VeriSign Security Review - May 2006
As phishing continues to mature, one of the last sanctities supposedly free of such malice has been under attack. The SSL/TLS encrypted Web page used for securely transmitting private information has seen increased abuse by phishers. They took advantage of loopholes in some SSL Certificate practices and obtained certificates that make them look legitimate.IE 7 will change that, and enterprise security managers should take notice: the advent of High Assurance Certificates will prove its long-term effectiveness against phishing.
In this issue:
Hot Topics
Standards and Regulations
News from VeriSign
Security Events
MetaFisher – The New Face of Botnets
Three The last two years saw the emergence of Web-controlled botnets used for attacks such as phishing, and MetaFisher was the most sophisticated such botnet.
MetaFisher appeared in 2005 as a Bot and security analysts knew immediately that it was a highly sophisticated work in progress. In late 2005, at the height of the Microsoft Windows Media File (WMF) incident, MetaFisher activity ramped up. In February 2006, when VeriSign iDefense Labs spotted MetaFisher's unusual encrypted communication with a Web site, it investigated further and discovered that a sophisticated command-and-control center via a PHP interface was used to manage a bot family and trigger phishing attacks. MetaFisher managed to evade anti-virus and intrusion detection systems by running as a browser help object (BHO) on the infected computer.
In March, VeriSign iDefense Labs broke the encryption scheme used to control MetaFisher infected computers and, through painstaking analysis and cooperation with other researchers such as Sunbelt Software and Symantec, correlated the codes and scope of the attacks to date which included banks in the U.K., Germany, and Spain. The VeriSign iDefense team then worked with VeriSign's Security Operations Center (SOC) to develop and deploy snort signatures to effectively detect MetaFisher activities.
VeriSign leveraged its intelligent infrastructure services supported by a team of analysts and engineers to best understand the full scope of this massive and sophisticated operation. VeriSign also had the customer reach to prevent devastating attacks on financial targets.
Back to Top
April Threat Summary
The VeriSign iDefense Threat Level eased after patches came out for the Microsoft 06-012 vulnerability. Microsoft, however, has just released two new critical bulletins, Microsoft 06-019 involving Microsoft Exchange, and Microsoft 06-020 involving Macromedia Flash in Windows XP and IE 6. Both could allow remote code execution.
Cloudmark detected two phishing schemes that used Voice over IP (VoIP) to collect personal banking information. Phishers may have been using this technique for some time, though these are the first detected attacks of their kind. More at Information Week.
Sendmail, Inc. reported a race condition vulnerability that affects the mail transfer agent on a wide scale. A remote, unauthenticated attacker could execute arbitrary code with the privileges of the Sendmail process. If Sendmail is running as root, the attacker could take complete control of an affected system. Sendmail has provided an Advisory and a new version of the software is available.
On April 18, Oracle Corporation released a security bulletin that addressed 39 vulnerabilities in multiple products. The security bulletin did not release details on those vulnerabilities.
Back to Top
IE 7 Beta 2 Released
Microsoft has released an updated test version of IE 7 for Windows XP and is hoping to convince the public to try out the evolving software. To help spur downloads of IE 7 Beta 2, the company is offering free telephone support for customers in Germany, Japan, and North America.
Asia Now #1 Spammer
Asia has overtaken North America as the top spam relaying region in the world, according to a report released on Thursday by Sophos. According to the report, nearly one half the spam worldwide originated in Asia. North America was a distant second with just over 25 percent. On a per-country basis, the U.S. remains Number One while China is a close second. Read more .
Authorize.net Hacked
Online payment service provider Authorize.net reported on April 3 that its online processing service had been used by hackers attempting to steal money from credit and debit cards. The hackers ran 3,000 transactions on stolen credit cards over one weekend, but the theft was foiled when the Authorize.net auto-generated email alerted merchants of the processed payments. All fraudulent charges were voided.
Back to Top
Standards and Regulations
GAO Reports On SOX Burden
The Government Accountability Office (GAO) is releasing a report confirming that smaller firms indeed carry a proportionally heavier financial burden on Sarbanes-Oxley compliance. The SEC needs to come up with new regulations aimed at reducing smaller firms' compliance cost, the report says. It does point out that a lot of the cost is due to confusion and one-time startup costs.
First Local WiFi Security Law
Concerned with identity theft and other crimes over the wireless networks, New York's Westchester Country enacted a law that requires businesses to install basic security measures when customers' personal information is transmitted via wireless networks. Read more .
Back to Top
News from VeriSign
VeriSign Hosts Risk Management Talks
With a keen understanding of customers' needs to balance security investments with security risks, VeriSign is inviting IT professionals to a series of risk management talks. In this six-city tour through New York, Washington, D.C., Atlanta, Chicago, Dallas, and Mountain View, IT professionals will have a chance to mingle with each other and hear discussions on the holistic view of threats, vulnerabilities, network access policies, and potential business impacts in assessing security risk. VeriSign will demonstrate how to dynamically generate a risk score including financial impacts, to simulate and model the effects of changes, and to measure compliance with both internal and external policies and regulations.
Back to Top
Get Ready for IE 7
High Assurance SSL: What Does It Mean To You?
Many enterprise customers have asked about the upcoming Microsoft IE 7 release and what it would mean to enterprise security. VeriSign is engaged in one of the most significant developments in IE 7: the new High Assurance SSL Certificates for securing online transactions.
With the new IE 7 release, there will be a new kind of SSL Certificate to assure users of the identity of an encrypted site. Whereas other certificates will retain the same cumbersome user interface as they have in Internet Explorer 6, High Assurance certificates display the organizational identification and the issuing certificate authority (CA) right in the top address bar and also turn the address bar green to signal safety.
To issue a High Assurance certificate, the CA must validate the applicant organization through vetting processes that meet the High Assurance standard. To meet the High Assurance standard, a CA may have to bolster its certificate issuance practices. Issuing a certificate merely upon verifying the domain name ownership, for example, does not meet the High Assurance standard and can not be displayed as such.
Back to Top
What Should You Do to Get Ready?
As IE 7 gets wider market adoption, site visitors will likely be looking for High Assurance when they consider giving up personal information. For large enterprises, High Assurance certificates will not only bolster customer confidence, but in the long run, it will also become one of the most effective anti-phishing tools, as they are nearly impossible to spoof.
Prepare to meet your customers' demand for IE 7 and High Assurance SSL by talking to your certificate authority (CA). You may be going through a more stringent vetting process than before. Your IT manager in charge of certificate issuance, for example, may need further proof that he or she indeed has the authority to do so. Other administrative steps to ensure a smooth transition include making sure that your registered domain names are correctly listed and have the right contact names. VeriSign has been a leading contributor to the emerging High Assurance SSL standard. Contact your VeriSign representative for more information.
Back to Top
Security Events
May 23-25, 2006
World Enterprise Information World
Secaucus, NJ
June 4-6, 2006
GLOBALCOMM 2006
Chicago, IL
June 5-7, 2006
Gartner IT Security Summit
Washington, D.C.
June 6-7, 2006
NACHA Authentication Mandate
Reston, VA
June 27-29, 2006
Identity Management Conference
Chicago, IL
Back to Top
