Ubersecure http://www.ubersecure.com it starts with you Fri, 08 Mar 2013 13:41:02 +0000 en-US hourly 1 http://wordpress.org/?v=3.5.1 Zero cost steps to manage ZeroAccess malware uptick http://www.ubersecure.com/2013/03/zero-cost-steps-for-zeroaccess-malware-uptick/ http://www.ubersecure.com/2013/03/zero-cost-steps-for-zeroaccess-malware-uptick/#comments Fri, 08 Mar 2013 00:46:46 +0000 Simon J. Herring http://www.ubersecure.com/?p=467

I’ve see an seven-fold increase in HTTP drive by attacks this month, particularly ZeroAccess and Blackhole variants. If you’re battling the uptick of HTTP drive-by attacks and the modern malware that they deliver, then take the following zero cost steps before you invest in more technology:images

  • Patch your endpoints. I know… it’s easier said than done, especially if you have legacy apps that rely on older versions of Java.  The bottom line is malicious code exploits weaknesses in software. And the situation isn’t going to get any better.  Cyber thugs have found a lucrative model in attacking the end-point, so expect this trend to continue.  Now before you say, “Hey what about zero days!?!” Yes, I hear you.  You can’t patch those, so consider the following additional steps.
  • Dedicate a browser to secure surfing.  I currently use two browsers — Internet Explorer and Firefox.  My IE browser has Java enabled.  I use this browser to access less than 10 sites that are strictly business related or rely on legacy Java.  My other browser is Firefox.  Java is not enabled. I also use a variety of security plug-ins.  NoScript is my favorite. No plugins or scripts run by default, so it’s perfect for Internet research or checking out sites I am not familiar with.
  • Up the sensitivity of your AV solution. There’s at least 40 antivirus products on the market, so this is very generic advice.  It’s possible there’s some extra firepower you can squeeze out of your AV product.  Many organizations are concerned that AV is too intrusive or slows down their systems so they dial back the sensitivity, but that’s a somewhat antiquated notion given the average horsepower of today’s desktops.  (Personally, I think it’s more intrusive to have the help-desk take away your system while it’s wiped due to an infection.) If your AV product supports it, please make sure it’s allowed to automatically block malicious websites when mischief is detected.  One more note on AV… if you’re still doing a full scan once a week, then understand that you’re giving cyber criminals several days to do their worst before your scheduled scan detects the malware.  A shorter interval between scans means faster detection, especially if the “on access” process fails to block the malware.
  • Review your reputation filters.  Check and tweak the paranoia level of your malware gateway.  If you feel like you’ll be swamped with too many requests to unblock sites, consider the time it takes to create an exception for a blocked site versus completely rebuilding a compromised system.  A note about web reputation:  a site that’s been hacked/seeded won’t develop a bad rap until it’s detected by the companies that maintain reputation lists. This means there’s a window of time where an infected site still has an acceptable reputation, so the gateway will grant access.  It’ll be up to your endpoint protection solution to step-in and manage the malware. Reputation lists aren’t perfect, but they are effective once the site is picked-up and placed on the naughty list.
  • Block Internet Ads. Cyber criminals have a great level of success distributing malware through ad banners.  There’s no need to hack the websites users visit with this tactic — you simply create weaponized ads and wait for them to stream across an unsuspecting user’s web session.  The solution is to block Advertising.  Yes, this makes websites look unattractive, but it also keeps malware from slipping through.  I’d rather see webpages with missing Ad banners than inundate the help desk with re-image requests. The executives I’ve spoken with understand how the productivity of end users and the integrity of sensitive data outweighs the aesthetic appeal of websites.
  • Stop surfing as admin.  When you get hit with an HTTP drive-by (or any malware for that matter), the malicious code will piggy-back on your current permissions.  If you’re logged-in as a super user like administrator…well, you’ve given the malware full control of your system.  What to do?  Stop logging-in as an administrator.  There’s no reason to surf the web while logged-in as an admin.  In fact, I’ve not logged-in to my system as an administrator for over 5 years.  If I need to run a program as an admin I elevate my privileges.
This is not a complete list.  I’d love to hear some other zero cost (or even low cost) solutions you’re using to manage HTTP drive-by attacks, so submit a comment.
]]> http://www.ubersecure.com/2013/03/zero-cost-steps-for-zeroaccess-malware-uptick/feed/ 0 What’s in your “IT cockpit”? http://www.ubersecure.com/2011/12/whats-in-your-it-cockpit/ http://www.ubersecure.com/2011/12/whats-in-your-it-cockpit/#comments Mon, 05 Dec 2011 17:44:45 +0000 Simon J. Herring http://www.ubersecure.com/?p=320

Would you trust a pilot to land a plane based on his gut?  What if you looked in the cockpit and saw no instrumentation – no altimeter, radar, or other dials? Such a sophisticated piece of equipment as a passenger jet demands it.  There’s simply too much at stake.  Your business is no different.

English: Swiss HB-IZX Saab 2000 cockpit

Image via Wikipedia

Businesses are built upon technology — technology that is flawed, often unstable, implemented incorrectly or in a hurry, and targeted by hackers.  A company’s ability to create products or deliver services is impacted when this technology fails, is abused, or manipulated.  The longer these failures, security breaches, or mis-configurations go unnoticed, the greater the impact.  A system to detect these events and alert personnel is as crucial to keeping the business healthy as instrumentation is to landing a jet.  Without it, you’re flying blind.

Consider the following situations over which you should have operational visibility:

  • Early detection and alerting for system abuse, allowing the security team to block access and fix weaknesses before personal information is stolen.
  • Predicting when database hard drives will be at capacity allowing additional disk to be added proactively, versus an emergency upgrade at 2AM… after the disks are full.
  • Knowing exactly how long it takes a customer to login to your on-line store, or whether anyone can login at all, ensuring transactions can be completed and the speed/experience is acceptable.

This is by no means and extensive list.  It does represent monitoring/detection objectives we’ve quickly and successfully implemented for clients that must know immediately when systems or processes are at risk.  There’s no room for error — systems must be functioning correctly, always accessible, and secure from unauthorized access.  The status of these objectives (and many more) are accessible to executives and technical personnel through  their AccelOps system.  On-demand dashboards, deep analysis, reporting, and alerting let decision makers and system administrators take corrective and proactive action before the business is impacted.

If the CEO asks to take a look in your “IT cockpit” what would he/she see?  Would they have confidence that you can help them fly the plane, or would it appear you’re flying blind?

Enhanced by Zemanta
]]> http://www.ubersecure.com/2011/12/whats-in-your-it-cockpit/feed/ 0 Mighty Zeus and your bank account http://www.ubersecure.com/2011/01/mighty-zeus-and-your-bank-account/ http://www.ubersecure.com/2011/01/mighty-zeus-and-your-bank-account/#comments Wed, 26 Jan 2011 00:55:38 +0000 Simon J. Herring http://blog.ubersecure.com/?p=70
The Seal of the United States Federal Bureau o...

Image via Wikipedia

The FBI’s IC3 issued a warning this week about ACH fraud targeting businesses across the US.  The targets of these attacks are companies that have recently posted on job search sites.  So what’s the connection?  If you’ve posted a job opening, then it’s only logical that someone at the targeted business is expecting a resume or curriculum vitae (CV).  They are, after all, trying to fill a vacant position.  This means an email with an attached resume isn’t really  “unsolicited email”, making it more likely to be opened by the recipient.

At the core of this “resume” attack is the Zeus aka “Zbot”… a data-theft Trojan that’s responsible for stealing large sums of money from companies across the nation.  The IC3 warning highlights one recent case: a US business lost $150,000 when cyber criminals were able to nab the online banking credentials from the person that handles financial transactions.  Money was fraudulently sent in three transactions to accounts in the Ukraine and the US.  The FBI advises clients to ensure all email is scanned by an anti-virus solution.  This is certainly a good start, but technology alone won’t protect your personal or business bank account.

  • Anticipate unauthorized access.  Just assume your system(s) or PC will be broken-in to.  When this happens your financial and personal data will be targeted, so make it harder for data thieves to take it.   Based on my experience as an ethical penetration tester, I know it’s all too easy for a hacker to “leapfrog” from one system to another once they’re on the network.  This is especially true if PCs are un-patched, easily guessed or blank passwords are used, and sensitive data like bank account numbers and passwords, etc., are saved to the “desktop” (or elsewhere) without encryption.  Take inventory of what sensitive information you’ve saved and whether you really need it.  If you do, store it on a secure/encrypted thumb drive.
  • Buy USB thumb-drive that supports encryption.  I personally use a 2GB S200 from IronKey.  My IronKey securely stores my credentials (login & password) for every important website I use.  I do not keep login names, accounts, and password on my laptop in clear text.   When I need to login to these sites, I plug-in my IronKey and use the “secure” Firefox version that comes with it.  This adds an additional layer of web browser security.  IronKey makes both a personal and enterprise version, so this is a solution that works well for consumers and businesses alike.
  • Use a separate system for banking and only for banking.  Even with encryption, a patched OS, anti-virus, firewalls, and a secure browser, I still believe that using the same PC to surf the web and manage your money is dangerous.  So buy a netbook – it’ll cost you less than $300.  Only turn it on when you have bills to pay, money to transfer, etc.  Turn it off when you’re done.  Keep it in a safe place, away from your spouse, kids, roommate, or whoever might take it for a spin on the information superhighway.    Don’t check your email, Facebook page, eBay account, do Internet research, or IM your friends from this system.  Have I made this clear?  This is no ordinary, casual, web-surfing laptop — this is your banking system — your “banktop” — keep it safe.  Use it for banking only.
  • Enable alerts on key banking activities.  And finally, it wouldn’t hurt to know when an unexpected banking transaction happens.  My business bank lets me enable about 16 different alerts that can be sent over SMS or email.  I receive an alert for every successful or failed login, deposits, and transactions over a certain dollar amount.  I know within seconds if something has happened.  So far, so good.

All this protect your hard-earned cash?  You bet.  Your other choice is to use the drive-up teller or in-person banking.  There’s certainly nothing wrong with that.  But if you’re going to use Internet banking, please take it seriously — mighty Zeus is only a few clicks away.

Related articles
Don’t check email, Facebook, eBay, or IM from this system.  This is no ordinary, casual, web-surfing laptop — this is your banking system — your “loot-top.”
Enhanced by Zemanta
]]> http://www.ubersecure.com/2011/01/mighty-zeus-and-your-bank-account/feed/ 1