FBI, Slovenian and Spanish Police announce more arrests of Mariposa Botnet Creator, Operators

Published: 2010-07-29
Last Updated: 2010-07-29 15:20:18 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

Fellow handler Kevin points us to new developments on this case, announced here ==> www.fbi.gov/pressrel/pressrel10/mariposa072810.htm

 

0 comment(s)

Snort 2.8.6.1 and Snort 2.9 Beta Released

Published: 2010-07-29
Last Updated: 2010-07-29 13:00:14 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

 New versions of Snort (Beta and Production)are both out. Release notes are here ==> http://www.snort.org/news/2010/07/28/snort-2-8-6-1-and-snort-2-9-beta-released/

New features that I'm finding interesting in 2.9 (Beta):

  • A Data Acquisition API (DAQ) is introduced in this version
  • A byte extract option that bears some investigation - this allows extracted values from one rule to be used in subsequent rule options
  • Some welcome updates for IPv6
  • Support for Intel's QuickAssist for use in pattern matching. This is by far the most interesting feature in the bunch (to me at least) - support for hardware based acceleration (on boxes that have this feature). QuickAssist uses FSB attached FPGAs for this, so builds on previous FPGA work. Attaching the FPGAs to the server FSB overcomes previous limitations in FPGA I/O rates (talk about the sledgehammer approach!), this likely raises the maximum throughput for Snort considerably!
    More info on Quck Assist, and Snort's integration with it can be found here ==> http://www.intel.com/technology/platforms/quickassist/
    and here ==> http://download.intel.com/embedded/applications/networksecurity/324029.pdf

 If anyone has used the new QuickAssist feature and has formal or informal benchmarks, please feel free to comment !

=============== Rob VandenBrink, Metafore ===============

0 comment(s)

NoScript 2.0 released

Published: 2010-07-29
Last Updated: 2010-07-29 12:47:50 UTC
by Rob VandenBrink (Version: 1)
2 comment(s)

Paul wrote in to tell us about the new version of NoScript just out ==> http://noscript.net/

The main new feature is protection against the Craig Heffner's DNS rebinding attack that's getting some press, which will be presented at Blackhat.this week ==> http://www.blackhat.com/html/bh-us-10/bh-us-10-briefings.html#Heffner

The protection is pretty simple - look up the public ip of the workstation, and place it in the LOCAL pseudo list.  It uses a public site https://secure.informaction.com/ipecho for this - I can't comment at this time if this is a "safe" site to use for this or not.

If anyone has more info on this please feel free to comment.

=============== Rob VandenBrink Metafore ===============

2 comment(s)

The 2010 Verizon Data Breach Report is Out

Published: 2010-07-29
Last Updated: 2010-07-29 03:16:35 UTC
by Rob VandenBrink (Version: 1)
0 comment(s)

This year's data breach report continues this valuable narrative.  This years report is based on a larger case sample than in previous years, thanks to a partnership with the United States Secret Service, who contributed information on a few hundred of their cases this year.  Many of the findings echo those of previous years (excerpts below).


Who is behind Data Breaches?

70% resulted from external agents
48% caused by insiders
11% implicated business partners
27% involved multiple parties

How do breaches occur?
48% involved privilege misuse
40% resulted from hacking
38% utilized malware
28% involved social tactics
15% comprised physical attacks

What commonalities exist? (this was the interesting section for me)
98% of all data breached came from servers
85% of attacks were not considered highly difficult
61% were discovered by a third party
86% of victims had evidence of the breach in their log files
96% of breaches were avoidable through simple or intermediate controls
79% of victims subject to PCI DSS had not achieved compliance

Come on!  Not only don't folks seem to be implementing some basic protections, but when they're told that they've been compromised (in their log files), no-one is listening!  I guess this isn't much different than in previous years, but it'd be nice to see a positive trend here.

I'm not sure that I believe the low numbers for government data breaches (4%).  I guess the report can only summarize data from cases that are "seen" by the incident handlers.

Find the full report here ==> http://www.verizonbusiness.com/resources/reports/rp_2010-data-breach-report_en_xg.pdf

Take a few minutes to read it over coffee this morning - I found it a good read, and just about the right length for that first cup !

=============== Rob VandenBrink, Metafore =====================

0 comment(s)

Comments

What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
https://defineprogramming.com/
https://defineprogramming.com/
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
Enter corthrthmment here...

Diary Archives