SAP slaps patch on leaky factory software

SAP's February round of critical software updates includes one for SAP Manufacturing Integration and Intelligence (xMII) that may be of interest to hackers and spies. The software is widely used in manufacturing industry, where it connects factory-floor systems to business applications for performance monitoring -- but a flaw in it meant that restrictions on who could see what were not enforced. The patch for xMII fixes a directory traversal vulnerability, SAP reported Tuesday in security note 2230978. The vulnerability could have allowed attackers to access arbitrary files and directories on an SAP fileserver, including application source code, configuration and system files and other critical technical and business-related information, security researchers at ERPScan said Wednesday.To read this article in full or to leave a comment, please click here

Security ‘net 0x1339ED2: Security begins with you

I’m a couple of days late with this post for Data Privacy Day,, but not too late for Data Privacy Month (February). I wanted to highlight it anyway (and maybe I’ll put it on my calendar so I don’t forget next year). The point, of course (“you don’t need to have a point to have a point”) is that each and every one of us—that’s you and I, in case you’ve not gotten it yet—need to take security seriously. Security begins with you. To this end, the Cloud Security Alliance has a good post up on what you can do to improve data privacy.

Why are end users so mistake-prone? Because, frankly, most don’t care. They think data security is IT’s problem—that if IT does its “job” and filters out the threats, they have nothing to worry about. Moreover, when they do something stupid, they think it’s IT’s job to come to the rescue. They don’t understand the risks they create for the company or the fact that once rung they can’t unring the bell. So, they go on ignoring security policies and finding creative workarounds for security measures that inconvenience them—such as utilizing “shadow IT.”

Continue reading

Microsoft fixes 36 flaws in IE, Edge, Office, Windows, .NET Framework

Microsoft released its second batch of security updates for this year, addressing a total of 36 flaws in Internet Explorer, Edge, Office, Windows and .NET Framework.The patches are covered in 12 security bulletins, five of which are rated critical. There is also a thirteenth bulletin, also critical, for Flash Player. Although it's maintained by Adobe, Flash Player is included with Internet Explorer 11 and Edge, so Microsoft is distributing Adobe's patches through Windows Update.Researchers from security vendor Qualys believe that MS16-022, the Flash Player bulletin, should be at the top of users' priority list this month because it contains fixes for 22 critical vulnerabilities that could give attackers complete control over computers. Flash Player is a frequent target for attackers and can be exploited by simply visiting a malicious or compromised website.To read this article in full or to leave a comment, please click here

IBM’s X-Force team hacks into smart building

As buildings get smarter and increasingly connected to the Internet, they become a potential vector for attackers to target.IBM's X-Force ethical hacking team recently ran a penetration test against a group of office buildings using building automation systems that controlled sensors and thermostats.In this particular case, a building management company operated more than 20 buildings across the United States, as well as a central server.Without any social engineering, or online data gathering about employees, the team targeted one building."We did it old-school, just probing the firewall, finding a couple of flaws in the firmware," said Chris Poulin, research strategist for IBM's X-Force. "Once we had access to that, we had access to the management system of one building."To read this article in full or to leave a comment, please click here

Identity thieves obtain 100,000 electronic filing PINs from IRS system

The Internal Revenue Service was the target of an attack that used stolen social security numbers and other taxpayer data to obtain PINs that can be used to file tax returns electronically.The attack occurred in January and targeted an IRS Web application that taxpayers use to obtain their so-called Electronic Filing (E-file) PINs. The app requires taxpayer information such as name, Social Security number, date of birth and full address.Attackers attempted to obtain E-file PINs corresponding to 464,000 unique SSNs using an automated bot, and did so successfully for 101,000 SSNs before the IRS blocked it.The personal taxpayer data used during the attack was not obtained from the IRS, but was stolen elsewhere, the agency said in a statement. The IRS is notifying affected taxpayers via mail and will monitor their accounts to protect them from tax-related identity theft.To read this article in full or to leave a comment, please click here

Dumping Core: Analytical Findings on Trojan.Corebot

Download the full report here. The Corebot banking trojan was initially discovered and documented last year by researchers at Security Intelligence. Since then, it has evolved rapidly and, in terms of capabilities such as browser-based web injections, it is now similar to the dominant banking malware such as Zeus, Neverquest, and Dyreza although its actual impact to date is […]

Dumping Core: Analytical Findings on Trojan.Corebo

Download the full report here.

The Corebot banking trojan was initially discovered and documented last year by researchers at Security Intelligence. Since then, it has evolved rapidly and, in terms of capabilities such as browser-based web injections, it is now similar to the dominant banking malware such as Zeus, Neverquest, and Dyreza although its actual impact to date is nowhere close.

ASERT has been studying and monitoring Corebot since shortly after it was initially documented and an in-depth analysis of Corebot’s inner workings are provided in this threat intelligence report, including coverage of its cryptography, network behavior, and banking targets.

The Big Bong Theory: Conjectures on a Korean Banking Trojan

Download the full report here. ASERT has been analyzing samples of a banking trojan targeting South Korean financial institutions. We call the banker “Big Bong” and provide, in this threat intelligence report, an in-depth behavioral analysis of the malware from builder to bot and from installation to exfiltration including obfuscation techniques, certificate use, and VPN-based […]

The Big Bong Theory: Conjectures on a Korean Banking Trojan

Download the full report here.

ASERT has been analyzing samples of a banking trojan targeting South Korean financial institutions. We call the banker “Big Bong” and provide, in this threat intelligence report, an in-depth behavioral analysis of the malware from builder to bot and from installation to exfiltration including obfuscation techniques, certificate use, and VPN-based network communications. A goal hypothesis is put forth – “The Big Bong Theory,” including some background on the South Korean banking infrastructure. This intelligence report will be of interest to security researchers, incident responders, and anyone interested in advanced malware analysis.

Retired IT specialist shares inside story of botched National Park Moose project

You might think that a niche conference on cabling design and installation held in Orlando in February would be a sleepy little affair, but I found just the opposite to be true. The table setter when I arrived was a humorous/informative look by Ekahau's Jussi Kiviniemi at designing Wi-Fi networks for high capacity. The presenter compared such network installation and design to that of setting up a bar, but also made pointed observations about the conference center’s own imperfect Wi-Fi installation history. The next presentation (“The Moose Project: What Went Wrong? An ICT Case Study from the National Park Service”) was as fiery a talk at a tech conference as I’ve ever heard. Recently retired National Park Service IT specialist Michael Thornton emphasized that he didn’t want to “bash anybody or point fingers” over what he described as a systemic problem with architectural, engineering and construction (AEC) projects, but at the same time he is urging fellow members of the information and communications technology field (ICT) to rise up and convince organizations that ICT pros need to be included in project plans from the start – or else risk botching those projects and wasting millions of dollars.To read this Continue reading

BGP or OSPF? Does Topology Visibility Matter?

One of the comments added to my Using BGP in Data Centers blog post said:

With symmetric fabric… does it make sense for a node to know every bit of fabric info or is reachability information sufficient?

Let’s ignore for the moment that large non-redundant layer-3 fabrics where BGP-in-Data-Center movement started don’t need more than endpoint reachability information, and focus on a bigger issue: is knowledge of network topology (as provided by OSPF and not by BGP) beneficial?

Read more ...

US regulator coming around to view that a Google computer could qualify as car driver

The U.S. federal transport safety regulator is coming around to the view that rules could be updated so that computers in autonomous cars can be considered as drivers, but added that the rule-making could take some time.The move by the National Highway Traffic Safety Administration could be a major boost for Google and a number of companies including traditional car makers that are working on partially or fully autonomous vehicles."If no human occupant of the vehicle can actually drive the vehicle, it is more reasonable to identify the driver as whatever (as opposed to whoever) is doing the driving," Paul A. Hemmersbaugh, chief counsel of the NHTSA, wrote in a Feb 4 letter in reply to a Google proposal relating to its self-driving cars.To read this article in full or to leave a comment, please click here

Poseidon hacker group behind long-running extortion scheme

Kaspersky Lab has linked a single group to a long-known campaign of cyberattacks that appears to be aimed at extorting corporate victims.The Poseidon Group may have been active since 2001, according to an analysis of malware samples. The group's tools have been designed to function on systems set to English and Portuguese.Victims are usually sent spear-phishing emails and malware hidden inside office documents. Once on a network, the hackers explore its topology in order to eventually steal intellectual property and commercial information."Then the attacker looks for all administrator accounts on both the local machine and the network," Kaspersky wrote in a post on Tuesday. "This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest."To read this article in full or to leave a comment, please click here

Skyport Systems – Moving the edge

The traditional security model has put significant emphasis on what’s typically called the ‘external edge’.  That is, the connection between your network and any third party network.  This is also where we create a delineation between ‘trusted’ and ‘untrusted’ networks.  Regardless of how you define this boundary, it becomes the focal point for any security related tooling.  This creates some interesting challenges…

Scale – Applying security tooling at the external edge introduces some possible scale concerns.  You now have a single point in the network has to scale to provide connectivity and security services to all of the users and applications.  While this might make sense in smaller networks, aggregating everything in one place on larger networks can be challenging.  Considering that many security tools can handle significantly lower amounts of traffic than routers and switches, you may find that doing this all in one place introduces a bottleneck in the network.  Scaling security appliances is often a much larger task than scaling network links. 

Network magic – I often joke that network engineers have to perform network magic to get all of the security tools all of the traffic they Continue reading

1 … 3,067 3,068 3,069 3,070 3,071 … 3,762