Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
Password-Stealing Malware Spikes
McAfee's recent report on malware has staggering numbers that are simply hard to believe, yet because I've been battling daily the very bots, Trojans, and scareware they researchers are talking about, I can't help but agree.
Cyber-Crime No Longer Smash and Grab
Typically, banking customers discovered they'd been victimized by cyber-crime when they discovered their bank accounts emptied. No more. According to this report, online thieves are getting craftier at covering their tracks to go undetected for longer stretches of time.
Stupid IRS Spam
I believe that anyone who uses the Internet on a regular basis has to know that most e-mail messages are spam, and possibly part of a fraud scheme. I also realize that some people are more aware than others, and that some criminals are clever. But the current spread of an email message that claims to be from the IRS accusing a person of fraud demonstrates that naivete that runs deep on the Internet.
Disaster Recovery: SMBs Think They're Ready. Symantec Says They're Not.
A new Symantec study of small and midsized business disaster recovery preparedness reveals a dramatic disconnect between DR beliefs and DR realities. Namely, most businesses are convinced they're prepared to recover from a disaster. Wrong.
Making Server Virtualization Storage More Scalable
Storage scalability in a virtualized environment is quickly becoming a concern for some data centers. Unlike the very predictable single server world which had a single application, single NIC card and single host bus adapter, the virtualized host can have dozens of virtual machines and multiple network interface cards. This leads to a very unpredictable and random workload that can push storage controllers to their limits.
IRS virus demonstrates stupidity is rampant
The proliferation of the current IRS virus demonstrates stupidity is rampant on the Internet.
Security By Geography: Stop A Country With A Click
I'm hoping that it's more than a mere reinforcement of America's most unfortunate xenophobic tendencies, but TechGuard Security's new PoliWall ESE security appliances take a geographic approach to SMB security by filtering IP according to their country of origin.
Dutch ISPs Sign Anti-Botnet Treaty
Netherlands ISPs last month launched a joint effort to fight malware-infected computers and botnets -- fondly described by locals as a "treaty."
Metasploit Adds Exploit For Unpatched Windows SMBv2 Bug
The upcoming stable release of Metasploit Framework version 3.3 is brimming with awesome new features that will make a lot of penetration testers happy. New features include the ability to take screenshots of exploited systems, while others add raw power, like being able to exploit the unpatched SMBv2 vulnerability in Windows Vista and Server 2008.
Reducing The Storage Costs In Server Virtualization
One of the most expensive components of a server virtualization project is the storage which it is attached to. This is one of the reasons that VMworld seems more like a storage event than a server virtualization event. One of the key themes from vendors at this years event was reducing the storage costs in server virtualization projects.
Hacking Gets Physical
The guilty plea entered into federal court last week, by a contract IT worker, for disrupting a computer system used to monitor off-shore oil platforms shows that illegal hacking is likely to increasingly danger the physical world.
SMB Security Provider Sees $1 Billion Markets Becoming $100 Million Markets
Walter Scott, CEO of Malta-based GFI Software, says that a combination of decreasing bandwidth costs and increasingly cost-conscious small and midsize companies are changing the security landscape.
Wolfe's Den Podcast: Trend Micro Takes Security To The Cloud
Eva Chen, CEO and co-founder of Trend Micro, talks about what cloud-computing users should do to secure their data and how her company is itself using the cloud to protect against the explosion of malware.
Online Bank Fraud: 5 Riskpoints Your Business Needs To Worry About
How much do you know about the security habits, practices, technologies policies of your business's online bank and other financial services and institutions? Odds are, if Terry Austin of Guardian Analytics is right, it's nowhere near enough.
BeEF: XSS Vuln To Hack In Less Than 20 Characters
As I'm finishing another successful Web application penetration test, I'm kicking myself for not noticing a new release of one of my all-time favorite Web hacking tools, the Browser Exploitation Framework (BeEF). BeEFis a fantastic tool for getting across to developers and Web admins the seriousness of vulnerabilities like cross-site scripting (XSS).
Debit Or Credit? Neither
I stopped using my debit card altogether a couple of years ago out of an intense fear that I would never recoup the losses if my card were skimmed in the grocery-store line or compromised at TJ Maxx. Now I casually slide my checkbook onto the card reader stand and perform that rare act of putting pen to paper while trying to avoid the annoyed stares of shoppers behind me in line who may lose a few seconds off of their shopping time because I didn't use plastic.
Survey Says: PCI DSS Compliance Not Strategic
That's right. A survey conducted by the Ponemon Institute, and backed by security firm Imperva, says that the vast majority of firms don't view the Payment Card Industry Data Security Standard (PCI DSS) as a strategic initiative.
Spammers To Idaho: You're The Tops!
Spam targeting is one of those categories you don't want to be Number One in, but somebody has to be. According to a new report from MessageLabs, the top spam targets in the U.S. live in Idaho. But the rest of the states aren't that much better off.
Implementing Power Efficient Drives
Most green storage methods really allow you to store more data in the same physical space, for the same amount of power consumption. To get serious about power efficiency you have to be able to turn things off. The ideal way to do this is have the drives either spin down or turn them off, but there is limited information about implementing power efficient drives.
Scareware And Bots Require Layered Defenses
Defense in depth is not a new idea in security, but the importance of taking a layered approach is more important than ever. The current rise in infections by bots and scareware, along with recent reports on anti-malware endpoint protection, demonstrate how we need to be doing more at every layer.
Credit Card Compliance Still Poorly Practiced
A new survey from Imperva and the Ponemon Institute finds that despite the rising number of data breaches, many companies still do not fully adhere to compliance standards. And many of those that are protecting credit card information are neglecting security when it comes to other, equally sensitive data. Smaller businesses may be having the most trouble with the standards.
Security Software Market Remains Strong
While the growth of the security software market took a hit this year, along with most every other market segment, it's still pegged to grow 8 percent, year over year, according to a market research firm. There's also stronger growth ahead.
The Search For A Perfect Corporate Password Policy
What qualifies as a safe and sane password policy for your business? A recent blog post serves up some interesting answers to this question.
Think Your Anti-Virus Is Working? Think Again
Most enterprises and Web users probably think that if they simply keep their anti-virus systems up to date, that they're in good shape. A pair of reports published by NSS Labs today dispels any such notion.
SANS Honeypot Shows Prevalence Of Web Attacks
The recent New York Times malvertisement attack helped bring mainstream media attention to the problem of popular, legitimate Websites being compromised and used as the source of Web-based malware attacks. What would probably shock those same people is how often Websites are attacked.
Classifying Green Storage
There is an ever increasing emphasis by storage suppliers on the power efficiency of their systems. There is also an increasing interest from IT managers on making their environment more power efficient. This is being driven not so much by the desire to be environmentally sensitive, but more because an increasing number of data centers simply can't get more power to the building.
Microsoft Steps Up To Squash Malicious Advertising Threat
While the move by Microsoft to file five civil lawsuits to help fight malicious online advertisers, the winning bet is probably not going to be on this having a big impact on malicious advertising any time soon. There's just too much money being made.
Live Chat With A Cybercrook! Popup Talk Latest Scam
Phishers have always counted on volume and automation to generate revenues: scam mails by the millions, proliferating malware links, a deluge of devious and deceptive tools designed to grab info from the unsuspecting. Now they're using chat to pluck their pigeons one-on-one.
Backup Vs. Recovery
One thing suppliers and analysts are quick to point out is that when it comes to data protection it is not about how well you backup, it is about how well you recover. That sounds very catchy and for the most part is accurate. I believe however, that backup is an equally important part of the data protection puzzle. It is after all poor backup strategies that make recovery so hard and unpredictable.
A Trick For Defending WordPress, Other Apps
There's a little trick -- or basic security measure -- you can use to help protect your WordPress blog and other Web applications against the never-ending bombardment of new vulnerabilities and exploits.
Systems Infected Tend To Stay Infected
Think most PC and end point infections are quick hits? Think again. Research released today shows that once infected, systems tend to stay that way for a long, long time.
Anatomy Of A Client-Side Attack Using Metasploit
A new report from the SANS Institute sheds light on some important attack trends that security professionals need to take action on immediately.
iPhone Security Fix May Reveal Longstanding Vulnerability
The latest release of the OS for iPhones and iPod Touches breaks the Microsoft Exchange Server compatibility of many existing devices. In doing so, it may have revealed that businesses that trusted Apple's assurances about the devices' security were misled.
NY Times Website Infected With Fake Antivirus
The New York Times Website became the victim of a malicious Internet-based advertisement over the weekend. Users of certain sections of NYTimes.com encountered notifications that they were infected with malware and needed to install the antivirus software linked from the notification. And if you've dealt with a user, friend, or family member who's fallen for this sort of ruse, then you know the AV software is really just malware posing as AV.
SQL Vulnerabilities Continue To Plague Web Security
A gray-hat hacker with a reputation for outing corporate Web site vulnerabilities says he's uncovered SQL injection flaws in the Web site of RBS WorldPay. RBS responded, saying no customer data was accessed.
Hacking A Board Meeting
A client recently asked us to gain access to its facility and attend a meeting of the board and executive management. Here at Secure Network we've been asked to gain access to numerous networks via social engineering techniques, but this job seemed rather unachievable at first. Turns out it was easier than we expected.
New York Times Malware Problem: All The Scamware That's Unfit To Post
This weekend's eruption of popup antivirus scam ads on The New York Times site offers a couple of opportunities, the most important of which is to remind your employees of the increasing aggressiveness of rogue antivirus malware.
SSD Drives OPEX Savings Too
Solid State Disk (SSD) is often the solution to drive up performance of a particular application, increasing response time to users and thereby increasing revenue or productivity. There can also be significant CAPEX savings by implementing SSD, what is often missing from the discussion is the operational or OPEX savings that comes from implementing SSDs.
All Forensic Investigators Are Not Created Equal
I've always had a predilection toward incident response and forensics. For some reason, I just like digging through a compromised system, network flow data, and unknown binaries to figure out what happened -- it gives me a rush.
Ethics, Integrity, and Playing Nice
As security professionals we are paid to know how to do bad things. We must know how to do these bad things in order to defend from bad people. What separates us from the criminals is our integrity. We hack for the good of humanity.
Blacklisting For Extra Mail Server Security
A majority of systems around the world use Internet blacklists as lists of IP addresses that are most likely compromised -- by bots -- and used by these systems to block or otherwise filter email. However, these lists can sometimes be used beyond the blacklist's design intent for increased security, but only after careful consideration.
New Warnings On EMP Threat
More than 800 people registered for a conference being held in Niagara Falls, NY to discuss the possible nightmare outcome of an electromagnetic pulse (EMP) attack on the continental U.S. A fix is startlingly cheap, but remains ignored.
Why Social Engineers Need Training
Many security professionals who think they know anything about penetration testing also think they know enough to perform social engineering. After all, they are successful time and time again, so they think they know what they are doing. However, what follows is a textbook example of how a little knowledge in the wrong hands can be very dangerous.
The End Of The Storage Volume
Traditional volumes have been around as long as we have had file systems, but now may be the time to pronounce the end of the storage volume. As data centers get larger and storage systems are populated with more and more physical drives they are growing into a storage manager's nightmare. There are just too many volumes of drives to be managed effectively.
Windows XP, 2000 Left Patchless Against DoS Attacks
I think most people would agree that Windows Millennium Edition (ME) was the bastard child Microsoft wanted to turn its back on. After yesterday's Patch Tuesday, I'm starting to think Windows XP and Windows 2000 have joined the ME ranks.
Wordpress Hack And Other Patch Problems Demand Patch Policies
The recent Wordpress hack, affecting older, unpatched versions of the blogware, as well as the raft of critical patches Microsoft released yesterday make this a good time to review -- or implement! -- an effective patch policy.
The Efficiency Roadblock To Virtualization
In my last entry we discussed some of the challenges storage presents to expanding the level at which companies deploy virtualized servers. There is another, potentially larger roadblock to virtualization; staff inefficiency.
Patch Tuesday: Five Critical
Security managers and operation teams will be greeted with a handful of significant Microsoft patches when they return to work Tuesday afternoon. Unfortunately for them, the most aggravation and the significant danger may come from the patch that isn't on the docket.
The Story Of A Girl I Met Online
I have met many people online during the past two decades, and I have many stories to tell. The latest is about a girl who decided I was her future husband.
Hosting Kevin Mitnick
It's not easy being Kevin Mitnick: The reformed black hat hacker may sue AT&T after it kicked him off its wireless network, and his Web hosting provider dropped him after his Website suffered a nasty hack last month. Seems he has become too big a target for some network and hosting providers.
|
Everything You Need to Know About DNS AttacksIt's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask.
Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted.
Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
