Attackers Using Taidoor Trojan to Target Think Tanks and US-Taiwan Interests

In 2008, the Taidoor Trojan made its first appearance on the Web. It started by attacking government agencies, but the group behind it expanded their reach by targeting a wide range of victims. Now, based on research from Symantec..



In 2008, the Taidoor Trojan made its first appearance on the Web. It started by attacking government agencies, but the group behind it expanded their reach by targeting a wide range of victims. Now, based on research from Symantec, it appears that the group running Taidoor is interested in think tanks, especially those that are focused on Taiwan.

While Taidoor started out by targeting governments, between 2009 and 2010, the malware shifted gears. Government victims were counted among those in the media, financial, telecom and manufacturing sectors. The length of the attack, almost four years now, shows that the group responsible for Taidoor is persistent if nothing else.

Based on the collected data, Symantec says that since May 2011, there has been a substantial increase in Taidoor related activity. The malware’s current targets are primarily private industry and influential international think tanks with a direct involvement in US and Taiwanese affairs. Facilities in the services sector that these organizations may use have also been targeted.

“The attackers generally used document based vulnerabilities sent through email as attachments to compromise their intended targets. The most common document type exploited by Taidoor attacks is PDF followed closely by Word documents,” Symantec explained in a blog post.

“In all, at least 9 different vulnerabilities have been observed in use by these attackers in the past. We should bear in mind that the vulnerabilities used are generally ones that are already publically disclosed and patched by vendors at time of use. The attackers are simply exploiting the fact that some organizations may be slow to apply patches.”

Like other Trojan attacks, once the system is compromised, the malware waits for instructions once it calls home. However, Taidoor is a bit interesting in this regard, as the attacker(s) will routinely access the compromised host and run various commands, to check for recently accessed documents, a list of installed software, desktop and network configurations, and more. Moreover, the attacks have a normal workday, as they only check the infected hosts during set times.




Source:
Securityweek
www.securityweek.com

Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com

Facebook Tips to Make Password Privacy Issue a Non-issue

Here are a few tips to help you enjoy the service and not worry about interfering with your ability to land that perfect job.



Facebook is in the middle of another hubbub over companies asking prospective employees for their login information for the social networking site as part of the hiring process, but you can make the obvious privacy concern a non-issue by being careful.
Here are a few tips to help you enjoy the service and not worry about interfering with your ability to land that perfect job.
The bottom line: A little Facebook savvy goes a long way.
First, understand that Facebook isn't private. Yes, you can choose your friends and to some degree limit what people see about your posts, but plenty of interested parties actually have a window into what you're sharing. For one thing, the social network keeps track of everything you do on its territory so as to push hyper-targeted ads to you.
Timeline, for example, has been widely criticized for communicating too much about users because it visually aggregates everything you've ever done on the site -- the information you've included on your profile, your photos, everything you've ever "liked," any Facebook apps you’re using, a map showing where you've been (according to geo-tagged posts and photos), as well as a timeline of everything you’ve ever posted.

And by encouraging people to create an online scrapbook and add to Timeline extra information about their lives -- all the way back to birth if they want -- Facebook gleans even more personal data about its users. The point is to deliver ads that users are more likely to click on.
Speaking of ads, PCWorld recently reported that "liking" something on Facebook can make you an unwitting and unpaid endorser of an advertiser’s products or services. Once you "like" a company page, check in at a merchant location, post an update mentioning a product, service, or company, your activity can be used as an ad. That's because your friends may receive an update informing them of your activity -- whether you want Facebook to share it or not.
You can't opt out of these Sponsored Stories.
Second, use online etiquette so there's less dirt on you to find. A couple of online behaviors are not only annoying to other users, they can be telling to potential employers investigating your online profile. Take political spewing, for example. You know that Facebook friend who constantly posts commentary about political issues? How often are you completely in agreement with his perspective? That’s because political opinions are divisive. Polite Facebook users don’t push their political agendas onto their friends.
Online complaining is another common practice that makes people look bad. If your girlfriend just dumped you or you lost your house or job, it's best to keep it to yourself -- at least digitally. The people who want to hear your sad story have a relationship with you in the real world; Facebook isn't the place to air your troubles.
Third, use Facebook to your advantage rather than disadvantage. Instead of worrying about what people will find when they vet you online, how about being proactive about everything you share?
Like it or not, your digital identity is what defines you to potential employers and recruiters seeking you out online. And if you're interested in pushing your career forward, experts suggest that you take your digital identity seriously. The right words, photos, and social media banter online can impress a prospective employer or recruiter, while the wrong ones may turn them off.
All of this isn't to say that the practice of asking someone to hand over their social media login credentials is OK -- far from it. For one thing, your friends haven't necessarily given permission for non-friends to see their posts.
At the same time, over-sharing online can cause you problems because people you don't expect may be watching; avoid doing so and you'll be better off.



Source:
PCWorld
www.pcworld.com

Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com

Open source code libraries suffer from vulnerabilities

A recent study found that more than a third of 1,261 open source libraries had a known vulnerability and about a quarter of the downloads were tainted.



A study of how 31 popular open source code libraries were downloaded over the past 12 months found that more than a third of the 1,261 versions of these libraries had a known vulnerability and about a quarter of the downloads were tainted.

The study was undertaken by Aspect Security, which evaluates software for vulnerabilities, with Sonatype, a firm that provides a central repository housing more than 300,000 libraries for downloading open source components and gets 4 billion requests per year.

"Increasingly over the past few years, applications are being constructed out of libraries," says Jeff Williams, CEO of Aspect Security, referring to "The Unfortunate Reality of Insecure Libraries" study. Open source communities have done little to provide a clear way to spotlight code found to have vulnerabilities or identify how to remedy it when a fix is even made available, he says.

"There's no notification infrastructure at all," says Williams. "We want to shed light on this problem."

He adds that Aspect and Sonatype are mulling how it might be possible to improve the situation overall.

According to the study, researchers at Aspect analyzed 113 million software downloads made over 12 months from the Central Repository of 31 popular Java frameworks and security libraries (Aspect says one basis for the selection of libraries were those being used by its customers). Researchers found:

19.8 million (26 percent) of the library downloads have known vulnerabilities.

The most downloaded vulnerable libraries were Google Web Toolkit (GWT), Apache Xerces, Spring MVC, and Struts 1.x. (The other libraries examined were: Apache CXF, Hibernate, Java Servlet, Log4j; Apache Velocity, Spring Security, Apache Axis, BouncyCastle, Apache Commons, Tiles, Struts2, Wicket, Java Server Pages, Lift; Hibernate Validator, Java Server Faces, Tapestry, Apache Santuario, JAX-WS, Grails, Jasypt, Apache Shiro, Stripes, AntiSamy, ESAPI, HDIVl, and JBoss Seam.)
Security libraries are slightly more likely to have a known vulnerability than frameworks, the study says. "Today's applications commonly use 30 or more libraries, which can compromise up to 80 percent of the code in an application," according to the study.

The types of vulnerabilities found in open source code libraries vary widely.

"While some vulnerabilities allow the complete takeover of the host using them, others might result in data loss or corruption, and still others might provide a bit of useful information to attackers," the study says. "In most cases, the impact of a vulnerability depends greatly on how the library is used by the application."

The study noted some known well-publicized vulnerabilities.


Spring, the popular application development framework for Java, was downloaded more than 18 million times by over 43,000 organizations in the last year. However, a discovery last year showed a new class of vulnerabilities in Spring's use of Expression Language that could be exploited through HTTP parameter submissions that would allow attackers to get sensitive system data, application, and user cookies.

In 2010 Google's research team discovered a weakness in Struts2 that allowed attackers to execute arbitrary code on any Struts2 Web application.
In Apache CXF, a framework for Web Services, which was downloaded 4.2 million times by more than 16,000 organizations in the last 12 months, two major vulnerabilities were discovered since 2010 (CVE-2010-2076 and CVE 2012-0803) that allowed attackers to trick any service using CXF to download arbitrary system files and bypass authentication.

Discovery of vulnerabilities are made by researchers, who disclose them as they choose, with some coordinated and "others simply write blog posts or emails in mailing lists," the study notes. "Currently, developers have no way to know that the library versions they are using have known vulnerabilities. They would have to monitor dozens of mailing lists, blogs, and forums to stay abreast of information. Further, development teams are unlikely to find their own vulnerabilities, as it requires extensive security experience and automated tools are largely ineffective at analyzing libraries."

Although some open source groups, such as OpenBSD, are "quite good" in how they manage vulnerability disclosures, says Williams, the vast majority handle these kinds of security issues in haphazard fashion and with uncertain disclosure methods. Organizations should strengthen their security processes and OpenBSD can be considered an encouraging model in that respect, the study says.

Williams adds that use of open source libraries also raises the question of "dependency management." This is the security process that developers would use to identify what libraries their project really directly depends on. Often, developers end up using code that goes beyond the functionality that's really needed, using libraries that may also be dependent on other libraries. This sweeps in a lot of out-of-date code that brings risk and no added value, but swells the application in size. "Find out what libraries you're using and which are out of date," says Williams. "We suggest minimizing the use of libraries."

The report points out, "While organizations typically have strong patch management processes for software products, open source libraries are typically not part of these processes. In virtually all development organizations, updates to libraries are handled on an ad hoc basis by development teams."




Source:
InfoWorld
www.infoworld.com

Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com

Multiple Vulnerabilities in Cisco ASA 5500 and Cisco Catalyst 6500

Cisco ASA 5500 Series Adaptive Security Appliances (ASA) and Cisco Catalyst 6500 Series ASA Services Module (ASASM) are affected by the following vulnerabilities.



Summary

Cisco ASA 5500 Series Adaptive Security Appliances (ASA) and Cisco Catalyst 6500 Series ASA Services Module (ASASM) are affected by the following vulnerabilities:
· Cisco ASA UDP Inspection Engine Denial of Service Vulnerability
· Cisco ASA Threat Detection Denial of Service Vulnerability
· Cisco ASA Syslog Message 305006 Denial of Service Vulnerability
· Protocol Independent Multicast Denial of Service Vulnerability
These vulnerabilities are independent of each other; a release that is affected by one of the vulnerabilities may not be affected by the others.
Cisco has released free software updates that address these vulnerabilities. Workarounds are available to mitigate some of the vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-asa
Note: The Cisco Catalyst 6500 Series Firewall Services Module (FWSM) may be affected by some of the vulnerabilities above.
A separate Cisco Security Advisory has been published to disclose the vulnerabilities that affect the Cisco FWSM. This advisory is available at: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120314-fwsm


Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com

Distributed Denial of Service (DDoS) Attacks - Report

One in Three Companies Suffered One or More Distributed Denial of Service (DDoS) Attacks in Last Twelve Months Finds Research, , according to independent research commissioned by Corero Network Security.




One in three organisations (31%) has suffered one or more Distributed Denial of Service (DDoS) attacks in the last 12 months, according to independent research commissioned by Corero Network Security (CNS: LN), the leading provider of DDoS Defence and Intrusion Prevention System (IPS) solutions. The research amongst IT directors in 300 mid-to large-sized enterprises in the UK and US also found US companies were twice as likely as those in the UK to have experienced an attack: 38% of US companies versus 18% of UK companies.
Conducted by VansonBourne, the research also revealed a much greater level of concern amongst US enterprises, reflecting the increased exposure of US companies to DDoS attack. Nearly two thirds (63%) of US IT directors said they are concerned about the threat of DDoS attack against just 29% in the UK. Retail companies in the UK are particularly worried with more than half (52%) reporting a high level of concern about DDoS attacks. This is far higher than the concern cited by financial organisations (28%), manufacturing (11%) and other commercial sectors (7%) in the UK.
US companies across all verticals showed a heightened level of awareness and concern about attacks.
Political/ideological motivation was cited as the largest source of DDoS attack among UK companies reporting attacks, with a third blaming what is known as “hacktivism”. The different vertical markets in the UK also revealed a marked variation in the motivations behind attacks. The retail sector in the UK considers financial extortion either for fraud or to extract ransom money to be the primary intention, whilst in the finance sector, political or ideological motives are the main reasons for the attacks.
In the US, however, a competitor seeking unfair business advantage was by far the leading motivation, as unscrupulous competitors were blamed for more than half (52%) of the DDoS attacks amongst the US companies that reported being victims. In contrast, only one in five victim companies in the UK said competitors were responsible.
Country
Base: Respondents who have been victims of a DDOS attack Total UK USA
Political/ideological 23% 33% 20%
Competitor looking to gain business advantage 46% 22% 52%
Financial extortion i.e. ransom money 13% 17% 12%
Just for laughs 17% 22% 16%
*Other (please specify) 1% 6% 0%


Whilst levels of concern about the risk of DDoS attacks varied significantly between UK and US respondents, three in five (62%) IT directors claimed to have technology in place to protect their organisations against attack. However more than half (53%) of companies surveyed were still concerned about potential attacks.
“The UK was more cautious in deploying web business assets therefore they have not been as exposed as their US counterparts. As they deploy web applications they tend to do so in a more cautious protected manner and because of this may be experiencing less disruptive DDoS attacks. As the sophistication of attacks rises their numbers will become more in line with the US” said Richard Stiennon, chief research analyst at IT-Harvest.
“DDoS is a major, growing and evolving threat to global Internet commerce,” said Andrew Miller Chief Operating Officer at Corero Network Security plc in the UK. “High-profile ideologically motivated attacks by groups such as Anonymous have raised awareness of ‘hacktivist’-based DDoS attacks, but any enterprise may fall victim to unscrupulous competitors or cyber criminals.
“IT directors who believe they are protected against DDoS attack because they have traditional perimeter security technology, such as network firewalls, in place, may be lulled into a false sense of security. These companies should consider purpose-built DDoS defence technology to block attacks and maintain continual availability lest the business suffer significant loss.”
About Corero Network Security:
Corero Network Security (CNS:LN) is an international network security company and the leading provider of Distributed Denial of Service (DDoS) defence and Intrusion Prevention System (IPS) solutions. Corero’s products and services provide comprehensive, integrated, high-performance protection against constantly evolving network-borne cyber threats. Customers include enterprises, service providers and government organizations worldwide. Corero’s appliance-based solutions are highly adaptive and preemptively respond to modern cyber attacks, known and unknown, protecting critical information and online assets. Corero’s products are transparent on the network, highly scalable, and feature the lowest latency, and highest reliability in the industry. Corero is headquartered in Hudson, Mass., with offices around the world.
For more information on Corero's IPS and DDoS products, visit: www.corero.com

Researchers discover new Duqu variant that tries to evade antivirus detection

The Duqu authors are continuing their mission despite public awareness about the malware



Security researchers have discovered a new variant of the Duqu cyberespionage malware that was designed to evade detection by antivirus products and other security tools.

Researchers from Symantec announced the discovery of a new Duqu driver, the component responsible for loading the malware's encrypted body, on Monday via Twitter. The driver is called mcd9x86.sys and was compiled on Feb. 23, said Vikram Thakur, principal security response manager at Symantec.

Originally discovered in October 2011, Duqu is related to the Stuxnet industrial sabotage worm, with which it shares portions of code. However, unlike Stuxnet, which was created for destructive purposes, Duqu's primary goal is stealing sensitive information from particular organizations around the world.

The discovery of the new driver is a clear indication that the Duqu authors are continuing their mission, said Thakur. "No amount of public awareness about Duqu has deterred them from using it to accomplish their objective."

"I think when you invest as much money as invested into Duqu and Stuxnet to create this flexible framework, it's impossible to simply throw it away and start from zero," said Costin Raiu, director of Kaspersky Lab's global research and analysis team. "We always said that future variants of Duqu and Stuxnet will most likely be based on the same platform, but with enough changes to make them undetectable by security software. Indeed, this is the case here."

The source code of the new driver has been reshuffled and compiled with a different set of options than those used in previous versions. It also contains a different subroutine for decrypting the configuration block and loading the malware's body.

"We have seen this technique in October 2011, when the Duqu drivers were recompiled and bundled with new encryption subroutines, following the public disclosure," Raiu said.

The Duqu variant most likely uses a new C&C (command and control) server, since all previously known ones were shut down on Oct. 20, 2011, Raiu said. However, neither Symantec nor Kaspersky researchers know the exact address of the new server, because they don't have the component that contains that information.

"We do not have the full Duqu body, only the loader in the form of the driver. The loader does not contact the C&C directly, it only loads the main body which is stored in encrypted form," Raiu said.

Even if the new server would be known, it would probably be configured in a manner that it wouldn't allow anyone to get too close to the real attackers, Thakur said. The Duqu authors are confident that the malware will remain non-attributable, he said.

The organizations targeted by the new version are also unknown at the moment, but they're probably the same ones as in previous variants, Raiu said.




Source:
InfoWorld
www.infoworld.com

Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com

Java-based Web Attack Installs Hard-to-detect Malware in RAM

The attack code loaded an exploit for a known Java vulnerability (CVE-2011-3544), but it wasn't hosted on the affected websites themselves.



A hard-to-detect piece of malware that doesn't create any files on the affected systems was dropped onto the computers of visitors to popular news sites in Russia in a drive-by download attack, according to security researchers from antivirus firm Kaspersky Lab.

Drive-by download attacks are one of the primary methods of distributing malware over the Web. They usually exploit vulnerabilities in outdated software products to infect computers without requiring user interaction.

Kaspersky Lab researchers recently investigated such an attack on visitors to www.ria.ru, a website that belongs to the Russian RIA Novosti news agency, and www.gazeta.ru, a popular Russian-language online newspaper.

The attack code loaded an exploit for a known Java vulnerability (CVE-2011-3544), but it wasn't hosted on the affected websites themselves. Instead, it was served to their visitors through banners displayed by a third-party advertising service called AdFox.

What's interesting about this particular attack is the type of malware that was installed in cases of successful exploitation: one that only lives in the computer's memory.

"The operation of such an exploit involves saving a malicious file, usually a dropper or downloader, on the hard drive," said Kaspersky Lab expert Sergey Golovanov, in a blog post on Friday. "However, in this case we were in for a surprise: No new files appeared on the hard drive."

The Java exploit's payload consisted of a rogue DLL (dynamic-link library) that was loaded and attached on the fly to the legitimate Java process. This type of malware is rare, because it dies when the system is rebooted and the memory is cleared.

However, this wasn't a problem for the cybercriminals behind this particular attack, because of the very high probability that most victims would revisit the infected news websites, Golovanov said.

The malicious DLL loaded into memory acted as a bot, sending data to and receiving instructions from a command and control server over HTTP. In some cases, the instructions given out by attackers were to install an online banking Trojan horse on the compromised computers.

"This attack targeted Russian users. However, we cannot rule out that the same exploit and the same fileless bot will be used against people in other parts of the world: They can be distributed via similar banner or teaser networks in other countries," Golovanov said.

The best protection against this type of attack is to keep the installed software on computers up to date, especially browsers and their plug-ins. In case exploits that target previously unknown vulnerabilities are used, it's best to have an antivirus product running that is capable of scanning Web traffic and detecting attack code generically.

It's ideal to stop the infection in its early stages, because once this type of "fileless" malware gets loaded into memory and attaches itself to a trusted process, it's much harder to detect by antivirus programs, Golovanov said.



Source:
PCWorld
www.pcworld.com

Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com