Archive for the ‘Recent News’ Category

Anti-Virus Sites have XSS vulnerabilties??

Best Practices, Recent News | Posted by Dave
May 12 2009

XSS flaws found in sites of multiple anti-virus firms

Dirty half-dozen

By John Leyden • Get more from this author

Security researchers have revealed that the websites of no less than six anti-virus firms are vulnerable to cross-site scripting flaws, of a type that might lend themselves to phishing attacks.

Some of the firms involved have admitted problems, while others say the issues raised have either already been fixed or are erroneous.

Nemesis, a gang of programmers and security bods that work mostly in chat room software development, reckons the sites of Symantec, Kaspersky, Eset (Nod32), AVG, F-secure and Trend Micro are all vulnerable, one way or another. The group has posted screen shots to back up its claims in an advisory here.

El Reg contacted the six firms involved on Monday evening, some of who have already got back to us. We’ll add statements from the others as and when they become available.

  • Trend Micro said the flaw highlighted by Nemesis is on a part of its site which is outsourced. The firm added that the flaw was in the process of getting fixed.
  • Eset said the site with the alleged flaw, eset.co.il, was run by its Israeli distributor. “The iFrame injection has been removed from eset.co.il and today (Tuesday) the site will be deeply scanned to fix all other possible vulnerabilities,” it said in a statement.
  • Symantec said the reported vulnerability on its site was discovered and fixed last month. “Symantec was notified of a reported security vulnerability on a webpage within Symantec’s website back in April,” a spokeswoman explained. “Upon notification of the potential vulnerability, Symantec immediately conducted comprehensive testing and fixed the vulnerability. Symantec takes the security of its website very seriously and can confirm that no company or customer information was exposed.”
  • AVG said there wasn’t any problem with its site. “We’ve investigated the issue as raised by The Register, and we can report that there is no vulnerability on the AVG website. We’re always looking at potential security issues – and extra ways to keep our customers’ data secure. As an internet security company, we often find that we come under attack from the bad guys.”

Broadly speaking the cross-site scripting flaws detailed by the Nemesis make it possible to present rogue iFrames from third-party servers as if they came from the sites of security vendors a surfer might be visiting. This type of vulnerability therefore lends itself to attacks that rely on impersonation, such as phishing. XSS flaws, more generally, also pose cookie stealing and other risks.

This class of vulnerability has popped up on the website of security firms over recent months. Most notable Romanian hacking group HackersBlog exposed XSS flaws on the websites of Kaspersky, BitDefender, F-Secure and Symantec in a two month campaign before the group got bored and disbanded in late March 2009.

Other incidents of similar problems on the websites of McAfee and Symantec have cropped up since to the point where its tempting to think that the problem has become endemic.

In other security-related news, AVG released a fix for a vulnerability involving how its software processes Zip files. An advisory on the flaw, discovered by security researcher Thierry Zoller, can be found here. ®

Tags: , , , ,
No Comments »

The FAA was successfully attacked

compliance, Recent News | Posted by Dave
May 08 2009

Note from Dave:  Soon I hope to start writing some more original content, until then I will continue to post hacker related news on here.  The reason I am post these articles is simple, Cyber Security is not an option.  Many businesses get it, others not so much.  If the FAA and the Pentagon can be successfully hacked,  how safe do you think you really are?  Better to understand your weaknesses and try to mitigate those vulnerabilities than to put you head back in the sand.

 

Dave

 

Hackers have broken into the air traffic control mission-support systems of the U.S. Federal Aviation Administration several times in recent years, according to an Inspector General report sent to the FAA this week.

In February, hackers compromised an FAA public-facing computer and used it to gain access to personally identifiable information, such as Social Security numbers, on 48,000 current and former FAA employees, the report said.

Last year, hackers took control of FAA critical network servers and could have shut them down, which would have seriously disrupted the agency’s mission-support network, the report said. Hackers took over FAA computers in Alaska, becoming “insiders,” according to the report dated Monday.

Then, taking advantage of interconnected networks, hackers later stole an administrator’s password in Oklahoma, installed “malicious codes” with the stolen password and compromised the FAA domain controller in the Western Pacific Region, giving them the access to more than 40,000 FAA user IDs, passwords, and other data used to control a portion of the mission-support network, the report said.

And in 2006, a virus spread to the air traffic control (ATC) systems, forcing the FAA to shut down a portion of its systems in Alaska, according to the report.

The attacks so far have primarily disrupted mission-support functions, but attacks could spread over network connections from those areas to the operational networks where real-time surveillance, communications and flight information is processed, the report warned.

“In our opinion, unless effective action is taken quickly, it is likely to be a matter of when, not if, ATC systems encounter attacks that do serious harm to ATC operations,” the report concluded.

 

An audit of the FAA’s air traffic control cybersecurity protection measures finds them lacking and says there have been several breaches by hackers and a virus.

(Credit: U.S. Department of Transportation, Office of Inspector General)

 

The breaches were possible because Web applications that support the air traffic control system operations are not properly secured to prevent unauthorized access and network intrusion-detection software is not adequately being used to monitor and detect cyberattacks, the report concluded.

The FAA’s increasing use of commercial software and Internet Protocol-based technologies as part of an effort to modernize the air traffic control systems poses a higher security risk to the systems than when they relied primarily on proprietary software, the report said.

“Now, attackers can take advantage of software vulnerabilities in commercial IP products to exploit ATC systems, which is especially worrisome at a time when the Nation is facing increased threats from sophisticated nation-state-sponsored cyber attacks,” the report said.

In general, the nation’s critical infrastructure is increasingly at risk as previously isolated and closed systems are moved to the Internet and commercial software, like Windows, is used, security experts have said.

The air traffic control system auditors said they discovered more than 760 high-risk vulnerabilities in the Web applications tested, including holes that provided “front-door access” to the systems and could allow attackers to inject malicious code onto FAA user computers. Web applications were not adequately configured and the applications with known vulnerabilities were not patched in a timely manner, auditors found.

Meanwhile, intrusion detection systems (IDS) are deployed at only 11 of hundreds of air traffic control facilities and none of the IDS sensors is installed to monitor operational systems at those sites, the report said. Cyber incidents are not effectively monitored or fixed quickly, the report concluded.

In 2008, more than 870 cyber incident alerts were issued to the organization responsible for air traffic control operations and by the end of the year 17 percent (more than 150 incidents) had not been remediated, “including critical incidents in which hackers may have taken over control” of operations computers, the report said.

The FAA is “identifying and fixing weaknesses,” FAA spokeswoman Laura Brown told The Wall Street Journal. “We are working on developing security architecture for that whole system.”

However, Brown dismissed the notion that hackers could get access to critical air traffic control operational systems.

The audit of the air traffic control systems was requested by the ranking minority members of the House Committee on Transportation and Infrastructure and its Aviation Subcommittee.

 

http://news.cnet.com/8301-1009_3-10236028-83.html

Tags: , , , , , , ,
No Comments »

FBI Probes Hacker’s $10 Million Ransom Demand for Stolen Medical Records

Recent News | Posted by Dave
May 06 2009


The FBI is investigating a $10 million ransom demand by a hacker or hackers who say they have stolen nearly 8.3 million patient records from a Virginia government Web site that tracks prescription drug abuse, an FBI official confirmed Wednesday.

The state police in Virginia are also investigating the possible breach of confidential records.

The FBI official said the Virginia Information Technologies Agency (VITA) referred the case to the FBI last week, asking for help.

Asked whether people’s personal information is secure, the official said he couldn’t say.

“I really can’t make a declarative statement as to whether anyone’s information is in jeopardy at this point,” the official said.

Asked whether people have been notified that their information may have been breached, the official said it would be up to VITA to do that.

http://www.foxnews.com/story/0,2933,519187,00.html

Tags: , , , ,
No Comments »

DDoS attacks on the rise.

Recent News | Posted by Dave
May 04 2009

(WEB HOST INDUSTRY REVIEW) — The past few months has seen a rise in large distributed denial of service attacks which threaten to send entire countries offline, raising concerns among Internet security experts in the Internet infrastructure that help contribute to these attacks, according to a report by The Washington Post.

These DDoS attacks use botnets to send large amounts of spam to websites to the point where it cannot handle incoming traffic from its regular visitors.

In the past six months, DDoS monitoring firm Arbor Networks (www.arbornetworks.com) says it has witnessed a rise in the number, sophistication and size of these attacks, while perpetrators seem to be targeting larger ISPs.

Earlier this month, domain registrar Register.com was hit by a major DDoS attack that caused causing intermittent outages for about 48 hours.

The Post article also cites recent DDoS attacks against dedicated managed hosting provider The Planet, which it says was hit by a “massive” DDoS attack on April 6 and 7, as well as Brazillian ISP Telefonica, which lasted for several days.

Though DDoS attacks are typically seen as the work of cyber criminals who are seeking some kind of financial compensation in exchange for retreating these attacks.

All three of the aforementioned companies were performed in precise intervals over a period of days, according to The Post.

Experts say that the nature of these attacks suggest that the hackers were just showing off their malicious capabilities to attract media coverage in an effort to draw interest from criminals that would hire them for their services.

The domain name system contains many DDoS assault attack weaknesses, which is a key component of the Internet.

Since the global DNS system does not yet have a widely deployed system in place to confirm the location of an individual requesting a site’s location, it makes it harder to block DDoS attackers that lie about their location, according to The Post.

Additionally, there has also been a rise in the number of botnets used to attack networks has largely increased because of globally-spreadl viruses like the Conficker worm.

These attacks are significantly easier to defend against as inffective individuals can work with their ISP to find and drop traffic from the Internet source.

ISPs can also improve their defense against DDoS attacks by adopting long-established Internet best practices.

 

Source http://www.thewhir.com/web-hosting-news/050109_Internet_Sees_Rise_in_DDoS_Attacks

Tags: , ,
No Comments »