Ryan Naraine

Online crime complaints hit record high in 2008

The FBI’s Internet Crime Complaint Center (IC3) says complaints of online crime hit a record high in 2008, driven mostly by non-delivery of goods and service and those pesky 419 (Nigerian) e-mail scams.
Accordign to a new report (PDF from ic3.gov), the center received a a total of 275,284 complaints, a 33.1% increase over the previous year. The total dollar loss linked to online fraud was $265 million, about $25 million more than in 2007. The average individual loss amounted to $931.  Other significant findings include:

Public search engines mine private Facebook details

From DarkReading (Kelly Jackson Higgins)
Another reason to be careful what you post on Facebook: All it takes is a simple Google search, and phishers and marketers can glean a treasure trove of private information [darkreading.com] based on relationships among Facebook “friends,” according to new research.

Researchers from the U.K.’s University of Cambridge recently published a paper [PDF frm cam.ac.uk] detailing a project in which they developed a software tool to correlate and map Facebook profiles they found via public search engines, such as Google, to build detailed maps of relationships among Facebook members.  Read the full story [darkreading.com]

Microsoft issues PowerPoint zero-day warning

Microsoft has issued an advisory to warn about an under-attack zero-day vulnerability affecting its PowerPoint software.
According to the pre-patch advisory, the flaw allows remote code execution if a user opens a booby-trapped PowerPoint file. The company described the attacks as “limited and targeted.”


From DarkReading.com (Kelly Jackson Higgins)
Big-name botnets like Kraken/Bobax, Srizbi, Rustock, the former Storm — and even the possible botnet-in-waiting, Conficker — have gained plenty of notoriety, but it’s the smaller and less conspicuous ones you can’t see that are doing the most damage [darkreading.com] in the enterprise.
These mini-botnets range in size from tens to thousands versus the hundreds of thousands, or even millions, of bots that the biggest botnets deploy. They are typically specialized and built to target an organization or person, stealing corporate and personal information, often without a trace. They don’t attract the attention of the big spamming botnets that cast a wide net and generate lots of traffic; instead they strike quietly, under the radar. Read the full story [darkreading.com]

By Sumner Lemon, IDG News Service
An expected activation of the Conficker.c worm at midnight today passed without incident [computerworld.com], despite sensationalized fears [cbsnews.com] that the Internet itself might be affected, but security researchers said users aren’t out of the woods yet.
While infected computers have started reaching out to command servers as expected, nothing untoward has happened. Read the full story [computerworld.com].  CNet’s Elinor Mills is also tracking [zdnet.com] Conficker’s April 1st activation closely.

By Tim Wilson, DarkReading/InformationWeek

We polled more than 400 business technology professionals to determine which threats they consider the most serious, how they prioritize their defensive efforts, and what plans they’ve put in place to keep their organizations’ data safe in 2009 and beyond.  We find that professionals worry about threats from outside attackers [informationweek.com], but it’s the danger from within the company that really keeps them awake at night. About 52% of more than 400 respondents say they’re most concerned about internal risks, including both accidental and malicious data compromises by employees or business partners during the course of their day-to-day activities. 
Read the full story [informationweek.com]

By Georg Wicherski

As already reported by F-Secure, criminals are using the Conficker hype to push rogue anti-virus software to computer users.
Their solution will sometimes display false alerts on clean systems and try to lure their victims into buying a fake cleaning program for $39.95 from them. Opposed to what they were claiming on remove-conficker.org (website already taken down), their solution fails to detect Kido.  Read more and see video demo [viruslist.com] of this latest threat.

By Matt Hines, eWEEK
Security researchers are highlighting a more powerful breed of attack that is specifically targeting users of the open source Mozilla Firefox web browser.
Long touted for its improved security over rival browsers including Microsoft IE, Firefox has been mined for dozens of vulnerabilities over the last few years, but the application hasn’t ever faced the same level of attacks as Explorer. However, experts are charting the emergence of a new, sophisticated breed of Firefox threat that packs a significantly more potent punch than its predecessors.  Read the full story [eweek.com]

By Vivian Yeo, ZDNet Asia

The threat from Web-based malware is growing at a rapid pace, with nearly 200 percent more malicious sites [zdnet.com] identified this month, according to a new report from MessageLabs.
Released Tuesday, the MessageLabs Intelligence Report revealed that 2, 797 new Web sites hosting malicious content including spyware, were blocked by the security vendor in March, a 200 percent jump over the previous month.
Read the full story [zdnet.com]

By Andrew Jaquith
Despite years of investments in technology and processes, protecting enterprise-wide data remains a maddeningly elusive goal for chief information security officers (CISOs). Software-as-a-service (SaaS), Web 2.0 technologies, and consumerized hardware increase the number of escape routes for sensitive information. Regulations, statutes, and contractual expectations drown CISOs in audit requests and ratchet up the pressure to do something about the problem. Hordes of vendors confuse CISOs with innumerable sales pitches.
Instead of beating your head against the wall, devolve responsibility to the business, keeping controls closest to the people who use the data. IT security should be primarily responsible only for deploying data protection technologies that require minimal or no customization. Read the full story [csoonline.com]