Security Community Blog

Flame Malware exploits Microsoft's digital certificate

Prashant Bharadwaj | 07 Jun 2012 | 0 comments

Flame is a new recent malware spreading wide across. It is found that it exploits the Microsoft's digital certifcate to infect the target. It initiates a kind of "Man-in-the-middle" attack!

When a machine tries to connect to Microsoft’s Windows Update, it redirects the connection through an infected machine and it sends a fake, malicious Windows Update to the client.

In the process of infecting a client, 8 CAB files are used. One of them contains a specifically built program called WuSetupV.exe:

This program (also detected as Worm.Win32.Flame.a), which is 28KB in size, has been signed by a fake Microsoft certificate:

This allows it to run in the victim’s machine...

Weak Passwords and Languages

riva11 | 07 Jun 2012 | 0 comments

Here an interesting article based on a Cambridge University study, In which languages are internet passwords easiest to crack?

DESPITE entreaties not to, many people choose rather predictable passwords to protect themselves online. "12345"; "password"; and the like are easy to remember but also easy for attackers to guess, especially with programs that automate the process using lists ("dictionaries") of common choices. Cambridge University computer scientist Joseph Bonneau has recently published an analysis of the passwords chosen by almost 70m (anonymised) Yahoo! users. One interesting result is shown below. The chart shows what percentage of accounts could be cracked after 1,000 attempts using such a dictionary. Amateur linguists can have fun speculating on why the Chinese do so well and the Indonesians...

Your Input on DLP Requested – Monetary Incentive

linda_park | 05 Jun 2012 | 0 comments

In an effort to understand how data loss prevention is affecting the role of security executives, Symantec is conducting a research study with a select group of Symantec/Vontu DLP customers.

If you were involved in the selection of DLP at your company, you will qualify!

The survey will take about 10 minutes. In appreciation for your participation, we will give you the option to receive a $50 gift card for Amazon.com.

To be invited to participate in the survey, please send your name, title and work email address to linda_park@symantec.com by Friday, June 8, 2012 at 12 pm PDT.

Sincerely,

Linda Park

Sr. Product Marketing Manager | Data Loss Prevention | Symantec

415.829.5046 | go.symantec.com/dlp | ...

Flamer - The Most Complex Malware Threat Since Stuxnet

BJT | 04 Jun 2012 | 0 comments

At this time, Flamer seems to have targeted only a few hundred organizations and individuals located in a small segment of the globe. But make no mistake; Flamer is important worldwide. The complexity of the code within Flamer is on par with that seen in Stuxnet; arguably the most complex piece of malware Symantec has analyzed to date. However the mission of Flamer is much different from that of Stuxnet, which was designed to deliver a payload that disrupted the systems it was targeted toward. Symantec and others’ research indicates that Flamer, as of this moment; is purely focused on capture and exfiltration of sensitive information.

The good news for our public sector customers is that Symantec has protections in place to detect this threat (W32.Flamer). Specifically, we have:

AntiVirus, AntiSpyware, IPS component, Symantec Insight, and Heuristics detection and conviction measures in Symantec Protection Suite...

Small and Emerging Indian Cities Lucrative For Cyber Attackers - ISTR 17

Mira Davda | 29 May 2012 | 0 comments

Augmented by broadband penetration smaller and emerging cities of India are exploring opportunities offered by the virtual world. This group of connected people and businesses has reached critical mass and is lucrative enough to be targeted by cyber criminals.

Indian Cities such as Bhubaneshwar, Surat, Cochin, Jaipur, Vishakhapatnam and Indore are increasingly facing the risk of cyber attacks, with one in four bot- infections in India reported in such cities, reveals India findings of Symantec Internet Security Threat Report, Volume (ISTR) 17. Also, some cities that repeatedly appear in the list for origin of phishing in India - Ahmedabad, Nashik and Coimbatore also figure in the list of bot-infections. Botnets are networks of zombie machines that are used to perform sophisticated attacks and conduct coordinated attacks. The presence of bot-infected computers in these locations indicates that they are being inducted as part of a network of compromised...

The Flame- Most Powerful Malware Till Date

AR Sharma | 28 May 2012 | 8 comments

Just now 'The Flame', the most powerful malware till date has been identified. Again, we must say that calling 'The Flame' a malware is insult for 'The Flame'.

When security community can call Stuxnet- the first cyber weapon, then 'The Flame' should be called as first nuclear cyber weapon.

'Flame' is the 20 times more complex than Stuxnet. Antivirus companies took 6 months to analyze Stuxnet. Imagine how much time and effort would be required to analyze 'The Flame'

'Flame' is massive and most likely targeted for Iran and Isreal.

Once the PC is infected with 'Flame', it steals all info including password, traffic, image, audio and keystrokes.

In the group of malware, 'Flame' joins the elite club along with Stuxnet and Duqu.

'Flame' is the sophisticated attack toolkit. When fully deployed, it's over 20 Mb in size. Such a huge size is due to many different...

Information Thieves Can Steal Along With IP, An Organization’s Credibility

Mira Davda | 25 May 2012 | 0 comments

The value of data is appreciating, especially with organizations rapidly adopting new technologies to provide access to business information anywhere, at any time. This means threats to data or information translate into business risks to business. These risks, related to reputation, customer loyalty, finance and legal, are not only serious but also quantifiable. The first benchmark Cost of Data Breach Study in India, conducted by the Ponemon Institute on behalf of Symantec, revealed that the average organizational cost of a data breach in India is INR 53.4 million (53.4 crore), with malicious breaches by hackers or criminal insiders being the most expensive type at INR 4,224 for one compromised record.

The report further components of the total cost: detection, escalation and redressal formed a significant component, averaging INR 16.4 million (1.64 crore) and INR 20.9 million (2.09 crore) respectively. Victims lost INR 14.6 million (1.46 crore...

Rule review an important task

Milan_T | 18 May 2012 | 1 comment

For Security rule requirements may very with respect to time. Like rule implemented once need to be modified or changed or must be reviewed piriodically.

If any new recuirements come to the picture it must be reviwed. I have SSIM in my organisation implemented before few years rules was as it is. Now security purpose and engineering approch needed to update it. so accordingly older rules must be updated, and if necessary it must be added new once for provideing better services.

Download Insight in SEP 12.1

Chetan Savade | 17 May 2012 | 5 comments

Hello Everyone,

Auto-Protect includes a feature that is called Download Insight, which examines the files that users try to download through Web browsers, text messaging clients, and other portals.

Supported portals include Internet Explorer, Firefox, Microsoft Outlook, Outlook Express, Windows Live Messenger, and Yahoo Messenger.

Download Insight determines that a downloaded file might be a risk based on evidence about the file's reputation. Download Insight is supported only for the clients that run on Windows computers.

You can enable or disable Download Insight and change how sensitive Download Insight is to potentially malicious files. You can also specify the additional criteria that Download Insight uses when it makes a decision about a file. Use these settings to help control the number of false positive detections.

You might want to customize Download Insight settings to decrease false positive detections on client computers. You can...

Tips

Chetan Savade | 15 May 2012 | 0 comments

Hello Everyone,

Tips to improve performance, speed & security.

5 tips for PC health: Organize your folders, update Windows, run antivirus software

Working on a slow, disorganized computer can be frustrating. Read on for organization tips and guidelines to keep your PC on the right track using tools built in to the Windows operating system.

1. Organize your folders

2. Clean up your hard disk

3. Use System Restore

4. Keep Windows and Microsoft Office up-to-date

5. Run antivirus software and a spyware detection and removal tool

Reference : http://bit.ly/JywScP

Speed up your PC

A badly fragmented hard drive will bring even a top-of-the-line new computer to a grinding halt. Learn how a preventive maintenance plan can keep your Windows PC running smoothly and swiftly.

http://bit....

Security Community Blog

Links

About Security Community Blog

Filter by:

Blog Tags