gathered as part of a federally funded mammography research project.
According to UNC's chairman, Matt Mauro, signs of the breach were first noticed in July by a researcher who had difficulty in accessing the server. Mauro also mentions that the actual breach may have occurred as far as two years back, when they had first discovered some viruses in their systems in 2007. UNC took the server offline when the breach was discovered in July, and the server has remained offline since then, while the university continues to take precautionary measures in order to avoid future breaches.
The university explains that notifications of those potentially affected by the breach have only begun now because the appropriate parties (and authorities) needed adequate time to find out how serious the breach was, as well identify the potential victims of this breach. UNC also reports that they do not believe that the attackers have "downloaded or modified the data in any way."
Fortunately. But who knows if that will remain the case for long.
I think that the breach was due to the viruses that were discovered back in 2007; this article did not address as to how or if the university had taken any action to remedy the affects of this discover -- which I certainly hope it did. Also, I have to question the security measures that the university has protecting its systems, such as the proper firewalls and antivirus soft wares, etc. Hopefully they do regular updates to make sure that they are protected, as these viruses and becoming more sophisticated everyday. Again, this article does not provide a lot of details about the nature of the breach, or the viruses, which makes me wonder if the problem came from a virus that they weren't able to clean out from the system when they first found a few of them two years ago. As for who may have wanted to break into this system, I am not sure; it really could have been anybody, and the university has not been able to track them, either.
In spite of the reasons provided by the university with regards to its delay in notifying the potential victims of this breach, I am still surprised that it took them so long to do so. While I understand that UNC wants to have a good idea as to how severe the breach may have been in order to avoid any additional and unnecessary panic or distress to any of the potential victims, they certainly knew that they had been breached and I think that they could have informed all those who had any chance of being affected in a much more timely manner. So, all those 236,000 women. This way, these women, who run a high chance of being subject to identity theft, would be aware of these dangers and could keep an eye out for anything suspicious in their financial records (for example). I think that the university has a duty to make sure that they are protecting the interests of the people whose information they are holding, and I think that informing the potential victims as soon as possible (from the time that the event of the breach was first confirmed) would have been part of that duty.
Source: http://news.idg.no/cw/art.cfm?id=F5CF8FE9-1A64-6A71-CE25FB1B13C666EE
According to UNC's chairman, Matt Mauro, signs of the breach were first noticed in July by a researcher who had difficulty in accessing the server. Mauro also mentions that the actual breach may have occurred as far as two years back, when they had first discovered some viruses in their systems in 2007. UNC took the server offline when the breach was discovered in July, and the server has remained offline since then, while the university continues to take precautionary measures in order to avoid future breaches.
The university explains that notifications of those potentially affected by the breach have only begun now because the appropriate parties (and authorities) needed adequate time to find out how serious the breach was, as well identify the potential victims of this breach. UNC also reports that they do not believe that the attackers have "downloaded or modified the data in any way."
Fortunately. But who knows if that will remain the case for long.
I think that the breach was due to the viruses that were discovered back in 2007; this article did not address as to how or if the university had taken any action to remedy the affects of this discover -- which I certainly hope it did. Also, I have to question the security measures that the university has protecting its systems, such as the proper firewalls and antivirus soft wares, etc. Hopefully they do regular updates to make sure that they are protected, as these viruses and becoming more sophisticated everyday. Again, this article does not provide a lot of details about the nature of the breach, or the viruses, which makes me wonder if the problem came from a virus that they weren't able to clean out from the system when they first found a few of them two years ago. As for who may have wanted to break into this system, I am not sure; it really could have been anybody, and the university has not been able to track them, either.
In spite of the reasons provided by the university with regards to its delay in notifying the potential victims of this breach, I am still surprised that it took them so long to do so. While I understand that UNC wants to have a good idea as to how severe the breach may have been in order to avoid any additional and unnecessary panic or distress to any of the potential victims, they certainly knew that they had been breached and I think that they could have informed all those who had any chance of being affected in a much more timely manner. So, all those 236,000 women. This way, these women, who run a high chance of being subject to identity theft, would be aware of these dangers and could keep an eye out for anything suspicious in their financial records (for example). I think that the university has a duty to make sure that they are protecting the interests of the people whose information they are holding, and I think that informing the potential victims as soon as possible (from the time that the event of the breach was first confirmed) would have been part of that duty.
Source: http://news.idg.no/cw/art.cfm?id=F5CF8FE9-1A64-6A71-CE25FB1B13C666EE
Friday, September 25, 2009
Texas Instruments Signing Keys Broken
In class we have been discussing asymmetric cryptography and the importance of digital signatures to prove who the person sending a message. Texas Instrument uses RSA digital signatures to authenticate any updates to the operating systems on their calculators. Since their signing keys are two short (512-bits) a community of hackers were able to factor the moduli and publish the private keys. Although TI sent out a DMCA notice to the community of hackers to take down the keys from the public websites, it is too late now. Too many people know what they are.
In the case of this event TI felt that there was no obvious financial incentive for cracking their private key. However they should have expected that if they used too-short keys that their cryptography would be broken. There are hackers out there that do it just for the fun of it, even if there is no incentive. A consequence of this may be that customers will be more skeptical when downloading updates for their calculators.
Although this event will not affect the copyrights held by TI, they should change their signing keys to be longer so that an event like this does not occur again. This event shows that RSA 512-bit keys are too short and ineffective. Any company that does not want their cryptography to be broken should not use one.
Source: http://www.schneier.com/blog/archives/2009/09/texas_instrumen.html
Tuesday, September 22, 2009
Monday, September 21, 2009
Man Finds Innovative Way to Get Back Stolen Laptops
Remote tracking software can now be used to help locate stolen computers. In Miami Beach, Florida a man was at a business meeting when someone broke into his car and stole two laptop computers. The man reported the crime to the police, who were pessimistic about finding the computers. Discouraged but dedicated to getting his computer back, the man returned home and remembered he had downloaded remote access software called LogMeIn. The software allows users to access their computer and files on computers other than their own. The man logged onto his account and for three hours watched his laptop's screen go on Facebook, check email, post on Craigslist, and go on pornographic sites. The man even watched the person taking a video of himself with the camera on the computer. The man used a video camera to tape the evidence in order to prove what he had seen to the police and after paying a website $10 he even had the person’s address that had his computer. The man went back to the police with the evidence then the police went to the home of the man who had one of the stolen computers. The person the police visited ended up not being the thief and was actually someone who had bought the computer at a barbershop. A month and a half later police caught the thief but were unable to prosecute the thief because there was not sufficient evidence.
The man did not take security precautions with either of the laptops. He did not use passwords on his username and log on. An appropriate risk management strategy for a laptop should include a password with at least one lowercase letter, one uppercase letter, one digit, and is at least eight characters long.
Going back to the first assignment, if the Veterans Affairs employee had downloaded this software there would be a chance that they got it back. It is interesting how remote tracking software was used for a reason other than its intended purpose in order to track down stolen computers.
Source: http://www.pcworld.com/article/172093/an_amazing_laptop_recovery_story.html
The man did not take security precautions with either of the laptops. He did not use passwords on his username and log on. An appropriate risk management strategy for a laptop should include a password with at least one lowercase letter, one uppercase letter, one digit, and is at least eight characters long.
Going back to the first assignment, if the Veterans Affairs employee had downloaded this software there would be a chance that they got it back. It is interesting how remote tracking software was used for a reason other than its intended purpose in order to track down stolen computers.
Source: http://www.pcworld.com/article/172093/an_amazing_laptop_recovery_story.html
Sunday, September 20, 2009
E-Trade Skimming Scam
Another interesting article for someone looking for a case study. First come, first served...
Man Gets 15 Months for E-Trade Skimming Scam
Man Gets 15 Months for E-Trade Skimming Scam
Subscribe to:
Posts (Atom)
Posts
