Robert Lemos

Fraudulent certificates issued for major websites

Nine valid but fraudulent certificates have been issued for major Internet sites -- including Google mail, Microsoft Live, and Yahoo -- raising the possibility of undetectable phishing, man-in-the-middle and drive-by download attacks, multiple advisories stated on Wednesday.

The secure sockets layer (SSL) certificates, issued by root certificate authority Comodo, allow the attackers to sign fraudulent sites and content. The certificates were issued because of a compromise at a registration authority (RA) using stolen log-in credentials for one of Comodo's European partners, according to the company's report on the incident.

CSO Online

Web attackers deface gov't sites, steal from financials

Driven by the hacktivism of the loose-knit Anonymous group, denial-of-service attacks surged to the top of the list of Web incidents, outpacing SQL injection and cross-site scripting, according to a survey of publicly disclosed attacks.

The ongoing survey, known as the Web Hacking Incident Database, categorized 222 incidents in 2010 and found that attackers aimed to take down the Web sites in a third of the incidents, while defacement accounted for 15 percent of attacks and stealing information was the goal in 13 percent of incidents.

CSO Online

Open-Source Vulnerabilities Paint A Target On Android

In 2009, Red Hat, SuSE, and other Linux distributors fixed a major flaw that could have allowed any user to escalate his privileges and fully compromise a Linux system. The vulnerability, in theudev process, occurred because the device-resource-handling component did not verify that a certain type of message, known as a netlink message, came from the kernel.

A variant of the udev flaw, or CVE-2009-1185, is one component of the DroidDream attack identified earlier this month. That exploit, called exploid.c, uses a netlink message to create a user-controlled copy of the init process, which handles boot up, thus gaining root access. The init process reuses much of the code from the previously vulnerable udev process, according to Zach Lanier, a security consultant with mobile-security provider Intrepidus Group.

DarkReading

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

...

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

DarkReading

Mobile Flaw Could Cloak Clicks

It's possible to craft a malicious website so that a user's clicks are secretly redirected to a legitimate site in a way that steals a user's passwords and other data. Many Web developers have added protections to block the tactic on standard Web sites, but Stanford University researchers warn that there are not nearly enough defenses against the technique on mobile websites, which are accessed from devices such as the iPhone.

As a result, a smart-phone user could think he's tapping to check a baseball score but is actually tapping on a button in a hidden page to confirm a money transfer.

Technology Review

Inside Verizon's Insider Threat Data

For security firms that argue malicious insiders are a greater threat than outside attackers, the latest Verizon Data Breach Investigations Report seems like vindication: The proportion of incidents with an insider agent doubled to 48 percent, while attacks with an external hacker dropped to 70 percent. Incidents involving data theft from the outside still account for the majority of attacks -- with insiders catching up.

The driving factor behind the increase in insider attacks was not the economic downturn -- an oft-argued opinion -- but rather the inclusion of a new data set in Verizon's database, says Alex Hutton, principal of research and intelligence for Verizon Business. The U.S. Secret Service joined much of its caseload data to Verizon's database, adding a large number of incidents where the victim had a better idea of the identity of the attacker and believed the person could be prosecuted. Both factors tend to favor incidents with an insider component. "With the Secret Service [cases], we got exposed to a whole new set of data," Hutton says of the report.

DarkReading

Wireless Car Sensors Vulnerable to Hackers

Hackers could "hijack" the wireless pressure sensors built into many cars' tires, researchers have found. Criminals might then track a vehicle or force its electronic control system to malfunction, the University of South Carolina and Rutgers University researchers say.

The team, which successfully hijacked two popular tire-pressure-monitoring systems (TPMS), will describe the work at the USENIX Security conference in Washington, DC, this week.

Technology Review

Flawed Deployments Undermine Kerberos Security

Significant weaknesses in the common configuration of Kerberos-based authentication servers could allow attackers to more easily circumvent security measures in networks that rely on the open authentication standard, according to recent research presented by consultants at the recent Black Hat USA 2010 conference.

The researchers found several common configuration problems that may allow attackers to significantly weaken the security that Kerberos provides.

DarkReading

Cloud-Based Denial Of Service Attacks Looming, Researchers Say

With the help of the cloud, taking down small- and midsize companies' networks is easy, two consultants told attendees here last week.

With a credit card and an e-mail address, security consultants David Bryan of Trustwave and Michael Anderson of NetSPI created a handful of virtual server instances on Amazon's EC2 and used a homemade program to attack the network of a client -- a small business that wanted its connectivity tested.

With only three servers -- although they eventually scaled up to ten -- the consultants took the company off the Internet. The price? Six dollars.

DarkReading

Your Apps Could Be Leaking Private Info

A study of iPhone and Android apps has revealed that many of these programs secretly collect and transmit users' personal information.

The App Genome Project, launched by the mobile security company Lookout, analyzed every app available through Apple's App Store and Google's Android Market. Developers must disclose an app's functionality when they submit an app to either store. Apple performs its own review before making an app downloadable.

Technology Review