Attacks/Breaches
8/5/2011
08:57 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

The Week In Security: 4 Big Stories

Cyber threats as part of future wars, Android malware, and Shady Rats made news. Don't miss the week's key security stories.

InformationWeek Now--What's Hot Right Now
Whenever the security community gathers in Las Vegas for its annual Black Hat conference in Las Vegas, a UBM TechWeb event, you know some interesting technology vulnerabilities will be disclosed. It's an annual security checkup of sorts, though tech vendors such as mobile device makers cringe at some of the prognoses.

With Android Trojans, Shady Rat, and mobile malware, the security news has piled up this week. Take a minute to step back and look at these key issues that deserve your attention.

1. Ex-CIA Official: Cyber Threat Resembles Pre 9/11

The current threat of cyber terrorism reminds Cofer Black, former director of the CIA's counterterrorist center, of al Qaeda 9/11, he told Black Hat attendees in a keynote. At that time, Black said, U.S. leaders didn't comprehend the terrorist threat or its implications enough, InformationWeek.com's Mathew Schwartz reported.

"They didn't understand it. They had no personal experience with it," Black said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it." Will those decision-makers hear it soon? Let's hope so.

2. China Behind Shady Rat, Security Experts Say

McAfee researchers brought to light what it calls the Shady RAT (remote access tool) attacks this week, which the security vendor said successfully compromised at least 72 organizations, including 22 governmental agencies and contractors. While McAfee did not name China as the entity behind the five-year effort, the security community at Black Hat was not so shy with its opinion.

"Experts said there was little doubt who launched Shady RAT," InformationWeek.com's Schwartz reported. "This just further confirms what we already know, that China is doing these things," Joel Brenner, told InformationWeek at Black Hat. Brenner is former senior counsel to the National Security Agency, former head of U.S. counterintelligence under the director of national intelligence, and currently counsel to Cooley.

3. Androids Now An Appealing Target

Three of 10 Android users will likely find malware on their devices each year, according to a report from Lookout Security released this week. Some 500,000 to one million people already found one in 2011, the company said. In related news early this week, a CA researcher reported an Android Trojan with the ability to record phone calls. But as it turns out, this one wasn't as bad as CA believed.

Symantec researchers followed up later in the week with the news that the code was in fact an app, "widely available on multiple sites in China, with no effort made to conceal its function," InformationWeek.com's Robert Strohmeyer reported. The code did involve a speech recorder--and one application for it in China was people trying to check up on the fidelity of their spouses. Watch out Tiger Woods, but everyone else, just keep an eye on which mobile apps you trust. It's still often too hard to tell the good from the bad. By the way, check out our look at the 8 worst Android malware attacks to date.

4. Macs Vulnerable To Advanced Persistent Threats

As Apple moves further into the enterprise, is Apple keeping up with today's malware "innovators"? Today, Macs are "arguably even more vulnerable to APTs than Windows PCs, since many Mac-specific technologies are quite easy to exploit," InformationWeek.com's Schwartz reported.

Alex Stamos, co-founder and CTO of iSEC Partners told Black Hat attendees that he recommends limiting Mac access to some network resources. "We use Macs on our network," he said. "We treat them as I recommend you treat them--as little islands in a hostile network." For example, you may need to rethink DNS requests and simply avoid some technologies, he said. One example: Snow Leopard Server (10.6). Check out his real-world advice on how to deal with these risks.

Laurianne McLaughlin is editor-in-chief for InformationWeek.com. Follow her on Twitter at @lmclaughlin.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

Best of the Web
Dark Reading Radio