Robert Lemos

Open-Source Vulnerabilities Paint A Target On Android

In 2009, Red Hat, SuSE, and other Linux distributors fixed a major flaw that could have allowed any user to escalate his privileges and fully compromise a Linux system. The vulnerability, in theudev process, occurred because the device-resource-handling component did not verify that a certain type of message, known as a netlink message, came from the kernel.

A variant of the udev flaw, or CVE-2009-1185, is one component of the DroidDream attack identified earlier this month. That exploit, called exploid.c, uses a netlink message to create a user-controlled copy of the init process, which handles boot up, thus gaining root access. The init process reuses much of the code from the previously vulnerable udev process, according to Zach Lanier, a security consultant with mobile-security provider Intrepidus Group.

DarkReading

PCI Compliance Means Getting Your App Security Together

Many companies' applications still don't meet the security standards outlined in the Payment Card Industry (PCI) Data Security Standards, according to a recent study.

During the 18-month study, which was published last week, security firm Veracode scanned the binary code of more than 2,900 applications on behalf of its clients. Its findings are sobering: Nearly six out of every 10 applications had an "unacceptable" level of security; more than eight out of 10 applications failed to catch classes of Web application vulnerabilities required for remediation under PCI DSS.

While the customers eventually fixed the flaws, most enterprises' applications fail to meet with PCI standards -- a rather low bar for Web application security, says Chris Eng, senior director of security research at Veracode.

DarkReading

Two Ways For SMBs To Secure Their Home Workers

In the slowly recovering economy, telecommuting has become an essential way for businesses to retain valuable workers, increase productivity, and support "green" initiatives. But from a security perspective, telecommuting can also be dangerous -- if you don't have the right technologies in place.

For small and midsize businesses (SMBs), telecommuting is taking off. Nearly 60 percent of SMBs plan to increase their use of telecommuting to cut costs in the next 12 months, according to survey conducted by Staples Advantage, the IT service of the well-known office-supply chain. Yet many SMBs don't have the expertise in-house to deal with security -- about 40 percent rely on external IT support to run their operations, the study found.

DarkReading

Three Steps To Safer Connections With Your Business Partners

Among the speculation surrounding the spread of the Stuxnet worm -- the first cyberattack that targets industrial control systems -- is this likely scenario: Attackers might have spread the worm to a Russian technology provider in an effort to infect Iran's nuclear industry. Unknown to the Russian company, its workers were compromising facilities in multiple countries with a program designed to hide within the code of industrial controllers.

If true, the scenario would not be the first time that suppliers have been used to attack their customers. In a handful of recent instances, attackers have used contractors and other third parties as a bridge to their targets. While many companies are very watchful of their connection to the Internet, many times they are not so vigilant of their partners' connections to their own networks, says Eddie Schwartz, chief security officer of NetWitness, a data and network protection firm.

DarkReading

In Wake Of Attacks, Enterprises Look To Plug Browser Security Hole

For five hours last week, Twitter users were inundated with an avalanche of odd tweets. The messages -- actually snippets of JavaScript -- would execute when a browser user moused over the text. While the lion's share of the tweets were simple pranks, the technique exploited a flaw in Twitter's website that could have allowed malcontents to possibly attack the end user's system.

The vulnerability, known as a cross-site scripting flaw, allowed online miscreants to execute JavaScript code. Even fully patched modern browsers would not have been protected against the attack, according to security experts. The danger comes from emerging features of the Web -- and the ability of users to post content to sites.

The incident underscores that browsing websites, even well-known, "legitimate" sites, has inherent risks, says Michael Sutton, vice president of security research for Web security firm Zscaler.

DarkReading

For Small Businesses, Social Networking Poses New Security Risks

For about six hours on Tuesday, a small snippet of JavaScript code ran rampant among Twitter users. The code used a particular class of flaw to execute simple commands, including changing the color of the interface and posting itself to the users' followers. Victims only had to hover the mouse pointer over the text.

As social networks become more popular, such threats are becoming more common, taking advantage of the trust between users. No wonder, then, that more than a third of small and midsize businesses (SMBs) already have identified a social network as the entry point for a virus or Trojan horse infecting their corporate networks, according to survey released last week by Panda Security.

"Everyone has to worry about it, but small and medium businesses are most vulnerable," says Sean-Paul Correll, a senior threat researcher with Panda. "Either they don't have the needed expertise or they don't have the budget to hire the expertise."

DarkReading

Turn Workers Into Security Partners

When the "Here You Have" worm started spreading last week, Intel had only a small number of its computers infected.

The company's traditional defenses definitely helped, but a critical advantage was its well-trained employees, says Malcolm Harkins, the chief information security officer for Intel. When workers saw the worm and recognized it as a threat, they immediately started calling the information technology team.

"The employee base saw it, they reacted really quickly and helped us contain it by alerting us to it and then telling others not to click on it," Harkins says.

DarkReading

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

...

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

DarkReading

Should SMBs Invest In Cyber Risk Insurance?

Ferma recovered about 60 percent of the money, but its bank refused to repay the remainder. Many companies have sued their banks to recover their losses, but others are taking a different approach: cyber risk insurance.

"Small companies can lose their whole business if they are not careful, so they should consider offloading some of their risk with insurance," says Larry Clinton, president of the Internet Security Alliance.

DarkReading

Fraud At Sprint Offers Lessons For Enterprises, Experts Say

The recently revealed abuse of insiders' system privileges to commit fraud at Sprint could be a wake-up call for other enterprises to implement more stringent security practices, experts said this week.

Last week, nine Sprint employees were charged with misusing their access to the telecommunications giant's systems to redirect phone charges to other customers by "cloning" their cell phones -- to the tune of more than $15 million in fraudulent charges in the first six months of this year.

DarkReading