SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume XI - Issue #93
November 24, 2009
The CAG list of "User Vetted Tools for Automating the 20 Critical Controls" is now available at
http://www.sans.org/critical-security-controls/user-tools.php
If you know of a tool not on the list, that actually works effectively for automating any of the controls, please email cag@sans.org by December 15. The new CAG has metrics and tests and maps to the NIST guidelines - very cool:
https://www.sans.org/critical-security-controls/
The next step in the 20 critical controls is a nationwide consensus on the specifications needed for buying best of breed automation for each of the controls. We have drafts for Control 1 (Inventory) and 10 (Continuous vulnerability assessment). If you are (really) knowledgeable on either, please ask for one or both to add your input. cag@sans.org
Alan
TOP OF THE NEWS
Attacks Against Defense Dept. Systems On the RisePump-and-Dump Spammers Sentenced to Prison
Climate Research Documents Stolen and Posted to Internet
THE REST OF THE WEEK'S NEWS
Cross-Site Scripting Flaw in IE 8Zero-Day Flaw in Internet Explorer 6 and 7
iPhone Worm Steals Banking Data, Enlists Devices in Botnet
Hancock Fabrics Customers Reporting ATM Fraud
Opera Releases Updates Browser
Accident Victim Data Leaked From Las Vegas Hospital
****************** Sponsored By Absolute Software Corp. *****************
Laptop Data Security Webinar
In this webinar, Jack Heine, Research VP, Gartner, and David Holyoak, CIO of accounting firm Grant Thornton, discuss how to facilitate mobility while minimizing the risk of data exposure. These leading experts discuss the limitations of encryption and the critical layer of security provided by web-based tracking and anti-theft capabilities.
https://www.sans.org/info/51209
*************************************************************************
TRAINING UPDATE
-- SANS London, UK, November 28-December 6
16 courses, bonus evening sessions: Hex Factor, Forensics Mini Summit and more
https://sans.org/london09/
-- SANS CDI, Washington DC, December 11-18
24 courses, bonus evening presentations, including Future Trends in Network Security
https://www.sans.org/cyber-defense-initiative-2009
-- SANS Security East 2010, New Orleans, January 10-18, 2010. 19 courses, bonus evening presentations: Top 7 Trends in Incident Response and Computer Forensics, Advanced Forensic Techniques and more
https://www.sans.org/security-east-2010/
-- SANS AppSec 2010, San Francisco, January 29-February 5, 2010
https://www.sans.org/appsec-2010/
-- SANS Phoenix, February 14 -February 20, 2010
https://www.sans.org/phoenix-2010/
-- SANS 2010, Orlando, March 6 - March 15, 2010
https://www.sans.org/sans-2010/
Looking for training in your own community?
https://sans.org/community/
Save on On-Demand training (30 full courses)
- See samples at https://www.sans.org/ondemand/
Plus Ottawa, Tokyo and Bangalore all in the next 90 days.
For a list of all upcoming events, on-line and live: http://www.sans.org *************************************************************************
TOP OF THE NEWS
Attacks Against Defense Dept. Systems On the Rise (November 20 & 23, 2009)
According to the US-China Economic and Security Review Commission's annual report to Congress, US Defense Department (DoD) computer systems have been the target of cyber incidents 43,785 times in the first half of 2009; if the trend continues, cyber attacks against DoD systems will increase 60 percent over last year. The data regarding the attacks were provided by the US Strategic Command. The report says that a "large body of both circumstantial and forensic evidence strongly indicates Chinese state involvement in" the attacks. A Chinese Foreign Ministry spokesperson has said the report "is full of bias and has ulterior motives."-http://www.scmagazineus.com/report-cyberattacks-against-the-us-rising-sharply/ar
ticle/158236/
-http://www.computerworld.com/s/article/9141200/Cyberattacks_on_U.S._military_jum
p_sharply_in_2009?taxonomyId=17
-http://www.informationweek.com/news/government/security/showArticle.jhtml?articl
eID=221900505
-http://www.msnbc.msn.com/id/34108078/ns/technology_and_science-security/
Pump-and-Dump Spammers Sentenced to Prison (November 23, 2009)
A US District judge in Detroit today handed down prison sentences ranging from 32 months to 51 months to four men involved in a spamming stock fraud scheme. Alan M. Ralsky and his co-conspirators, Scott Bradley, How Wai John Hui, and John S. Brown orchestrated a pump-and-dump scheme in which they manipulated stock prices by sending out fraudulent emails. The scheme reportedly netted US $2.7 million.-http://www.justice.gov/opa/pr/2009/November/09-crm-1275.html
-http://www.freep.com/article/20091123/NEWS05/91123066/1002/BUSINESS/Spam-King-ge
ts-4-years-for-fraud
Climate Research Documents Stolen and Posted to Internet (November 20 & 21, 2009)
Attackers broke into computers at the Climatic Research Unit of the University of East Anglia in Britain and stole thousands of emails and other documents which they then posted to the Internet. Global warming skeptics say the documents support the notion that researchers have been skewing data to make the situation seem more ominous than it is. Researchers maintain that the information is being taken out of context.-http://www.washingtonpost.com/wp-dyn/content/article/2009/11/20/AR2009112004093_
pf.html
-http://www.computerworld.com/s/article/9141258/Global_warming_research_exposed_a
fter_hack?taxonomyId=17
-http://news.bbc.co.uk/2/hi/science/nature/8370282.stm
-http://www.v3.co.uk/v3/news/2253716/hackers-attack-uk-climate
************************ Sponsored Links: ****************************
1) REGISTER NOW for the upcoming webcast: Content-Aware SIEM with Anton Chuvakin
https://www.sans.org/info/51214
2) SANS Free Audio Cast: Why is Application Security so Hot? Why Smart Organizations are Focusing Security Efforts Here Featuring Jack Danahy, Security Executive, Office of the CTO at IBM.
https://www.sans.org/info/51219
***********************************************************************
THE REST OF THE WEEK'S NEWS
Cross-Site Scripting Flaw in IE 8 (November 23, 2009)
A cross-site scripting (XSS) vulnerability can be exploited to allow attacks on web pages that are otherwise safe. The vulnerability lies in a XSS filter added by Microsoft developers to help prevent XSS attacks. There is a way for webmasters to override the filter if they are concerned about the flaw being exploited.-http://www.theregister.co.uk/2009/11/20/internet_explorer_security_flaw/
Zero-Day Flaw in Internet Explorer 6 and 7 (November 22 & 23, 2009)
Microsoft has acknowledged the existence of a zero-day flaw in older versions of Internet Explorer (IE). Proof-of-concept exploit code for the vulnerability has been posted to the Internet; an attack could crash vulnerable systems or allow arbitrary code execution. The problem lies in the way the browser handles Cascading Style Sheet (CSS) information. Until a patch is available, users are encouraged to disable JavaScript, make sure their antivirus signatures are current, and visit only trusted websites. Upgrading to IE 8 could also help users' machines from this attack.-http://voices.washingtonpost.com/securityfix/2009/11/new_attack_targets_weakness
_in.html
-http://www.computerworld.com/s/article/9141278/New_attack_fells_Internet_Explore
r?source=CTWNLE_nlt_dailyam_2009-11-23
-http://www.computerworld.com/s/article/9141363/Microsoft_confirms_IE6_IE7_zero_d
ay_bug?source=rss_security
-http://www.h-online.com/security/news/item/New-critical-vulnerability-in-Interne
t-Explorer-866155.html
-http://www.eweek.com/c/a/Security/Microsoft-Confirms-Internet-Explorer-ZeroDay-V
ulnerability-761074/
-http://www.v3.co.uk/v3/news/2253767/remote-ie-flaw-discovered
iPhone Worm Steals Banking Data, Enlists Devices in Botnet (November 23, 2009)
A worm targeting jailbroken iPhones is designed to steal online banking login credentials. (A jailbroken iPhone is one that has been altered so that it can run applications that have not been approved by Apple.) This worm changes the iPhones' root password and then connects to a command-and-control server in Lithuania to download additional files and data and to send back stolen information. iPhones infected with the worm also become part of a botnet.-http://www.eweek.com/c/a/Security/Symantec-New-Apple-iPhone-Worm-Targeting-Jailb
roken-Phones-745255/
-http://www.msnbc.msn.com/id/34115776/ns/technology_and_science-security/
-http://www.scmagazineuk.com/new-iphone-worm-detected-that-is-designed-to-change-
the-passwords-on-jailbroken-handsets-and-connect-them-to-a-botnet/article/158305
/
-http://blogs.usatoday.com/technologylive/2009/11/worm-turns-iphones-into-bots.ht
ml
-http://arstechnica.com/apple/news/2009/11/malicious-attacks-continue-against-jai
lbroken-iphone-users.ars
[Editor's Comment (Northcutt): I think we are all going to need to pay more attention to smart phone/PDA security and iPhone security in particular. What is the risk of someone getting access to your list of contacts? iPhone users are going to need a "plan b", because this is only going to get worse. Hopefully someone will put an endpoint whitelist solution in the iPhone app store soon. In the mean time, consider getting a second cell phone that is SIM compatible with your iPhone for high risk periods. ]
Hancock Fabrics Customers Reporting ATM Fraud (November 23, 2009)
A rash of fraudulent ATM withdrawals is believed to be connected to victims' previous transactions at Hancock Fabrics stores in California, Wisconsin and Missouri. At least one of the stores had recently replaced its point-of-sale machines.-http://www.bankinfosecurity.com/articles.php?art_id=1961
New Version of Opera Browser Addresses Serious Security Issue (November 23, 2009)
Opera has released version 10.10 of its flagship browser to address a known heap buffer overflow vulnerability that could be exploited to crash vulnerable systems and execute arbitrary code. The flaw has already been patched in Chrome, Firefox and SeaMonkey. The underlying problem is a format string vulnerability in third-party implementations of the dtoa C function that is used for string-to-number conversions. Opera 10.10 also fixes two other flaws. Users are urged to upgrade as soon as possible.-http://www.h-online.com/security/news/item/Opera-10-10-closes-extremely-severe-h
ole-866803.html
-http://blogs.zdnet.com/security/?p=4990
Accident Victim Data Leaked From Las Vegas Hospital (November 21, 2009)
The FBI is looking into an alleged breach of privacy law at University Medical Center in Las Vegas, Nevada. Officials have recently learned that an employee allegedly leaked confidential patient data, including Social Security numbers (SSNs), billing data and descriptions of injuries. One news report alleges that the information has been sold. The breach could be a violation of the Health Insurance Portability and Accountability Act (HIPAA).-http://www.lasvegassun.com/news/2009/nov/21/fbi-looking-umc-records-leak/
-http://www.lvrj.com/news/fbi-probing-umc-data-leaks-70690527.html
**********************************************************************
The Editorial Board of SANS NewsBites
Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Advisory Capability (CIAC).
John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.
Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.
Rohit Dhamankar is the Director of Security Research at TippingPoint, where he leads the Digital Vaccine and ThreatLinQ groups. His group develops protection filters to address vulnerabilities, viruses, worms, Trojans, P2P, spyware, and other applications for use in TippingPoint's Intrusion Prevention Systems.
Prof. Howard A. Schmidt is the President of the Information Security Forum (ISF) and author who has served as CSO for Microsoft and eBay and as Vice-Chair of the President's Critical Infrastructure Protection Board.
Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a senior Lockheed Martin Fellow.
Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Mark Weatherford, CISSP, CISM, is Chief Information Security Officer of the State of California.
Alan Paller is director of research at the SANS Institute.
Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.
Clint Kreitner is the founding President and CEO of The Center for Internet Security.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/
