Slashdot Mirror
Cyberespionage For Everyone
Mephistophocles writes "A chilling article by Darkreading's Kelly Jackson Higgins describes how the growing accessibility of hacking tools like RATs (Remote Access Trojans) have made cyber-espionage possible for more than just those financially backed by large nation-states, and speculates on what the implications of this may be: 'Researchers at Norman Security today revealed that they recently analyzed malware used in phishing emails targeting Israeli and Palestinian targets and found that attackers used malware based on the widely available Xtreme RAT crimeware kit. The attacks, which first hit Palestinian targets, this year began going after Israeli targets, including Israeli law enforcement agencies and embassies around the world. Norman says the same attacker is behind the attacks because the attacks use the same command-and-control (C&C) infrastructure, as well as the same phony digital certificates. This attack campaign just scratches the surface of the breadth and spread of these types of attacks around the world as more players have been turning to cyberspying. "We're just seeing the tip of the iceberg," says Einar Oftedal, deputy CTO at Norman.'"
Norman Security is not only still around as a company, but they're now regarded as a news source.
Maybe some day, instead of selling arms and giving money to the various factions in a conflict, we can just cyber trade stuff.
We could even put it on an exchange. Next phase: Jim Cramer explaining why you should buy Croation Insurgency at $35.00/share. It's a screaming buy. Booyah!
Finally, HFT takes over. The Intifada Exchange blows up and everybody blames the Jews... in angry comments on YouTube.
I like it. If we can just get ALL of the people that really care THAT MUCH about who can buy an apartment in a particular spot to fight in "cyberspace" instead of real life. Then, we can finally get on with our lives.
Can be USED by anyone is fine. Can WORK SUCCESSFULLY against anyone is the problem.
Thankfully, with the notable exception of Adobe, companies are getting their sh*t together and making these trojans an exercise in futility.
"We're just seeing the tip of the iceberg,"
I think cyber-security companies will pump this up FOREVER and there is no peak to the claims they will make.
...don't even need to use the XTREME RAT CRIMEWARE kit. Wired suggests we call them "hackers". RMS outraged. News at 11.
I mean, other than "everybody panic!" ?
Sent from my ENIAC
Mod my comment down all you like, cyber weapons are not weapons. Shoot a gun at someone and they die, sent a trojan to someone and they actually need to commit cyber suicide, run the trojan, on an insecure platform, without an anti-virus. The problem here is the legacy of platforms that will run anything, promptly hand full permissions to the app to be run and can be modified by these apps.
As I said higher up, and was modded -1:
Can be USED by anyone is fine. Can WORK SUCCESSFULLY against anyone is the problem.
Thankfully, with the notable exception of Adobe, companies are getting their sh*t together and making these trojans an exercise in futility.
"We're just seeing the tip of the iceberg,"
I think cyber-security companies will pump this up FOREVER and there is no peak to the claims they will make.
What's the Cyberespionage alternative for using a window as a mirror to observe the target? What's the counterpart of sitting on a park bench with a newspaper with a hole in it? Cyber Grouch Marx mask anyone?
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Did everyone already forget freely available rats like Sub7, BO and NetBus that used to be around in the late 90ies?
So, rather than celebrate the possibility of having transparency for all (it's not government spying when everyone is doing it to the government in return) ... Norman Security is reporting on the emergence of script kiddies?
- Nec Impar Pluribus, or so I'm told.
You're saying that by creating technology to break into other people's computers, we create technology that could be used to break into our computers?
TELL ME MORE.
They're not weapons, lethal or otherwise, if they cannot do harm. The problem here is the open OS's, and companies, notably Adobe, that create vectors (vulnerabilities) for doing harm.
The more script kiddies out there, the more secure the OSs will become because the more times they'll be attacked.
Adobe, Adobe, Adobe, Adobe, Adobe, Adobe, I'll say it a million times, because I am sick of it upgrading with some critical vulnerability. It's clear to me that Adobe is the company that currently does not have a technical grip on it's products and seems to be happy with an endless upgrade cycle.
I've started kicking their **** off PCs now because they just don't seem to be able to get their act together. But then that's also part of making OSs more secure: removing software from companies seemingly incapable of making their software secure.
As for words as weapons, bugger off, there's nothing you can say that can harm me. If you claim words as weapons then free speech is no more.
Wow, such a new concept!
From the article:"Turns out cyberespionage malware and activity is far more prolific than imagined.".
Really? Who "imagined" that malware activity was not that "prolific"? Did they just defrost those "researchers"?. Seems like these folks are the only ones surprised by the existence of script-kiddies, hackers in the Middle-East, the extent of Chinese state-sponsored cyber-espionage, and the growing hacker communities in Brasil and other emerging nations. Globalization => globalization of hacking. Who would have imagined that....
And the article links to another one ("Scope Of APTs More Widespread Than Thought" ) that goes on:
"There's a lot of cyberespionage happening internationally. This is not going to go away," Kaspersky's Schouwenberg says.
Gee, thanks for the eye-opening, completely obvious, self-evident statement, Shouwie, Here's a question: do you experts stay constantly tuned with what's happening in the world, or do you just wake up one day, burst out of the bubble where you were busy "imagining" things, and discover reality?
You mean like Sub7 and Netbus, which were readily available in the late 90s?
Dude. This was news before Slashdot existed.
Finally had enough. Come see us over at https://soylentnews.org/
Can't seem to find it
Norman was founded in 1984 and is based in Norway:
http://en.wikipedia.org/wiki/Norman_(company)
Norton was started by Peter Norton in 1990 and is now owned by Symantec:
http://en.wikipedia.org/wiki/Norton_Internet_Security
So, as you can see.. Your experience with Norton Clone has nothing to do with Norman.
reinstall Windows
Easyer said than done when there is no Windows CD supplied.
I have even seen cases where there is no bootable recovery partition, no supplied disks whatsoever except for a manual on a CD (no drivers even), resulting in a recovery that demands you order (and pay for) a "recovery boot CD" first. I believe that was a Gateway computer.
Hivemind harvest in progress..
Slashdot i welcome you in the 90's. Nice that you are rerunning stories from the era of your inception.
Hivemind harvest in progress..
Welcome to circa 1970.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Never mention Microsoft Windows ...
if you buy from the Microsoft Store you are sent to digital river to do your download
bonus tip if you have any win7 dvd you can install whichever version of Win7 you have the key for if the ei.cfg file has been removed/disabled (note must be correct Arch and source so an OEM 32 bit DVD can be used to install any 32 bit version)
Any person using FTFY or editing my postings agrees to a US$50.00 charge
I block out communications to their C&C servers here, via custom hosts files + firewall rules tables in combination:
---
0.0.0.0 flashsoft.no-ip.biz
0.0.0.0 good.zapto.org
0.0.0.0 hatamaya.chickenkiller.com
0.0.0.0 helpme.no-ip.biz
0.0.0.0 hint.zapto.org
0.0.0.0 hint1.zapto.org
0.0.0.0 idf.blogsite.org
0.0.0.0 javaupdate.no-ip.info
0.0.0.0 loading.myftp.org
0.0.0.0 lokia.mine.nu
0.0.0.0 may2008.dyndns.biz
0.0.0.0 may2008.dyndns.info
0.0.0.0 menu.dyndns.biz
0.0.0.0 mjed10.no-ip.info
0.0.0.0 monagameel.chickenkiller.com
0.0.0.0 natco1.no-ip.net
0.0.0.0 natco2.no-ip.net
0.0.0.0 natco3.no-ip.net
0.0.0.0 natco4.no-ip.net
0.0.0.0 owner.no-ip.biz
0.0.0.0 powerhost.zapto.org
0.0.0.0 ramadi.no-ip.biz
0.0.0.0 remoteback.no-ip.biz
0.0.0.0 skype.servemp3.com
0.0.0.0 test.cable-modem.org
0.0.0.0 www.hint-sms.com
---
SOURCE = Cyberattack_against_Israeli_and_Palestinian_targets.pdf
Downloadable from NORMAN -> via the article's source page here -> http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/240115353/the-globalization-of-cyberespionage.html
(I would post the direct link, but /. says it is "too long of a string of letters" so, there you are! Close as I can get...)
Excellent document too!
Well-done & INFORMATIVE for my purposes!
(Which is simply shutting these kinds of machinations down before they can even DO anything, much less even let me get it in the first place!)
* The rest, based on IP addresses, seem to be changing dynamically (ala "fastflux" type work), but again:
I simply add them as they are discovered via a Windows PowerShell script to my firewall rules table too - thank goodness they are NOT the majority of what these malware makers use usually though since they're relatively easy to "Blackhole" @ the ISP/BSP level via say, DNS Block lists as 1 example thereof.
APK
P.S.=> After all - "You can't get burned IF you don't & can't go into the hot kitchen"...
AND?
Yes, that is EXACTLY what this method of defense allows, easily, via a custom hosts file!
(Which is the primary one, since they "recycle" the host-domains they own usually)
And, of course, for those IP address based ones (rarer since they are EASILY blackholed @ the DNS level alone) & firewall rules tables also...
Do THAT, folks?
There is literally NO WAY for them to even "TALK TO MAMA" (C&C Servers) for orders!
Heck - NOT even IF I was to get one of these machinations, via say, a USB stick... they're totally "nullified" from the get-go!
... apk
and when ICQ and IRC was very popular, there were easy ways to obtain user IP addresses and only with that you could hack into someone's computer with a very basic tool. Another one required you to get them software, in which it came with a remote networking virus, opening ports and keeping them open. Often times people would already have it and nothing needed to be done. Another tool that I remember was something similar but if they used remote networking then you could easily gain access to their computer as well. Lesson learned is that even when you're 10 you could still hack people with the right tools, and the right tools was once very easy to get to, and it may very well still be that way.
Webcam Spying is a BIG part of Cyber Security for governments and citizens. The best way to protect your webcam from spying/espionage is to use a Webcam Cover. C-SLIDE makes the BEST webcam cover on the market today. Check them out at http://www.c-slide.com
I'm suprised that no one brought up the Second Amendment (at least those in the USA).