Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/5/2011
08:57 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

The Week In Security: 4 Big Stories

Cyber threats as part of future wars, Android malware, and Shady Rats made news. Don't miss the week's key security stories.

InformationWeek Now--What's Hot Right Now
Whenever the security community gathers in Las Vegas for its annual Black Hat conference in Las Vegas, a UBM TechWeb event, you know some interesting technology vulnerabilities will be disclosed. It's an annual security checkup of sorts, though tech vendors such as mobile device makers cringe at some of the prognoses.

With Android Trojans, Shady Rat, and mobile malware, the security news has piled up this week. Take a minute to step back and look at these key issues that deserve your attention.

1. Ex-CIA Official: Cyber Threat Resembles Pre 9/11

The current threat of cyber terrorism reminds Cofer Black, former director of the CIA's counterterrorist center, of al Qaeda 9/11, he told Black Hat attendees in a keynote. At that time, Black said, U.S. leaders didn't comprehend the terrorist threat or its implications enough, InformationWeek.com's Mathew Schwartz reported.

"They didn't understand it. They had no personal experience with it," Black said. "The decision-makers of today are in the same boat [with cyber]. They hear it, but they don't understand it." Will those decision-makers hear it soon? Let's hope so.

2. China Behind Shady Rat, Security Experts Say

McAfee researchers brought to light what it calls the Shady RAT (remote access tool) attacks this week, which the security vendor said successfully compromised at least 72 organizations, including 22 governmental agencies and contractors. While McAfee did not name China as the entity behind the five-year effort, the security community at Black Hat was not so shy with its opinion.

"Experts said there was little doubt who launched Shady RAT," InformationWeek.com's Schwartz reported. "This just further confirms what we already know, that China is doing these things," Joel Brenner, told InformationWeek at Black Hat. Brenner is former senior counsel to the National Security Agency, former head of U.S. counterintelligence under the director of national intelligence, and currently counsel to Cooley.

3. Androids Now An Appealing Target

Three of 10 Android users will likely find malware on their devices each year, according to a report from Lookout Security released this week. Some 500,000 to one million people already found one in 2011, the company said. In related news early this week, a CA researcher reported an Android Trojan with the ability to record phone calls. But as it turns out, this one wasn't as bad as CA believed.

Symantec researchers followed up later in the week with the news that the code was in fact an app, "widely available on multiple sites in China, with no effort made to conceal its function," InformationWeek.com's Robert Strohmeyer reported. The code did involve a speech recorder--and one application for it in China was people trying to check up on the fidelity of their spouses. Watch out Tiger Woods, but everyone else, just keep an eye on which mobile apps you trust. It's still often too hard to tell the good from the bad. By the way, check out our look at the 8 worst Android malware attacks to date.

4. Macs Vulnerable To Advanced Persistent Threats

As Apple moves further into the enterprise, is Apple keeping up with today's malware "innovators"? Today, Macs are "arguably even more vulnerable to APTs than Windows PCs, since many Mac-specific technologies are quite easy to exploit," InformationWeek.com's Schwartz reported.

Alex Stamos, co-founder and CTO of iSEC Partners told Black Hat attendees that he recommends limiting Mac access to some network resources. "We use Macs on our network," he said. "We treat them as I recommend you treat them--as little islands in a hostile network." For example, you may need to rethink DNS requests and simply avoid some technologies, he said. One example: Snow Leopard Server (10.6). Check out his real-world advice on how to deal with these risks.

Laurianne McLaughlin is editor-in-chief for InformationWeek.com. Follow her on Twitter at @lmclaughlin.

The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Here's how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own company's security ignores the bigger picture. Download it now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5243
PUBLISHED: 2020-02-21
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent hea...
CVE-2019-14688
PUBLISHED: 2020-02-20
Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnerability that could be exploited during a new product installation. The vulnerability was found to ONLY be exploitable during an initial produc...
CVE-2019-19694
PUBLISHED: 2020-02-20
The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (DoS) attack in which a malicious actor could manipulate a key file at a certain time during the system startup process to disable the product's malware protection functions or the ...
CVE-2020-5242
PUBLISHED: 2020-02-20
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file whic...
CVE-2020-8601
PUBLISHED: 2020-02-20
Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located in the same directory.