Microsoft Security Intel Report Released

The latest installment of Microsoft's Security Intelligence Report has been released, with a breakdown of threat assessment by country.

Redmond reports that malware was discovered on 7.8 of every 1000 computers scanned in the US, which seems surprisingly low. By comparison, Russia scored a 9.8, while Korea came in at 16.0 per 1000.

Worms and trojans were highlighted as the predominant threats in many of the countries in the report, with password stealers and other trojans/droppers also heavily utilized.

For more details and the full report, check out the Microsoft Security Intelligence Report Volume 8.

Image via Wikimedia Commons

Beware of Fake Anti-Virus Software

It's an unwritten rule that you never need anti-virus software until you need it badly. The corollary to that edict is that, being signature based, AV programs are only as good as what they already know, and studies have shown that leading anti-malware offerings fail to detect upwards of 50% of malicious code.

If that isn't enough to make you ponder an existence as an internet hermit, then perhaps the concept of fake anti-virus software will push you over the edge.

Researchers are reporting that increasingly, users are tricked by web site pop-ups and bogus warnings of virus infection detections followed by "suggestions" to download readily-available virus removal programs that are themselves malicious code. Once the user willingly runs the program, their machine is immediately compromised and often proceeds to download additional malcode in the background.

What can you do to protect yourself? Here are a couple of key things to remember.

1. Never, ever install a program or run a command unless you are absolutely certain of its source.
2. Ignore pop-ups, warning banners, and browser redirects. Trust me - the Internet is not one big loving community that exists to help you out. Rely only on warnings from programs you've installed yourself.
3. Always have a rescue CD available for virus removal, and don't be shy about using it if you're concerned. Brian Krebs has an excellent post on finding and using rescue CDs at his Krebs on Security blog.
4. Move off of Internet Explorer. I recommend Firefox with the NoScript add-on, but Google Chrome or Opera are other good options.
5. Keep your computer patched. If you're running Windows, enable automatic updates, and use a free product like Secunia PSI to help keep track of updates to popular applications like Adobe Reader, Sun Java, QuickTime, and other frequently overlooked programs.

Let's be careful out there.

Cyber Crooks Outpacing Bank Robbers

Threat landscapes are always evolving based on technology and opportunity cost. Why rob banks? Because that's where the money is.

Brian Krebs, in his Krebs on Security blog, details how the loot obtained from banks by cyber attacks is rapidly outpacing the losses caused by physically sticking up a bank branch.

In fact, real-life bank robbers stole a total of just over $30 million in the first three quarters of 2009, just $5 million more than cyber crooks did in the third quarter of last year alone.

Krebs makes an interesting observation:

I can’t help but notice one other important distinction between these two types of bank crimes: The federal government sure publishes a lot more information about physical bank robberies that it makes available about online stick-ups. 

By the way, Willie Sutton never said that people rob banks because that's where the easy money is.

Please Rob Me via Twitter

Being a cranky security curmudgeon, I'm constantly battling with my progeny about their tendency toward social network oversharing.

I'm told that it's a generational difference, that unlike my boomer peers, today's contemporaries believe that real-time sharing is not only normal but encouraged. Facebook's frequently controversial privacy updates demonstrates the social log-rolling involved with determining how much sharing is too much.

Sometimes overlooked by those dishing out a steady stream of updates on the intertubes are the very real implications of what can happen when these data points are collected, collated, and actioned. Case in point - Please Rob Me.

For the uninitiated, Please Rob Me aggregates public Twitter messages, allowing for a centralized view of who's doing what. Geographic location is one of the available filters.

As detailed by Caroline McCarthy on Cnet, these sharing practices could lead to valuable information falling into the wrong hands.

"On one end we're leaving lights on when we're going on a holiday, and on the other we're telling everybody on the internet we're not home," the Please Rob Me site says to explain its rationale. "The goal of this website is to raise some awareness on this issue and have people think about how they use services like Foursquare, Brightkite, Google Buzz, etc."

As sharing on society networks grows and oldsters like me die off, there's a real concern that fraudsters and crooks will gain real-time access to lucrative information to facilitate their nefarious behavior.

Consider it the modern equivalent of hiding your key under the front doormat. Don't be surprised if someone uses it.

XSS Flaws in Twitter and Google Calendar

Darknet has the details on additional cross-site scripting flaws recently discovered in both Twitter and Google Calendar.

While the latest vulnerabilities were reported and rapidly remediated, how could they possibly exist, given the pounding web sites took in 2009 due to unmitigated XSS issues?

Are web-based application providers not routinely scanning their internet points-of-presence as part of their vulnerability management programs? Or are they turning around code changes and feature updates so rapidly that their change management practices suffer and there's not enough testing performed prior to moving code from QA?

Ah, the joys of attempting to secure cloud computing.

As vendors push more offerings from the desktop to the cloud, you'll see attackers moving there too. It is more likely that crooks will try to find one of the thousands of windows unlocked, allowing them to steal valuable data unseen, than it will be for them to try to kick down the door like they did five years ago.

Willie Sutton never actually responded to the question of why he robbed banks with, "Because that's where the money is!", but know this: Attackers don't waste time and money on an exploit unless the return is favorable.

When sites are vulnerable, it's an open invitation to unwanted activity. Expect the bad guys to take advantage.

GSM Crypto Code Broken

For over 20 years, up to 80% of the world's phone calls made on cellular phones have relied on the GSM algorithm for protection.

Now comes word that a German computer engineer claims to have broken the code, part of his broader effort to demonstrate how insecure wireless systems are around the globe.

Karsten Nohl detailed his achievement at the Chaos Communication Congress in Berlin. 64-bit encryption? Hey, cellular phone providers - are you freaking kidding me?

Back in August 2009 I wrote the GSM algorithm's epitaph when I first learned that Nohl launched his open-source project to crack GSM cellular phone encryption.

Karsten Nohl claims that he's looking to exploit a vulnerability that's been known for 15 years and affects 3 billion phones as a way to prod cellular phone manufacturers and carriers to get serious about security.

Cracking GSM encryption is nothing new, but previously the tools have been very complex, highly technical, and pretty darned expensive. Nohl hopes to change that via his open-source project. Ah, the joys of distributed computing.

Less than 5 months later, Nohl is claiming success. Imagine what groups motivated by financial gain, such as Russian organized crime syndicates or Chinese hackers, will do with this ability.

Even more frightening is what these cartels may have already achieved. The days when we could consider security as secondary to killer features and functionality are gone.

If you're not planning six steps ahead, you're already three steps behind.

Via ZDNet

Metasploit Framework 3.3 is here

Metasploit Project has released version 3.3 of the Metasploit Framework, including updated exploits for WIndows 7.

All told, v3.3 packs 446 exploits and hundred of payloads, more than enough for those seeking an automated attack platform. 180 bugs have been fixed since the last release.

There's no need to be a cyber-genius to use the Metasploit Framework, much to the consternation of security professionals who miss the days when significant technical proficiency was required to write and launch attacks.

With the Metasploit Framework, it's as easy as selecting and configuring your exploit and payload, finding a vulnerable target, encoding your payload to hide from intrusion detection systems, and launching your exploit.

Remember, you should be using this tool for research, teaching, and assessment purposes only. Running Metasploit against targets without permission can get you a visit from people wearing sunglasses and dark suits.

You've been warned.

Microsoft Buries Consumers with Avalanche of Vulnerabilities

In the six years since Microsoft stopped pelting us with security fixes willy-nilly and implemented a monthly bulletin format, home and enterprise customers have been entombed by fixes for a soul-crushing 745 vulnerabilities, nearly half rated as "critical" by Redmond.

So laments Jaikumar Vijayan, writing in the Security Smart section of Network World.

The number of announced flaws in the last two years is double what it was in 2004 & 2005, which would seem to suggest that Microsoft's Trustworthy Computing initiative has done more to repair a leaky ship in motion than to build a seaworthy vessel in the first place. That flies in the face of the highly-publicized security mission, which promised a more secure computing environment out of the box.

Who remembers when Redmond shut down development in an effort to educate their architects and developers in the ancient practice of secure coding? I do. Made for some late software launches, as I recall, honking off people with certain licensing agreements, but it was an easier pill to swallow if the result was a modicum of protection from the forces of evil.

And there are some barely-used bridges in Washington state available for pocket change, too.

It's a perfect storm - Microsoft has created a monster in the form of feature-laden, highly-usable ubiqitous software offerings, which has led them to two parallel issues: Any security hardening will inevitably break the free-flow of usability consumers have come to expect, and maintaining depth in feature sets (and securing them) invariably leads to an increase in coding complexity that makes trusted computing all the more daunting a task.

When Vista first launched, one of the more trumpeted security features - UAC - also became one of the most hated. Microsoft attempted to add a thin layer of security into the computing experience, and it was obvious that they also tried to match it to existing usability and customer experience paradigms. It didn't work, because it was a jolting interruption of the seamless Windows pillow-ride that Microsoft had been marketing to us for years.

Linux and UNIX users don't whine much when prompted for admin credentials or root anytime they try to do anything that messes with the core operating system because it's basically been there from the beginning. Plus, it makes sense - a simple step to validate that some chunk of malware isn't trying to make an unauthorized system change. It's a small price to pay for avoiding the horrors of malicious code.

Redmond has essentially hoisted themselves on their own petard. It's like a parent that feeds their child a steady diet of junk food and sugar, and when the kid turns out a tad portly, the dinner plate is suddenly filled with quinoa and Brussels sprouts. What's a chunky lad to do?

This quandry is soon to be faced by the Apple crowd, too. As Macs begin to pick up market share, users will begin to be targeted by the bad guys as they are identified as a target-rich environment. With roughly 10% of computers sold, it's still not as attractive to craft exploits for Mac code as it is for the dominant Windows environment that garners more than 80% of the pie, especially given the ongoing security struggle the 745 vulnerabilities represents.

As Microsoft hopes and prays that XP users shut down forever and the world becomes populated with Vista and Windows 7 users biding time until they convert to Windows 8, their only salvation will be their ability to move users to a more secure environment one tiny step at a time.

The great unknown is whether people are willing to walk that path, and as John Hodgman learns in the newest Mac vs. PC commercials, there's a lot to be said for making a clean break to a new OS if there's going to be pain involved anyway.

Image via Wikimedia Commons

Catching a Virus On the Web

If you want to avoid catching the flu, stay out of public buildings and airplanes. If you want to keep your computer from catching malware, avoid web sites.

Seems drastic, right? But a recent report by Dasient identifies 640,000 web sites and 5.8 million web pages as being infected by malware.


If that's not frightening enough, how about this handy information?

Meanwhile, the Google blacklist of malware infected sites has more than doubled in the last year, registering as many as 40,000 new sites in one week.

Most of the malware is delivered via JavaScript or iFrames injected into otherwise legitimate sites, which means two things - first, that web developers are still doing a crappy job of securing their code, and second, you can't even trust mainstream sites.

That means it's time for me to again rant about using a browser other than Internet Explorer, advise you to keep your Windows OS (if you insist on sticking with Microsoft) and any applications fully patched at all times (Secunia PSI is a good choice, especially for peripheral apps), and run a recognized antivirus product that's updated at least daily.

Oh, and if you're using your computer for online banking, financial transactions, or shopping, you may want to check out my posting here on using a Live CD to keep malware from stealing your information.

Via cnet Insecurity Complex

Image via Wikimedia Commons

SANS - Social Engineering Computer Attacks

SANS has a timely diary entry on their Internet Storm Center page entitled Social Engineering in Real-World Computer Attacks in which they posit the following:

Why bother breaking down the door if you can simply ask to be let in? Social engineering works, both during penetration testing and as part of real-world attacks. This note explores how attackers are using social engineering to compromise computer defenses.

For all the millions spent on hardening systems and networks, there's always someone volunteering to open the door to allow attackers inside. Defense-in-depth as a strategy only works if the control mechanisms are left in place and not circumvented.

Would you install an alarm system in your house and write the passcode on the outside wall? Or would you give the code to someone who called or emailed you, claiming to be from the alarm company demanding that you validate your code for them or they would cut off your access?

Most people would answer "no" to those two questions, but history has shown that there's a real problem with people responding to phishing and vishing schemes and giving out their credentials willy-nilly. Look at some of the examples pointed out by SANS:

• Bogus parking violation notices on cars directing people to visit a web site to resolve that turns out to be a malicious site
• Voicemails left for customers to "call back" and verify their banking information
• People plugging in USB drives or CDs left in public places or sent via the mail or post

Firms that have your credentials should never be asking you to validate your credentials. Your bank doesn't need your account number, PIN, mother's maiden name, or answer to your secret question, because your bank already has that information.

Remember how your mom told you not to pick things up off of the ground and eat them because she didn't know where it came from? Yes? Then why would you pick up a USB drive or CD and stick it in your computer?

Never, ever give out information or data based on a phone call, message, or email you've received. Always contact firms and companies, such as banks, credit card companies, retailers, etc., using the contact information in your statements or using the "Contact Us" information that's posted on their official web site, which does not include following links that come via email or text messages.

There's an popular adage that you can't cure stupid. When it comes to computer attacks, the level of sophistication is increasing exponentially, so it's no longer a question of being smart. Attackers are targeting human nature, and that's a difficult challenge to overcome.

Image via Wikimedia Commons

Safer Online Banking Using a Live CD

I've been a Linux user for quite awhile now, so using a Linux distro Live CD is second nature for me. For many Windows home users, though, the thought of putting a CD in your tray and using it to do your online banking might seem a bit daunting.

More daunting than trying to recover your identity or money if it's stolen by fraudsters?

The space between convenience and security is rapidly narrowing as cyber-crooks develop potent malware and inventive schemes to steal banking credentials, compromise personal information, and build massive botnets to construct an ever-larger network of exploited Windows machines to advance their nefarious agenda.

Brian Krebs does a great job in his Security Fix blog of detailing the advantages of home users moving to Live CDs for online banking. And it's really not that daunting - put a CD in your tray, reboot your machine, and when it loads, pull up the web browser, do your banking as you normally do, and when you are finished, remove the CD from the tray and reboot, and you're back to your typical Windows installation. No muss, no fuss, no viruses or malware possible.

Brian points out a couple of tips that would benefit newbie Linux Live CD users, like how wireless can sometimes be tricky (plug into your router or broadband modem using a network cable instead) and be prepared for desktops to work better than laptops (funky hardware configurations and drivers are more prevalent on laptops), but if you use one of the newer distros, like the latest versions of Ubuntu, the problems are minimal.

I've recommended this to friends and family, and I'm advising you to consider it too. It's become much too difficult for home users to protect their Windows machines from every possible evil that's lurking. Using a Live CD is one way to get a leg up on the bad guys.

Drop me a note at redgeckoblog@gmail.com if you want some tips on which Live CDs work best and where to find them.

SANS Releases Top Cyber Security Risks

SANS has released their annual overview of top cyber security risks, and there are few surprises to be had by those who follow the topic on a regular basis.

Two significant areas of opportunity are called out - client-side applications (think Adobe, QuickTime, Flash, etc.), and Internet-facing web sites. Both suffer from the same root problem - poor coding practices and beleaguered IT admins who struggle to keep up on the continuous vulnerability patching treadmill.

SANS opines that there are less OS-targeted exploits floating around, which probably has more to do with the low-hanging fruit of client apps than it does any significant hardening of operating systems. Vista was marginally better than its predecessors, but since Vista never really took off in the enterprise, there's still a lot of XP deployed in the corporate world, and after a half-decade of vulnerabilities and flaws, XP has been patched so often that it looks like a pair of my Sears Toughskin jeans from 1973. And yet, each month, Microsoft releases a couple of new advisories with fixes that include XP as an impacted OS.

Attackers have decided that it's much easier to crawl in through an open window caused by a faulty, unpatched application than it is to brute force their way in through the front door of the OS. Once inside, the bad guys are still able to compromise a system, harvest credentials, steal personal information, and otherwise take full control of the machine without needing to assault the OS directly.

People are very trusting of video and Flash content, PDF files, Word docs, and other files associated with some of the weaker, flawed apps, and they will click on these file types all day long if they show up in email, instant messenger, or on a compromised web site. In many cases, the content will autorun, because users have allowed their systems configurations to be set for convenience, not security.

Web apps continue to be plundered via a combination of SQL injection and cross-site scripting attacks typically associated with poor coding practices and insufficient vulnerability assessment and remediation processes. Combined with happy-go-lucky users who will click on any url that comes within their reach, you have a perfect storm of ignorance and negligence that results in malware propagation and infected systems.

What's the answer? Aside from unplugging from the Internet and leading a Puritanic technology existence, the solution is better application development practices, enhanced and timely vulnerability assessment and remediation processes, and using system lockdowns and controls to protect users from themselves.

Not using Microsoft products can also be helpful, but that's my bias - even though my background is an a Microsoft engineer and certified trainer. Redmond is undoubtedly relieved that Apple, Adobe, and others are finally in the crosshairs as often as Microsoft has been. Misery loves company.

Month of Facebook Flaws

Picking up H.D. Moore's "Month of...." targeted vulnerability reporting mantle, a security researcher has vowed to spend the month of September 2009 disclosing a series of cross-site scripting vulnerabilities affecting various Facebook applications.

Hold on to your hats, boys and girls.

theharmonyguy plans to give Facebook web developers 24 hours notice before publicly disclosing the flaws. If you're smart, you'll buy some stock in Code Red and pizza delivery, because there are some coders who will be spending some late nights recompiling and testing their web apps over the next couple of weeks.

There have already been a couple of applications called out for their weaknesses - FarmVille for one. If you're using it, you're at risk until it's fixed.

Link to full article on The Register

Image by pshab via flickr

Easy Computer Snooping Tool

This is good news for people who are engaged in forensic examination of computers, but bad news when you consider that bad people will also have access to it, which means losing your data could happen more quickly and easily than before.

Via his Schneier on Security blog, Bruce Schneier links to a press release for EnCase Portable, which "runs on a USB drive, rather than a laptop, and enables the user to easily and rapidly boot a target computer to the USB drive, and run a pre-configured data search and collection job."

So essentially, someone could walk calmly into your home or office, or up to your computer in a conference room or left unattended in a coffee shop, plug in a discreet USB drive, reboot you, and proceed to suck all of your data back into the thumb drive. Depending on how long you are gone, this could go entirely unnoticed, with the only evidence being a computer that has rebooted.

There's not much additional information in the press release about whether controls such as full-disk encryption or bios password protection can be defeated by this tool, so it will be interesting to participate in the chatting within security circles to get the scoop.

This is just my gentle reminder to you that leaving your PC unattended, even for short periods of time, introduces risk, and to make sure you follow some simple security controls to keep data leakage to a minimum.

Prairie Dogs Pull Ocean 11 Caper

The Maryland Zoo spent a cool half-million dollars constructing an escape-proof habitat for a group of prairie dogs, and the ungrateful land rodents broke out in less than 10 minutes, leaving the zoo's Terry Benedict fuming.

"They find all the weak spots and exploit them," said Karl Kranz, the zoo's vice president for animal programs and chief operating officer.

I post this not because I'm fascinated by prairie dogs - meerkats have more personality - but because I'm a security geek, and it's a point I've been trying to make for years about stasis and complacency when designing and implementing a security infrastructure.

While you're laying the last row of virtual bricks on your perimeter, the forces of evil are already probing and prodding to find ways around your defenses. It's important that you do, too.

Five hundred grand is a lot of cash for a system that doesn't work, but anyone who has been in the corporate infosec world can quote much larger pricetags for enormous technology white elephants that either failed to provide the level of security and control that was promised, or became such a nightmare to implement that the system was either scaled back or discarded.

So take a lessen from the Maryland Zoo. Anytime you build a security system, spend some time determining what holes open up with the introduction of this new system, and have plans to fix them before you start building. And once you've remediated those gaps, move on to the next set of weaknesses. Then the next.

If you don't, someone else will.

Prairie Dogs Hack Baltimore Zoo , via Schneier on Security

T-Mobile Breach May Result in Zeta Jones Ass Sharing

Glancing at the T-Mobile website, their slogan is now Stick Together. I shit you not.

I guess by sticking together they mean putting a bunch of their sensitive files in one big insecure place to make it easier for cyber-criminals to make off with them?

T-Mobile is investigating reports that they've been compromised in the wake of a neener-neener big fat wiener posting on Full Disclosure that announced some black hat had made off with the jewels and was offering them to the highest bidder.

To be fair, we should all take a deep breath until this claim is either proven or dismissed as bunk. Given that T-Mobile is now answering questions from the traditional media, it will be difficult to keep this genie in the bottle if it turns out that the databases were indeed snatched and in the possession of the bad guys (or girls).

If, however, this turns out to be true, I suggest that any T-Mobile penalty somehow includes sharing Catherine Zeta Jones' ass.

Security Fix - T-Mobile Investigating Data Breach Claims , via Security Fix

The Cyber Security Sky is Falling!

It's hard to not don a Chicken Little outfit and run around the city warning people of the computer apocalypse developing right before their eyes. Geez, don't you people read the news for free on the Internets?

Some sort of "mystery virus" has infected the computers at the FBI and U.S. Marshals Service. Did anyone swab their USB ports and test for swine flu?

Neither agency was willing to reveal much detail about the event, but based on recent vulnerability management performance reporting on federal agencies, both law enforcement groups may have contracted the Melissa virus from 1999. I'm kidding, but they should really stop clicking on those little blue linky things that keep coming to them in emails while they're surfing for porn.

Also in the news is a distributed denial of service attack against DNS in China that left millions of Chinese users unable to resolve domain names to IP addresses, rendering them unable to evade the Great Firewall of China to watch You Tube videos and rue over how inadequate they are compared to glorious American male adult film stars.

Is their DNS held together with twine and broken twigs, tied seven layers high on the back of a bicycle? How can a DDOS knock the country out if the attack is at only one location?

Inquiring minds want to know.

How insecure is our electrical grid?

When The Wall Street Journal reported this week that Chinese, Russian, and myriad other groups of foreign nationals had been able to penetrate the electrical infrastructure of the United States and leave behind chunks of software code that might allow them to disrupt or destroy the grid remotely, there was a certain amount of panic generated as mainstream media picked up the story and flogged it for all it was worth.

Conversely, security professionals barely acknowledged the news reports, as this is hardly a recent development. Hardening an admittedly-brittle utility infrastructure and closing the known issues that exist in SCADA have long been on the radar of info security teams worldwide.

Given how much work has been performed in the last several years, the Journal report should serve not only as a warning as to the omnipresent threats that exist, but also as a wake-up to everyone involved and a call to action in support of proactive assessment and remediation. Imagine how insecure this infrastructure was five years ago, before anyone starting paying attention to it.

As technology began to permeate the broad segment of the economy known generically as utilities (gas, electric, water, telecommunications, transportation, etc.), the ability to monitor and manage the infrastructure remotely came as a huge benefit to the companies involved, allowing for several models to develop, including centralization, decentralization, and a hybrid of the two.

Further, technicians gained the ability to interact and make changes regardless of their geographic location, as long as they had Internet access and were (allegedly) credentialed to manage the infrastructure remotely.

The downside to such a distributed infrastructure is the explosion in the size of your perimeter and the number of access points that need to be identified and controlled. If there are doors for authorized personnel to gain access, those same ingress lines are available for the bad guys, not to mention any points of entry created by flaws, vulnerabilities, or poor system design.

Since a great number of these control mechanisms are routed via public networks, they are inherently vulnerable to attack and compromise. The alternative is separate data and communication networks for critical infrastructure, highly-secured and access-controlled. The problem with that is two-fold: it has to be built and maintained, and it has to be funded, no easy task for companies looking to make a profit or stay afloat.

The ability to take advantage of the economy of scale has long been used by utilities for cost-saving purposes. It's certainly much cheaper to buy and implement Cisco routers, switches, and networking gear, and there's a much deep pool of engineers and technicians to deploy and maintain Cisco products than, say, a proprietary hardware inventory built specifically for one purpose or utility.

The other side of that same coin is that evil-doers also know the ins-and-outs of Cisco hardware and OS offerings, so advantage evil-doers. The goal is to stay a step or two ahead of the threats. When the cost of failure is the crippling of our electrical grid or telco infrastructure, the stakes are raised exponentially, as everything else within the United States relies on that infrastructure remaining highly available.

It's a constant balancing act between efficiency and security. It's easy to make things more accessible and user-friendly, and to use public IP networks to tie it all together. But that typically works against the concept of high security. Just ask Microsoft.

Until some sort of security standards for so called "smart grids" are determined and the pendulum swings back toward the security side, we'll continue to have valid concerns about the vulnerability of our core infrastructure.

Let's hope we're able to move quickly in this area. Otherwise, a cold, dark future awaits us all.

Electrical Grid in U.S. Penetrated by Spies

China Engaging in Cyber Spying? Really?

This should be filed under "duh".

Media outlets are agog over reports that China is involved with "GhostNet", a computer espionage network.

According to Canadian security officials, compromised computers that make up GhostNet have been completely taken over, and those behind this evil network can browse and download files, and make use of "covertly installed" microphones and web cameras.

Smile, you're on Canton Camera.

Some are quick to point the finger at the Chinese government as being a central player in this espionage, but official spokes-peoples-Republic-of-China denies involvement, stating that cybercrime is expressly forbidden. Like pirating software and designer fashions is verboten, no doubt.

GhostNet has seemingly infiltrated business, education, government, and industry networks, which sounds remarkably like a systematic, well-planned mission to reconnoiter with breadth and depth. There's obviously an end-game here. What remains to be seen is the extent of the reach and the identity of the players.

As an infosec professional, I'd be interested in a detailed analysis of the infected systems and networks to identify common components. Without having any inside information, I'd guess Microsoft products might figure prominently in this, due to the long history of Asia-centric malware that targets the Windows and Office product sets. I just don't see a Mac or Linux / Unix footprint to this, given the disparity in targets and low saturation of these platforms.

Over the past year, there have been a staggering number of breaches and compromises resultant from silly, insecure infrastructures - P2P software on government computers, missing and / or stolen devices from which authorization and authentication credentials could be harvested, poor email practices, crappy Internet browsing policies coupled with insecure browsers and configs...the list goes on and on.

Something as simple as the security tests that were conducted in certain cities where scores of USB drives containing harmless malware were scattered in and around corporate parks, company headquarters, and government installations to determine how many would be taken inside a nearby premises and plugged into a desktop or laptop. The answer? Way, way too many. They know this because the flash drives reported in to a command & control point to report they had been inserted into a computer. You can't cure stupid.

No one should be surprised by this reporting. I'd be concerned about why it took so long to identify the issue, and if there was a gap between having this data and making it public. This shows that relying on security "controls" to prevent data leakage and compromise is only part of the equation.

Defense in depth as a strategy is beginning to show that there are always cracks, even tiny ones, and the other side only needs a small opening in order to accomplish their goals. It's very difficult to protect your network from everything, everyday, from everyone.

L0phtCrack Is Coming Back

L0phtCrack, the tried & true password cracking tool used by black hats and white hats alike, is poised for a comeback. Yay!

Symantec snuffed the handy app a couple of years ago, much to the chagrin of crooks, security geeks, and overworked sysadmins everywhere.

The original creators of L0phtCrack have reacquired the tool and are rumored to be releasing a new version next week at the SOURCE Boston conference.

cgisecurity.com is reporting that the new version will include several improvements, such as 64-bit Windows support and updated rainbow tables. We'll know the details and pricing information soon enough.