Nellie2

Personal Ramblings on a Security Theme

Entries Comments



Category: News


Botnet Taken Out In Canada

25 February, 2008 (18:02) | Internet, News, Security | By: Nellie2

There has been quite a bit of information on various security sites about the botnet bust in Canada last week… so I know I’m raking over old news.

But who cares… the point is, something is being done. The bad guys are getting tracked down and are being taken to task. Yes it’s a slow process and no.. they aren’t locking them up and throwing away the key yet… but every botnet that is taken down is one less that we need to worry about.

Over the course of the two years that this network was under investigation, the network took control of up to a million computers. When you figure the number of computers hijacked, the amount of the damages, and the number of people they were able to connect with this crime, this is a very impressive win for the Quebec police.

See the full story here at McAfee

US-Cert Vulnerability Summary for wc 18th Feb 2008

25 February, 2008 (17:47) | News | By: Nellie2

Vulnerability Summary for the Week of February 18, 2008

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

  • High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
  • Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
  • Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

Access the full list here:  Cyber Security Bulletin SB08-056

Secret Crush on Facebook

7 January, 2008 (22:15) | Internet, News, Security | By: Nellie2

Published on Heise Security today;

Fortinet security team warns about spyware which spreads through the Facebook social networking site. According to the advisory, the spyware uses the Facebook widget feature, which allows users to integrate their own programs into the pages of the web portal. When attacked a user is informed that “Someone has a Secret Crush on you”. To find out who this person is, the user is then instructed to install the “Secret Crush” widget. However, in order to proceed, the user has to invite an additional five contacts to install the widget.

The widget itself contains an IFrame which links to the Zango adware/spyware. Upon installation, Zango injects advertisements and other content. Although the user still has to install the software, Fortinet believes that the sender of these “Secret Crush” invitations exploits the carefree nature of Facebook users. Those who are prepared to publish personal information also don’t hesitate to install widgets and click on various links. In principle, widgets could be exploited to slip users IFrames to pages which infect systems through browser vulnerabilities, similar to the exploits which used the MPack web attack toolkit last year. Facebook has been informed about the problem.

If you are looking for a sightly different view on this.. then check out what Chris Boyd has to say at Vital Security. Considering he is the Zango nemesis.. I’m rather impressed at his objective views on the whole thing.

My thoughts on this? I don’t like it when an application wants access to all my information, I don’t like it when I have to send it to my friends before I can install it…… I do like being told about it and being given the choice to install or cancel however!!

Clarkson Oopsie

7 January, 2008 (21:50) | Education, News, Security | By: Nellie2

I shouldn’t laugh.. but if you are security concious (and I hope you are) and your friends and colleagues are for ever telling you what a load of rubbish you are going on about… then point them in the direction of this BBC news story.

Clarkson Stung After Bank Prank

Yes folks it really is that easy.. and whilst I’m sure you wouldn’t be daft enough to publish your bank details in a daily tabloid, I’ll bet you keep them on your computer.  Don’t…… there are some things that the good old pen, paper and lockable drawer just can’t beat.

Boom Times for Hi-Tech Criminals

2 January, 2008 (21:45) | Education, Internet, News, tips | By: Nellie2

Just in case you were wondering why there is a big need for all of us to be security concious.. to protect our computers, home networks and data… the BBC published an article today that helps to explain just what is going on out there and why.

Boom Times for Hi-Tech Criminals

Starting a career as a cyber criminal got much easier in 2007.

So say security experts looking back on 12 months in which hi-tech gangs took control of the net’s underground.

The economy supporting these groups has matured so much that now everything from virus-writing kits to spam-spewing zombies are available for rent or hire.

This has helped to fuel, say security professionals, rapid growth in the methods criminals use to catch out PC users and steal saleable data.

As the article explains… it’s all about money. The Hi-Tech criminal can make easy money in a very short space of time.  The article can make scary reading… but remember, ultimately it is YOUR responsibility to secure your computer and data, not Microsoft’s, not your ISP’s and not your friend who lives down the road and knows about computers.

Think about it… you wouldn’t leave your door open so that criminals can wander in and use your phone and car to commit crimes… so why leave your computer wide open?  If you don’t know how to secure it then educate yourself.. it’s not difficult if you know where to look… there are plenty of links on this blog to get you started.

Be careful out there………… but have fun!!!  :)

A Blog Is For Life

23 November, 2007 (19:50) | Internet, News, Security, tips | By: Nellie2

And so is anything else you post online for that matter!! Did you realise that your future could be compromised by your electronic footprint? The UK Information Commisioners Office completed a survey recently… and here are the conclusions.

As many as four and a half million* young people (71%) would not want a college, university or potential employer to conduct an internet search on them unless they could first remove content from social networking sites, according to new research by the Information Commissioner’s Office (ICO).
But almost six in 10 have never considered that what they put online now might be permanent and could be accessed years into the future.

The research findings are unveiled as the ICO launches a new website at www.ico.gov.uk/youngpeople to help young people understand their information rights. The first section contains tips and advice on safe social networking. As well as not thinking ahead before posting information on the web, the survey of Britons aged 14-21** also revealed that youngsters’ online behaviour is a gift to potential fraudsters. Two thirds (eight in 10 girls aged 16-17) accept people they don’t know as ‘friends’ on social networking sites and over half leave parts of their profile public specifically to attract new people. More than seven in 10 are not concerned that their personal profile can be viewed by strangers and 7% don’t think privacy settings are important and actively want everyone to see their full profile.

As for the data that young people make available, 60% post their date of birth, a quarter post their job title and almost one in 10 give their home address. Couple this basic information with details that might be used to create passwords e.g. sibling’s name (posted by 23%) pet’s name (posted by a quarter of girls) and even mother’s maiden name (posted by 2%) and fraudsters have the information they need to obtain products and services in a young person’s name or access existing bank or online accounts.

David Smith, Deputy Commissioner for the ICO, said: “Many young people are posting content online without thinking about the electronic footprint they leave behind. The cost to a person’s future can be very high if something undesirable is found by the increasing number of education institutions and employers using the internet as a tool to vet potential students or employees.

The research also found that a third of young people have never read privacy policies on social networking sites and don’t understand how they can manage their personal information. But when asked how they feel about websites potentially using their details to target advertising at them or to pass on to other websites or brands, a huge 95% are concerned about this, with 54% caring ‘a lot’ about how their personal information is used.

David Smith continues: “This shows that when young people are made aware that their details could be being passed between parties – legitimate or unscrupulous – they are worried. We have to help teenagers wise up to every aspect of the internet age they’re living in – it may be fun but unfortunately it is not the safe space many think it is.”

ICO Top Tips for protecting your identity online 

  • A blog is for life - remember you risk leaving a permanent electronic footprint. If you don’t think you’ll want it to exist somewhere in 10 years time, don’t post it
  • Privacy is precious – choose sites that give you plenty of control over who can find your profile and how much information they can see. Read privacy policies and understand how sites will use your details
  • Personal safety first – don’t allow people to work out your ‘real life’ location e.g. your place and hours of work. Your personal safety offline could be affected by what you tell people online
  • Password protected – change your passwords regularly, don’t use obvious words like your pet’s name and don’t use the same passwords on social networking sites as you do for things like internet banking
  • Address aware – use a separate email address for social networking

Biggest Security Mishap This Year

21 November, 2007 (21:18) | News, Security | By: Nellie2

Since I wrote my last post you would have to have been happily sitting up a tree not to have noticed the news about the loss of 25 million Child Benefit records the other day.

I’m not going to harp on about it.. the media are doing a pretty fine job without me joining in.  But if you are worried about your personal data falling into the wrong hands, here are a few things you can do.

  1. If you used your child’s name, date of birth or a combination of both as a password then change it.
  2. Check your account daily and report anything unexpected to your bank immediately.
  3. Keep checking your account, until this matter is resolved and we know what happened to the disks then it pays to be vigilant.
  4. Don’t panic, APACS have produced a useful FAQ that should help with any questions or concerns you may have.

Top Five Security Mishaps This Year

18 November, 2007 (17:47) | News, Security | By: Nellie2

From ZNet Security Threats Toolkit

Despite the message being driven home by governments, consumer groups and industry bodies that IT security is paramount, this year has thrown up a worrying number of serious breaches.

Some of these violations are down to the increasing sophistication of the criminals perpetrating the attacks but, in many instances, systems are compromised in ways that simply should not be possible. Aside from the damage done to an organisation&