Security needs drive cyberforensics industry

This is a great article out of USA Today about Cyberforensics, a field and service that Razorpoint Security is very familiar with and often is asked to help consult with clients on.

---

Cyberforensics, the science of finding and securing digital evidence buried deep within company networks, is fast emerging as a global industry.

Three major players are in the vanguard. PricewaterhouseCoopers has recently hired several former law enforcement agents and prosecutors to supplement its cyberforensic services, which already have 3,000 employees and 55 labs in 37 countries.

Verizon Business — supplier of communications, networking and security technologies to large organizations — has pumped more than $50 million into cyberforensics-related services in the past two years. That includes setting up a state-of-the-art hygienic lab to examine computer circuit boards.

The National Cybersecurity and Communications Integration Center in Arlington, Va.

And Stroz Friedberg, a private CSI-like company founded by an ex-FBI agent and an ex-U.S. Attorney, recently received a $115 million investment from private equity firm New Mountain Capital to open new offices across the U.S., Europe and Asia.

Demand for cyberforensics is being driven by "the proliferation and complexity of security issues companies are facing," says Alok Singh, New Mountain's managing director. "Issues of data security and integrity are critical for all companies around the world."

Large organizations increasingly need expert guidance preserving and extracting digital records, such as e-mail and copies of sensitive documents, for civil lawsuits and regulatory audits. They also increasingly need help getting to the bottom of security breaches.

U.S. Internet crime losses reached $560 million in 2009, up from $265 million in 2008, says the Federal Deposit Insurance Corp. Research firm Market Research Media estimates that the federal government will spend $55 billion from now through 2015 on cybersecurity.

Globally, a recent study by the Computing Technology Industry Association, a non-profit trade group, found that 63% of large organizations surveyed in 10 nations experienced at least one security incident in the past 12 months, with 45% of those incidents classified as serious.

Much like the CSI investigators portrayed on TV, cyberforensics sleuths preserve the crime scene and use their training, experience and intuition to ferret out crucial evidence. But instead of looking for fingerprints, DNA and ballistics, they hunt for "subtle data attributes inside company networks that have been changed or altered," says Ed Stroz, ex-FBI agent and co-founder of Stroz Friedberg.

PricewaterhouseCoopers forensics director Kim Peretti, a former Justice Department litigator, says the hunt can become intricate. "Looking for breach indicators is really more of an art than a science," Peretti says. "The more you do these types of investigations, the more you know where to look and what to look for."

By Byron Acohido, USA TODAY

128 Bit What? Razorpoint on SlideShare!

Razorpoint launched it’s new website a few months ago and one of our great new features are our whitepapers which show our commitment to our clients and dedication to the highest level of service in information security!

128 BIT WHAT?

View more documents from Razorpoint Security.

This is the first in our series, 128 bit what?!

Your data is encrypted. So what? Are you using SSL, AES, 3DES, or something else? Can your data be compromised with a cryptographic attack? What key length are you using? This paper attempts to shed a bit of light on the myths and misconceptions when dealing with encryption.

Is Free WiFi really Ever Free?

Razorpoint came across the article below and find it astounding as it may seem, people still don't get it. I have been in situations where internet access was "really needed," and an open "linksys" or "tmobile" or "default" network seemed like kismet (no pun intended). But, alas, the malicious hackers have taken this all too common scenario and used it to exploit the uneducated (read: most) wireless users. If remote wireless access is becoming more and more of a "must," try getting a MiFi box that allows a private WiFi connection to the box and then relays your connection over a 3G or 4G cellular network.

This way, as long as you have a cell signal, you have your own WiFi connection, even in a moving car or train. of course, if your cellular phone supports "tethering" you could also use your cell phone as a MiFi box. pun = kismet is also the name of a wireless network analysis/hacking tool.

Razorpoint Security will help you and your company prevent intrusions, hackers!


(Newser) – You're stuck in an airport and don't feel like paying $9.95 for Internet access ... but wait! You stumble upon a network called "Free Public WiFi." The heavens are smiling, right? Wrong. Available in thousands of locations across America, "Free Public WiFi" is an "ad hoc" network that connects you to another computer in the vicinity instead of the Internet, wireless security expert Joshua Wright tells NPR. The "zombie network" appears to have spread via a bug in old versions of Windows XP—and it provides an easy access point for hackers. As NPR explains, when computers running the older version of XP can't find one of its "favorite" wireless networks, it creates an "ad hoc" one named after the last network joined ... and the "Free Public WiFi" name then becomes available to nearby computers, enticing their unsuspecting owners to join, explains Wright. He compares its spread to how "a zombie takes a hold of one person, bites them, and they become infected by this zombie virus." He believes it may originally have been created by somebody trying to trick a friend into connecting "so he would get a Web page with some kind of a gross image or childish prank." Other "zombie" networks to steer clear of include "linksys," "hpsetup," "tmobile," and "default."

Originial article:

http://www.newser.com/story/102722/beware-free-public-wifi.html

ZEUS Malware Infects Globally Million PCs

Just when security companies have developed new ways of dealing with the infamous Zeus Trojan, a variant characterized as the "Son of Zeus" has arisen. Worse yet, the variant has the trait of being virtually undetectable by conventional antivirus applications.

About the Zeus Trojan and MS Windows

The Zeus Trojan made headlines back in 2009 as a "highly customizable" tool for hackers. It's main mission is to sniff out financial information and break into online bank accounts. Security experts estimate that the Zeus Trojan has been used to infiltrate tens of thousands of PCs around the world. Owners of infected PCs are unaware their computers are even infected, with the majority (if not all) of infections targeting MS Windows PCs.

Zeus a Persistent Threat, Continues to Morph

The Zeus Trojan continues to be a persistent threat and was responsible for stealing 3 Million US Dollars (as of October 1st, 2010) and a reported 6 Million British Sterling from UK bank accounts (Source: itnews.com.au).

The latest revision of the Trojan ("Son of Zeus") Trojan is codenamed "TSPY_ZBOT.BYZ," according to security experts. The reason why it is able to slip by conventional antivirus programs is because it imports a large number of application programming interfaces (API's), making it difficult to know (or even predict) where it will strike next. (Source: itpro.co.uk)

New Variant More Efficient Than Original

As is the case with most types of malware variants, the newer version is somewhat different (and much more efficient) than its predecessor. It is also different in its compression and can foil a detection system based on calculable entropy. In a nutshell, calculable entropy pertains to finding where in the viral code certain trigger routines might be hidden and gives TSPY_ZBOT.BYZ its "undetectable" status.

With most forms of malware, security companies are able to isolate the virus in a virtual "sandbox" and track how the code was executed, what system changes it made and any network traffic it generated. Thus, Zeus (in all of its forms) refuses to "play in the sandbox". (Source: itnews.com.au)

Conventional Antivirus Not Sufficient

This spells disaster for most security companies whose primary focus is to keep their customers safe. As Trend Micro research engineer Julius Dizon expressed, "To properly guard against this threat, conventional antivirus is not sufficient. Only improved detection techniques and proactive blocking of the websites, working together, can protect users."

Razorpoint Services Can Protect You
Mainstream network security providers are fine for organizations looking to "check the box." Most can neutralize the average hacker and help organizations comply with a security checklist. They apply their technologies and processes and fix the obvious problems. But these organizations usually are not suited to keep pace with the world's most sophisticated cyber criminals. Razorpoint is.

Passwords: To Secure or Not to Secure

Passwords have been in use since ancient times but it seems like the periodic controversy over whether or not to use them really gained momentum with computing. The latest view turned up in the SmartPlanet blog. There you’ll find Joe McKendrik waxing poetic about a Microsoft study that basically says the cost of passwords outweighs the risks. Wrong!

There is a perception that coming up with unique, strong passwords is a burden. And adding to this perceived difficulty are things like creating a new password, on a regular basis, that can never be the same as a previously used one, is in insurmountable task.

Reading that above blog posting made me feel as if i had taken a time machine to work that morning. Really? Passwords are always hard to remember? Really? So, let's see, users (the de facto weakest link in any security chain) should just be allowed to do whatever they like because, as soon as the enormous burden of password creation and retention is removed from their hectic schedules, productivity skyrockets. Really? Facebook, YouTube, and MySpace anyone? Oh, and finally, a "top security researcher from Microsoft?" Don't get me started.

Flux-capacitor and time circuits set back to 2010, cybercrime is about to surpass illegal drug trafficking as a moneymaker for criminals. Yes, you read that correctly. Cybercriminals can make more money than drug dealers. Hello? Things are getting worse, not better. While end user failure enables a large part of the rise in cybercrime, corporate ineptitude still plays a key role. Training and basic understanding of network and cybersecurity (strong passwords included) is pitifully low. On regular security engagements, my team and I are routinely stunned at what we find. Whether it is a small, medium, or even a large global firm, undoubtedly we achieve a mind blowing, head shaking dose of "I can not believe what I'm seeing." Dated or non-existent security policies, unmonitored and out-of-date security technologies (firewalls, VPN, IDS, etc.), understaffed and undertrained IT departments tasked with a security role, and a common company-wide malaise regarding proper network security. Routinely, we're able to obtain identity information, bank account access, transaction histories, internal pricing lists, etc. Billions spent on network security, and we're going backwards.

I agree that users get bombarded with different, often unclear and untrue, messages about security and how to handle certain situations (phishing emails and web sites, spoofed SSL certificates, even social engineering). A big reason for this is the wrong people get tasked with designing and disseminating a company's security policy. Security personnel should be doing this, not IT personnel. Perhaps a topic for another article, but Security is not an IT issue, it is a management issue.

Growing cybercrime profitability shows us that current and past security practices are severely flawed. But, stopping the use of one of them (passwords) isn't a solution. They should be enhanced. Yes, use a credentialed mechanism for secure access to data, sites, services, etc. But perhaps instead of forcing the average user to produce and remember cryptic passwords constantly, teach them to use patterns on a standard QWERTY keyboard. Examine this password: 0ok9ij)OK(IJ - It has all the password characteristics of a security manager's dream. But how on earth is someone going to remember that? Look at your keyboard and notice that those characters are in a pattern. Start with the zero and then move down and to the left; you get the "o" and the "k". Then move from the zero to the 9 and go down again for the "i" and "j". Then do the same two downward patterns while holding the Shift key. Dream password? Solved. Want another password? Pick a new starting point and a new directional pattern. What to make it unique to a particular site? Add a letter before or after that password ("E" for email, "I" company intranet, "A" for Amazon.com, etc.). You now have a strong password with nothing to remember but a keyboard pattern.

Strong passwords aside, however, two-factor authentication is another technology that can help with the ongoing battle of user password management. Two-factor authentication is something you have, and something you know. You can "have" a random password generator token on your key chain, and you can "know" a sufficiently strong password that goes with it. These and other technologies are available today in an attempt to curb cybercrime's expanse.

If it’s your business you’re securing, you can ignore the reports that say passwords are not cost effective. Instead, invest in employee education. Truly relevant, informative, actionable, employee security education. A good investment always yields solid returns. If you want to keep your support costs down while keeping your company secure, teach your employees the importance of good password habits along with an overarching mindset of reality-based security awareness.

While companies have consistently failed at these things, the future is now and big differences can be made. I believe we can only go up from here.

Gary Morse is President and Founder of Razorpoint Security Technologies.

Tabnabbing: A new type of phishing

Check out this page at azarask.in. They demonstrate a new method of phishing. A page you are looking at can auto-switch to a page that resembles a page of a trusted website such as gmail, facebook, paypal, or online banking. Part of the attack involves changing the favicon of the page and monitoring for page inactivity.

A New Type of Phishing Attack from Aza Raskin on Vimeo.

Widespread attacks continue against WordPress sites

Owners of self-hosted WordPress based websites should make sure that their FTP and wordpress passwords are secure. Also review your WordPress installation to make sure that it is up to date. The current version is 2.9.2. Sites hosted on WordPress.com are not affected.

Intruders in recent weeks have hacked a large number of websites created through the WordPress blogging platform to spread malware, with another major campaign launched on Thursday, security researchers said.

In addition to WordPress blogs, websites created with other PHP-based platforms, including the Zen Cart eCommerce solution, were affected by the attacks, Regina Smola, co-founder of WPSecurityLock, a provider of WordPress security services, told SCMagazineUS.com on Tuesday.

Attackers injected malicious JavaScript into the sites, causing visitors to be redirected to scareware domains that attempted to trick users into installing a virus, she said.

Read more...