Robert Lemos

Botnet takedown sets legal, not technical, precedent

In the security industry, researchers have often been able to infiltrate botnets. Yet, the next step has always been a big question mark.

Now, defenders may have a new slate of options. The takedown of the Coreflood botnet marks the start of more aggressive stance against botnets, say security experts. Last week, the U.S. Department of Justice obtained a temporary restraining order forcing registrars to reroute requests from infected computers, not to Coreflood's command-and-control servers, but to a substitute server managed by a non-profit group. Under the judge's order, the sinkhole server can issue commands to prevent the bot agents from carrying out normal operations.

The result has been a drop of several orders of magnitude in the activity from the botnet, says Don Jackson, director of threat intelligence for Dell SecureWorks.

CSO Online

Microsoft Builds Legal Weapon to Take Apart Botnets

The take-down of the Rustock botnet in March gave Microsoft another head for its mantle: two in just the last year. That’s an impressive take for any private firm, and one of a string of actions against bot networks in recent years. But security experts say that the company’s success in building a legal basis for moving against botnets is an even bigger achievement.

threatpost.com

PCI Compliance Means Getting Your App Security Together

Many companies' applications still don't meet the security standards outlined in the Payment Card Industry (PCI) Data Security Standards, according to a recent study.

During the 18-month study, which was published last week, security firm Veracode scanned the binary code of more than 2,900 applications on behalf of its clients. Its findings are sobering: Nearly six out of every 10 applications had an "unacceptable" level of security; more than eight out of 10 applications failed to catch classes of Web application vulnerabilities required for remediation under PCI DSS.

While the customers eventually fixed the flaws, most enterprises' applications fail to meet with PCI standards -- a rather low bar for Web application security, says Chris Eng, senior director of security research at Veracode.

DarkReading

Turn Workers Into Security Partners

When the "Here You Have" worm started spreading last week, Intel had only a small number of its computers infected.

The company's traditional defenses definitely helped, but a critical advantage was its well-trained employees, says Malcolm Harkins, the chief information security officer for Intel. When workers saw the worm and recognized it as a threat, they immediately started calling the information technology team.

"The employee base saw it, they reacted really quickly and helped us contain it by alerting us to it and then telling others not to click on it," Harkins says.

DarkReading

InfoWorld Tech Watch Blog - Week of September 6

Published this week: Group sues Department of Homeland Security to stop laptop searches • Microsoft botnet 'decapitation' scores legal win against cyber crime

Should SMBs Invest In Cyber Risk Insurance?

Ferma recovered about 60 percent of the money, but its bank refused to repay the remainder. Many companies have sued their banks to recover their losses, but others are taking a different approach: cyber risk insurance.

"Small companies can lose their whole business if they are not careful, so they should consider offloading some of their risk with insurance," says Larry Clinton, president of the Internet Security Alliance.

DarkReading

InfoWorld Tech Watch Blog - Week of August 23, 2010

Published this week: Pac-Man for president: Hack highlights e-voting flaws • The Pentagon plays security catch-up

Inside Verizon's Insider Threat Data

For security firms that argue malicious insiders are a greater threat than outside attackers, the latest Verizon Data Breach Investigations Report seems like vindication: The proportion of incidents with an insider agent doubled to 48 percent, while attacks with an external hacker dropped to 70 percent. Incidents involving data theft from the outside still account for the majority of attacks -- with insiders catching up.

The driving factor behind the increase in insider attacks was not the economic downturn -- an oft-argued opinion -- but rather the inclusion of a new data set in Verizon's database, says Alex Hutton, principal of research and intelligence for Verizon Business. The U.S. Secret Service joined much of its caseload data to Verizon's database, adding a large number of incidents where the victim had a better idea of the identity of the attacker and believed the person could be prosecuted. Both factors tend to favor incidents with an insider component. "With the Secret Service [cases], we got exposed to a whole new set of data," Hutton says of the report.

DarkReading

Banking in a Time of Cybercrime

Any small business, educational organization or local government needs to be wary these days. In the past year, cybercriminals have increasingly targeted these less-than-security-savvy groups with malicious software tailored to facilitate bank fraud.

In one case, which I documented for an article in Technology Review, online thieves targeted the accountant at a small California firm with a banking trojan. When the worker signed into the company’s bank account, the thieves initiated 27 fraudulent transactions totaling approximately $447,000. Former Washington Post reporter Brian Krebs has reported on over two dozen such cases. In total, the government estimates that businesses have lost more than $100 million as of early November.

Now, financial institutions and the government are preparing to advise businesses and other organizations on how to better bank online in these treacherous times.

UnsafeBits

PhotoDNA scans images for child abuse

Internet service providers may have better success at scanning their networks to actively seek out illicit images of child abuse, thanks to technology donated by Microsoft and Dartmouth College.

On Wednesday, the software giant and the well-known college announced that they had developed a software program to match modified images to the original by using a form of robust hashing that can ignore certain types of changes, such as resizing, cropping and the inclusion of text. The team donated the program, dubbed PhotoDNA, to the National Center for Missing and Exploited Children.

SecurityFocus