Robert Lemos

Botnet takedown sets legal, not technical, precedent

In the security industry, researchers have often been able to infiltrate botnets. Yet, the next step has always been a big question mark.

Now, defenders may have a new slate of options. The takedown of the Coreflood botnet marks the start of more aggressive stance against botnets, say security experts. Last week, the U.S. Department of Justice obtained a temporary restraining order forcing registrars to reroute requests from infected computers, not to Coreflood's command-and-control servers, but to a substitute server managed by a non-profit group. Under the judge's order, the sinkhole server can issue commands to prevent the bot agents from carrying out normal operations.

The result has been a drop of several orders of magnitude in the activity from the botnet, says Don Jackson, director of threat intelligence for Dell SecureWorks.

CSO Online

Fraudulent certificates issued for major websites

Nine valid but fraudulent certificates have been issued for major Internet sites -- including Google mail, Microsoft Live, and Yahoo -- raising the possibility of undetectable phishing, man-in-the-middle and drive-by download attacks, multiple advisories stated on Wednesday.

The secure sockets layer (SSL) certificates, issued by root certificate authority Comodo, allow the attackers to sign fraudulent sites and content. The certificates were issued because of a compromise at a registration authority (RA) using stolen log-in credentials for one of Comodo's European partners, according to the company's report on the incident.

CSO Online

HBGary's Hoglund: Anonymous 'not at all what people think they are'

On Super Bowl weekend, HBGary CTO Greg Hoglund found himself locked out of his own email account. The fallout of the leaked messages from his account and that of HBGary Federal's CEO Aaron Barr has been widely reported. Yet, not from the point of view of the victims. In Part 1 of this interview with CSO correspondent Robert Lemos, Hoglund talked about how the hack happened and the lessons for chief security officers. In Part 2, he describes his research on Anonymous and why the group is making the insider threat problem more dire.

CSO Online

HBGary's Hoglund identifies lessons in Anonymous hack

On Superbowl Sunday, HBGary CTO Greg Hoglund found himself locked out of his own e-mail account. As has since beenwidely reported in the media, the hacking group Anonymous leaked thousands of e-mail messages from the accounts of Hoglund and HBGary Federal's CEO Aaron Barr, chastising the company in a public statement. In this excerpt of an interview with CSO correspondent Robert Lemos, Hoglund admits that the company made many mistakes in defending its data, but refutes some of the details of the hack and highlights lessons that other companies should take to heart.

CSO Online

Web attackers deface gov't sites, steal from financials

Driven by the hacktivism of the loose-knit Anonymous group, denial-of-service attacks surged to the top of the list of Web incidents, outpacing SQL injection and cross-site scripting, according to a survey of publicly disclosed attacks.

The ongoing survey, known as the Web Hacking Incident Database, categorized 222 incidents in 2010 and found that attackers aimed to take down the Web sites in a third of the incidents, while defacement accounted for 15 percent of attacks and stealing information was the goal in 13 percent of incidents.

CSO Online

DroidDream turns Androids into zombies

The malicious code that led Google to remove more than 50 Trojan applications from the Android Marketplace appears to mainly be a "dropper" -- a program designed to load other code to further compromise the affected smartphone, according to a security firm's analysis.

The code, dubbed "DroidDream," attempts to use two exploits to gain root privilege on a compromised smartphone by breaking out of the sandbox designed to limit what applications can do on Android devices, mobile security firm Lookout stated in its most recent analysis.

CSO Online

Secure best practices no proof against Stuxnet

Companies infected by Stuxnet should not feel bad -- even systems secured to industry best practices had little chance to dodge the pernicious program, according to a recent report.

In the paper, "How Stuxnet Spreads - A Study of Infection Paths in Best Practice Systems," three researchers concluded that the worm's multitude of infection vectors and companies' need for interconnectivity between control systems makes it nearly impossible to defend against a well-constructed, multi-pronged attack such as Stuxnet.

CSO Online

Cyberwar: Is Offense the New Defense?

Eight months after it started spreading, the Conficker worm remains on hundreds of thousands, if not millions, of computer systems. While the furor over the worm has died down, worries over the capabilities of the sleeper botnet continue to concern cybersecurity experts.

The call to do something about the latent threat is growing louder. This week, two German researchers -- Felix Leder and Tillmann Werner, PhD students at the University of Bonn -- advocated attacking back at the botnet, before it's used for another purpose.

"Most counter measures nowadays are reactive, you wait for an attack to happen, and then you take the countermeasure," Werner said at the Conference on Cyber Warfare, an event held by the Cooperative Cyber Defence Centre of Excellence in Tallin. "We need something that will stop the attack in advance."

CSO Magazine