SANS NewsBites is a semiweekly high-level executive summary of the most important news articles that have been published on computer security during the last week. Each news item is very briefly summarized and includes a reference on the web for detailed information, if possible.
Spend five minutes per week to keep up with the high-level perspective of all the latest security news. New issues are delivered free every Tuesday and Friday.
Volume XII - Issue #78
October 01, 2010
Six new hands-on courses target the newest security challenges facing enterprises:
(1) Network Forensics
(2) Virtualization Security
(3) Combating Malware In the Enterprise
(4) Metasploit Kung-Fu for Enterprise Pen Testing
(5) Implementing and Auditing the 20 Critical Security Controls
(6) Advanced Penetration Testing, Exploits and Ethical Hacking
You'll find them (plus pen testing, hacker exploits, IDS, reverse
engineering malware, security essentials boot camp, auditing, legal,
and more) in London and/or in DC at the two largest cybersecurity
training events of the fall:
- -- SANS London starts November 27: http://www.sans.org/london-2010/
- -- SANS Cyber Defense Initiative in DC starts December 10: http://www.sans.org/cyber-defense-initiative-2010/
TOP OF THE NEWS
Dozens Charged in Connection with ZeuS-Enabled Bank FraudSurvey: Cyber Security Hampering Productivity
THE REST OF THE WEEK'S NEWS
Adobe to Release Patches for Acrobat and Reader on October 5Senate Committee Tries to Fast-Track Anti-Piracy Bill
Researchers Find Android Apps are Sharing Data
ZeuS Turns to LinkedIn as Vector of Infection
Nine Arrested in SIM Card Fraud Case
Survey: State CISO's Budget Cuts Take Toll on Data Protection
Microsoft Issues Out-of-Band Fix for ASP.Net Flaw
Malicious Online Impersonation Now a Crime in California
Cyber Storm III to Test National Cyber Incident Response Plan
*********************** Sponsored by SANS ************************** Special Webcast in Conjunction with SANS 2010 EU SCADA and Process Control Summit! Smart Grid: New Sweet Spot for Criminals and Terrorists Tuesday, October 19, 1 PM EST. As energy providers move to more open, public-facing Smart Grid technologies, the integrated fabric of our most critical infrastructure is already under attack. Learn how to plug the gaps between legacy SCADA control systems using 21st-Century security technologies, with experts Jonathan Pollet, founder of infrastructure consulting firm, RedTiger, and Eric D. Knapp, director of critical infrastructure technologies at NitroSecurity. Sign in at your SANS Portal Account or follow the link, here: http://www.sans.org/info/65318 *********************************************************************
TRAINING UPDATE New "Combating Malware in the Enterprise" course at SANS (SEC569). How do you fight off malware when you have thousands of hosts? Course debut in Las Vegas (Sept'10) and Washington DC (Dec'10):
http://www.sans.org/security-training/combating-malware-enterprise-1482-mid
- - -- SOS: SANS October Singapore, October 4-11, 2010 7 courses
http://www.sans.org/singapore-sos-2010/
- - -- SANS Chicago 2010, Skokie, Illinois, October 25-30, 2010 6 courses. Bonus evening presentations include Weaponizing LISP: Advancing the Art of Network Security and Examining the Global Underground of Malicious Actors
http://www.sans.org/chicago-2010/night.php
- - -- SANS San Francisco 2010, November 5-12, 2010 7 courses. Bonus evening presentations include Weaponizing LISP: Advancing the Art of Network Security
http://www.sans.org/san-francisco-2010/
- - -- SANS London 2010, November 27-December 6, 2010 14 courses. Bonus evening presentations include Latest Advances in Computer Forensics and Continuous Vulnerability Testing and Remediation: The 20 Critical Security Controls Perspective
http://www.sans.org/london-2010/
- - -- SANS Cyber Defense Initiative 2010, Washington DC, December 10-17, 2010 24 courses. Bonus evening presentations include Browser Based Defenses; Continuous Vulnerability Testing and Remediation: the 20 Critical Security Controls Perspective; and Cyberwar or Business as Usual? The State of US Federal CyberSecurity Efforts
http://www.sans.org/cyber-defense-initiative-2010/
- - -- SANS Security East 2011, New Orleans, LA, January 20-27, 2011 12 courses. Bonus evening presentations and special events include Happy Little Clouds: Governing, Assessing and Auditing Cloud Environments and Future Trends in Network Security
http://www.sans.org/security-east-2011/
- - - - -- Looking for training in your own community? http://sans.org/community/ Save on On-Demand training (30 full courses) - See samples at
http://www.sans.org/ondemand/discounts.php#current
Plus Dubai, Geneva, Bangalore, San Antonio and Sydney all in the next 90 days. For a list of all upcoming events, on-line and live: http://www.sans.org/index.php *********************************************************************
TOP OF THE NEWS
Dozens Charged in Connection with ZeuS-Enabled Bank Fraud (September 30, 2010)
Authorities on both sides of the Atlantic have charged dozens of people in connection with massive bank fraud using the ZeuS Trojan horse program. US authorities charged 92 people believed to have been involved in cyber attacks that stole more than US $200 million from bank accounts over the last four years. In the UK, authorities arrested 20 people who are believed to have stolen GBP 6 million (US $9.5 million) in just three months using ZeuS. While the charges in the US may have dealt a blow to the scheme's operations, the code's developers, those who run the back-end servers and the scheme's masterminds remain at large.-http://online.wsj.com/article/SB10001424052748704483004575523811617488380.html?m
od=WSJ_hps_LEFTWhatsNews#
-http://www.computerworld.com/s/article/9189019/Feds_hit_Zeus_group_but_the_brain
s_remain_overseas?taxonomyId=17
-http://www.infoworld.com/t/malware/governments-take-zeus-the-god-cybercrime-393
-http://www.reuters.com/article/idUSN3019563220100930
-http://www.wired.com/threatlevel/2010/09/zeus-raid/
-http://www.theregister.co.uk/2010/09/30/zeus_money_mules_charged/
-http://money.cnn.com/2010/09/30/technology/cyber_crime_charges/index.htm
-http://news.cnet.com/8301-27080_3-20018177-245.html?tag=mncol;title
[Editor's Note (Honan): Well done to all involved and hopefully more arrests will follow. Unfortunately the Zeus botnet is still very active with the Zeus Tracker website showing there are still 170 C&C servers online
-https://zeustracker.abuse.ch/]
Survey: Cyber Security Hampering Productivity (September 30, 2010)
A survey conducted by the Government Business Council found that officials at US federal government agencies feel that cyber security has a negative impact on productivity. Two of the most often cited issues are restricted access to information and delayed communications. Nearly two-thirds of the 162 respondents from 28 agencies said that security controls prevented them from accessing certain websites or applications they needed for their jobs. The officials said they often circumvented security controls to get their jobs done; some reported using non-agency devices to access the information they needed. The respondents also noted that security measures slowed down computers' performance. The respondents said that the most important consideration in implementing security policies should be access to information.-http://www.eweek.com/c/a/Security/CyberSecurity-Cutting-Federal-Government-Produ
ctivity-Survey-744792/
[Editor's Note (Pescatore): The blade guard on my power saw hampers my productivity in cutting wood, but chopping off my hand or even just a few fingers tends to also have an impact on my productivity. That said, there are a lot of very, very silly URL blocking and email policies in place out there that *do* impact productivity, *don't* increase security and *do* encourage users to bypass IT systems. ]
THE REST OF THE WEEK'S NEWS
Senate Committee Tries to Fast-Track Anti-Piracy Bill (September 29, 2010)
An anti-piracy bill introduced in the US Senate has inspired heated response on both sides of the debate. Some have questioned the timing of the proposed legislation, which was introduced just days before lawmakers adjourn to return home and campaign for the November midterm election. The Combating Online Infringement and Counterfeits Act would give the US Justice Department (DoJ) the authority to file civil action against the suspect domain names. If the suspect site is in the US, the Attorney General could ask court to find the domain name "is dedicated to infringing activities." The DoJ could then order the site's registrar to shut it down. DoJ would also have the authority to take steps to block US Internet users' access to overseas sites that have pirated content. ISPs could be ordered to block those sites and to order companies to stop doing business with the sites.-http://news.cnet.com/8301-31001_3-20018091-261.html?tag=topStories1
-http://www.computerworld.com/s/article/9188780/Outcry_prompts_amendments_to_onli
ne_IP_protection_bill?taxonomyId=71
-http://www.pcmag.com/article2/0,2817,2369948,00.asp
Researchers Find Android Apps are Sharing Data (September 29 & 30, 2010)
Researchers from Duke University, Penn State University and Intel labs have found that some applications for the Android smartphone are sharing information about their users. The researchers developed a tool called TaintDroid, which detects when applications send private data. TaintDroid was tested on 30 randomly selected free applications available in Android marketplace; half were found to be sending information to remote advertising servers. Two-thirds of the applications "handled data in ambiguous ways." The data shared include phone number, contacts, SIM card serial numbers and location information. In some cases, the information was being shared only when advertisements were being displayed on the users' phones. In other cases, location data were being sent even when the user was not running the application. The permissions granted by users to applications to access certain data do not explain how that information will be used. The researchers plan to present a report on their findings at the USENIX Symposium on Operating System Design and Implementation in Vancouver.-http://www.pcworld.com/businesscenter/article/206644/android_apps_more_open_than
_users_know.html?tk=hp_new
-http://www.bbc.co.uk/news/technology-11443111
-http://news.cnet.com/8301-27080_3-20018102-245.html
[Editor's Note (Pescatore): Android was developed by Google, and the vast majority of Google's revenue comes from selling advertising around other people's information. It should be no surprise to anyone using applications on Android to find that many apps are advertising friendly and privacy hostile. A much, much better "curated" app store model is needed for Android phones if this is going to change at all.
(Northcutt): The good news is you only paid $1.00 for the app; the bad news is that some marketing service paid the developer $5.00 for your information. The crazy thing is that some people not only don't care, they love it. I was talking with a real estate agent who had an iPhone/Android app on his phone called bump (like fist bump). If you bumped two bump-enabled phones together they share your contact information and any or all selected contacts with each other. He actually wanted me to install bump so I could bump him. Yikes!
-http://bu.mp/]
ZeuS Turns to LinkedIn as Vector of Infection (September 29, 2010)
In what has been described as "the largest such attack known to date," miscreants attempting to spread ZeuS malware have been sending malicious LinkedIn contact requests to users of the social networking service. When users click on the link in the phony invitation, they are sent to a web page that asks them to wait, during which time ZeuS is downloaded onto their computers. ZeuS lurks in browsers and harvests sensitive personal information, like online banking login credentials.-http://darkreading.com/security/attacks/showArticle.jhtml?articleID=227501020&am
p;subSection=Attacks/breaches
Nine Arrested in SIM Card Fraud Case (September 27 & 28, 2010)
French authorities have arrested nine people in connection with a scheme that allegedly defrauded telecommunications companies of millions of Euros. The people allegedly bought SIM card codes from unscrupulous telecommunications company employees and resell them for about 30 Euros (US $41) on the Internet. The group is believed to have been operating for five years and reportedly earned US $675,000 every month.-http://www.technewsdaily.com/sim-card-crime-ring-arrested-is-your-phone-safe-132
5/
-http://www.theregister.co.uk/2010/09/28/france_mobile_fraud_investigation/
-http://sip-trunking.tmcnet.com/topics/security/articles/104649-french-police-bus
t-mobile-phone-hackers.htm
Survey: State CISO's Budget Cuts Take Toll on Data Protection (September 28 & 29, 2010)
A survey from Deloitte & Touche and the National Association of State Chief Information Officers found that most state CISO's lack the necessary funds to adequately protect citizens' personal data. Seventy-nine percent of state CISOs said their budgets were remaining the same or being cut. Half of respondents said that just 1-3 percent of their budget is allocated specifically to information security. Other factors impeding states' abilities to protect information include increasing cyber threats and lack of qualified security professionals. In addition, "many state CISOs lack the visibility and authority to effectively drive security down to the individual agency level," according to Deloitte & Touche director and leader of state government security and privacy services Srini Subramanian.-http://content.usatoday.com/communities/technologylive/post/2010/09/most-states-
cannot-protect-citizens-personal-and-health-data/1?loc=interstitialskip
-http://cybersecurityreport.nextgov.com/2010/09/state_cybersecurity_budgets_decli
ning.php?oref=latest_posts
-http://civsourceonline.com/2010/09/29/budget-cuts-harm-cybersecurity-in-the-stat
es-survey-says/
-http://www.infosecurity-us.com/view/12812/state-cisos-see-budget-cuts-coming/
-http://www.deloitte.com/view/en_US/us/press/Press-Releases/4afd1754d835b210VgnVC
M1000001956f00aRCRD.htm
[Editor's Note (Pescatore): Since we are all in the "security union" together, it is always bad to see security budgets cut but state government funding overall is a disaster area. When your house is collapsing, not a good time to complain about the lack of a burglar alarm system. ]
Microsoft Issues Out-of-Band Fix for ASP.Net Flaw (September 28 & 29, 2010)
Microsoft has issued an out-of-band fix for a vulnerability in ASP.Net encryption. The flaw has already been exploited in limited attacks. ASP.Net is a web application framework used in millions of websites and applications. The fix was released to Microsoft Download Center so users have to download the patch and install it themselves. Microsoft plans to release the patch to Windows Update in several days.-http://www.theregister.co.uk/2010/09/29/ms_emergency_asp_net_fix/
-http://www.computerworld.com/s/article/9188440/Microsoft_issues_emergency_patch_
for_Windows_Web_bug?taxonomyId=82
-http://www.h-online.com/security/news/item/Patch-fixes-vulnerability-in-ASP-NET-
1098257.html
-http://www.microsoft.com/technet/security/bulletin/MS10-070.mspx
Malicious Online Impersonation Now a Crime in California (September 28, 2010)
California Governor Arnold Schwarzenegger has signed into law a bill that makes it a crime to impersonate someone online with malicious intent. People who impersonate others online for "purposes of harming, intimidating, threatening or defrauding another person" could find themselves facing misdemeanor charges. While the law's intent does not criminalize parody or satire, there are some who fear it could have a chilling effect of free speech online and that companies and public officials could abuse the law to quash their critics.-http://www.computerworld.com/s/article/9188498/California_bans_malicious_online_
impersonation?taxonomyId=17
Cyber Storm III to Test National Cyber Incident Response Plan (September 28 & 29, 2010)
The US Department of Homeland Security has kicked off Cyber Storm III, a cyber security preparedness exercise that this year involves seven federal agencies, 11 states, 12 foreign countries and 60 private companies, representing the banking, chemical, communications, defense, nuclear, IT, transportation and water components of critical infrastructure. Cyber Storm III will simulate large attacks on various systems at government organizations and in the critical infrastructure. Cyber Storm attack simulations are run every other year. The exercise will draw upon the support from the National Cybersecurity and Communications Integration Center, which opened a year ago; the exercise is hoped to help clarify how the Center fits into the big picture of cyber threat response. The exercise will also test the National Cyber Incident Response Plan, a document that is still in a draft stage.-http://fcw.com/articles/2010/09/28/dhs-testing-new-cyber-response-plan-in-global
-drill.aspx?admgarea=TC_SECCYBERSEC
-http://www.informationweek.com/news/government/security/showArticle.jhtml;jsessi
onid=45BRGGBRDA5ARQE1GHRSKHWATMY32JVN?articleID=227500797&pgno=1&queryTe
xt=&isPrev=
-http://www.computerworld.com/s/article/9188720/Cyber_Storm_III_simulates_large_s
cale_cyberattack?taxonomyId=17
-http://www.nextgov.com/nextgov/ng_20100929_4557.php?oref=topnews
-http://darkreading.com/vulnerability_management/security/cybercrime/showArticle.
jhtml?articleID=227500997
**********************************************************************
The Editorial Board of SANS NewsBites
Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the author/co-author of books on Unix security, Internet security, Windows NT/2000 security, incident response, and intrusion detection and prevention. He was also the co-founder and original project manager of the Department of Energy's Computer Incident Advisory Capability (CIAC)
John Pescatore is Vice President at Gartner Inc.; he has worked in computer and network security since 1978.
Stephen Northcutt founded the GIAC certification and currently serves as President of the SANS Technology Institute, a post graduate level IT Security College, www.sans.edu.
Dr. Johannes Ullrich is Chief Technology Officer of the Internet Storm Center and Dean of the Faculty of the graduate school at the SANS Technology Institute.
Ed Skoudis is co-founder of Inguardians, a security research and consulting firm, and author and lead instructor of the SANS Hacker Exploits and Incident Handling course.
Rob Lee is the curriculum lead instructor for the SANS Institute's computer forensic courses (computer-forensics.sans.org) and a Director at the incident response company Mandiant.
Rohit Dhamankar is a security professional currently involved in independent security research.
Tom Liston is a Senior Security Consultant and Malware Analyst for Inguardians, a handler for the SANS Institute's Internet Storm Center, and co-author of the book Counter Hack Reloaded.
Dr. Eric Cole is an instructor, author and fellow with The SANS Institute. He has written five books, including Insider Threat and he is a senior Lockheed Martin Fellow.
Ron Dick directed the National Infrastructure Protection Center (NIPC) at the FBI and is the incoming President of the InfraGard National Members Alliance - with 22,000 members.
Mason Brown is one of a very small number of people in the information security field who have held a top management position in a Fortune 50 company (Alcoa). He is leading SANS' global initiative to improve application security.
David Hoelzer is the director of research & principal examiner for Enclave Forensics and a senior fellow with the SANS Technology Institute.
Mark Weatherford, CISSP, CISM, is Chief Information Security Officer at the North American Energy Reliability Commission (NERC).
Alan Paller is director of research at the SANS Institute.
Marcus J. Ranum built the first firewall for the White House and is widely recognized as a security products designer and industry innovator.
Clint Kreitner is the founding President and CEO of The Center for Internet Security.
Brian Honan is an independent security consultant based in Dublin, Ireland.
David Turley is SANS infrastructure manager and serves as production manager and final editor on SANS NewsBites.
Please feel free to share this with interested parties via email, but no posting is allowed on web sites. For a free subscription, (and for free posters) or to update a current subscription, visit http://portal.sans.org/
