Attacks/Breaches
8/5/2011
08:57 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

The Week In Security: 4 Big Stories

Cyber threats as part of future wars, Android malware, and Shady Rats made news. Don't miss the week's key security stories.

InformationWeek Now--What's Hot Right Now
Whenever the security community gathers in Las Vegas for its annual Black Hat conference in Las Vegas, a UBM TechWeb event, you know some interesting technology vulnerabilities will be disclosed. It's an annual security checkup of sorts, though tech vendors such as mobile device makers cringe at some of the prognoses.

With Android Trojans, Shady Rat, and mobile malware, the security news has piled up this week. Take a minute to step back and look at these key issues that deserve your attention.

1. Ex-CIA Official: Cyber Threat Resembles Pre 9/11

The current threat of cyber terrorism reminds Cofer Black, former director of the CIA's counterterrorist center, of al Qaeda 9/11, he told Black Hat attendees in a keynote. At that time, Black said, U.S. leaders didn't comprehend the terrorist threat or its implications enough, InformationWeek.com's Mathew Schwartz reported.

"They didn't understand it. They had no personal experience with it," Black said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it." Will those decision-makers hear it soon? Let's hope so.

2. China Behind Shady Rat, Security Experts Say

McAfee researchers brought to light what it calls the Shady RAT (remote access tool) attacks this week, which the security vendor said successfully compromised at least 72 organizations, including 22 governmental agencies and contractors. While McAfee did not name China as the entity behind the five-year effort, the security community at Black Hat was not so shy with its opinion.

"Experts said there was little doubt who launched Shady RAT," InformationWeek.com's Schwartz reported. "This just further confirms what we already know, that China is doing these things," Joel Brenner, told InformationWeek at Black Hat. Brenner is former senior counsel to the National Security Agency, former head of U.S. counterintelligence under the director of national intelligence, and currently counsel to Cooley.

3. Androids Now An Appealing Target

Three of 10 Android users will likely find malware on their devices each year, according to a report from Lookout Security released this week. Some 500,000 to one million people already found one in 2011, the company said. In related news early this week, a CA researcher reported an Android Trojan with the ability to record phone calls. But as it turns out, this one wasn't as bad as CA believed.

Symantec researchers followed up later in the week with the news that the code was in fact an app, "widely available on multiple sites in China, with no effort made to conceal its function," InformationWeek.com's Robert Strohmeyer reported. The code did involve a speech recorder--and one application for it in China was people trying to check up on the fidelity of their spouses. Watch out Tiger Woods, but everyone else, just keep an eye on which mobile apps you trust. It's still often too hard to tell the good from the bad. By the way, check out our look at the 8 worst Android malware attacks to date.

4. Macs Vulnerable To Advanced Persistent Threats

As Apple moves further into the enterprise, is Apple keeping up with today's malware "innovators"? Today, Macs are "arguably even more vulnerable to APTs than Windows PCs, since many Mac-specific technologies are quite easy to exploit," InformationWeek.com's Schwartz reported.

Alex Stamos, co-founder and CTO of iSEC Partners told Black Hat attendees that he recommends limiting Mac access to some network resources. "We use Macs on our network," he said. "We treat them as I recommend you treat them--as little islands in a hostile network." For example, you may need to rethink DNS requests and simply avoid some technologies, he said. One example: Snow Leopard Server (10.6). Check out his real-world advice on how to deal with these risks.

Laurianne McLaughlin is editor-in-chief for InformationWeek.com. Follow her on Twitter at @lmclaughlin.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1032
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party inf...

CVE-2012-1417
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.

CVE-2012-1506
Published: 2014-09-17
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from th...

CVE-2012-1507
Published: 2014-09-17
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index...

CVE-2012-2583
Published: 2014-09-17
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.

Best of the Web
Dark Reading Radio