Security Research | Page 61


Earlier this week, independent analyst Richard Stiennon posted a video interview he did with Michael Xie. From Stiennon's blog post: Michael Xie is CTO of Fortinet and drives all of their development of true “Next Generation” security appliances. Hear him describe his views on speeds and feeds, routing and switching in the firewall, and cost per secure megabit. Take a look and listen (click the picture to jump to video): [Read More]
by RSS Rick Popko  |  Jul 09, 2009  |  Filed in: Security Research
With modern threats moving to multiple attack vectors, end users and clients need to be extra cautious. Malicious links are coming fast and furious through layered attacks - bundled up in obfuscated javascript, or on your favorite social networking site. The core of these attacks are quite primitive, and in fact, in most cases nearly identical with the end goal to install malicious payload on a target. Ultimately, the front end of these attacks have moved up higher into the application layer, riding on complex services while the back end (core)... [Read More]
by RSS Derek Manky  |  Jul 08, 2009  |  Filed in: Security Research
Remember that magical, silver bullet I spoke of when discussing the U.S. cyber security plan and the future of cyber security? Well, there still is no such item in existence yet; and there likely never will be one key solution. Securing cyberspace is a global problem that can not be addressed by one plan such as this. However, if this plan is properly implemented, enforced and refactored it should be able to lead by example. It is always said that the Internet has no borders, which is an inherit problem to tackling cyber crime. Remember, this is... [Read More]
by RSS Derek Manky  |  Jul 02, 2009  |  Filed in: Security Research
There was quite a bit of movement on the threat landscape this period, which I have summarized below. For more detail, our June 2009 Threat Landscape report can be found on Fortinet's FortiGuard Center. Web threat traffic in general rose significantly, with a noticeable difference in Malware and Phishing. Looking at period over period growth from last report, Phishing and Malware web traffic growth was at the highest yet, both posting significant gains. These gains represent more volume directed towards malicious sites, an ongoing trend as we continue... [Read More]
by RSS Derek Manky  |  Jul 01, 2009  |  Filed in: Security Research
Tags:
****We have been receiving lots of spam in June with the age-old, eCard social engineering hook. The messages show up with these subject headers: "You have received an eCard" "You have received a greeting ecard" "You Have Received a Greeting Card" The bodies are all very simple, one piggybacking on the trusted name '123greetings.com' while the others being more simple instructing the recipient to open the eCard to view. All traced malware variants are related to the ZBot family, or W32/Branvine.A!tr.dldr. The latter downloads Privacy Center (detected... [Read More]
by RSS Derek Manky  |  Jun 29, 2009  |  Filed in: Security Research
Tags:
I don't know if you encounter the same problem as I, but I keep on receiving spam from people I however do like (friends, family, etc). You know, the kind of awfully nice people that nonetheless strangely feels compelled to forward their own rubbish: hoaxes, chain letters, petitions, jokes and, of course, a full load of lengthy attachments. This is a real nuisance, yet I cannot report them to online spam fighting websites, nor simply black list them: from time to time, among other mails, they do send interesting stuff (personal news, cool invitations),... [Read More]
by RSS Axelle Apvrille  |  Jun 25, 2009  |  Filed in: Security Research
While the next generation of tech has arguably arrived, it is simply a fact now that social networking sites and the blogosphere have become an integrated part of many peoples lives - some may even call them home (at least to their browsers). In 2008, we predicted the wave of spam that would hit these "Web 2.0" platforms as it was a natural target for spam to migrate to after years of living inside of mass mailers. Indeed, throughout the year of 2008 we witnessed a barrage of attacks on these sites: malicious social applications, "Spam 2.0", worms... [Read More]
by RSS Derek Manky  |  Jun 18, 2009  |  Filed in: Security Research
Last week, I had hardly reached my desk when a colleague rushed by my side and told me, all excited, Apple had announced the release of a new iPhone 3GS. They also unveiled interesting new functionality in MobileMe, which started out a long chat in our lab. To summarize our discussion, tomorrow, MobileMe is releasing three novelties: locating your iPhone, for example, when it is lost displaying a message or a sound onto your iPhone remotely wiping your iPhone so a thief won't find read any sensitive data All of these are quite appealling at... [Read More]
by RSS Axelle Apvrille  |  Jun 16, 2009  |  Filed in: Security Research
Read this article if you use CRC32, or if you know it is unsecure but think it is good enough in your case. CRC32 - Cyclic Redundancy Check with 32 bits of output - is a widely used checksum algorithm. It is designed to detect accidental alteration of data during transmission or storage. It is not meant to be used in security-related situations. Now, my crypto-friends are probably already bored and will tell me it has been known for ages. Sure, but if it is that obvious, why do people keep on using CRC32 in wrong situations ? Have a look at the... [Read More]
by RSS Axelle Apvrille  |  Jun 09, 2009  |  Filed in: Security Research
On May 29th, 2009, U.S. President Barack Obama held a conference at which he discussed a cyber security plan following an earlier 60 day review released in April. While there has been much debate and discussion on this initiative which is yet to take development with the announcement of a cyber "czar", I think one the more important aspects to recognize is that this is a step forward. Is it a step forward because this is the one answer, the silver bullet launched from the U.S. to stop cyber terrorism and information warfare in its tracks? Certainly... [Read More]
by RSS Derek Manky  |  Jun 04, 2009  |  Filed in: Security Research