Fake femme fatale shows social network risks

From: Fake femme fatale shows social network risks



By Jaikumar Vijayan, Computerworld
July 22, 2010 06:22 AM ET

Hundreds of people in the information security, military and intelligence fields recently found themselves with egg on their faces after sharing personal information with a fictitious Navy cyberthreat analyst named "Robin Sage," whose profile on prominent social networking sites was created by a security researcher to illustrate the risks of social networking.

In a conversation with Computerworld, Thomas Ryan, co-founder of Provide Security, said he used a few photos to portray the fictional Sage on Facebook, LinkedIn and Twitter as an attractive, somewhat flirty cybergeek, with degrees from MIT and a prestigious prep school in New Hampshire. Then he established connections with some 300 men and women from the U.S. military, intelligence agencies, information security companies and government contractors.

The goal, said Ryan, was to determine how effective social networking sites can be in conducting covert intelligence-gathering activities.

Despite some patently obvious red flags -- such as noting that the 25-year-old Sage had worked professionally for 10 years -- the scheme worked. The connections to Sage, who was depicted as a real-life Abby Scuito, a fictional character in CBS's NCIS television series, were established in less than a month. Many friends freely shared personal information and photos, invited the fictional threat analyst to conferences and asked her to review documents. Some "friends" at major companies, including Google and Lockheed Martin, even expressed interest in hiring her, he noted.

A security researcher created a fake online profile for a fictional cyberthreat analyst named "Robin Sage."

Had Sage really been a foreign agent, she would have had access to a lot of very useful information, said Ryan, who is scheduled to present his findings next week at the BlackHat security conference in Las Vegas. Excerpts from his interview with Computerworld follow:

What prompted you to conduct the experiment? One of the biggest drivers was all the talk about cyberwarfare and cyberespionage -- and what's real and what's not real. I wanted to see how much intel you could gather from a person just by lurking on a social networking site. I [also] wanted to see who was most susceptible to clicking. I wanted to see how fast this thing would propagate. One of the things I found was that MIT and St. Paul's [prep school] were very cliquey. If they don't remember seeing you, they are not going to click. You had less of a chance of penetrating those groups than the actual intel and security communities.

How many connections and friends did Robin Sage make? On Facebook, 226; on LinkedIn, 206; and on Twitter, 204. The connections on Facebook were security and military, LinkedIn was mainly security and intel, and Twitter was mostly hackers.

Did Sage mostly seek out these friends, or were they more likely to make the first move? It was a combination of both. I did approach a few people, [mostly] from the security industry. They had the most connections. They are the speakers, the ones that are always sociable.

What type of information can one get through such connections? Pretty much everything. I had access to e-mail and bank accounts. I saw patterns in the kind of friends they had. The LinkedIn profiles would show patterns of new business relationships.

Why do you think Sage was so successful at making new connections? Because she was an attractive girl. It definitely had to do with looks.

Were most of the connections male? It wasn't all men. The male versus female split was 82% to 18%. The highest number of women were from the intelligence community. The only women who were there from the security community were people promoting conferences and stuff like that.

Do you think a fictional male character would have been as successful in attracting "friends"? It depends on who the male was and how he was portrayed.

What did Facebook do when they discovered what was going on? Facebook shut down the Robin page and my personal page. They said, due to security reasons, I am not allowed to use Facebook again. LinkedIn just deleted the Robin account but [a cached version] is still there on Google.

What's the takeaway from the experiment? The big takeaway is not to friend anybody unless you really know who they are. The same tactic was used to infiltrate a secret Israeli base. The people on the base were the only ones on a private Facebook page. Somebody was able to gain access to it and gather intel on the base.

Anything else? I was never able to friend anyone from the CIA or the FBI. I tried. It just didn't work. Toward the end of the experiment, there was this massive influx of Arabs from overseas that were trying to get on the Robin page where all the military stuff was. I didn't really care for it. That was a bit scary.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan , or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com .

Latest News from ScanSafe Puts It In Direct Competition With Ironport

Strangely enough, a new security report from ScanSafe, talks about compromised legitimate sites that are now hosting re-directors for phishing scams (purportedly trying to look like Bank of America), so they can bypass reputation filters.

Both ScanSafe and Ironport are of course owned by Cisco, so it's interesting to see ScanSafe put down a technology that Ironport talks up as one of their strengths.

The fact that reputable sites can get compromised has always been a reason to avoid reputation filters for web security. Reputation may work well for email security, but it just doesn't translate to web security in the same way.

Cybercriminals Increase Effectiveness with Multi-stage Attacks

From: http://finance.yahoo.com/news/Cybercriminals-Increase-bw-3831469612.html?x=0&.v=1

Commtouch® (Nasdaq:CTCH - News) today released its Internet Threats Trend Report for Q2 2010 and video highlights from the report.

Cybercriminals have been increasing the effectiveness of their individual outreach by creating multi-stage, also known as blended, attacks, which combine messaging and Web elements. They use email or search engine results to lure victims to sites hosting spam advertising, malware, or phishing. The Q2 report analyzes the many methods fraudsters, malware distributors and spammers use to inspire their victims to action, such as leveraging trusted brands like Apple and Google; holidays, such as Mother’s Day; or current events, for example, the Football World Cup.

During Q2, Gmail and Yahoo kept the top spots as far as spoofed domains for email distribution, but they have been joined in the top six by Twitter. The Twitter domain was faked in a widespread mailing designed to lure users to a “password reset” Web page that contained malware.

Commtouch’s quarterly trend report is based on the analysis of more than two billion email messages daily, as well as the GlobalView™ URL database, within the company’s cloud-based GlobalView Network.

Other highlights from the Q2 Trend Report include:

* Spam levels averaged 82% of all email traffic throughout the quarter, bottoming out at 71% at the start of May and peaking at nearly 92% near the end of June. These numbers are slightly lower than those detected in Q1 and equate to an average of 179 billion spam messages per day.
* Pharmacy spam retained the top spot with 64 percent of all spam.
* An average of 307,000 zombies were activated daily to inflict malicious activity, representing a slight increase over the prior quarter.
* India has surpassed Brazil for the title of the country with the most zombies (13 percent of the world’s total).
* TDSS.17 was the most widely distributed email-borne virus, but the Mal/Bredo malware had the most variants - over 1800 (more than double the variants of Q1).
* Pornography remains the Web site category most infected with malware.
* In the Web 2.0 sphere of user-generated content, streaming media/downloads is the most popular topic for blog creators.

"Cybercriminals have been forced to change their techniques to evade improved detection technology," said Asaf Greiner, Commtouch vice president, products. "Complex multi-stage attacks with improved social engineering are proving to be the preferred technique."

Commtouch Recurrent Pattern Detection™ and GlobalView technologies identify and block messaging and Web security threats, including increasingly malicious malware and phishing outbreaks. More details, including samples and statistics, are available in the Commtouch Q2 2010 Internet Threats Trend Report, available at http://www.commtouch.com/download/1753, with video highlights available at http://www.commtouch.com/trend-report-video-q2.

NOTE: Reported global spam levels are based on Internet email traffic as measured from unfiltered data streams, not including internal corporate traffic. Therefore global spam levels will differ from the quantities reaching end user inboxes, due to several possible layers of filtering.

Finjan sues McAfee, Symantec over patent claims

From: http://www.computerworld.com/s/article/9179184/Finjan_sues_McAfee_Symantec_over_patent_claims

Finjan has sued five rival security companies, including Symantec and McAfee, claiming it holds crucial patents used by popular antivirus products and security services.

The lawsuit was filed Monday in the U.S. District Court for the District of Delaware. Also named are Webroot Software, Websense and Sophos.

Finjan alleges that flagship products from these companies violate two patents that Finjan has held for about a decade. Formerly a technology vendor itself, Finjan sold most of its assets last November to another security company, M86, but held onto its patent portfolio, which it is now trying to turn into a moneymaker. Finjan owns about a dozen patents, all related to computer security.

In 2008, Finjan won a jury verdict against Secure Computing (now owned by McAfee), awarding it damages for patent infringement by Secure Computing's Webwasher and CyberGuard TSP software. Jurors awarded Finjan US$9.2 million in damages, but a federal judge later increased that award to $13.8 million.

Monday's lawsuit involves one of the patents covered in the Secure Computing case that relates to network-based virus protection. It also names a second patent, a "system and method for protecting a client during runtime from hostile downloadables," that covers Finjan's desktop antivirus claims.

The company asked the court to award unspecified financial damages and an injunction preventing the companies from selling their products, which include McAfee's Web Gateway and VirusScan software, and Symantec's Brightmail Gateway and Norton Antivirus.

Symantec and McAfee declined to comment on the suit. Webroot, Websense and Sophos (which was acquired by Apax Partners in May) could not immediately be reached for comment.

Antivirus Struggling with Obfuscated JavaScript

From: http://research.zscaler.com/2010/06/antivirus-struggling-with-obfuscated.html

As part of our offline research, we regularly test various desktop antivirus (AV) solutions to determine how effective they are at catching web based threats. One segment where I feel that AV has struggled, is with the identification of malicious content when analyzing obfuscated JavaScript. While obfuscated JavaScript can be an indication of malicious content, such as injected IFRAME attacks, the technique is regularly used by legitimate sites. Most notably, we see heavy usage of JavaScript obfuscation among online advertising vendors. JavaScript obfuscation is used by legitimate sites for two reasons. First, code may be obfuscated in an effort to limit the size of the code by removing whitespace and changing variable names in order to make it more efficient. Secondly, sites leverage obfuscation in order to 'protect' code by making it harder to understand and therefore copy. This latter motivation is of minimal value however as client side content can always be de-obfuscated given a basic level of effort. After all, the browser needs to interpret the code at some point.

JavaScript obfuscation presents a challenge for AV vendors. Despite what marketing literature would suggest, detecting malicious content still heavily relies on the use static signatures. Obfuscation is problematic as signatures cannot detect what they cannot see. This leaves two options. The AV engine can either first de-obfuscate the JavaScript or signatures can be created for obfuscated content. The latter is problematic as even a slight change in the content or encoding algorithm can lead to vastly different output, while de-obfuscation is an imperfect science as those who have used tools such as Malzilla can attest to.

I ran across an obfuscated JavaScript sample recently which illustrates this challenge. The code in question is perfectly legitimate and resides at About.com, a popular website which delivers information on a variety of topics. On a page entitled APR calculator, when looking at the page source, you will note a large block of obfuscated JavaScript within the section of the page.

<script language="javascript">document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A...

At first glance, this appears to be a classic case of malicious content injected into an otherwise legitimate page. It's essentially a large block of hexadecimal encoded characters and it requires a couple of passes to fully decode everything. However, once de-obfuscation is complete, you uncover JavaScript code designed to calculate your mortgage payments...not attack your browser. For those interested in seeing the code in all it's glory, please follow the links below.

Obfuscated/De-obfuscated JavaScript files

* Obfuscated JavaScript
* First de-obfuscation pass
* Fully de-obfusctaed JavaScript

Despite the benign nature of this Javascript code, at the time this blog was published, no fewer than 18 of 41 antivirus engines flagged this code as malicious. What does this tell us about how the engines operate? Clearly they are inspecting the obfuscated code as opposed to the de-obfuscated code and flagging based on the existence of certain functions/data. The problem with this approach - while JavaScript obfuscation is used by the bad guys, it's used by the good guys as well. Identifying malicious content by statically inspecting obfuscated JavaScript is overly simplistic and as can be seen, is bound to trigger false positives.

Credit crunch is fueling data theft

From: http://www.thetechherald.com/article.php/200911/3206/ScanSafe-Credit-crunch-is-fueling-data-theft

ScanSafe, an SaaS security vendor based in London and San Francisco, has released its Annual Global Threat report. According to the stats collected from 240 billion Web requests in 2008, the credit crunch being felt all over the world is fueling a surge in Web-based attacks. The report details growth like no other, with attack vectors such as Iframe-related attacks jumping over 1000 percent.

ScanSafe used 240 billion Web requests from corporate customers, spread out over 80 countries, to track the data used in its report. According to the data, there was an explosive growth in Malware throughout 2008.

For example, 582 percent growth between like quarters in 2007 and 2008 and a 300 percent volume ratio increase from January 2008 through to December 2008. Exploits and Iframes were up 1731 percent in 2008, while data-theft Trojans increased by 1559 percent.

“We saw a continued acceleration of Web-delivered malware in 2008, reaching significant peaks in both October and November. The numbers are staggering,” said Mary Landesman, senior security researcher at ScanSafe.

“There is a high correlation of increased online crime with the decline in the global economy. It could be that the increasing levels of job loss and uncertainty are fueling the surge in criminal activity. It is also likely that cyber crime is proving to be a viable business opportunity in a climate where legitimate opportunities are becoming increasingly more limited.”

The credit crunch is fueling this growth, the report says, as 14 percent of all ScanSafe’s blocks were the result of encounters with data theft Trojans, compared to six percent in 2007. Towards the end of 2008, when the credit crunch was in full swing, the report details the largest growth in this category. Not only did October and November 2008 show the highest levels of blocks, but they also showed a heavy saturation of data theft Malware.

According to one section of the report, there was a change of intent in 2008. Criminals are now shifting their focus to the targeting and harvesting of sensitive data. Most of the Malware delivered through the Web provided remote customization and configurability, enabling attackers to target specific data and manage how that data is obtained.

For home users, the targets were game-related credentials and credit card numbers. For businesses, it was intellectual property and the potential to eavesdrop on all network transmissions via ARP poisoning or other man-in-the-middle attacks.

Trusted sites also posed a substantial risk. In April 2008, ScanSafe said it counted an excess of 780,000 malicious Web pages from only five vertical segments because of a single SQL injection attack.

“Today’s malware is all about stealing and harvesting data. Cyber criminals have moved away from defacing sites or merely designing malware as a prank and it is now created with commercial and criminal intent,” added Landesman. “Online crime has become a lucrative business and both commercial and personal data fetch a significant sum on black markets.”

Security firms warn of bogus job search emails

From: http://www.infosecurity-us.com/view/9409/security-firms-warn-of-bogus-job-search-emails/

Security vendors – including Websense and Sophos – have sent up a red flag about suspect emails targeting human resources staff. The messages apparently contain zip files that, when opened, infect users’ PCs with rouge anti-virus.

Websense Security Labs reports that the attached ZIP is an executable malware file directing to the Oficla bot. “This connects to a URL in the davidopolko.ru domain for its [command-and-control] functions”, the firm noted in a security blog posting. Once downloaded, the malware brings up a warning box telling users their machine has been infected by a trojan, followed by the download and installation of a rouge anti-virus called ‘Security essentials 2010’.

Malware tracking website VirusTotal shows a detection rate for this attack at just over 50% for the major anti-virus vendor engines.

Websense said the spam is quickly proliferating, as its security lab saw more than 230 000 samples in just four hours this morning.

Graham Cluley, Sophos senior technology consultant , warns staff to be cautious if receiving an unexpected email with what appears to be a resume/CV attached.

Cluley says the emails, which are short and to the point, have the following characteristics:

Subject: New resume
Attached file: Resume_document_459.zip
Message body: Please review my CV, Thank you!

"Hmm.. hardly the most convincing job application I've ever seen – they haven't even given any clues as to which role they might be applying for", said Cluley in his security blog posting last night. "However, you or some of your users might still be tempted to open the attached CV to see if it sheds any more clues as the point of the communication", he added.

Sophos' Cluey went on to say that, if you do make the mistake of opening the attached Resume_document_459.zip file, you run the risk of infecting your Windows computer with malware.

Sophos' research teams, he says, are intercepting the threat proactively as Troj/Invo-Zip and Mal/EncPk-NS.

“HR departments are used to receiving CVs over email and this kind of malicious activity is indicative of the modern-day hacker”, added Carl Leonard, EMEA security research manager for Websense. “The broad-brush approach to seeding malware is now out of favor; fraudsters know they can infect more computers, and steal more data, if they use techniques that fit the target.”