SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume XII - Issue #102
December 28, 2010
TOP OF THE NEWS
Stuxnet May be Responsible for Decommissioning of 1,000 Centrifuges at Iranian Uranium Enrichment FacilityGermany to Establish National Cyber Defense Center
Missouri Escrow Company Sues Bank Over Unauthorized Electronic Transfer
THE REST OF THE WEEK'S NEWS
Hackers Target Carders.cc and Five Other SitesFCC's Net Neutrality Rules to Face Hurdles
Security Not Always a Consideration in Web Connected Gadgets
Man Facing Possible Prison Time for Reading Wife's eMail
Napolitano Reiterates DHS's Commitment to Cyber Security
******************** Sponsored By SANS 2011 ****************************
SANS 2011 in Orlando is now taking registration for 39 courses. Bonus evening presentations and special events include Hiding in Plain Sight: Forensic Techniques to Counter the Advanced Persistent Threat; and Law and the Public's Perception of Data Security.
http://www.sans.org/sans-2011/">http://www.sans.org/sans-2011/
*************************************************************************
TRAINING UPDATE
New "Combating Malware in the Enterprise" course at SANS (SEC569). How do you fight off malware when you have thousands of hosts? Learn the answers in Orlando in March:
http://www.sans.org/security-training/combating-malware-enterprise-1482-mid
-- SANS Security East 2011, New Orleans, LA, January 20-27, 2011 12 courses. Bonus evening presentations and special events include Happy Little Clouds: Governing, Assessing and Auditing Cloud Environments; and Future Trends in Network Security
http://www.sans.org/security-east-2011/
-- North American SCADA 2011, Lake Buena Vista, FL, February 23-March 2, 2011
http://www.sans.org/north-american-scada-2011/
-- SANS Phoenix 2011, Phoenix, AZ, February 25-March 2, 2011 6 courses. Bonus evening presentations and special events include Indicators of Compromise: ABCs of IOCs and Network Vulnerability Exploitation, Step By Step From Discovery through to Metasploit Module
http://www.sans.org/phoenix-2011/
-- SANS AppSec 2011: Summit & Training, San Francisco, CA, March 7-14, 2011 7 courses. Bonus evening presentations and special events includes The Road to Sustainable Security
http://www.sans.org/appsec-2011/
-- SANS 2011, Orlando, FL, March 27-April 4, 2011 39 courses. Bonus evening presentations and special events include Hiding in Plain Sight: Forensic Techniques to Counter the Advanced Persistent Threat; and Law and the Public's Perception of Data Security
http://www.sans.org/sans-2011/">http://www.sans.org/sans-2011/
-- Looking for training in your own community?
http://sans.org/community/
Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Atlanta, Bangalore, Singapore and Barcelona all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/index.php ****************************************************************************
TOP OF THE NEWS
Stuxnet May be Responsible for Decommissioning of 1,000 Centrifuges at Iranian Uranium Enrichment Facility (December 24 & 27, 2010)
According to a report prepared by the Institute for Science and International Security, the Stuxnet worm may have been responsible for putting as many as 1,000 centrifuges out of service at the Natanz uranium enrichment facility in Iran. The plant currently has IR-1 10,000 centrifuges. Stuxnet contains code that causes these IR-1 centrifuges' rotors to vary their speed in such a way that their motors are damaged.-http://www.jpost.com/Defense/Article.aspx?ID=200843&R=R1
-http://www.wired.com/threatlevel/2010/12/isis-report-on-stuxnet/
Germany to Establish National Cyber Defense Center (December 27, 2010)
Germany's Interior Ministry has announced that it will establish a National Cyber Defense Center next year. Government spokesperson Stefan Paris said that government systems recorded 1,600 attacks in the first six months of 2010, a significant increase over the 900 attacks reported in all of 2009. Paris acknowledged that there were likely many more attacks that were not detected. The government believes the majority of the attacks originated in China.-http://uk.reuters.com/article/idUKTRE6BQ2JS20101227
-http://www.google.com/hostednews/afp/article/ALeqM5hNZEw4FdQReC4SDVsk0KxGwp1png?
docId=CNG.742e6f8c140c9fad9f90528e14966d4e.1c1
[Editor's Note (Cole): The awareness that so many attacks are not detected is a wakeup call to look more closely at the traffic that is leaving your network, identifying anomalies or strange patterns in the traffic. Since many organizations are broken into and do not realize it, the more proactive you are the better. Prevention is important, but detection is a must. ]
Missouri Escrow Company Sues Bank Over Unauthorized Electronic Transfer (December 26, 2010)
A Missouri escrow company is suing BancorpSouth Bank for failing to take adequate precautions against unauthorized funds transfers. Choice Escrow lost US $440,000 from their BancorpSouth account to cyber thieves, and the bank has refused to refund the money. The company's director of business development, Jim A. Payne, is urging legislators at the state and federal level to pass laws that would force banks that do not implement effective security measures to cover losses from unauthorized transfers from commercial accounts. Cyber security blogger Brian Krebs broke the story more than a month ago. He observed that banks often blame the clients for the thefts, saying that it's their fault for allowing their computers to become infected with malware. But Krebs says that "any security or authentication mechanism that does not start with the assumption that the customer's system is already compromised by malicious software does not have a prayer of defeating today's malicious attacks."-http://krebsonsecurity.com/2010/11/escrow-co-sues-bank-over-440k-cyber-theft/
-http://www.news-leader.com/article/20101226/BUSINESS/12260323/Hacker-blamed-for-
theft
[Editor's Note (Schultz): I agree with Krebs. Financial institutions should assume the worst case when it comes to security in customer computers and should at a minimum provide customers with software and/or services that provide a high amount of assurance that these computers have not been compromised.
(Ranum): The bank performing the transaction cannot reasonably be expected to assume responsibility for an endpoint they have no ability to control. Legislating that banks "implement effective security measures" is nonsensical, since 'effective' measures would have to include things that are not widely in use today because they are considered onerous. ]
THE REST OF THE WEEK'S NEWS
Hackers Target Carders.cc and Five Other Sites (December 27, 2010)
On December 25, hackers broke into Carders.cc, exploit-db.org, backtrack-linux.org and three other websites to demonstrate their lapses in security. All of the targeted sites either have criminal ties or are run by security experts whose security was not up to par. It is the second time in a year that this particular group has broken into Carders.cc, an underground forum used by cyber criminals for trading stolen credit card information. The first time the attackers broke into Carders.cc, they posted some of the stolen credit card numbers they found there; this time, no numbers were published.-http://www.h-online.com/security/news/item/Merry-Haxmas-1159312.html
-http://krebsonsecurity.com/2010/12/carders-cc-linux-exploit-org-and-exploit-db-o
rg-hacked/
-http://www.eweek.com/c/a/Security/Hackers-Attack-Criminal-Sites-Security-Experts
-to-Expose-Security-Flaws-296445/
[Editor's Comment (Northcutt): In this era of organized crime hacking for money, we have not seen a lot of 1990s-era hacking for glory. But between Gawker and this, we may be seeing a bit of a turnaround. Some of the posts and papers from #27C3 lead me to think there is a growing sense in the security community that if we don't start to take control of the situation we will descend into chaos.
-http://www.huffingtonpost.com/2010/12/12/gawker-hack-hacked-databa_n_795613.html
-http://events.ccc.de/]
FCC's Net Neutrality Rules to Face Hurdles (December 26, 2010)
The net neutrality rules approved by the US Federal Communications Commission (FCC) last week are likely to face legal challenges and attempts by Republican lawmakers to repeal them. The question is not whether the rules will be challenged in court, but rather, who will file the lawsuit. The key legal question is likely to be whether the FCC has the authority to establish the rules. An April ruling from the US Court of Appeals for the District of Columbia Circuit curtailed the FCC's effort to enforce net neutrality in a case involving Comcast.-http://www.pcworld.com/businesscenter/article/214936/whats_next_for_the_fcc_and_
net_neutrality.html
Security Not Always a Consideration in Web Connected Gadgets (December 26, 2010)
Researchers are discovering that new gadgets designed to connect to the Internet, such as smartphones and certain HDTVs, are not always being designed with security in mind. Hackers shifting their focus to these devices is inevitable as the Internet-ready gadgets become more and more ubiquitous. Protecting the devices from attacks will also require new approaches. In some cases, the volume of mobile phone apps offered makes it impossible to vet them all adequately.-http://www.nytimes.com/2010/12/27/technology/27hack.html?_r=1&ref=technology
[Editor's Note (Schultz): Saying that security is not always a consideration in Web connected devices is a gross understatement. Because mobile device applications are intended for single-user contexts, there is little or no authentication and authorization in most of these applications. Critical security functions such as data encryption and auditing are also almost always missing.
(Cole): With the holiday season wrapping up this is a good time to remind your family to do a few important things with regard to security: 1) turn off Bluetooth and other services that are not needed; 2) always run some form of security on your wireless; 3) put any web enabled devices behind a firewall or filtering device. ]
Man Facing Possible Prison Time for Reading Wife's eMail (December 27, 2010)
A Michigan man could face up to five years in prison for reading his wife's email. Leon Walker found his wife's (Clara Walker) gmail password in a notebook and used it to access her account, from which he learned that she was having an affair. Leon Walker is Clara Walker's third husband. The email disclosed that she was having an affair with her second husband, who has a history of domestic violence against her. Leon Walker shared the information with Clara Walker's first husband, the father of her son, who filed an emergency motion for custody. Walker is facing a felony charge under a law that is aimed at prosecuting people who have committed identity theft or have stolen trade secrets. His trial is slated to begin in February 2011.-http://www.guardian.co.uk/world/2010/dec/27/us-man-hacking-wifes-emailss
-http://news.cnet.com/8301-17852_3-20026611-71.html
-http://content.usatoday.com/communities/ondeadline/post/2010/12/man-charged-with
-felony-for-reading-his-wifes-email/1
Napolitano Reiterates DHS's Commitment to Cyber Security (December 22, 2010)
In a speech in Washington DC earlier this month, Department of Homeland Security (DHS) Secretary Janet Napolitano said she sees cyber security as DHS's primary responsibility. Napolitano said that "cyberspace is fundamentally a civilian space, and government has a role to help protect it, in partnership with responsible partners across the economy and across the globe." She noted the devastating effect a major cyber attack could have on components of the country's critical infrastructure and listed DHS's recent cyber security-related accomplishments, including the launch of the National Cybersecurity and Communications Integration Center.-http://www.infosecurity-us.com/view/14831/dhs-secretary-to-industry-military-hey
-you-get-out-of-my-space/
-http://www.informationweek.com/news/government/security/showArticle.jhtml?articl
eID=228800919&cid=RSSfeed_IWK_All
**********************************************************************
The Editorial Board of SANS NewsBites
Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Adv isory Capability (CIAC)
John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.
Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.
Rob Lee is the curriculum lead instructor for the SANS Institute's computer forensic courses (computer-forensics.sans.org) and a Director at the incident response company Mandiant.
Rohit Dhamankar is a security professional currently involved in independent security research.
Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a founder with Secure Anchor Consulting.
Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Mark Weatherford, CISSP, CISM, is Chief Information Security Officer at the North American Energy Reliability Commission (NERC).
Alan Paller is director of research at the SANS Institute.
Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.
Clint Kreitner is the founding President and CEO of The Center for Internet Security.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/
