Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×

Submission + - Vatican Said To Be Victim in Recent Cyber Attack (securityweek.com) 1

wiredmikey writes: Late last week, security researchers from Radware discovered a new Trojan Key Logger on a system of one of its clients named “Admin.HLP” that captures sensitive user information and attempts to export it to a server in a remote location.

At the time Radware would not comment on who the victim was, but soon after, a source told FOXBusiness that the Victim was the Vatican.

The governing body of the Catholic Church is not commenting on the issue, however. “No comment,” is all that was said in a two-word email from the Vatican Press Office on August 31 sent in response to an inquiry from Catholic News Agency.

The Vatican has been hit with cyber attacks in the past, including DDoS attacks and Website defacements by Anonymous. It's unclear who was behind these recent targeted attacks, however.


Submission + - Toyota Says Contractor Sabotaged Network & Stole Data (securityweek.com) 1

wiredmikey writes: Yet another "disgruntled" worker story today. According to court documents obtained by SecurityWeek, Toyota has filed a lawsuit against an ex-contractor who was working for the automaker in Kentucky, for sabotaging its supplier network and downloading sensitive information.

The day he was terminated, from midnight until approximately 06:30 a.m. on August 24, the contractor “sabotaged various programs and applications; and accessed, copied, downloaded and/or disseminated trade secrets and proprietary information.” Further, the automaker charges the former contractor with modifying 13 applications on toyotasupplier.com causing it to crash.

Toyota asked the court for a temporary restraining order preventing him from leaving the country and returning to India. The automaker asked the court for a temporary restraining order preventing him from leaving, but it wasn’t needed as he agreed to an order on Monday that he would not travel for 14 days. He remains free on a $2,500 bond until trial.


Submission + - Dell Scoops Up Quest Software for $2.4 Billion (securityweek.com)

wiredmikey writes: Ending weeks of speculation, Dell and Quest Software today announced they have entered into a definitive agreement, under which Dell would acquire Quest, a provider IT management software solutions, in a deal valued at approximately $2.4 billion. Dell says that the acquisition will provide critical components to expand its software capabilities in systems management, security, data protection and workspace management. Quest’s products will fall under Dell’s recently-formed Software Group, and strengthen Dell’s enterprise solutions capabilities.

Founded in 1987, Quest is headquartered in Aliso Viejo, California, has 3,850 employees, and claims more than 100,000 customers around the word. The company had $857 million in global revenue based on its fiscal year 2011 results.


Submission + - Cyberattacks Jumped 81% in 2011, Vulnerabilities Dropped (securityweek.com)

wiredmikey writes: In its latest threat report released on Monday, Symantec revealed that while the number of vulnerabilities fell by 20% in 2011, the number of malicious attacks jumped by 81% and the number of Web-based attacks that the company blocked jumped by 36%. Moreover, the number of unique malware variants surpassed 400 million.

Another interesting takeaway from the report is the fact that targeted attacks are growing. Symantec notes that the number of daily targeted attacks increased from 77 per day to 82 per day by the end of 2011. More than 50 percent of such attacks target organizations with fewer than 2,500 employees, and almost 18 percent target companies with fewer than 250 employees. When it comes to the actual targets, 58 percent of attacks focused on employees in roles such as human resources, public relations, and sales.


Submission + - HP Ships Switches With Malware Infected Flash Cards (securityweek.com)

wiredmikey writes: HP has warned of a security vulnerability associated with its ProCurve 5400 zl switches that contain compact flash cards that the company says may be infected with malware. The company warned that using one of the infected compact flash cards in question on computer could result in the system being compromised.

According to HP, the potential threat exists on HP 5400 zl series switches purchased after April 30, 2011 with certain serial numbers listed in the security advisory.

This issue once again brings attention to the security of the electronics supply chain which has been a hot topic as of late. In March 2012, a consortium of experts published a preview of standards meant to improve the security of the global supply chain for commercial software and hardware products. The standards are the work of The Open Group, and are supported by companies ranging from Boeing to Oracle to IBM.


Submission + - Microsoft Plugs 11 Security Holes (securityweek.com)

wiredmikey writes: Microsoft patched 11 security vulnerabilities today, including a critical bug being targeted by attackers.

According to Microsoft, organizations should focus first on MS12-027 and MS12-023. Already, MS12-027 has come under limited, targeted attack. MS12-027 addresses a vulnerability affecting the MSCOMCTL.OCX ActiveX control that could allow remote code execution if a user visits a website with specially-crafted content designed to exploit the vulnerability. This particular vulnerability affects several pieces of software, including versions of Microsoft Office, SQL Server and BizTalk Server.

John Harrison, group product manager with Symantec Security Response, advised organizations to also pay attention to MS12-024, which patches a critical vulnerability in Windows that could permit remote code execution if a user or applications runs or installs malicious, signed portable executable files on an affected system.

Data Storage

Submission + - Obama Administration Places $200 Million Bet On Big Data (securityweek.com)

wiredmikey writes: Big Data. It’s more than a buzzword. At least the Obama Administration believes so.

As the Federal Government aims to make use of the massive volume of digital data being generated on a daily basis, the Obama Administration today announced a “Big Data Research and Development Initiative” backed by more than $200 million in commitments to start.

Through the new Big Data initiative and associated monetary investments, the Obama Administration promises to greatly improve the tools and techniques needed to access, organize, and glean discoveries from huge volumes of digital data.

Interestingly, as part of a number of government announcements on big data today, The National Institutes of Health announced that the world’s largest set of data on human genetic variation – produced by the international 1000 Genomes Project (At 200 terabytes so far) is now freely available on the Amazon Web Services (AWS) cloud.

Additionally, the Department of Defense (DoD) said it would invest approximately $250 million annually across the Military Departments in a series of programs.

“We also want to challenge industry, research universities, and non-profits to join with the Administration to make the most of the opportunities created by Big Data,” Tom Kalil, Deputy Director for Policy at OSTP noted in a blog post. “Clearly, the government can’t do this on its own. We need what the President calls an ‘all hands on deck’ effort.”


Submission + - Einstein on Security Procedures and Processes (securityweek.com)

wiredmikey writes: An interesting column by Oliver Rochford on how in addition to being a renowned theoretical physicist, Albert Einstein was also quite a wizard at writing security procedures and processes, without even really knowing it.

In the column, using several quotes and examples from Einstein's work, Rochford argues how a Security Guru should be more than just a technician, and that his/her education must reach far beyond I.T. It is easy to forget that there is a reason for the procedures, policies and approaches that we use and advocate beyond having some in place.

The article highlights a selection of Einstein's wisdoms that may worthwhile when considering security. After all, who better to secure the Manhattan Project than a genius, right?


Submission + - Microsoft: RDP Vulnerability Should be Patched Immediately (securityweek.com)

wiredmikey writes: Microsoft is urging organizations to apply the sole critical update in this month’s Patch Tuesday release as soon as possible. The critical bulletin – one of six security bulletins issued as part of today’s release – addresses two vulnerabilities in the Remote Desktop Protocol (RDP).

Those IT admins who use RDP to manage their machines over the internet, which is essentially the default in cloud-based installations such as Amazon’s AWS, need to patch as quickly as possible, said Qualys CTO Wolfgang Kandek.

Besides the RDP bugs, this month’s Patch Tuesday addressed five other vulnerabilities: two denial-of-service bugs and an escalation of privileges issue in Microsoft Windows; a remote code execution vulnerability in Microsoft Expression Design; and an escalation of privileges issue in Microsoft Visual Studio. All those issues are rated ‘important’ with the exception of one of the Windows’ denial-of-service bugs, which is rated ‘moderate.’


Submission + - Employees Clueless on, or Disregard IT Security Policy (securityweek.com)

wiredmikey writes: If you are part of a security team that spends time carefully piecing together and reviewing corporate IT security policies, this may hurt your feelings: According to a recent survey, more than half of workers don’t always follow or are unaware of their company’s security policies.

The survey numbers show that more than half (54 percent) of employees don’t always follow their company’s IT security policies, or aren’t even aware of the policies (21 percent).

But those facts shouldn’t come as much of a surprise. This isn’t the first survey that shows employees will go through whatever steps they can to access the Internet at any cost, visit the sites they want, copy data they feel they are entitled to, and access information that may not necessarily be relevant to their job function.


Submission + - Detecting Cyber Attacks Using Radio Frequency (securityweek.com)

wiredmikey writes: Recently the New York Police Department announced it was working with the Department of Defense to develop gun-scan technology capable of detecting concealed firearms. The scanner would work in a similar fashion as an infrared detector, but with a slight twist – it would read the energy people emit and identifying where that energy is being blocked by an object, such as a gun.

The technology falls under the umbrella of what is called Measurement and Signature Intelligence, or MASINT, commonly used by the military for activities like tracking war ships using their radio frequency (RF) signatures. But what if cyber-attackers could be tracked in a similar way?

This question is being asked and answered by Brad Bowers, a security operations manager for a large financial institution.

“I focused on Radio Frequency (RF) MASINT for my research, and while I don't see it being used in the traditional sense for tracking down hackers defacing Websites, it can still be a very valuable tool for tracking down attackers,” he said. MASINT, he said, is a better fit for critical infrastructure companies with complex computer systems controlling various types of sensors, valves and temperature gauges.

MASINT is still in its infancy from the perspective of commercial, non-military uses, but one can see some of the ways capabilities can be adapted...


Submission + - Enterprise IT Spend to Reach $2.7 Trillion in '12 (securityweek.com)

wiredmikey writes: According to recent information coming from Gartner, global enterprise IT spending is projected to total $2.7 trillion in 2012. That figure represents a 3.9 percent increase from 2011 spending of $2.6 trillion. Despite increased IT spending during in a tough economic climate, growth is slowing from the expected 5.9 percent increase in 2011.

Also, according to Gartner, this year 350 companies will each invest more than $1 billion in IT.

Gartner believes that this new era brings with it urgent and compelling forces, including: the cloud, social, mobility, and an explosion in information.

“The impact of these forces will make architectures of the last 20 years obsolete,” said Analyst Peter Sondergaard. “Together, they force the issue – they drive us to create the post-modern business, drive simplicity and force creative destruction.”


Submission + - The History and Evolution of Malware (securityweek.com)

wiredmikey writes: Wade Williamson provides an interesting read on the evolution of malware, starting with a brief history, and background of modern malware threats, along with an explanation of the modern malware lifecycle...

Modern malware is emerging as one of the most concerning forces at play in information technology. With the ability to potentially coordinate millions of infected nodes, pass through security boundaries undetected on demand, and to adapt functionality on demand, modern malware has more in common with a fully distributed cloud-based application than it does with the simple self-replicating viruses and worms that we have known in the past.

40 years ago while working at BBN, Bob Thomas began experimenting with the concept of a mobile application. To this end he developed the Creeper program, which had the ability to move from machine to machine. Creeper quickly proliferated through ARPANET infecting everything in its path, and the emergence of the computer virus was upon us.

Given the evolution of malware, it is important that we look at more than simply the function of the malware (i.e. a banking botnet). It's just as important to understand how malware protects itself, communicates and foils our existing defense in depth.


Submission + - Adobe to Issue Emergency Flash Fix Wednesday (securityweek.com)

wiredmikey writes: Adobe today said it would release a Flash Player update tomorrow, September 21, 2011. The out of cycle update will address critical security issues in flash player as well as an important universal cross-site scripting issue that is reportedly being exploited in the wild in targeted attacks.

To illustrate the importance of keeping systems up to date, including Adobe flash products, the fact that the RSA cyber attack was executed using a spear phishing attack with an embedded flash file should serve as a friendly reminder. RSA was breached after an employee opened a spreadsheet that contained a zero-day exploit that installed a backdoor through an Adobe Flash vulnerability.


Submission + - Companies Boosting IT Security Staffing & Budg (securityweek.com)

wiredmikey writes: With data breaches and cyber attacks constantly making headlines, it’s clear businesses continue to face challenges when it comes to securing IT assets and protecting company data. The good news – a recent survey shows IT security budgets and workforces may be reacting accordingly.

Symantec’s 2011 State of Security Survey fielded responses from a total of 3,300 businesses around the world to gauge their attitudes about risk and security. Among the findings: the number of organizations reporting attacks in the past 12 months dropped to 71 percent from 75 percent in 2010, and the number reporting an increased frequency of attacks dropped from 29 percent to 21 percent year-over-year.

For many businesses, those drop-offs seem to be corresponding to an increase in staffing and security budgets focused on certain areas. In regards to staffing, 46 percent of respondents said they are increasing staff in the areas of network and Web security. A virtually identical percentage said they were increasing their budgets for those areas as well (42 percent for network security, 41 percent for Web security). Meanwhile, 38 percent are increasing their security systems management budgets.

The main drivers of security will sound familiar. When asked what industry trends are affecting the difficulty of security, the most mentioned issues were mobile computing (47 percent), social media (46 percent) and consumerization of IT (45 percent).

Slashdot Top Deals

God made machine language; all the rest is the work of man.