Showing posts with label cyber crime threats. Show all posts
Showing posts with label cyber crime threats. Show all posts

Friday, September 09, 2011

Cyber Crime:Threats to VoIP and Mobile Convergence

3:03 AM Unknown No comments


The cell phone is getting an completely new tool—
especially outside the U.S., in which accessing the Internet from a cellular device can offer a much better experience than traditional fixed computing. VoIP technology also continues to increase and will rival landline and mobile communications in terms of reliability and call quality.
As Internet telephony and cellular computing handle more and much more data, they will turn into far more frequent targets of cyber crime.

From the outset, VoIP infrastructure has been vulnerable to the same sorts of attacks that plague other networked computing architectures. As soon as voice is digitized, encoded,compressed into packets and exchanged more than IP networks, it's susceptible to misuse.
Cyber criminals will be drawn towards the VoIP medium to engage in voice fraud, data
theft and other scams—similar towards issues email has experienced.
Denial of service, remote code execution and botnets all apply to VoIP networks, and will become more problematic for mobile devices as well.
“Criminals know that VoIP can be applied in scams to steal individual and financial |facts so voice spam and voice phishing aren't heading away” stated Tom

“Most men and women have been trained to enter social security numbers, credit card numbers, bank account numbers, etc. more than the phone even though interacting with voice response systems,” stated Cross.

“Criminals will exploit this social conditioning to perpetrate voice phishing and identity theft. At the same time, consumers wil demand far better availability from phone program than they would from an ISP, so the threat of the DoS attack might compel carriers to pay out over a blackmail scam.”

Tom Cross - X-Force Researcher, IBM World-wide-web Security Systems
“At this point, mobile device potential is far ahead of security,” mentioned Traynor. “We’ll begin to determine the botnet problem infiltrate the mobile world in 2009.”
Patrick Traynor - Assistant Professor, School of Computer Science at Georgia Tech,
and member in the Georgia Tech Facts Security Center Cross,a researcher on the IBM Web Security Systems X-Force team. “Denial of program will also continue to be a critical threat to VoIP. If a big number of VoIP phones become infected by malware and flood a network with traffic, the results could be extremely disruptive. 
We expect some cyber criminals to attempt to blackmail
carriers based on a DoS attack scenario.”

According to Cross, large telecom corporations in Europe are now servicing clients  with VoIP. And where phone service is concerned, users have one more mentality about sharing individual information and also a higher expectation of quality.
On the bright side, Cross believes the IT and telecom communities have learned valuable security lessons from the spam and phishing problems that have plagued the
Simple Mail Transfer Protocol (SMTP).

“VoIP providers and users would like to avoid the spam crisis that has inundated email,” said Cross.
“Current research efforts at university-based centers like GTISC are studying how popularity networks according to inherited trust could be applied to VoIP to prevent voice fraud. In this kind of system, good security reputations will improve VoIP peering and call ranking so that legitimate calls get through, and voice spam and phishing are blocked.”

Cross also cited the need for intrusion prevention systems at the VoIP carrier level, along with endpoint security for Session Initiated Protocol (SIP) phones and other VoIP devices.
“While exploits targeting the iPhone have circulated publicly, I’m somewhat surprised that there haven’t been more attacks to date,” mentioned Cross.

Dave Amster, vice president of security investigations for Equifax also sees the security challenges presented by mobile computing. “More and more financial transactions
will take place more than cellular devices,” stated Amster.
“Consumers are ordering credit reports from their Blackberrys, which puts valuable information at risk.
The challenge for businesses and banks will be maintaining secure mobile applications and ease of use at the exact same time.”
 Already in Japan, people use their cell phones at vending machines and subway
token dispensers.

According to Traynor, “malware will be injected onto cell phones to turn them into bots. Large mobile botnets could then be used to perpetrate a DoS attack against
the core in the mobile network.
But due to the fact the mobile communications field is evolving so quickly, it presents
a certain opportunity to model security properly—an opportunity we missed in the PC.”
 “However, it's not going to be an easy trouble to solve.”

Traynor pointed to battery power like a principal security hurdle, “If you place antivirus software on the mobile device, it will run the battery down, so cellular security will require new approaches and partnerships between manufacturers, carriers and software developers.”

Read more »

Posted in: ,,,,,,

Saturday, August 27, 2011

Cyber Threats report :Emerging threats for…all data-driven![cyber warfare]

8:26 PM Unknown No comments

Emerging threats for…all data-driven!

Cyber Warfare

Security experts consulted by GTISC believe cyber warfare will accompany conventional military interaction more often inside the many years ahead. They expect it's going to also play a much more shadowy role in attempts by antagonist nations to subvert the U.S. economy and infrastructure.

Consider the cyber attacks that occurred between Russia and Georgia earlier this year like a type for military
cyber engagements in 2009 and beyond. 
Don Jackson, director of threat intelligence for SecureWorks, compiled the right after research to implicate direct Russian government involvement in cyber attacks against Georgia:

Physical and cyber attack targets and timing align:
• Logs of DDoS targeted visitors and changes in network routing indicate that Russian cyber warfare operations coincided virtually exactly in the final “all clear” for Russian Air Force attacks sometime between 0600 and 0700 on August 9, 2008.
• Both cyber attack targets (media outlets and local government communication systems) and air force targets were located within inside Georgian city of Gori.
• The exact timing of cyber attacks against new classes of targets in Gori and Russian Air Force attacks indicated coordination among known hacking groups and military operators.
Source of Russian cyber attacks against Georgia:
• The vast majority of Georgian Web traffic is routed throughTurkey and Russia. As of August 10, 2008, visitors routed through Turkey was almost completely blocked, and IP traffic through Russia (via Azerbaijan) was slow and efficiently unusable.
• Russian government-run Rostelecom conducted most of the routing changes that blocked site visitors to
Georgian IP address space.
• The Moscow-based COMSTAR network also cooperated with government  demands to follow suit, as did other network operators that control routing from your ostensibly neutral Moscow Internet Exchange (MSK-IX).
• DDoS and cache poisoning attempts targeting DNS servers for major Georgian networks were also launched during the state-operated Rostelecom and Moscow-based COMSTAR networks. 

These attempts used the same tools, tactics and target lists as attacks from portions of Turkish networks controlled by former associates of the Russian Organization Network (RBN).
The associates are believed to have connections to local St. Petersburg government, the former powerbase of Putin and those people now in charge of the FSB state security organization.

Attack types:

• Along with DDoS attacks against Georgian media outlets and federal government Internet sites, researchers observed:

— Route hijacking
— Brute force server compromise
— Information theft
— Multi-factor DDoS attacking network and computer software layers
— Defacement and hosting of fake Georgian Web pages containing misinformation and propaganda.

Some DDoS attacks, route hijacking, and system intrusions originated from sources not previously
affiliated with identified hacking groups and appear to have been coordinated inside a manner that would allow attackers to disable or intercept Georgian government communications according to Russian military and intelligence objectives.
Jon Ramsey, chief technology officer for SecureWorks attributes increasing cyber warfare exercising to the following:
• The low cost to launch cyber attacks compared with physical attacks
• The lack of cyber defenses
• The “plausible deniability” the internet affords
• The lack of “cyber rules of engagement” in conflicts among country states

George Heron, founder of BlueFin Security and former chief scientist for McAfee believes cyber warfare will play a significant role in between China and the U.S. “Cyber threats originating from China are incredibly real and growing,” said Heron.
“Other evidence supports this, just like the majority of bot masters being traced back to China, along with malware along with other disruptive threats.”
Heron pointed towards U.S. transportation system infrastructure, the telecommunications system, nuclear energy plant communications, the water provide IT infrastructure and other entities as prime cyber targets of enemy nations.
“We now know that it only takes infiltrating the DNS operator vulnerability to subvert an entire DNS sector,”
Heron continued. “Cyber warfare efforts could eat this approach to exploit vulnerable servers and gateways
controlling the power grid or water/dam flow control.”
Howard A. Schmidt, a GTISC professor of practice agrees.

“Our essential infrastructure systems are fundamentally dependent on the internet and IP-based technology,
and there are interdependencies between them that our enemies will seek to exploit,” stated Schmidt.

“Cyber warfare completely evens the playing field as developing nations and large countries with a formidable military presence can both launch both equally dangerous attacks more than the Web.”
The U.S. federal government is already bracing for the inevitability of cyber warfare and hosted the second annual Cyber Storm activity in March 2008—involving nine states, four foreign governments, 18 federal agencies and 40 individual firms in a weeklong cyber attack scenario3.

“Cyber Storm II is really a successful example of public and private partnership to identify cyber warfare threats and plan powerful countermeasures,” said Heron.
“We need more information sharing and additional collaboration like this to defend our national interests against an onslaught of cyber terrorism.”

Schmidt advocates a three-step method to bolstering U.S. cyber defenses:
• Identify the Internet-enabled systems we depend on and the interdependencies between them.
• Develop a comprehensive plan to protect those systems, such as  roles and responsibilities, vulnerability identification and remediation, threat mitigation and response.
• Model facts security for your future as software improvements, network enhancements and new  echnologies like mobile communications accomplish traction.



“The future threat goes beyond what we think of as cyber-espionage and intellectual property theft,
although that certainly remains a factor,” said Heron. “I think we’re going to see more technologically savvy,
state-sponsored attacks to the IT systems that support foundational services here in the U.S.”
George Heron - Founder, BlueFin Security
See Also:
Cyber Crime:Threats to VoIP and Mobile Convergence...

Read more »

Posted in: ,,,,,,,,

Friday, August 26, 2011

Cyber Threats report 2009:Emerging threats for…all data-driven!(2)

2:15 AM Unknown No comments


Emerging threats for…all data-driven!

BOTNETS

Most botnet command and manage websites is also traced back to China2. But Lee cautions that this statistic could be misinterpreted since "a good deal of Chinese are usingpirated software program which doesn’t receive security updates.”

According to Lee, “That techniques numerous Chinese computers are rife with vulnerabilities, doing them a haven for botnet command and manage sites.”
Botnets en masse are considered a bot army and these malicious computing forces could be applied to conduct cyber warfare within the future.

In addition, bot payloads are becoming increasingly complex to avoid evolving security measures.
According to Lee’s research at GTISC, several recent bot variants have exhibited more than 100 distinct binary payloads used to hide the communications path and to vary the command and manage IP address. The net effect creates botnets and bot masters harder to track.

However, new technologies can pinpoint the Internet communications among botnets and bot masters and
shut down the vital links required for cyber crime and cyber warfare. Signature-based defenses like antivirus
and intrusion detection are no match to your subtle communications between bot and bot master.
But newer behavior analysis approaches can support identify bots without signatures.

Lee’s search team at GTISC is developing algorithms to analyze targeted visitors patterns from internal machines to outside machines. Strange anomalies in connection duration, time of day, or type of information uploaded/downloaded can indicate a botnet command and control attempt. Lee’s research also examines how botnets use the internet infrastructure.
For example, look-up requests to DNS servers may perhaps provide information on which domain is applied for botnet communications. In addtion, global sensor networks are now using specialized algorithms to pinpoint bot army communications.
Once the command and control links are observed and disrupted, the bot army threat can be neutralized as long as layered security is already in location
Related Articles:
Cyber Crime:Threats to VoIP and Mobile Convergence...

Read more »

Posted in: ,,,,,,,,

Cyber Threats report 2009:Emerging threats for…all data-driven!

1:59 AM Unknown No comments




Emerging threats for…all data-driven!


BOTNETS

In 2008, botnets have turn into worse—a trend expected to continue following year.
GTISC estimated in last year’s report that 10 percent of on-line computers have been component of botnets,groups of computers infected with malicious code and unknowingly controlled by a malicious master.
This year, GTISC researchers estimate that botnet-affected machines may comprise 15 percent of on-line computers.

“Compared with viruses and spam, botnets are growing at a faster rate,” mentioned Wenke Lee, an associate professor at GTISC along with a leading botnet researcher. Lee cites three unavoidable factors which are spurring botnet growth:
• Infection can occur even through legitimate Web sites
• Bot exploits/malware delivery mechanismsnare gaining sophistication and better obfuscation techniques
• Users don't need to do anything to become infected; simply rendering a Web page can launch a botnet exploit

Bots can also be delivered to a machine in a variety of ways—
via Trojans, emails, an unauthorized instant message client or an infected Internet site. Once installed, bots lie low to avoid notice by antivirus and anti-spyware technology.
Periodically, the bot communicates to a “command and control” server and waits for your response.

The communication— using the command and manage server as an intermediary—can preserve the malicious bot master’s identity hidden.
Lee issues out the distinction among botnets and malware: “What we think of as malware can be responsible for turning a machine into a bot,” mentioned Lee.
“But conventional malware is often a single-purpose attack.

A bot really remains over a machine, maintains a command and manage mechanism to enable communication with the bot master, and can update itself based on people communications. 
The updates enable new bot communication and malicious capabilities, and are often applied to avoid detection.”

Bot communications are designed to seem like normal (Web) targeted visitors using accepted ports, so even firewalls and intrusion prevention systems have a tough time isolating bot messages.
Lee agreed, “It’s incredibly tough to filter bot traffic at the network edge since it uses http and every
enterprise allows http traffic.”

Prompted to act in unison, bots turn into bot armies that harness considerable computing power to engage in a
variety of malicious activities, including:
— Information theft (social security numbers, credit card information, trade secrets, etc.)
— Denial of program attacks
— Spam delivery
— DNS server spoofing

According to a report compiled by Panda Labs, in 2Q 2008, 10 million bot computers had been applied to distribute spam and malware across the internet every day1.
Damballa continues to find that 3-5 percent of enterprise assets are compromised on average by targeted
threats for instance bots—even during the presence in the best and most up-to-date security.
Leading industry analysts predict this range to be even higher.
Read more »

Posted in: ,,,,,,,,

Monday, August 22, 2011

Emerging threats for…all data-driven!:Malware

5:20 AM Unknown No comments

Emerging threats for…all data-driven!

Data will continue to become the principal motive behind future cyber crime—whether targeting conventional fixed computing or cellular applications.
According to security expert George Heron, “It’s all within the data,”
whether botnets, malware, blended threats, cellular threats or cyber warfare attacks. And Heron expects data
to drive cyber attacks for many years to come. The details motive is woven through all 5 emerging threat categories,
beginning with malware-
                                                                          Malware

Ryan Naraine, security evangelist for Kaspersky, believes that malware delivery—the very first step in generating a bot—will turn into much more insidious by taking advantage of poorly configured Web sites, social networking sites and false domains.

“We are projecting a 10-fold increase in malware objects detected in 2008,”    stated Naraine.
“This is ‘hockey-stick’ growth driven by identity theft and data-focused cyber crime.”
Naraine expects criminal senders to use far better social engineering techniques to cloak malcode in what appears to become legitimate email with acceptable Net links.

For example:
A Facebook message sent from 1 friend to another includes a link to a YouTube video of interest to the recipient. The recipient clicks over a link supposedly sent by his/her friend, and then sees a prompt to install the latest version of Flash Player to be able to watch the video clip.
The user clicks to install the update, but actually installs a piece of malware on the machine, effectively involving the pc inside a botnet.

As cyber criminals move beyond mass-distribution style phishing scams, they're learning how to localize and personalize their attacks for far better penetration. 
Social networking sites like MySpace, Facebook and others will likely be applied as delivery mechanisms for getting unsuspecting users to a malicious Website link in order to deliver malware.

During the coming year, GTISC along with other security experts also expect a lot more targeted spear-phishing vehicles to install malware and/or steal data.
For example:
Attackers may target clients of a local credit union with a spoofed email referencing a local news story of
interest. Once clients click the bogus link inside the email, the malware is installed and can log keystrokes and mine other individual information| to be sent back to a malicious bot master or cyber criminal.

Naraine cited computing mono-cultures and slow or non-existent desktop computer software patching as fueling the malware/botnet crisis. “When you've almost 100 percent of users standardized on the single application, it approaches that a single issue of security failure can bring about infection of an entire computing ecosystem,” stated Naraine.

Naraine’s research implies that some of the largest botnets are comprised of corporate machines. “It takes
the average business2 to 3 months to apply a Windows patch across all devices, so malware and botnets
will continue to take in advantage of identified vulnerabilities within business environments.”
On the bright side,several software program vendors are now shipping auto-patch/update ability with every new software release.


Firefox, Adobe and Apple all do this And Naraine believes that Microsoft operating system security has improved with each successive release. The auto-update features support both corporate and consumer end users stay up to date with patches—which eliminates a lot of “low-hanging fruit” |for ones cyber crime community.



A total of 28940 different malicious and potentially unwanted programs were detected on users’ computers
in August. That is an increase of more than 8,000 on July's figures and points to a significant increase in the
number of in-the-wild threats.
                                                                                  http://www.kaspersky.com/news?id=207575678
“We are so conditioned to click on links, and the bad guys know this,” said Naraine. “The email lures, the
enticements and the personalization of malware attacks are getting much better. Social engineering attacks
on social networks are beginning to explode and will only get worse.”
                                                            Ryan Naraine - Security Evangelist, Kaspersky Lab, Americas
Read more »

Posted in: ,,,,,,

 
Design by Wordpress Theme | Bloggerized by Free Blogger Templates | coupon codes