IT Security Blog

Even with Gates Leaving, Microsoft is still the prime target

By


He has ruled the computer industry for a long time with the introduction of Windows through Microsoft and has left his mark on the lives of most if not all those who have used their software, Bill Gates has finally stepped out (for real this time) of the Microsoft management for good. Even as the news was still warm and getting out into the wild, another attack on the software giant has been detected and reported by the security provider WebSense about a fake OS patch that is aimed to address some vulnerabilities in Microsoft software. The supposed patch redirects users to a malicious web page that installs malware on the unsuspecting user.

“It’s a deception attack, where it is made to look like a Microsoft update and the user has to take action, rather than an exploit where the user gets infected without saying yes to the download,” Hubbard said. (Hubbard is a Chief Technology Officer at Websense)

Most seasoned users of Microsoft products, know that the company does not send notification of software patches through email (which is done by their AutoUpdate system that automatically does all the work for you…. well, even without you for some updates are unstoppable if you have your system on automatic mode). Any unsuspecting user that clicks on the “Yes” button to get the said update gets a backdoor program installed instead without any warnings. The wide open door can then be used by hackers to obtain information about the user or even take over the victim computer as another minion in the never ending battle between malware and security experts. The hackers managed to go around spam filtering systems by using a redirection path that aims the browser to the web site of the US Secret Service which is a sure sign of more devious acts to come.
The complexity and knowledge of hackers on how to circumvent security is very much a threat to all internet users and still remains a real threat for all of us who use the internet each day.

Source : SC Magazine

Voicemail Spam on Your Mobile – Coming Soon

By


Came across the incident on InfoWorld and it seems quite interesting for it involves spam messages on your mobile. That might seem a long way from the world of IT but as more and more of us turn to the mobile workforce that may present a big problem that can rival spam in your email inbox. The incident has a user from a certain location who moves to a different location that didn’t have the best of service availability when it came to his mobile carrier. He was contacted by AT&T and was informed that due to some technical constraints that cannot guarantee their full range of services. So in the end he was forced to sign up with an alternate mobile provider (Sprint) from which he began receiving marketing mail and text messages that were on the same level as phishing scams out for your personal information.
Unsolicited marketing is banned (which led to the downfall of most off-site call centers) in the US and almost anywhere else if I got it right, so why does a leading provider allow such things to happen? Well, the marketing industry for one is one of the most aggressive when it comes to the utilization of new technologies to further their reach and mobile phones being almost part of everyday life (except for some far reaches of the Amazon or Africa) it is a ripe and well established area to focus on for marketing drives.
Communications is the key and mobile workforces being very dependent on it makes them prime targets as prey for such marketing drives. The poor fellow isn’t alone for millions of us do get unsolicited voice mail or text messages from time to time (some more than others) and there should be something done to correct such menacing and disrupting activities.

Source : InfoWorld

ExFeds – Don’t Mess with our Clients

By

idtheft.jpgA startup firm named iSekurity has former agents from the various US Federal agencies in their roster is to begin offering Identity theft protection service which may become the start of a new chapter or rather business in the world of industrial espionage and identity theft. These former agents are no strangers to the growing problems associated with identity theft and it is costing money for many US businesses and the people who work for them. From petty credit card fraud to more serious crimes, they’ll tackle them all and they would do it with the same precision and tenacity as they have learned in the service. The President and founder of the company promises to get people who steal identities or give their clients a sum of $11,000 as remuneration for any cases they fail to resolve.
This is in response to growing frustration among people with crimes that have resulted from identity thefts and the company’s crews of over 100 former agents are well versed in the art of surveillance and apprehension.
Private businesses like these, hope to fill in the gap between law enforcement and the public where they can do little to stifle these crimes that often have links to organized crime syndicates. From drug running to many other gang related activities, these guys have done it all. The president of the company was a former Presidential detail to former presidents and has taken the role of leading the Secret Service’s elite CAT or Counter Assault Team. With impeccable records in their former federal duties, criminals have one more group of people to overcome in their endless pursuit of identity theft.

Unified Communications under Attack…. So Soon!

By

unified.jpgThe move to shift from multi-level communications and incorporating Unified communications such as VoIP and other unified platforms has become the prime targets of hackers who are now turning to IM attacks as their targets. Offices have de-centralized communications and other systems combining them into one system that is capable of handling communications eliminating the need for maintaining several systems each with its specific function. IM or Internet Messaging is cheaper and allows office workers in the field to communicate cheaply with the office and VoIP allows them to communicate cheaply over vast distances.
Unified communications is the next step towards virtualization which is currently being developed and tested by various developers. IM is one of the most convenient means of communications which has the capability to receive mail from all over just as SMS or Text messaging has done in the Mobile Industry. Every user who uses the internet may have one or more IM accounts with the many free mail providers or through their company hosting service. Using the IM allows hackers to send malware, unload their payloads and go on to propagate through the networked system, which if looked at from a business perspective crippling one of the vital communications links. There are still mobile phones and other means communications but being ever present at every desktop, any unsuspecting user can download malware without proper intrusion prevention and detection systems in place. Mobile phones have also suffered attacks from malware that is designed to attack stripped down versions of popular Operating systems, the forays of hackers into unified communications may mean they are keeping pace with the development of new technologies as fast as businesses adopt them and accept them as just part of the game.

Paypal Boosts security

By

phishing.jpgIn efforts to boost security, Paypal, one of the premier internet online payment providers is moving to block users who use older browsers to prevent weaknesses that these browsers possess. They have found that many users online still use old Microsoft IE 3.0 and 4.0 which have ended their support life a long time ago hence they do not have the needed updated security updates that are necessary to conduct safe and secure online transactions with regards to payments and other related business. Paypal has had a lot of bad publicity with regards to phishing and infiltration where people intercept and go on fake bidding sprees just to get at the vital financial information that people usually share over the network. In hopes of boosting security, they will be using script detection to begin blocking users and that they do apologize for all the inconvenience this may cause the millions of users who may be affected by their move. This comes as the amount of identity theft and other crimes have increasingly entered their ranks ending in much stolen information that leads to credit card fraud. Being the biggest, they are the most viable target for such hackers and they are trying to boost security on that front of the deal.
This would hopefully prevent more cases from developing and that any new ones will be ‘nipped in the bud’ so to speak.
Paypal and eBay have offered select users with a distinct security keys using VeriSign passwords that is to be transmitted during payment transactions which aims to prevent interception of the transaction information as it travels through the internet. Unlike specific credit card transactions that travel through dedicated lines which are now slowly being protected by PCI-DSS for improved security, regular PC do not have that much security hardware installed to protect them from interception by hackers who could tap into the network getting all credit card information for illegal purchases.

Social Networks – Keep the bad guys out!

By

sexofender.jpgIn the UK, identified sex offenders are facing bans from social networking sites which is to boost the reliability and security of having these social networksUK where surveillance has become a part of everyday life, with CCTV systems and all types of other video surveillance abound that may be possible with current facial recognition techniques that can scan a person’s face from any angle allowing identification without that person in question even knowing about it.
The intent is quite good but just how will these social web sites go about identifying sexual offenders is a very tough task indeed. With millions of registered users that span the globe along with the hundreds of social networking sites that may be next to impossible. Don’t expect these people to enter their true identity for that is the first thing they would make them most identifiable. To invent some form of technology that would brand them as such would be better and can indeed make the internet a safer place for all of us including your kids who are often the victims of such criminals.