Attacks/Breaches
8/5/2011
08:57 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

The Week In Security: 4 Big Stories

Cyber threats as part of future wars, Android malware, and Shady Rats made news. Don't miss the week's key security stories.

InformationWeek Now--What's Hot Right Now
Whenever the security community gathers in Las Vegas for its annual Black Hat conference in Las Vegas, a UBM TechWeb event, you know some interesting technology vulnerabilities will be disclosed. It's an annual security checkup of sorts, though tech vendors such as mobile device makers cringe at some of the prognoses.

With Android Trojans, Shady Rat, and mobile malware, the security news has piled up this week. Take a minute to step back and look at these key issues that deserve your attention.

1. Ex-CIA Official: Cyber Threat Resembles Pre 9/11

The current threat of cyber terrorism reminds Cofer Black, former director of the CIA's counterterrorist center, of al Qaeda 9/11, he told Black Hat attendees in a keynote. At that time, Black said, U.S. leaders didn't comprehend the terrorist threat or its implications enough, InformationWeek.com's Mathew Schwartz reported.

"They didn't understand it. They had no personal experience with it," Black said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it." Will those decision-makers hear it soon? Let's hope so.

2. China Behind Shady Rat, Security Experts Say

McAfee researchers brought to light what it calls the Shady RAT (remote access tool) attacks this week, which the security vendor said successfully compromised at least 72 organizations, including 22 governmental agencies and contractors. While McAfee did not name China as the entity behind the five-year effort, the security community at Black Hat was not so shy with its opinion.

"Experts said there was little doubt who launched Shady RAT," InformationWeek.com's Schwartz reported. "This just further confirms what we already know, that China is doing these things," Joel Brenner, told InformationWeek at Black Hat. Brenner is former senior counsel to the National Security Agency, former head of U.S. counterintelligence under the director of national intelligence, and currently counsel to Cooley.

3. Androids Now An Appealing Target

Three of 10 Android users will likely find malware on their devices each year, according to a report from Lookout Security released this week. Some 500,000 to one million people already found one in 2011, the company said. In related news early this week, a CA researcher reported an Android Trojan with the ability to record phone calls. But as it turns out, this one wasn't as bad as CA believed.

Symantec researchers followed up later in the week with the news that the code was in fact an app, "widely available on multiple sites in China, with no effort made to conceal its function," InformationWeek.com's Robert Strohmeyer reported. The code did involve a speech recorder--and one application for it in China was people trying to check up on the fidelity of their spouses. Watch out Tiger Woods, but everyone else, just keep an eye on which mobile apps you trust. It's still often too hard to tell the good from the bad. By the way, check out our look at the 8 worst Android malware attacks to date.

4. Macs Vulnerable To Advanced Persistent Threats

As Apple moves further into the enterprise, is Apple keeping up with today's malware "innovators"? Today, Macs are "arguably even more vulnerable to APTs than Windows PCs, since many Mac-specific technologies are quite easy to exploit," InformationWeek.com's Schwartz reported.

Alex Stamos, co-founder and CTO of iSEC Partners told Black Hat attendees that he recommends limiting Mac access to some network resources. "We use Macs on our network," he said. "We treat them as I recommend you treat them--as little islands in a hostile network." For example, you may need to rethink DNS requests and simply avoid some technologies, he said. One example: Snow Leopard Server (10.6). Check out his real-world advice on how to deal with these risks.

Laurianne McLaughlin is editor-in-chief for InformationWeek.com. Follow her on Twitter at @lmclaughlin.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

CVE-2015-0235
Published: 2015-01-28
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVE-2015-0312
Published: 2015-01-28
Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVE-2015-0581
Published: 2015-01-28
The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related t...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.