SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume XII - Issue #103
December 31, 2010
TOP OF THE NEWS
Apple Facing Lawsuits Over iOS User Data SharingSCADA Spending Projections Up
THE REST OF THE WEEK'S NEWS
Attackers Exploiting Known Rich Text Format Vulnerability in Microsoft WordFederal Agents Seize Data from Servers Allegedly Used in Pro-WikiLeaks PayPal Attack
4Chan Suffers Attacked
ChronoPay.com Suffers Redirect Attack
Woman Arrested for Allegedly Selling Insider Info on Tech Companies
Trojan Targets Android OS
NIST Issues Final Version of IPv6 Deployment Guidelines
Wired.com Responds to WikiLeaks Coverage Criticism
Mozilla Says Old Password Exposure a Low Risk Incident
******************** Sponsored By SANS 2011 ****************************
SANS 2011 in Orlando is now taking registrations. 39 courses. Bonus evening presentations and special events include Hiding in Plain Sight: Forensic Techniques to Counter the Advanced Persistent Threat; and Law and the Public's Perception of Data Security
http://www.sans.org/sans-2011/">http://www.sans.org/sans-2011/
************************************************************************* TRAINING UPDATE
New "Combating Malware in the Enterprise" course at SANS (SEC569). How do you fight off malware when you have thousands of hosts? Learn the answers in Orlando in March:
http://www.sans.org/security-training/combating-malware-enterprise-1482-mid
-- SANS Security East 2011, New Orleans, LA, January 20-27, 2011 12 courses. Bonus evening presentations and special events include Happy Little Clouds: Governing, Assessing and Auditing Cloud Environments; and Future Trends in Network Security
http://www.sans.org/security-east-2011/
-- North American SCADA 2011, Lake Buena Vista, FL, February 23-March 2, 2011
http://www.sans.org/north-american-scada-2011/
-- SANS Phoenix 2011, Phoenix, AZ, February 25-March 2, 2011 6 courses. Bonus evening presentations and special events include Indicators of Compromise: ABCs of IOCs and Network Vulnerability Exploitation, Step By Step From Discovery through to Metasploit Module
http://www.sans.org/phoenix-2011/
-- SANS AppSec 2011: Summit & Training, San Francisco, CA, March 7-14, 2011 7 courses. Bonus evening presentations and special events includes The Road to Sustainable Security
http://www.sans.org/appsec-2011/
-- SANS 2011, Orlando, FL, March 27-April 4, 2011 39 courses. Bonus evening presentations and special events include Hiding in Plain Sight: Forensic Techniques to Counter the Advanced Persistent Threat; and Law and the Public's Perception of Data Security
http://www.sans.org/sans-2011/">http://www.sans.org/sans-2011/
- - -- Looking for training in your own community?
http://sans.org/community/
Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Atlanta, Bangalore, Singapore and Barcelona all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/index.php ****************************************************************************
TOP OF THE NEWS
Apple Facing Lawsuits Over iOS User Data Sharing (December 28, 2010)
Apple is facing a pair of lawsuits over its sharing of information from Unique Device Identifiers (UDIDs) with advertising networks. The lawsuits, both filed in California, allege that Apple iPhones and iPads allow advertising networks to track users' behavior. Specifically, the suits allege that the devices' operating systems are being used to send personal information to advertisers - the information includes apps that users download and how often and for how long the apps are used. The data are being shared with advertisers without users' permission.-http://technolog.msnbc.msn.com/_news/2010/12/28/5725165-apple-sued-for-sharing-u
sers-information-with-advertisers
-http://news.cnet.com/8301-13579_3-20026677-37.html?tag=mncol;title
-http://www.eweek.com/c/a/Mobile-and-Wireless/Apple-Allowed-Advertisers-Access-to
-iPhone-iPad-Owners-Data-Report-595599/
-http://www.theregister.co.uk/2010/12/28/apple_privacy_lawsuit/
[Editor's Note (Ranum): I think it's probably worth emphasizing that the data are not being "shared" with advertisers: they are being sold. ]
SCADA Spending Projections Up (December 27, 2010)
Statistics from research firm Frost & Sullivan indicate that the Supervisory Control and Data Acquisition (SCADA) market is expected to grow from $4.6 billion last year to nearly US $7 billion in 2016. The advent of Stuxnet has brought the issue of SCADA security to headlines around the world. The Frost & Sullivan report indicates that companies expect to include security in their SCADA spending.-http://www.informationweek.com/blog/main/archives/2010/12/scada_security.html
[Editor's Note (Paller): The people shaping the future of SCADA security are getting together in Orlando at the end of February. Most of the major electric utilities and the key suppliers will be there along with water, gas & oil, and other major users. Government speakers will unveil new pathays and improved resources, If you play a roll in securing the critical infrastructure, this is the one meeting to attend early in 2011.
-http://www.sans.org/north-american-scada-2011/]
********************** Sponsored Link: *****************************
1) Wondering how to protect SCADA and other control systems? The North American SCADA conference can help you create a game plan to prevent future attacks. ( http://www.sans.org/info/68424 ), Lake Buena Vista, Florida, February 23 - March 2, 2011 ***********************************************************************
THE REST OF THE WEEK'S NEWS
Attackers Exploiting Known Rich Text Format Vulnerability in Microsoft Word (December 30, 2010)
The Microsoft Malware Protection Center Threat Research & Response blog communicated a warning about active attacks on Windows machines. The exploit involves using a RTF (rich text format) file to create a stack overflow in Word running on Windows. The vulnerability was patched in Microsoft Word 2002, 2003, 2007 and 2010 in November's batch of updates; the flaw has also been fixed in Word 2008 and 2011, but Word 2004 for Macintosh is still vulnerable. Users who have not downloaded the November patch are urged to do so as soon as possible.-http://www.computerworld.com/s/article/9202819/Microsoft_warns_of_Word_attacks
-http://blogs.technet.com/b/mmpc/archive/2010/12/29/targeted-attacks-against-rece
ntly-addressed-microsoft-office-vulnerability-cve-2010-3333-ms10-087.aspx
Federal Agents Seize Data from Servers Allegedly Used in Pro-WikiLeaks PayPal Attack (December 30, 2010)
US federal agents have seized records at Texas hosting company Tailor Made Services because servers there were allegedly used to launch a distributed denial-of-service (DDoS) attack against PayPal. The attack appears to have been prompted by PayPal's decision to freeze a WikiLeaks account. The FBI obtained from PayPal eight IP addresses associated with planning the attack. Agents armed with warrants copied the hard drive of at least one server at Tailor Made.-http://www.theregister.co.uk/2010/12/30/avenge_assange_server_raids/
-http://www.itworld.com/legal/132033/fbi-raids-texas-hosting-company-wikileaks-dd
os-attackers
4Chan Suffers Attacked (December 29, 2010)
4Chan has come under a DDoS attack that has left discussion boards difficult if not impossible to reach. No one has claimed responsibility for the attack, although it is possible that it was launched in retaliation for attacks aided by 4Chan members as part of the group Anonymous, to show support for WikiLeaks.-http://www.bbc.co.uk/news/technology-12090245
-http://www.eweek.com/c/a/Security/4chan-Forum-for-Anonymous-Activists-Hit-by-DoS
-Counterattack-174885/
-http://www.theregister.co.uk/2010/12/29/4chan_ddos/
[Editor's Note (Northcutt): Hmmm, normally I would ask that we pull this story from the lineup, but the WikiLeaks potential link is interesting. However if you are not familiar with the acronym NSFW ( Not Safe For Work ) DO NOT go to 4Chan from your work account. Also it is not clear that Anonymous is actually anonymous:
-http://yro.slashdot.org/story/10/12/11/0228212/Anonymous-WikiLeaks-Proponents-No
t-So-Anonymous]
ChronoPay.com Suffers Redirect Attack (December 29, 2010)
A hijacking attack on ChronoPay.com, Russia's largest online payment processor, redirected visitors to a phony site that attempted to steal their financial information. ChronoPay chief executive Pavel Vrublevsky said the phony site was up for several hours between December 25 and 26, and that approximately 800 credit card numbers were harvested. The attackers also posted a message to the ChronoPay home page claiming that all personal data used on the site in 2009 and 2010 had been stolen. The message appeared to be from Vrublevsky, who said that the claims were untrue, claiming the only data compromised were the credit card numbers stolen last week.-http://krebsonsecurity.com/2010/12/russian-e-payment-giant-chronopay-hacked/
Woman Arrested for Allegedly Selling Insider Info on Tech Companies (December 29 & 30, 2010)
A California woman described as a self-employed commodities trader has been arrested and charged with conspiracy to commit securities fraud and securities fraud for allegedly buying and trading insider information from technology companies. Winifred Jiau allegedly has ties to Primary Global Research LLC in Mountain View, California. Four executives at high tech companies were arrested for allegedly selling insider information to Primary Global for sizeable consulting fees. Jiau was allegedly paid more than US $200,000 over two years for the information she provided to hedge fund managers. Jiau has been granted bail, but must surrender her US and Taiwanese passports and remain under electronic surveillance at her own home. She faces up to 25 years in prison and fines in excess of US $5 million.-http://articles.latimes.com/2010/dec/29/business/la-fi-insider-trading-arrest-20
101229
-http://www.computerworld.com/s/article/9202730/Charges_filed_in_high_tech_inside
r_trading_case?taxonomyId=82.
-http://www.reuters.com/article/idUSTRE6BS3IC20101230?feedType=RSS&feedName=t
opNews
-http://news.cnet.com/8301-1001_3-20026795-92.html
Trojan Targets Android OS (December 29, 2010)
Malware known as Geinimi targets the Google Android platform and has characteristics of botnet malware. It appears to have been bundled with legitimate games, both paid and free; the developers were unaware that the malware was piggybacking on their products. The malware targets Chinese-speaking users. Geinimi communicates with a command-and-control server that has the capability of telling infected devices to perform certain tasks, such as downloading or uninstalling software. Android users receive prompts and must approve the actions before they occur. Internet Storm Center:-http://www.isc.sans.org/diary.html?storyid=10186
-http://www.computerworld.com/s/article/9202778/Android_mobile_malware_has_botnet
_like_traits?taxonomyId=85
-http://news.cnet.com/8301-1009_3-20026804-83.html?tag=mncol;title
NIST Issues Final Version of IPv6 Deployment Guidelines (December 27 & 29, 2010)
NIST has released the final version of its "Guidelines for the Secure Deployment of IPv6." This is an important starting point for organizations planning to deploy IPv6. It outlines many important security issues and includes a good primer about IPv6 and its features, as well as a number of very valuable resources as references. The guidelines are NIST Special Publication 800-119.-http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf
-http://www.govinfosecurity.com/articles.php?art_id=3218
-http://www.tmcnet.com/channels/ip-transit/articles/130362-ip-transit-the-move-ip
v6-tackle-challenges-now.htm
-http://www.enterprisenetworkingplanet.com/daily_news/article.php/419164/Network-
Intrusion-Prevention-System-Supports-IPv6.htm
-http://tech.slashdot.org/story/10/12/27/148258/After-IPv4-How-Will-the-Internet-
Function?from=headlines
[Editor's Note (Ullrich): Probably within the next couple weeks, Regional Registrars will receive their final IPv4 allocations. It is probably too late to get started thinking about IPv6 now, but this NIST document is a good resource to get you started.
[Editor's Note (Northcutt): Great document! Managers should read at least the executive summary and ensure your technical people can explain the reasons for the recommendations. Technical people, if you have any network responsibility, you need to know everything in this publication backwards and forwards.]
Wired.com Responds to WikiLeaks Coverage Criticism (December 28, 2010)
Wired.com editor-in-chief Evan Hansen and senior editor Kevin Poulsen respond to criticism of their coverage of Bradley Manning, Julian Assange and WikiLeaks. Salon.com columnist and blogger Glenn Greenwald has issued a rebuttal to their response to his allegations.-http://www.wired.com/threatlevel/2010/12/greenwald/
-http://www.salon.com/news/opinion/glenn_greenwald/2010/12/29/wired_1/index.html
Mozilla Says Old Password Exposure a Low Risk Incident (December 28, 2010)
Mozilla says the accidental exposure of 44,000 inactive addons account passwords was "harmless." All of the passwords contained in the exposed database were inactive, and Mozilla says it can account for every download of the database, which was inadvertently left on a Mozilla public server. The passwords were encrypted and Mozilla has disabled the old accounts. Internet Storm Center:-http://isc.sans.edu/diary.html?storyid=10162
-http://www.theregister.co.uk/2010/12/28/mozilla_password_snafu/
-http://www.computerworld.com/s/article/9202658/Mozilla_site_exposed_encrypted_pa
sswords?taxonomyId=17%27
************************************************************************
The Editorial Board of SANS NewsBites
Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Adv isory Capability (CIAC)
John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.
Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.
Rob Lee is the curriculum lead instructor for the SANS Institute's computer forensic courses (computer-forensics.sans.org) and a Director at the incident response company Mandiant.
Rohit Dhamankar is a security professional currently involved in independent security research.
Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a founder with Secure Anchor Consulting.
Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Mark Weatherford, CISSP, CISM, is Chief Information Security Officer at the North American Energy Reliability Commission (NERC).
Alan Paller is director of research at the SANS Institute.
Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.
Clint Kreitner is the founding President and CEO of The Center for Internet Security.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/
