Archive

Archive for January, 2006

U.S. Federal Trade Commission announces settlement related to data security

January 25th, 2006
No comments

This just in: The U.S. Federal Trade Commission (FTC) announced today that ChoicePoint, Inc., which “acknowledged last year that the personal records of more than 163,000 consumers in its database had been compromised,” will pay substantial civil penalties. Deborah Platt Majoris, the Chairman of the FTC, stated in Commission’s press release today: “The message to Choicepoint and others should be clear: Consumers’ private data must be protected from thieves.”
The FTC stated that Choicepoint… “will pay $10 million in civil penalties and $5 million in consumer redress to settle Federal Trade Commission charges that its security and record-handling procedures violated consumers’ privacy rights and federal laws.”…

Original post by blog@rsa.com (Shannon Kellogg) and software by Elliott Back

Computer security Systems

SANS – Internet Storm Center – More on Nyxem

January 24th, 2006
No comments

More on Nyxem

Published: 2006-01-23,
Last Updated: 2006-01-23 22:13:35 UTC by Bojan Zdrnja (Version: 1)

Although Nyxem is comparatively less spread then worms like Sober or Netsky, it’s still doing a fair number of rounds.

The graph below is from one of the e-mail gateways with a decent number of e-mails processed daily (around 500.000+). You can see that Nyxem.E is the top malware instance detected in last 24 hours, with more than double the occurences then the next highest occuring worm (Netsky).

This is not strange as the Web counter that the worm visits upon infecting the machine currently shows around 630,000 infections (we can’t be sure that this number is correct). Bert Rapp e-mailed us asking about the URL that the worm visits. This can help you in determining if a machine is infected, as it will visit the URL with the counter.

The counter is at:

h tt p:// webstats.web.rcn.net/ [REMOVED] / Count.cgi?df=765247

You can search your web logs for this host name (which looks as a legitimate site).

Other than that, Fortinet released their in-depth analysis of the Nyxem worm with some pretty interesting details (you can find the original analysis here).
The most interesting part, which I haven’t seen in other analysis of the worm says:

“Additional Registry Changes

  • The virus is coded to register the dropped ActiveX control through changes to the system registry. By creating the following registry entries, the control is considered “safe” and digitally signed.”

The threat of worms like this will make them much more dangerous in the future. If a worm puts a fake CA certificate on an infected machine, MITM attacks become extremely easy. Of course, we all know that once the machine is infected you can’t trust it, but this looks like another (big) problem for the average user out there.

SANS – Internet Storm Center – Cooperative Cyber Threat Monitor And Alert System.

Uncategorized

SANS – Internet Storm Center – What’s the threat? And who is noticing it? Nyxem_e versus CME 508

January 24th, 2006
No comments

 What’s the threat? And who is noticing it? Nyxem_e versus CME 508

Published: 2006-01-22,
Last Updated: 2006-01-22 20:00:45 UTC by Patrick Nolan (Version: 4(click to highlight changes))

CME 508 does not threaten like Nyxem_e, on February 3rd and every third day of the month thereafter Nyxem.E will destroy users work (see F-Secure’s blog) when the worm activates and replaces “the content of user’s files with a text string “DATA Error [47 0F 94 93 F4 K5]”. Among these files are: DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP” “on all available drives”, and yes, available = shared drives.

fwiw, I look at published email malware statistics daily, both Nyxem_e and CME 508 are approximately the same in volume reports, and nowhere near sober was last year as far as raw numbers go. But Nyxem.E has legs, it’s more like a centipede than a worm, and it’s not likely to drop off the radar soon, certainly not before the 3rd of February.

The Handlers diary previously referenced Nyxem.E in More on Blackmal/Grew/Nyxem (file deletion payload.
Source info – see the F-Secure Virus Information Pages : Nyxem.E

The vendors below do not mention the destruction of user work, as of the checking I just did, ymmv.
Also Known As: 

WORM_GREW.{A, B} [Trend Micro],
“It gathers email addresses from files with the following extension names:

DMP
DOC
MDB
MDE
PDF
PPS
PPT
PSD
RAR
XLS
ZIP”.

W32.Blackmal.E@mm Symantec

W32/Nyxem-D [Sophos],

W32/MyWife.d@MM  [McAfee],

W32/Grew.A!wm (Fortinet),

W32/Small.KI@mm [Norman],

Win32/Blackmal.F [Computer Associates]

Tearec.A Panda

UPDATE
The CME reference is difficult but not impossible to follow. I’m reading CME links which show “Latest CME Identifiers CME-508“, however, that last 508 link has english that says the newest CME-ID is “CME-503  – Date Assigned 2006-01-20″. In any event I base my comment that “CME-508″ is not a threat because I interpret vendor malware write-ups mentioning CME 503 as the “new” threat called CME-508 at cme.mitre.org. The vendors are listing 503, none are using 508 ……

SANS – Internet Storm Center – Cooperative Cyber Threat Monitor And Alert System.

Computer security Systems

Introducing the Speaking of Security Podcast

January 22nd, 2006
No comments

Click here to listen/download (9:52).
In our inaugural podcast, you’ll hear the latest RSA Security headlines; a Q&A with the vice president and general manager of RSA Conferences, Sandra Toms LaPedis; and a monthly policy update with Speaking of Security blogger Shannon Kellogg, who reviews government data security regulations in 2005 and gives us a look ahead at what we can expect in 2006. We want to hear from you!
Please contact us at podcast@rsasecurity.com.

Original post by blog@rsa.com (Podcast Producers) and software by Elliott

Computer security Systems

Cost of cyber-crime continues to grow according to the FBI

January 19th, 2006
No comments

The cost of cyber-crime is up according to the 2005 FBI Computer Crime Survey, estimating that U.S. organizations lose over $67 billion dollars a year. The FBI’s latest data, released on January 18th, is based on responses from over 2,000 public and private sector organizations in four U.S. States (Iowa, Nebraska, New York, and Texas). According to the survey results, 9 out of 10 organizations experienced a computer security incident with over 20 percent of the respondents indicating they suffered 20 or more attacks over a one year period. Interestingly, 44 percent reported intrusions from within their organizations, suggesting a very strong case for improved internal access controls…

Original post by blog@rsa.com (Shannon Kellogg) and software by Elliott Back

Computer security Systems

Top 10 (or more?) Blogs Covering Identity and Data Protection

January 17th, 2006
No comments

The RSA Bloggers are putting together a list of the top blogs covering identity and data protection. Eventually (when our lazy blog programmer gets around to it…just kidding) we’ll post it as our first “blog roll”. This is new terminology to me as a still-relatively-fresh blogger, but the goal of the blog-roll is to single out the sites that are shaping the future of online security and identity. We want to have a list that reflects the global nature of the conversation. Plus, we want them to be engaging, topical, and present a mature point of view. We’re not endorsing the sites or their content, of course, but simply recommending them based on reputation. Let’s us know what you think – and what we’ve missed! Here’s the current list…

Original post by blog@rsa.com (Stan Swiniarski) and powered by Img Fly

Computer security Systems

The Authentication Continuum II

January 9th, 2006
No comments

Continued from last week
If there are too many form factors we will defeat the object of adding value and enabling web-based transactions and access. On the other hand, not enough, or too much (the application of the wrong form factors in the wrong combinations) will also add cost and inhibit use.
At the very bottom end of the continuum, anonymity (cash or the digital equivalent) is a huge part of the problem in terms of the sheer volume of transactions. According to APACS in the UK, of the 27 billion cash payments in 2003, 17 billion were for £5 (about $8.50) or less. Unsurprisingly, retailers are the biggest consumers of cash: roughly £100 billion was spent in UK retailers alone in 2004…

Original post by blog@rsa.com (John Madelin) and powered by Img Fly

Computer security Systems

The Blocker Tag

January 8th, 2006
No comments

Last month, a patent entitled “Method and apparatus for selective blocking of radio frequency identification devices” (patent number 6,970,070) issued at the U.S. Patent Office. As the title suggests (in its vague and formal language), this patent covers the RSA Blocker Tag, an RFID privacy device invented at RSA Laboratories in 2003.
After the whirlwind of trade-press coverage around the Blocker a few years ago, some may be wondering why RSA Security didn’t issue a press release around the issuance of the patent. (It happened very quickly by USPTO standards — in just over two years!) The reason is simple: The Blocker Tag is not likely to become a product anytime soon.

Original post by blog@rsa.com (Burt Kaliski) and a wordpress plugin by Elliott

Computer security Systems

The Authentication Continuum

January 4th, 2006
No comments

A single identity or a single form factor is an impossible aspiration and will not solve the bigger problem of transaction, application and service enablement. We have moved from a debate as to what “The” definitive authentication mechanism will be (most popular candidates? Smart cards vs. biometrics) to a growing acknowledgement that there will be multiple mechanisms, from chip and pin, to mobile phones, to RFID-embedded payment cards, and so on.

Original post by blog@rsa.com (John Madelin) and software by Elliott Back

Computer security Systems