VeriSign Security Review - June 2006 |
An eventful Microsoft patch week passed with no significant new exploits. Security managers, however, should remain vigilant as unpatched issues remain. Last month also saw the painful departure of spam warrior Blue Security who faced defeat of the money-hungry spam and phishing industry. VeriSign continues to monitor spam, phishing, and other malicious activities to help customers stave off costly attacks.
In this issue:
Hot Topics
Standards and Regulations
News from VeriSign
Ask a VeriSign Consultant
Security Events
Hot Topics
Phishing Attacks Against American Banks Increase
Phishing attacks against US financial organizations have increased to some 62 percent of all phishing scams noted, while identity fraud attacks against European targets have been dropping, according to a recent survey by RSA Security. Nevertheless, Germany recently outpaced China as the second worst country for hosting phishing attacks (14 percent of attacks), followed by China, the UK and South Korea. Of identity fraud attacks worldwide, 40 percent of non-US attacks are aimed at Spain, Germany and the Netherlands, according to the survey (Thomas, Daniel, “Phishing attacks against Europeans drop,” June 14, 2006, http://www.computing.co.uk/computing/news/2158229/phishing-attacks-against ).
Back to Top
Monthly Threat Summary
The VeriSign iDefense Threat Level was raised to Elevated, or Level 3, and remained there due to concerns over the recent slew of Microsoft vulnerabilities. Despite Microsoft's June 12 patch, VeriSign iDefense believes that the existence of unpatched issues in an application with the prevalence of Excel warrants an elevated alert level.
The Mozilla Foundation has released thirteen security advisories specifying security vulnerabilities in Mozilla Firefox, SeaMonkey, Camino, and Thunderbird. These vulnerabilities allow attackers to execute arbitrary machine code in the context of the vulnerable application crash affected applications. That may potentially allow remote execution of machine code gain access to potentially sensitive information.
The authors behind the Turkojan remote administration tool (RAT) announced the release of v.3.0 of their product in postings on a variety of cyber crime-related forums. Turkojan is a RAT designed to steal a victim's passwords and other sensitive information.
A new worm that initiates contact with unsuspecting Internet users by sending an America Online Instant Messenger (AIM) message from a user's buddy list emerged in May. The message promises new photos and includes a hyperlink that directs victims to a fake logon page for the popular social-networking site MySpace. Once a user logs on, the fake Web page obtains the username and password, and then redirects the user to the legitimate logon page. With this information, a hacker could access a victim's MySpace page to obtain personal information (such as home address, full name and date of birth) that could be used for identity theft.
Back to Top
The Demise of Blue Security
Continued denial-of-service attacks last month brought down the anti-spam startup Blue Security. The Israel-based company had 500,000 users and had been successful in getting some spammers to use its open-source mailing list scrubber. Other, more malicious spammers, however, launched massive attacks from zombie computers and flooded Blue Security's database servers. The company decided to take down its service to prevent the damage from spreading to the rest of the Internet community.
Back to Top
Assessing Geopolitical Threats Via Data Analysis
A crucial role of security intelligence is determining the geographical location of salient cyber activity and its underlying motivations. Known as geopolitical intelligence, this information is often crucial in providing context for prevention and mitigation strategies. VeriSign iDefense takes a discerning look into the data that organizations commonly use to make such determinations and illustrates how the research and analysis can transform seemingly undirected data into actionable intelligence.
Open-Source Statistics
There is no “one-stop shop” for Internet statistics. As with any Internet search, the analyst must question the accuracy, timeliness, and objectivity of the information provided from search results. Even assuming perfect data, however, collecting and collating intelligence from millions of sources is an impossible task.
Proprietary Statistics
Proprietary data are generally more accurate than open-source statistics, but the analyst must, once again, question the accuracy, timeliness, and objectivity. An example of constrained data appeared in Symantec Corporation's recent semi-annual threat report (Symantec Corp, March 2006). The chart identified bot infections by country for the second half of 2005, which the publisher deemed an important indicator of bot-related attacks in specific geographic locations. For the July-December 2005 timeframe, the U.S. and U.K. are identified as having the highest percentages of bot-infected computers, 26 percent and 22 percent, respectively. China came in third at 9 percent, according to the published data. Interestingly, neither the hotspot countries of Russia or Brazil made the Top 10 list. The data is most likely accurate within the scope of their measurements. Given the limitations of the data collection methodology, however, the statistical statement made about worldwide bot infections is probably specious at best.
Data Samples: Analysts Must Consider the Scope
For a statistically valid argument about worldwide bot attacks, the same percentage of computers from each area studied should be included in the sample population. Symantec's sample population consists of only computers that have installed Symantec's anti-virus application. A similar visual illustration of this point can be found in a world map of virus and spam origins as determined by Postini's email security and integrated message management solutions. Charts at http://www.postini.com/stats/ show data from Ethiopia and Brazil, detailing virus and spam origins in those countries. While independent analysis supports the conclusion that southern Brazil harbors many sophisticated cyber crime actors, Ethiopia's role in cyber crime (and/or infection rates) has yet to be determined. The assessment from Postini indicates similar levels of involvement for viruses and spam, respectively.
Thus, without knowing the exact nature of the data displayed, the conclusions drawn from these data sources call for further scrutiny. Compare the above data with those from ClickZ.com and the CIA World Factbook, for example, one would notice that Brazil, a large source of spam, is among the countries with more than 20 million Internet users. Ethiopia, on the other hand, is not.
Conclusions
Analysis and trending of numerical information from various sources is a useful way to prioritize workflow and gauge risks. The quality of the data, however, plays a large role in the decisions made.
Back to Top
Standards and Regulations
NIST Information Security Handbook Draft Released
The National Institute of Standards and Technology (NIST) released “Draft Special Publication 800-100, Information Security Handbook: A Guide for Managers.” It is a broad overview of information to assist CIOs and government agency security managers in understanding how to establish and implement and information security program. Earlier in May, the same organization published “Guide for Developing Performance Metrics for Information Security.”
Back to Top
News from VeriSign
2006 VeriSign Network Security Trend Survey
VeriSign released results of the annual network security trend survey in May. Polling on a cross-section of industries including manufacturing, banking, healthcare, and services, the survey found that the top five security budget priorities are vulnerability/risk management, security auditing, intrusion detection, compliance, and data privacy. Close to 90 percent of respondents engage in some degree of outsourcing, with intrusion detection and prevention management, firewall management, and VPN management at the top of the outsourcing list. See full report.
Each month, our highly experienced security consultants share their expertise in an area of your concern. This month, Branden Williams reviews best practices in complying with the new PCI data security standard. Send your questions to askverisignsecurity@verisign.com .
Ask a VeriSign Consultant
Complying With the New PCI Data Security Standard
Q: How can I optimize my compliance to PCI?
A:The Payment Card Industry Data Security Standard (PCI-DSS) is about to be updated and released to users of the electronic payment systems they govern. While the details of the changes have been tightly controlled by the card associations, it is our understanding that only minor changes will be made.
Merchants & Service Providers can ensure that PCI has a minimal impact on their organization by doing everything possible to reduce the scope of PCI. This can be accomplished in a number of ways. Here are a few:
- Eliminate card numbers from your environment as much as possible. Use hashing or reference numbers in systems where you need to identify specific card numbers for tracking. Card numbers are not needed after settlement occurs for the majority of your transactions. Only in cases of investigations or charge backs would you need the number.
- Surround credit card processing and storage with firewalls. Companies can effectively reduce the scope of PCI-DSS on their infrastructure by treating the networks that store and process credit card data as “Secured Enclaves.” Bring the perimeter closer to the payment systems and require users to use strong authentication and encryption to access those areas.
- Push back on vendors that supply software for your credit card processing needs. Vendors of Point Of Sale (POS), storage, and retrieval applications should make the needed changes to their applications to ensure compliance. If an application that handles card numbers for you has not been certified under Visa's Payment Application Best Practices, you should push the vendors to meet compliance. In future releases of the PCI-DSS, this will be a requirement that can keep you from compliance.
- Perform regular checks of your payment systems. Though PCI-DSS requires an annual assessment, companies that endorse quarterly or 6-month reviews will ensure that special circumstances do not prevent them from being compliant.
Branden Williams is a Principal Consultant at VeriSign. He is a Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM), Visa Qualified Data Security Professional (QDSP) and Qualified Payment Application Security Professional (QPASP), Checkpoint Certified Security Administrator (CCSA), and Checkpoint Certified Security Expert (CCSE).
Back to Top
Security Events
June 27-29, 2006
Identity Management Conference
Chicago, IL
July 26, 2006
itsGOV Technology Showcase
Washington, D.C.
July 29-Aug 3, 2006
Black Hat
Las Vegas, NV
Back to Top
