Uncategorized

Security Pros Are Focused on the Wrong Threats

From The New York Times (Riva Richmond)
Corporate information technology departments are prioritizing the wrong threats to their computer systems, focusing on old problems and leaving their companies open to a raft of new cyberattacks targeting sensitive customer and corporate information.
That is the finding of a new biannual report from the SANS Institute, a training organization for computer security professionals, whose senior staff weighed two sets of data that have not been rigorously compared to date: data on the most common attacks hitting corporate networks and data on which vulnerabilities are most prevalent on company networks.  Read the full story [nytimes.com]   Read the full report [sans.org]

Apache Shows How to Handle a Network Compromise

The Apache Software Foundation last week was the victim of a serious network attack in which a number of its Web servers and other machines were compromised by attackers who were able to gain root privileges and jump from machine to machine. The incident was embarrassing and a serious problem for the foundation, but instead of making excuses and hiding behind the veil of confidentiality, Apache officials have published the gory details of the attack.

How the TJX and Heartland Hackers Worked

The group of hackers alleged to have broken into the networks of a string of companies, including TJX, Hannaford and Heartland Payment Systems, were in no hurry once they worked their way into the companies’ systems. In fact, they had plenty of time to do their dirty work, in some cases sitting inside the networks and stealing data for as long as a year.

Snow Leopard AV Only Scans For Two Trojans

by Ryan Naraine

The built-in malware protection in Apple’s Snow Leopard upgrade appears to be nothing more than a XProtect.plist file containing five signatures for two of the most popular Mac OS X trojans — OSX.RSPlug and OSX.Iservice.  Read the full story [zdnet.com]

iPhone Eavesdropping Coming Soon

by Ryan Naraine

From The Last Watchdog (Byron Acohido)

How much time should vendors of popular technology be given to fix a known security flaw? That’s the central question of the “full disclosure” debate – and one that is being tested again via Karsten Nohl’s campaign to compile a decryption handbook useful for eavesdropping on transmissions from AT&T and Tmobile phones, including iPhones and GPhones.

Nohl, a computer science PhD candidate from the University of Virginia, is calling for the global community of hackers to crack the encryption used on GSM phones. He plans to compile this work into a code book that can be used to eavesdrop on conversations and data transfers to and from GSM phones. Read the full story [lastwatchdog.com]

The Art of Creating Strong Passwords

by Ryan Naraine

From Computerworld (Michael Scalisi)

While security has never been more important than it is today, the fastest way for an IT professional to become the most despised person in the company is to start enforcing a strong password policy. A policy perceived as overbearing may cause people to write down their passwords on a sticky-note near their computers, circumventing its very purpose. Your policy will be ineffective if your users don’t know how to create strong passwords that are easy to remember.  Read the full story [computerworld.com]

Practical Advice for Super Safe Web Browsing

by Ryan Naraine

By Rich Mogull (Macworld)
As a security analyst and researcher, I often find myself exploring some of the darker corners of the Internet. In the course of staying current on security issues, I frequently must browse the sorts of Web sites no average person should go anywhere near; I’m also far more likely to be targeted in an attack. That’s forced me to develop a somewhat extreme approach to safer surfing.  Read the full story [macworld.com]

Practical Advice For Cleaning Hacked Web Sites

by Ryan Naraine

From the HP Security Labs blog
If Google detects that your website is hosting malware, it is pretty clear your site has been attacked.  A frightening trend with SQL Injection attacks concerns how an attacker will insert links to javascript content used to serve malicious links that may try and automatically compromise the users of your website.  When this happens, Google will automatically detect this and actively deter users from visiting your  website.
Here are some of the  basic recovery steps that need to be taken to ensure all content that was possibly modified by the attacker will be removed. The steps below are simply a very rough set of guidelines on one way that a security  analyst might approach securing a hacked website.  Read the full story [hp.com]

Microsoft Struts Office 2010 ‘Sandbox’ Security

by Ryan Naraine

From Computerworld (Gregg Keizer)
Microsoft’s plan to “sandbox” documents in the next version of Office looks like a “very good step forward,” according to one security analyst.
Last week, Microsoft revealed more details about a new security feature in Office 2010, dubbed “Protected View,” that is designed to shut down the popular hacker tactic of feeding users rigged Word, Excel and PowerPoint files.  Read the full story [computerworld.com]

TJX, Heartland Suspect Was Near Plea Deal

by Dennis Fisher

From NYTimes.com (Brad Stone)
Albert Gonzalez, a suspect in several hacking cases, was close to reaching a comprehensive plea agreement with federal prosecutors in Massachusetts and New York when federal prosecutors in New Jersey indicted him on Monday on a new raft of computer crimes, said Mr. Gonzalez’s lawyer, Rene Palomino Jr. Read the full story [NYTimes.com].

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.