Symantec Has Some Flaws With SEP

AI Assistant on The Way

Researchers at Carnegie Mellon University are working on artificial intelligence software that could one day become a personal assistant, whispering directions to get to a restaurant, put together a book shelf or repair a manufacturing machine.

Symantec Uncovers Advanced Spying Malware

An advanced malicious software application has been discovered that since 2008 was used to spy on private companies, governments, research institutes and individuals in 10 countries, anti virus software maker Symantec Corp said in a report on Sunday.

The Mountain View, California-based maker of Norton anti virus products said its research showed that a “nation state” was likely the developer of the malware called Regin, or Backdoor. Regin, but Symantec did not identify any countries or victims.

Symantec said Regin’s design “makes it highly suited for persistent, long-term surveillance operations against targets,” and was withdrawn in 2011 but resurfaced from 2013 onward.

The malware uses several “stealth” features “and even when its presence is detected, it is very difficult to ascertain what it is doing,” according to Symantec. It said “many components of Regin remain undiscovered and additional functionality and versions may exist.”

Almost half of all infections occurred at addresses of Internet service providers, the report said. It said the targets were customers of the companies rather than the companies themselves. About 28 percent of targets were in telecoms while other victims were in the energy, airline, hospitality and research sectors, Symantec said.

Symantec described the malware as having five stages, each “hidden and encrypted, with the exception of the first stage.” It said “each individual stage provides little information on the complete package. Only by acquiring all five stages is it possible to analyze and understand the threat.”

Regin also uses what is called a modular approach that allows it to load custom features tailored to targets, the same method applied in other malware, such as Flamer and Weevil (The Mask), the anti virus company said. Some of its features were also similar to Duqu malware, uncovered in September 2011 and related to a computer worm called Stuxnet, discovered the previous year.

Symantec said Russia and Saudi Arabia accounted for about half of the confirmed infections of the Regin malware and the other countries were Mexico, Ireland, India, Iran,Afghanistan, Belgium, Austria and Pakistan.

Source

Will The Drupal Flaw Be Catastrophic?

The Drupal web content management system has been exposed as having backdoor access that could deliver your site to hackers.

The problem is not particularly new. Drupal warned about it earlier this month, but it still needs tackling as millions of websites may be at risk.

Drupal said that sites running version 7 really ought to have upgraded to 7.32 by now, because not doing so leaves them as open as a torn tea bag.

Initially the alert was about the threat, but the firm has updated its earlier advice and is now warning of in-the-wild attacks.

That earlier advice was about a problem in a database API. “A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution,” warned Drupal in a security alert.

“Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks. This vulnerability can be exploited by anonymous users.”

More recent information from the firm points users toward the released upgrade, and informs them that attacks started not long after the initial announcement.

“You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is seven hours after the announcement,” it said, adding that, even when updated, sites will have some cleaning up to do.

“If you have not updated or applied this patch, do so immediately, then continue reading this announcement; updating to version 7.32 or applying the patch fixes the vulnerability but does not fix an already compromised website,” it explains.

“If you find that your site is already patched but you didn’t do it, that can be a symptom that the site was compromised – some attacks have applied the patch as a way to guarantee they are the only attacker in control of the site.”

Gavin Millard, EMEA technical director at Tenable Network Security, advised people to follow Drupal’s advice.

“The so-called ‘Drupageddon’ vulnerability could have easily led to exploitation of any systems running the vulnerable code. With such an easy to exploit flaw, the chance of exfiltration of data or further exploitation are high,” he said.

“For those who have good security controls, reviewing of logs and traffic directed at the sites following the vulnerability being announced and the patch applied is common sense and highly advisable, with appropriate action taken if indicators of compromise are found.

“For those who don’t have such a good level of security or visibility into the logs, the advice from the Drupal team should be heeded. If you don’t know if you were exploited you should assume that you have been.”

Source

Windows 7 Infection Rate Soaring

Windows 7′s malware infection rate soared by as much as 182% this year, Microsoft said on Tuesday.

But even with that dramatic increase, Windows 7 remained two to three times less likely to fall to hacker attack than the aged Windows XP.

Data from Microsoft’s newest twice-yearly security report showed that in the second quarter of 2012, Windows 7 was between 33% and 182% more likely to be infected by malware than in the second quarter of 2011.

The infection rate for Windows RTM, or “release to manufacturing,” the original version launched in Oct. 2009, was 33% higher this year for the 32-bit edition (x86), 59% higher for the 64-bit (x64) OS.

Windows 7 Service Pack 1 (SP1) — the upgrade that shipped in Feb. 2011 — saw even larger infection increases: 172% for x86, 182% for x64.

Microsoft blamed several factors for the boost in successful malware attacks, including less savvy users.

“This may be caused in part by increasing acceptance and usage of the newest consumer version of Windows,” said Microsoft in its latest Security Intelligence Report. “Early adopters are often technology enthusiasts who have a higher level of technical expertise than the mainstream computing population. As the Windows 7 install base has grown, new users are likely to possess a lower degree of security awareness than the early adopters and be less aware of safe online practices.”

Source…

Conflicker Worm Still Wreaking Havoc

Security firm fighting the dreadful Conflicker worm claim that they have it on the ropes. The team of computer-security researchers said they managed to neutralize the worm’s impact by blocking its ability to communicate with its developer, who is still anonymous.

Unfortunately after years of trying fighting the Conflicker, security experts estimate the worm infects between five million to fifteen million computers.  The Conficker worm, showed up in 2008. The worms intent is to disable a computer’s security measures, including Windows software updates and antivirus protection, leaving machines vulnerable to more malicious software.  Read more….

Benefits of Cloud Computing

In a nutshell Cloud Computing is the process of having on-demand hosted computing services provided outside your own network environment through a vendor’s Public or Private Data Center. Cloud Computing can be broken into three distinct categories. They are SaaS (Software as a Service), IaaS (Infrastructure as a Service), and PaaS (Platform as a Service).

Even though the concepts of Cloud Computing have been around for years, it still remains in its infancy. However, its adoption rate has been rather explosive lately, due in part to its seamlessness and ease of information integration.Cloud Computing has many benefits for medium and small businesses by way of collaboration and Productivity. For instance users will have the ability to work on the same projects in real-time from any location whether it’s the office, at home or an overseas location, at any time. The office never closes.

Another reason Cloud Computing has become so enticing is businesses can cut expenses on hardware and IT staffing to support the very same services as if they were on-site (Break/Fix issues are resolved by the vendor and the customer is never aware since services are redundant). Security is also enhanced because leading vendors adhere to higher levels of security features that are cost prohibitive to most medium and small businesses. In these days of high profile data breaches added security is must have.

Businesses should also consider their IT teams will not have a steep learning curve adapting to Cloud based services, since most user environment applications are similar in design to those they are accustomed to using today. Another added convenience is that Cloud Computing rids businesses of the old and costly software licensing requirement for every application/user. Cloud Computing allows the business to buy services on a time/usage metric.

If your business is looking to stay agile and save money, Cloud Computing may be the right direction to move.