Attacks/Breaches
8/5/2011
08:57 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

The Week In Security: 4 Big Stories

Cyber threats as part of future wars, Android malware, and Shady Rats made news. Don't miss the week's key security stories.

InformationWeek Now--What's Hot Right Now
Whenever the security community gathers in Las Vegas for its annual Black Hat conference in Las Vegas, a UBM TechWeb event, you know some interesting technology vulnerabilities will be disclosed. It's an annual security checkup of sorts, though tech vendors such as mobile device makers cringe at some of the prognoses.

With Android Trojans, Shady Rat, and mobile malware, the security news has piled up this week. Take a minute to step back and look at these key issues that deserve your attention.

1. Ex-CIA Official: Cyber Threat Resembles Pre 9/11

The current threat of cyber terrorism reminds Cofer Black, former director of the CIA's counterterrorist center, of al Qaeda 9/11, he told Black Hat attendees in a keynote. At that time, Black said, U.S. leaders didn't comprehend the terrorist threat or its implications enough, InformationWeek.com's Mathew Schwartz reported.

"They didn't understand it. They had no personal experience with it," Black said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it." Will those decision-makers hear it soon? Let's hope so.

2. China Behind Shady Rat, Security Experts Say

McAfee researchers brought to light what it calls the Shady RAT (remote access tool) attacks this week, which the security vendor said successfully compromised at least 72 organizations, including 22 governmental agencies and contractors. While McAfee did not name China as the entity behind the five-year effort, the security community at Black Hat was not so shy with its opinion.

"Experts said there was little doubt who launched Shady RAT," InformationWeek.com's Schwartz reported. "This just further confirms what we already know, that China is doing these things," Joel Brenner, told InformationWeek at Black Hat. Brenner is former senior counsel to the National Security Agency, former head of U.S. counterintelligence under the director of national intelligence, and currently counsel to Cooley.

3. Androids Now An Appealing Target

Three of 10 Android users will likely find malware on their devices each year, according to a report from Lookout Security released this week. Some 500,000 to one million people already found one in 2011, the company said. In related news early this week, a CA researcher reported an Android Trojan with the ability to record phone calls. But as it turns out, this one wasn't as bad as CA believed.

Symantec researchers followed up later in the week with the news that the code was in fact an app, "widely available on multiple sites in China, with no effort made to conceal its function," InformationWeek.com's Robert Strohmeyer reported. The code did involve a speech recorder--and one application for it in China was people trying to check up on the fidelity of their spouses. Watch out Tiger Woods, but everyone else, just keep an eye on which mobile apps you trust. It's still often too hard to tell the good from the bad. By the way, check out our look at the 8 worst Android malware attacks to date.

4. Macs Vulnerable To Advanced Persistent Threats

As Apple moves further into the enterprise, is Apple keeping up with today's malware "innovators"? Today, Macs are "arguably even more vulnerable to APTs than Windows PCs, since many Mac-specific technologies are quite easy to exploit," InformationWeek.com's Schwartz reported.

Alex Stamos, co-founder and CTO of iSEC Partners told Black Hat attendees that he recommends limiting Mac access to some network resources. "We use Macs on our network," he said. "We treat them as I recommend you treat them--as little islands in a hostile network." For example, you may need to rethink DNS requests and simply avoid some technologies, he said. One example: Snow Leopard Server (10.6). Check out his real-world advice on how to deal with these risks.

Laurianne McLaughlin is editor-in-chief for InformationWeek.com. Follow her on Twitter at @lmclaughlin.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This is a secure windows pc.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.