Physical access isn't needed for all these attacks. For example, on the iPhone, all it would take would be to get a user to visit a page hosting the malicious code. It may require some social engineering or a watering hole attack but that's not incredibly difficult.
It's not really SCADA, it's different. SCADA is from Siemens, this is different and the Niagara Framework is used in places beyond big facilities such as power plants and factories. The Niagra framework reaches offices buildings, hospitals, airports and more.
This alert is actually not very new and dates back to July. ICS-CERT re-releases things all the time in order to update small things and be sre people see an update, no matter how minor. Here is the original that came out in July:
According to Amazon Web Services, and as mentioned in the article, GovCloud "supports existing AWS security controls and certifications such as FISMA, SAS-70, ISO 27001" -- So it seems as though you are incorrect on the fact that GovCloud hasn't received FIMSA certification.
Compaqt, because of HTTP of session hijacking works over unsecured wireless connections, it's important to use SSL beyond just the login. So even during the login process when the password is submitted, once a session is established, the session can be hijacked.
You're right -- It's not SET to default, but users can set the service to use HTTPS by default.The actual title of the article is "Twitter Enables Option for HTTPS by Default" - Though I agree that the/. could have been more clear.
I would think if it wasn't obvious enough before, that the "Craigslist Killer" would make that reason enough to come to the conclusion that it's a dangerous place. That being said, there is quite a lot of success with people buying and selling. Just don't have any protections in place like something like eBay.
Spam is declining for a few reasons -- Anti-spam technology is getting better and more widely deployed. sure with massive volumes and good spammer technology plenty is still getting through -- but it's becoming more challenging for spammers to reach the inbox these days. Cybercriminals have switched to focusing on using malware and botnets as these much more profitable over time than the basic spamming. Why would you waste time trying to get someone to buy viagra from an online pharmacy when you could capture their credit card or online banking details instead? Successfully capturing a few dozen credentials like this would likely be more profitable than reaching a million users with a spam message. Massive volumes of spam will still continue but overall the spam industry just ain't what it used to be!
Not surprising and something that's likely to be a trend in consumer devices over time, especially as more and more devices become "connected" -- An interesting research report we highlighted last week shows just how vulnerable these newly connected devices are (ok PS3 isn't newly connected but many more consumer devices are)
Cellphones, iPods, digital cameras, set-top boxes, gaming systems... these devices pervade modern life. Mostly, they make our lives easier and more fun. But if they're built without the proper security technology, our favorite gizmos and gadgets can seriously compromise our privacy, finances and even our personal safety:
http://www.securityweek.com/security-focus-consumer-electronics
According to Microsoft: "For consumers and very small businesses needing protection from malicious software including spyware, viruses, trojans and rootkits, Microsoft Security Essentials is a no-cost, high-quality anti-malware service that efficiently addresses the ongoing security needs of a genuine Windows-based PC. Forefront Endpoint Protection 2010 provides endpoint protection for business environments, including antimalware and additional protections like behavior monitoring and firewall management. Forefront Endpoint Protection 2010 also includes central deployment, configuration, and reporting features needed for ensuring protection is maintained across the enterprise."
Microsoft did just release the latest version of Forefront as well (Forefront End Point Protection 2010)
It's not so much news as it is insight. If you're an experienced network expert it may not be surprising, but too many people in the tech world still don't have a clue on some of the challenges, dangers, problems that are happening currently and that we face moving forward with the overall internet infrastructure.
Slashdot Mirror
Physical access isn't needed for all these attacks. For example, on the iPhone, all it would take would be to get a user to visit a page hosting the malicious code. It may require some social engineering or a watering hole attack but that's not incredibly difficult.
In slides of his presentation he does mention iPads, iPhone and OSX. See Slide #18:
http://www.slideshare.net/lgra...
It's not really SCADA, it's different. SCADA is from Siemens, this is different and the Niagara Framework is used in places beyond big facilities such as power plants and factories. The Niagra framework reaches offices buildings, hospitals, airports and more.
http://www.securityweek.com/niagara-vulnerabilities-put-office-buildings-airports-hospitals-risk
That being said, this warning was originally issued back in July with ICS-CERT not really adding anything new in this warning.
-M
This alert is actually not very new and dates back to July. ICS-CERT re-releases things all the time in order to update small things and be sre people see an update, no matter how minor. Here is the original that came out in July:
http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-195-01.pdf [us-cert.gov] -- It's pretty much identical from what I can see.
It's Global Payments, Inc. Will have more info on it shortly!
A good one also would be http://www.databreaches.net/ - M
Update: It wasn't Norton, it was older versions of their Enterprise protection:
http://www.securityweek.com/symantec-confirms-hackers-accessed-source-code-two-enterprise-security-products
According to Amazon Web Services, and as mentioned in the article, GovCloud "supports existing AWS security controls and certifications such as FISMA, SAS-70, ISO 27001" -- So it seems as though you are incorrect on the fact that GovCloud hasn't received FIMSA certification.
Not a typo, here is an example of a recent prosecution -- http://www.fbi.gov/news/pressrel/press-releases/fbi-slovenian-and-spanish-police-arrest-mariposa-botnet-creator-operators -- Andy many more are behing hunted down Brian Krebs writes about: http://krebsonsecurity.com/2011/03/microsoft-hunting-rustock-controllers/#more-8707
Compaqt, because of HTTP of session hijacking works over unsecured wireless connections, it's important to use SSL beyond just the login. So even during the login process when the password is submitted, once a session is established, the session can be hijacked.
You're right -- It's not SET to default, but users can set the service to use HTTPS by default.The actual title of the article is "Twitter Enables Option for HTTPS by Default" - Though I agree that the /. could have been more clear.
I would think if it wasn't obvious enough before, that the "Craigslist Killer" would make that reason enough to come to the conclusion that it's a dangerous place. That being said, there is quite a lot of success with people buying and selling. Just don't have any protections in place like something like eBay.
Assantisz, the article does link to the ISC advisory. Are you are correct, they do list it as high severity.
The ISC and US-CERT have it ranked as "High Severity"
Anyone else think China's progress on this is a result of stolen intellectual property?
http://blog.mylookout.com/2010/12/geinimi_trojan/ -- From the myLookout Blog who made the discovery
Spam is declining for a few reasons -- Anti-spam technology is getting better and more widely deployed. sure with massive volumes and good spammer technology plenty is still getting through -- but it's becoming more challenging for spammers to reach the inbox these days. Cybercriminals have switched to focusing on using malware and botnets as these much more profitable over time than the basic spamming. Why would you waste time trying to get someone to buy viagra from an online pharmacy when you could capture their credit card or online banking details instead? Successfully capturing a few dozen credentials like this would likely be more profitable than reaching a million users with a spam message. Massive volumes of spam will still continue but overall the spam industry just ain't what it used to be!
Not surprising and something that's likely to be a trend in consumer devices over time, especially as more and more devices become "connected" -- An interesting research report we highlighted last week shows just how vulnerable these newly connected devices are (ok PS3 isn't newly connected but many more consumer devices are) Cellphones, iPods, digital cameras, set-top boxes, gaming systems... these devices pervade modern life. Mostly, they make our lives easier and more fun. But if they're built without the proper security technology, our favorite gizmos and gadgets can seriously compromise our privacy, finances and even our personal safety: http://www.securityweek.com/security-focus-consumer-electronics
Good link and that does have lots more on the history prior to the pleading guilty. The article was updated to link to that story for more details.
According to Microsoft: "For consumers and very small businesses needing protection from malicious software including spyware, viruses, trojans and rootkits, Microsoft Security Essentials is a no-cost, high-quality anti-malware service that efficiently addresses the ongoing security needs of a genuine Windows-based PC. Forefront Endpoint Protection 2010 provides endpoint protection for business environments, including antimalware and additional protections like behavior monitoring and firewall management. Forefront Endpoint Protection 2010 also includes central deployment, configuration, and reporting features needed for ensuring protection is maintained across the enterprise." Microsoft did just release the latest version of Forefront as well (Forefront End Point Protection 2010)
Yes, they mentioned it earlier, today it appears to actually be in action and built into the latest beta of the product.
Someone else had commented that it did work via web interface as well and didn't require a serial interface. Statement from HP should be coming soon.
Actually, the full press release with all the clutter and no information on the API, etc. is here: http://phx.corporate-ir.net/phoenix.zhtml?c=176060&p=irol-newsArticle&ID=1504334&highlight=
If I could afford to have it towed across the atlantic I'd put a bid in :)
It's not so much news as it is insight. If you're an experienced network expert it may not be surprising, but too many people in the tech world still don't have a clue on some of the challenges, dangers, problems that are happening currently and that we face moving forward with the overall internet infrastructure.