From: http://www.networkworld.com/community/node/64427
When it comes to implementing a social computing strategy, many companies still abide by the security axiom of “only allow what is specifically permitted.” In fact, according to our latest research, 40 percent of (all?) companies block all access to public social networking sites such as Facebook, Twitter, YouTube, or MySpace. These companies tend to have conservative views toward technology, and consider the risk of allowing access too great—often from both security and productivity standpoints.
Even many of the 60 percent of companies that now allow access restrict it in some way, either by time of day, approved groups (e.g. marketing, customer service, sales), or for specific use cases. We often hear from IT leaders that initial efforts to block access entirely were thwarted by legitimate business needs for the organization to participate in public social networks. In some cases, the path is reactive; access is wide open until someone in legal and/or compliance functions becomes aware of this usage. Often then the reaction is a knee-jerk, “full stop” for any social-computing activities.
There are four primary areas involved in addressing security and compliance concerns related to social computing:
• Breach. Forty-six states, the District of Columbia, Puerto Rico, and the Virgin Islands have adopted legislation requiring notification of security breaches involving personal information. In addition, federal regulations, such as the Health Information Technology for Economic and Clinical Health, contain breach notification clauses.
• Attack. Compliance with legislation and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Payment Card Industry Data Security Standard (PCI-DSS), mandate organizations implement security best practices to prevent access to sensitive data.
• Unacceptable use. Typically, this is an internal policy that defines the acceptable use of corporate assets. Employees sign off on the policy and its ramifications, often as part of an employment contract.
• Accountability. Specific compliance requirements, such as Financial Services Regulatory Authority (FINRA) 10-6, require logging of trader communications. This may also include an internal compliance requirement to monitor and log communications with a high likelihood of becoming part of litigation and e-discovery.
One of the greatest concerns about social networking is the risk of a sensitive data breach. Social-computing applications are potential conduits to breach sensitive information—specifically, personally identifiable information and protected health information . Examples include a real-time breach in which sensitive information transfers in the clear during, for instance, an IM chat. Another example is a non-real-time breach in which a file transfers (intentionally or unintentionally) as part of a Skype session, for instance. Remember, the breach is the disclosure, not the exploitation of the data.
In addition to the breach challenge itself, there is also the challenge of tracking a breach. Without proper audit controls on all social-computing communications, the organization most likely will be totally unaware of any sensitive data breach. There is an additional concern that even when a company knows of a breach, they may have little recourse to limit its exposure. For example, a team within a manufacturing company sets up a Facebook group to facilitate collaboration on the design of its newest, and revolutionary, manufacturing process. There is an assumption of privacy since the group is closed with the exception of the team’s access. However, all it takes is one user without properly set privacy settings whose account is compromised to enable leakage of the group’s information. Users may not go through the due diligence required to determine data ownership for materials placed on public social sites.
Sites such as Facebook and LinkedIn are primary targets for cyber criminals. The primary attack vector is sending a legitimate looking link—from a “friend”—that takes the user to an infected Web page. The user opens the Web page, clicks on a link and inadvertently downloads malware, exposing the enterprise to significant risk. As discussed, blocking access to these sites is not absolute so the only option in this case is to block access to bad URLs.
Security practitioners who participate in Nemertes’ research indicate this attack vector is becoming one of their greatest challenges. In addition, recent reports indicate millions of compromised or fake Facebook accounts are available for sale. Protecting against these attacks requires, at a minimum, a Web-content-aware firewall with granular filtering to dynamically block access to specific Web pages, and even specific areas of an individual Web page. Companies that provide solutions in this area include Blue Coat, FaceTime Communications in partnership with Blue Coat, Palo Alto Networks, Socialware, Trend Micro, Webroot, WebSense, and Zscaler.
As more companies shift from “block everything” to “block some things,” the need for a proactive social security and compliance strategy will continue to gain importance.
Monday, August 2, 2010
Thursday, July 22, 2010
Fake femme fatale shows social network risks
From: Fake femme fatale shows social network risks
By Jaikumar Vijayan, Computerworld
July 22, 2010 06:22 AM ET
Hundreds of people in the information security, military and intelligence fields recently found themselves with egg on their faces after sharing personal information with a fictitious Navy cyberthreat analyst named "Robin Sage," whose profile on prominent social networking sites was created by a security researcher to illustrate the risks of social networking.
In a conversation with Computerworld, Thomas Ryan, co-founder of Provide Security, said he used a few photos to portray the fictional Sage on Facebook, LinkedIn and Twitter as an attractive, somewhat flirty cybergeek, with degrees from MIT and a prestigious prep school in New Hampshire. Then he established connections with some 300 men and women from the U.S. military, intelligence agencies, information security companies and government contractors.
The goal, said Ryan, was to determine how effective social networking sites can be in conducting covert intelligence-gathering activities.
Despite some patently obvious red flags -- such as noting that the 25-year-old Sage had worked professionally for 10 years -- the scheme worked. The connections to Sage, who was depicted as a real-life Abby Scuito, a fictional character in CBS's NCIS television series, were established in less than a month. Many friends freely shared personal information and photos, invited the fictional threat analyst to conferences and asked her to review documents. Some "friends" at major companies, including Google and Lockheed Martin, even expressed interest in hiring her, he noted.
A security researcher created a fake online profile for a fictional cyberthreat analyst named "Robin Sage."
Had Sage really been a foreign agent, she would have had access to a lot of very useful information, said Ryan, who is scheduled to present his findings next week at the BlackHat security conference in Las Vegas. Excerpts from his interview with Computerworld follow:
What prompted you to conduct the experiment? One of the biggest drivers was all the talk about cyberwarfare and cyberespionage -- and what's real and what's not real. I wanted to see how much intel you could gather from a person just by lurking on a social networking site. I [also] wanted to see who was most susceptible to clicking. I wanted to see how fast this thing would propagate. One of the things I found was that MIT and St. Paul's [prep school] were very cliquey. If they don't remember seeing you, they are not going to click. You had less of a chance of penetrating those groups than the actual intel and security communities.
How many connections and friends did Robin Sage make? On Facebook, 226; on LinkedIn, 206; and on Twitter, 204. The connections on Facebook were security and military, LinkedIn was mainly security and intel, and Twitter was mostly hackers.
Did Sage mostly seek out these friends, or were they more likely to make the first move? It was a combination of both. I did approach a few people, [mostly] from the security industry. They had the most connections. They are the speakers, the ones that are always sociable.
What type of information can one get through such connections? Pretty much everything. I had access to e-mail and bank accounts. I saw patterns in the kind of friends they had. The LinkedIn profiles would show patterns of new business relationships.
Why do you think Sage was so successful at making new connections? Because she was an attractive girl. It definitely had to do with looks.
Were most of the connections male? It wasn't all men. The male versus female split was 82% to 18%. The highest number of women were from the intelligence community. The only women who were there from the security community were people promoting conferences and stuff like that.
Do you think a fictional male character would have been as successful in attracting "friends"? It depends on who the male was and how he was portrayed.
What did Facebook do when they discovered what was going on? Facebook shut down the Robin page and my personal page. They said, due to security reasons, I am not allowed to use Facebook again. LinkedIn just deleted the Robin account but [a cached version] is still there on Google.
What's the takeaway from the experiment? The big takeaway is not to friend anybody unless you really know who they are. The same tactic was used to infiltrate a secret Israeli base. The people on the base were the only ones on a private Facebook page. Somebody was able to gain access to it and gather intel on the base.
Anything else? I was never able to friend anyone from the CIA or the FBI. I tried. It just didn't work. Toward the end of the experiment, there was this massive influx of Arabs from overseas that were trying to get on the Robin page where all the military stuff was. I didn't really care for it. That was a bit scary.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan , or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com .
By Jaikumar Vijayan, Computerworld
July 22, 2010 06:22 AM ET
Hundreds of people in the information security, military and intelligence fields recently found themselves with egg on their faces after sharing personal information with a fictitious Navy cyberthreat analyst named "Robin Sage," whose profile on prominent social networking sites was created by a security researcher to illustrate the risks of social networking.
In a conversation with Computerworld, Thomas Ryan, co-founder of Provide Security, said he used a few photos to portray the fictional Sage on Facebook, LinkedIn and Twitter as an attractive, somewhat flirty cybergeek, with degrees from MIT and a prestigious prep school in New Hampshire. Then he established connections with some 300 men and women from the U.S. military, intelligence agencies, information security companies and government contractors.
The goal, said Ryan, was to determine how effective social networking sites can be in conducting covert intelligence-gathering activities.
Despite some patently obvious red flags -- such as noting that the 25-year-old Sage had worked professionally for 10 years -- the scheme worked. The connections to Sage, who was depicted as a real-life Abby Scuito, a fictional character in CBS's NCIS television series, were established in less than a month. Many friends freely shared personal information and photos, invited the fictional threat analyst to conferences and asked her to review documents. Some "friends" at major companies, including Google and Lockheed Martin, even expressed interest in hiring her, he noted.
A security researcher created a fake online profile for a fictional cyberthreat analyst named "Robin Sage."
Had Sage really been a foreign agent, she would have had access to a lot of very useful information, said Ryan, who is scheduled to present his findings next week at the BlackHat security conference in Las Vegas. Excerpts from his interview with Computerworld follow:
What prompted you to conduct the experiment? One of the biggest drivers was all the talk about cyberwarfare and cyberespionage -- and what's real and what's not real. I wanted to see how much intel you could gather from a person just by lurking on a social networking site. I [also] wanted to see who was most susceptible to clicking. I wanted to see how fast this thing would propagate. One of the things I found was that MIT and St. Paul's [prep school] were very cliquey. If they don't remember seeing you, they are not going to click. You had less of a chance of penetrating those groups than the actual intel and security communities.
How many connections and friends did Robin Sage make? On Facebook, 226; on LinkedIn, 206; and on Twitter, 204. The connections on Facebook were security and military, LinkedIn was mainly security and intel, and Twitter was mostly hackers.
Did Sage mostly seek out these friends, or were they more likely to make the first move? It was a combination of both. I did approach a few people, [mostly] from the security industry. They had the most connections. They are the speakers, the ones that are always sociable.
What type of information can one get through such connections? Pretty much everything. I had access to e-mail and bank accounts. I saw patterns in the kind of friends they had. The LinkedIn profiles would show patterns of new business relationships.
Why do you think Sage was so successful at making new connections? Because she was an attractive girl. It definitely had to do with looks.
Were most of the connections male? It wasn't all men. The male versus female split was 82% to 18%. The highest number of women were from the intelligence community. The only women who were there from the security community were people promoting conferences and stuff like that.
Do you think a fictional male character would have been as successful in attracting "friends"? It depends on who the male was and how he was portrayed.
What did Facebook do when they discovered what was going on? Facebook shut down the Robin page and my personal page. They said, due to security reasons, I am not allowed to use Facebook again. LinkedIn just deleted the Robin account but [a cached version] is still there on Google.
What's the takeaway from the experiment? The big takeaway is not to friend anybody unless you really know who they are. The same tactic was used to infiltrate a secret Israeli base. The people on the base were the only ones on a private Facebook page. Somebody was able to gain access to it and gather intel on the base.
Anything else? I was never able to friend anyone from the CIA or the FBI. I tried. It just didn't work. Toward the end of the experiment, there was this massive influx of Arabs from overseas that were trying to get on the Robin page where all the military stuff was. I didn't really care for it. That was a bit scary.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan , or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com .
Monday, July 19, 2010
Latest News from ScanSafe Puts It In Direct Competition With Ironport
Strangely enough, a new security report from ScanSafe, talks about compromised legitimate sites that are now hosting re-directors for phishing scams (purportedly trying to look like Bank of America), so they can bypass reputation filters.
Both ScanSafe and Ironport are of course owned by Cisco, so it's interesting to see ScanSafe put down a technology that Ironport talks up as one of their strengths.
The fact that reputable sites can get compromised has always been a reason to avoid reputation filters for web security. Reputation may work well for email security, but it just doesn't translate to web security in the same way.
Both ScanSafe and Ironport are of course owned by Cisco, so it's interesting to see ScanSafe put down a technology that Ironport talks up as one of their strengths.
The fact that reputable sites can get compromised has always been a reason to avoid reputation filters for web security. Reputation may work well for email security, but it just doesn't translate to web security in the same way.
Friday, July 16, 2010
Cybercriminals Increase Effectiveness with Multi-stage Attacks
From: http://finance.yahoo.com/news/Cybercriminals-Increase-bw-3831469612.html?x=0&.v=1
Commtouch® (Nasdaq:CTCH - News) today released its Internet Threats Trend Report for Q2 2010 and video highlights from the report.
Cybercriminals have been increasing the effectiveness of their individual outreach by creating multi-stage, also known as blended, attacks, which combine messaging and Web elements. They use email or search engine results to lure victims to sites hosting spam advertising, malware, or phishing. The Q2 report analyzes the many methods fraudsters, malware distributors and spammers use to inspire their victims to action, such as leveraging trusted brands like Apple and Google; holidays, such as Mother’s Day; or current events, for example, the Football World Cup.
During Q2, Gmail and Yahoo kept the top spots as far as spoofed domains for email distribution, but they have been joined in the top six by Twitter. The Twitter domain was faked in a widespread mailing designed to lure users to a “password reset” Web page that contained malware.
Commtouch’s quarterly trend report is based on the analysis of more than two billion email messages daily, as well as the GlobalView™ URL database, within the company’s cloud-based GlobalView Network.
Other highlights from the Q2 Trend Report include:
* Spam levels averaged 82% of all email traffic throughout the quarter, bottoming out at 71% at the start of May and peaking at nearly 92% near the end of June. These numbers are slightly lower than those detected in Q1 and equate to an average of 179 billion spam messages per day.
* Pharmacy spam retained the top spot with 64 percent of all spam.
* An average of 307,000 zombies were activated daily to inflict malicious activity, representing a slight increase over the prior quarter.
* India has surpassed Brazil for the title of the country with the most zombies (13 percent of the world’s total).
* TDSS.17 was the most widely distributed email-borne virus, but the Mal/Bredo malware had the most variants - over 1800 (more than double the variants of Q1).
* Pornography remains the Web site category most infected with malware.
* In the Web 2.0 sphere of user-generated content, streaming media/downloads is the most popular topic for blog creators.
"Cybercriminals have been forced to change their techniques to evade improved detection technology," said Asaf Greiner, Commtouch vice president, products. "Complex multi-stage attacks with improved social engineering are proving to be the preferred technique."
Commtouch Recurrent Pattern Detection™ and GlobalView technologies identify and block messaging and Web security threats, including increasingly malicious malware and phishing outbreaks. More details, including samples and statistics, are available in the Commtouch Q2 2010 Internet Threats Trend Report, available at http://www.commtouch.com/download/1753, with video highlights available at http://www.commtouch.com/trend-report-video-q2.
NOTE: Reported global spam levels are based on Internet email traffic as measured from unfiltered data streams, not including internal corporate traffic. Therefore global spam levels will differ from the quantities reaching end user inboxes, due to several possible layers of filtering.
Commtouch® (Nasdaq:CTCH - News) today released its Internet Threats Trend Report for Q2 2010 and video highlights from the report.
Cybercriminals have been increasing the effectiveness of their individual outreach by creating multi-stage, also known as blended, attacks, which combine messaging and Web elements. They use email or search engine results to lure victims to sites hosting spam advertising, malware, or phishing. The Q2 report analyzes the many methods fraudsters, malware distributors and spammers use to inspire their victims to action, such as leveraging trusted brands like Apple and Google; holidays, such as Mother’s Day; or current events, for example, the Football World Cup.
During Q2, Gmail and Yahoo kept the top spots as far as spoofed domains for email distribution, but they have been joined in the top six by Twitter. The Twitter domain was faked in a widespread mailing designed to lure users to a “password reset” Web page that contained malware.
Commtouch’s quarterly trend report is based on the analysis of more than two billion email messages daily, as well as the GlobalView™ URL database, within the company’s cloud-based GlobalView Network.
Other highlights from the Q2 Trend Report include:
* Spam levels averaged 82% of all email traffic throughout the quarter, bottoming out at 71% at the start of May and peaking at nearly 92% near the end of June. These numbers are slightly lower than those detected in Q1 and equate to an average of 179 billion spam messages per day.
* Pharmacy spam retained the top spot with 64 percent of all spam.
* An average of 307,000 zombies were activated daily to inflict malicious activity, representing a slight increase over the prior quarter.
* India has surpassed Brazil for the title of the country with the most zombies (13 percent of the world’s total).
* TDSS.17 was the most widely distributed email-borne virus, but the Mal/Bredo malware had the most variants - over 1800 (more than double the variants of Q1).
* Pornography remains the Web site category most infected with malware.
* In the Web 2.0 sphere of user-generated content, streaming media/downloads is the most popular topic for blog creators.
"Cybercriminals have been forced to change their techniques to evade improved detection technology," said Asaf Greiner, Commtouch vice president, products. "Complex multi-stage attacks with improved social engineering are proving to be the preferred technique."
Commtouch Recurrent Pattern Detection™ and GlobalView technologies identify and block messaging and Web security threats, including increasingly malicious malware and phishing outbreaks. More details, including samples and statistics, are available in the Commtouch Q2 2010 Internet Threats Trend Report, available at http://www.commtouch.com/download/1753, with video highlights available at http://www.commtouch.com/trend-report-video-q2.
NOTE: Reported global spam levels are based on Internet email traffic as measured from unfiltered data streams, not including internal corporate traffic. Therefore global spam levels will differ from the quantities reaching end user inboxes, due to several possible layers of filtering.
Thursday, July 15, 2010
Finjan sues McAfee, Symantec over patent claims
From: http://www.computerworld.com/s/article/9179184/Finjan_sues_McAfee_Symantec_over_patent_claims
Finjan has sued five rival security companies, including Symantec and McAfee, claiming it holds crucial patents used by popular antivirus products and security services.
The lawsuit was filed Monday in the U.S. District Court for the District of Delaware. Also named are Webroot Software, Websense and Sophos.
Finjan alleges that flagship products from these companies violate two patents that Finjan has held for about a decade. Formerly a technology vendor itself, Finjan sold most of its assets last November to another security company, M86, but held onto its patent portfolio, which it is now trying to turn into a moneymaker. Finjan owns about a dozen patents, all related to computer security.
In 2008, Finjan won a jury verdict against Secure Computing (now owned by McAfee), awarding it damages for patent infringement by Secure Computing's Webwasher and CyberGuard TSP software. Jurors awarded Finjan US$9.2 million in damages, but a federal judge later increased that award to $13.8 million.
Monday's lawsuit involves one of the patents covered in the Secure Computing case that relates to network-based virus protection. It also names a second patent, a "system and method for protecting a client during runtime from hostile downloadables," that covers Finjan's desktop antivirus claims.
The company asked the court to award unspecified financial damages and an injunction preventing the companies from selling their products, which include McAfee's Web Gateway and VirusScan software, and Symantec's Brightmail Gateway and Norton Antivirus.
Symantec and McAfee declined to comment on the suit. Webroot, Websense and Sophos (which was acquired by Apax Partners in May) could not immediately be reached for comment.
Finjan has sued five rival security companies, including Symantec and McAfee, claiming it holds crucial patents used by popular antivirus products and security services.
The lawsuit was filed Monday in the U.S. District Court for the District of Delaware. Also named are Webroot Software, Websense and Sophos.
Finjan alleges that flagship products from these companies violate two patents that Finjan has held for about a decade. Formerly a technology vendor itself, Finjan sold most of its assets last November to another security company, M86, but held onto its patent portfolio, which it is now trying to turn into a moneymaker. Finjan owns about a dozen patents, all related to computer security.
In 2008, Finjan won a jury verdict against Secure Computing (now owned by McAfee), awarding it damages for patent infringement by Secure Computing's Webwasher and CyberGuard TSP software. Jurors awarded Finjan US$9.2 million in damages, but a federal judge later increased that award to $13.8 million.
Monday's lawsuit involves one of the patents covered in the Secure Computing case that relates to network-based virus protection. It also names a second patent, a "system and method for protecting a client during runtime from hostile downloadables," that covers Finjan's desktop antivirus claims.
The company asked the court to award unspecified financial damages and an injunction preventing the companies from selling their products, which include McAfee's Web Gateway and VirusScan software, and Symantec's Brightmail Gateway and Norton Antivirus.
Symantec and McAfee declined to comment on the suit. Webroot, Websense and Sophos (which was acquired by Apax Partners in May) could not immediately be reached for comment.
Wednesday, June 16, 2010
Antivirus Struggling with Obfuscated JavaScript
From: http://research.zscaler.com/2010/06/antivirus-struggling-with-obfuscated.html
As part of our offline research, we regularly test various desktop antivirus (AV) solutions to determine how effective they are at catching web based threats. One segment where I feel that AV has struggled, is with the identification of malicious content when analyzing obfuscated JavaScript. While obfuscated JavaScript can be an indication of malicious content, such as injected IFRAME attacks, the technique is regularly used by legitimate sites. Most notably, we see heavy usage of JavaScript obfuscation among online advertising vendors. JavaScript obfuscation is used by legitimate sites for two reasons. First, code may be obfuscated in an effort to limit the size of the code by removing whitespace and changing variable names in order to make it more efficient. Secondly, sites leverage obfuscation in order to 'protect' code by making it harder to understand and therefore copy. This latter motivation is of minimal value however as client side content can always be de-obfuscated given a basic level of effort. After all, the browser needs to interpret the code at some point.
JavaScript obfuscation presents a challenge for AV vendors. Despite what marketing literature would suggest, detecting malicious content still heavily relies on the use static signatures. Obfuscation is problematic as signatures cannot detect what they cannot see. This leaves two options. The AV engine can either first de-obfuscate the JavaScript or signatures can be created for obfuscated content. The latter is problematic as even a slight change in the content or encoding algorithm can lead to vastly different output, while de-obfuscation is an imperfect science as those who have used tools such as Malzilla can attest to.
I ran across an obfuscated JavaScript sample recently which illustrates this challenge. The code in question is perfectly legitimate and resides at About.com, a popular website which delivers information on a variety of topics. On a page entitled APR calculator, when looking at the page source, you will note a large block of obfuscated JavaScript within the section of the page.
At first glance, this appears to be a classic case of malicious content injected into an otherwise legitimate page. It's essentially a large block of hexadecimal encoded characters and it requires a couple of passes to fully decode everything. However, once de-obfuscation is complete, you uncover JavaScript code designed to calculate your mortgage payments...not attack your browser. For those interested in seeing the code in all it's glory, please follow the links below.
Obfuscated/De-obfuscated JavaScript files
* Obfuscated JavaScript
* First de-obfuscation pass
* Fully de-obfusctaed JavaScript
Despite the benign nature of this Javascript code, at the time this blog was published, no fewer than 18 of 41 antivirus engines flagged this code as malicious. What does this tell us about how the engines operate? Clearly they are inspecting the obfuscated code as opposed to the de-obfuscated code and flagging based on the existence of certain functions/data. The problem with this approach - while JavaScript obfuscation is used by the bad guys, it's used by the good guys as well. Identifying malicious content by statically inspecting obfuscated JavaScript is overly simplistic and as can be seen, is bound to trigger false positives.
As part of our offline research, we regularly test various desktop antivirus (AV) solutions to determine how effective they are at catching web based threats. One segment where I feel that AV has struggled, is with the identification of malicious content when analyzing obfuscated JavaScript. While obfuscated JavaScript can be an indication of malicious content, such as injected IFRAME attacks, the technique is regularly used by legitimate sites. Most notably, we see heavy usage of JavaScript obfuscation among online advertising vendors. JavaScript obfuscation is used by legitimate sites for two reasons. First, code may be obfuscated in an effort to limit the size of the code by removing whitespace and changing variable names in order to make it more efficient. Secondly, sites leverage obfuscation in order to 'protect' code by making it harder to understand and therefore copy. This latter motivation is of minimal value however as client side content can always be de-obfuscated given a basic level of effort. After all, the browser needs to interpret the code at some point.
JavaScript obfuscation presents a challenge for AV vendors. Despite what marketing literature would suggest, detecting malicious content still heavily relies on the use static signatures. Obfuscation is problematic as signatures cannot detect what they cannot see. This leaves two options. The AV engine can either first de-obfuscate the JavaScript or signatures can be created for obfuscated content. The latter is problematic as even a slight change in the content or encoding algorithm can lead to vastly different output, while de-obfuscation is an imperfect science as those who have used tools such as Malzilla can attest to.
I ran across an obfuscated JavaScript sample recently which illustrates this challenge. The code in question is perfectly legitimate and resides at About.com, a popular website which delivers information on a variety of topics. On a page entitled APR calculator, when looking at the page source, you will note a large block of obfuscated JavaScript within the section of the page.
<script language="javascript">document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A...
At first glance, this appears to be a classic case of malicious content injected into an otherwise legitimate page. It's essentially a large block of hexadecimal encoded characters and it requires a couple of passes to fully decode everything. However, once de-obfuscation is complete, you uncover JavaScript code designed to calculate your mortgage payments...not attack your browser. For those interested in seeing the code in all it's glory, please follow the links below.
Obfuscated/De-obfuscated JavaScript files
* Obfuscated JavaScript
* First de-obfuscation pass
* Fully de-obfusctaed JavaScript
Despite the benign nature of this Javascript code, at the time this blog was published, no fewer than 18 of 41 antivirus engines flagged this code as malicious. What does this tell us about how the engines operate? Clearly they are inspecting the obfuscated code as opposed to the de-obfuscated code and flagging based on the existence of certain functions/data. The problem with this approach - while JavaScript obfuscation is used by the bad guys, it's used by the good guys as well. Identifying malicious content by statically inspecting obfuscated JavaScript is overly simplistic and as can be seen, is bound to trigger false positives.
Thursday, May 27, 2010
Credit crunch is fueling data theft
From: http://www.thetechherald.com/article.php/200911/3206/ScanSafe-Credit-crunch-is-fueling-data-theft
ScanSafe, an SaaS security vendor based in London and San Francisco, has released its Annual Global Threat report. According to the stats collected from 240 billion Web requests in 2008, the credit crunch being felt all over the world is fueling a surge in Web-based attacks. The report details growth like no other, with attack vectors such as Iframe-related attacks jumping over 1000 percent.
ScanSafe used 240 billion Web requests from corporate customers, spread out over 80 countries, to track the data used in its report. According to the data, there was an explosive growth in Malware throughout 2008.
For example, 582 percent growth between like quarters in 2007 and 2008 and a 300 percent volume ratio increase from January 2008 through to December 2008. Exploits and Iframes were up 1731 percent in 2008, while data-theft Trojans increased by 1559 percent.
“We saw a continued acceleration of Web-delivered malware in 2008, reaching significant peaks in both October and November. The numbers are staggering,” said Mary Landesman, senior security researcher at ScanSafe.
“There is a high correlation of increased online crime with the decline in the global economy. It could be that the increasing levels of job loss and uncertainty are fueling the surge in criminal activity. It is also likely that cyber crime is proving to be a viable business opportunity in a climate where legitimate opportunities are becoming increasingly more limited.”
The credit crunch is fueling this growth, the report says, as 14 percent of all ScanSafe’s blocks were the result of encounters with data theft Trojans, compared to six percent in 2007. Towards the end of 2008, when the credit crunch was in full swing, the report details the largest growth in this category. Not only did October and November 2008 show the highest levels of blocks, but they also showed a heavy saturation of data theft Malware.
According to one section of the report, there was a change of intent in 2008. Criminals are now shifting their focus to the targeting and harvesting of sensitive data. Most of the Malware delivered through the Web provided remote customization and configurability, enabling attackers to target specific data and manage how that data is obtained.
For home users, the targets were game-related credentials and credit card numbers. For businesses, it was intellectual property and the potential to eavesdrop on all network transmissions via ARP poisoning or other man-in-the-middle attacks.
Trusted sites also posed a substantial risk. In April 2008, ScanSafe said it counted an excess of 780,000 malicious Web pages from only five vertical segments because of a single SQL injection attack.
“Today’s malware is all about stealing and harvesting data. Cyber criminals have moved away from defacing sites or merely designing malware as a prank and it is now created with commercial and criminal intent,” added Landesman. “Online crime has become a lucrative business and both commercial and personal data fetch a significant sum on black markets.”
ScanSafe, an SaaS security vendor based in London and San Francisco, has released its Annual Global Threat report. According to the stats collected from 240 billion Web requests in 2008, the credit crunch being felt all over the world is fueling a surge in Web-based attacks. The report details growth like no other, with attack vectors such as Iframe-related attacks jumping over 1000 percent.
ScanSafe used 240 billion Web requests from corporate customers, spread out over 80 countries, to track the data used in its report. According to the data, there was an explosive growth in Malware throughout 2008.
For example, 582 percent growth between like quarters in 2007 and 2008 and a 300 percent volume ratio increase from January 2008 through to December 2008. Exploits and Iframes were up 1731 percent in 2008, while data-theft Trojans increased by 1559 percent.
“We saw a continued acceleration of Web-delivered malware in 2008, reaching significant peaks in both October and November. The numbers are staggering,” said Mary Landesman, senior security researcher at ScanSafe.
“There is a high correlation of increased online crime with the decline in the global economy. It could be that the increasing levels of job loss and uncertainty are fueling the surge in criminal activity. It is also likely that cyber crime is proving to be a viable business opportunity in a climate where legitimate opportunities are becoming increasingly more limited.”
The credit crunch is fueling this growth, the report says, as 14 percent of all ScanSafe’s blocks were the result of encounters with data theft Trojans, compared to six percent in 2007. Towards the end of 2008, when the credit crunch was in full swing, the report details the largest growth in this category. Not only did October and November 2008 show the highest levels of blocks, but they also showed a heavy saturation of data theft Malware.
According to one section of the report, there was a change of intent in 2008. Criminals are now shifting their focus to the targeting and harvesting of sensitive data. Most of the Malware delivered through the Web provided remote customization and configurability, enabling attackers to target specific data and manage how that data is obtained.
For home users, the targets were game-related credentials and credit card numbers. For businesses, it was intellectual property and the potential to eavesdrop on all network transmissions via ARP poisoning or other man-in-the-middle attacks.
Trusted sites also posed a substantial risk. In April 2008, ScanSafe said it counted an excess of 780,000 malicious Web pages from only five vertical segments because of a single SQL injection attack.
“Today’s malware is all about stealing and harvesting data. Cyber criminals have moved away from defacing sites or merely designing malware as a prank and it is now created with commercial and criminal intent,” added Landesman. “Online crime has become a lucrative business and both commercial and personal data fetch a significant sum on black markets.”
Subscribe to:
Posts (Atom)
Posts
