Cyber Intrusion during May 2007
In total 110 Indian websites were defaced during May 2007. Mostly the websites under .com domain were defaced by the hacker groups. A chart depicting Top Level Domain(TLD) wise defacements is shown in the figure.
The vulnerabilities which might have been exploited for the defacements are:
1. PHP “libxmlrpc library ()”, “make_http_soap_request ()”, user_filter_factory_create ()" Buffer Overflow and "ftp_putcmd ()"CRLF Injection Vulnerabilities CIAD-2007-26
2. Opera Torrent File Processing Remote Buffer Overflow and Code Execution Vulnerability CVE-2007-2809
3. Apache Tomcat JK Web Server Connector Double Encoded ".."
Security Bypass
CVE-2007-1860
Statistics of Defaced Indian Websites during 01-15 May 2007
Any proxy server that doesn't restrict its client base to its own set of clients and allows any other client to connect to it, is known as an open proxy server. An open proxy server will accept client connections from any IP address and make connections to any Internet resource.
CERT-In tracked 74 open proxy servers functioning in India during May 2007. All the concerned ISPs were alerted immediately to shut down the open proxy servers. A bar chart of open proxy servers tracked during this year is shown in the figure.
Statistics of Open Proxy Servers tracked during Jan 2007-May 2007
The critical and medium vulnerabilities in various Operating Systems, Application software and Network devices discovered during May 2007 and their countermeasures alongwith wide-spreading malicious code like virus/ worm/Trojan are given below:
Microsoft Excel BIFF Record, Set Font and Auto Filter record Remote Code Execution Vulnerabilities
Microsoft Office Drawing Object Remote Code Execution Vulnerability
Multiple Vulnerabilities in Microsoft Exchange
[ McAfee], Trojan-Downloader.Win32.Agent.bjo [Kaspersky], W32/Grum-B [Sophos], TR/Proxy.Agent.CL [AntiVir], Win32:Agent-GJR , Trojan.Downloader-4640, Trojan.Downloader.18993
Newsmaker: Cyberattack in Estonia--what it really means
[Source:
www.news.com.com]
newsmaker When it comes to denial-of-service attacks, Jose Nazario has seen just about everything.As senior security researcher at Arbor Networks, Nazario closely monitors network attacks. A denial-of-service, or DoS, attack occurs when someone directs a large number of requests to a target URL so quickly that the Web server can't respond, and the site becomes inaccessible.
Estonian/Russian statue riots spill online
[Source:
www.theregister.co.uk]
Civil unrest in Estonia over the removal of Soviet era memorials has been accompanied by attacks against the Baltic nation’s internet infrastructure.
Several Estonian government websites remain unavailable whilst others, such as that of the Estonian Police, remain available only in text-only forms as a result of sustained denial of service attacks.
How quickly are phishing websites taken down?
[Source: www.lightbluetouchpaper.org]
Tyler Moore and myself have a paper (An Empirical Analysis of the Current State of Phishing Attack and Defence) accepted at this year’s Workshop on the Economics of Information Security (WEIS 2007) in which we examine how long phishing websites remain available before the impersonated bank gets them “taken-down”.
Two-Factor Security Threats Still Exist
[Source:
www.securitypronews.com]
Two factors of security are better than one, but the extra factor does not guarantee complete safety from potential threats. By all means, let's get a two factor authentication security plan in place for financial institutions. The age of the username/password as being enough security for people has been in the rear view mirror for a long time.
Online Criminal Gangs Battle With Botnets
[Source:www.informationweek.com]
Two or three online criminal gangs are waging an all-out battle for control of the largest botnets, sending out waves of malware aimed at stealing zombie computers from rival gangs to build up their own army.Each online gang is trying to build up the biggest botnet because the bigger the army of infected computers they control, the more money spammers and hackers will pay to use them, explains Shane Coursen, a senior technical consultant for Kaspersky Lab.
White Papers: Ten Ways Hackers Breach Security
[Source:
www.first.org]
Hacking, cracking, and cyber crimes are hot topics these days and will continue to be for the foreseeable future. However, there are steps you can take to reduce your organization's threat level. The first step is to understand what risks, threats, and vulnerabilities currently exist in your environment.
Peer-to-peer networks co-opted for DOS attacks
[Source:www.theregister.com]
A flaw in the design of a popular peer-to-peer network software has given attackers the ability to create massive denial-of-service attacks that can easily overwhelm corporate websites, a security firm warned last week.Over the past three months, more than 40 companies have endured attacks emanating from hundreds of thousands of Internet Protocol addresses (IPs), with many of the attacks producing more than a gigabit of junk data every second, according to security solutions provider Prolexic Technologies.
Gozi hybrid Trojan menaces the net
[Source:www.theregister.com]
VXers have developed a strain of malware capable of logging keystrokes as well as snooping on encrypted SSL streams originating from compromised PCs.The hybrid variant of the Gozi Trojan was discovered by Don Jackson, a researcher with SecureWorks who discovered the original Gozi malware earlier this year. In its original form, Gozi spread using IE exploits. It used advanced Winsock2 functionality to snoop on traffic.
Malware targets OpenOffice users
[Source:www.theregister.com]
Malware miscreants have crafted a cross-platform worm targeted at OpenOffice users that's capable of infecting Windows, Mac, and Linux computers.The OpenOffice/StarBasic macro worm, dubbed BadBunny , is a proof-of-concept worm that's not been seen outside the lab. Most anti-virus firms describe it as a low-risk threat.
New Microsoft Tool Strips Exploits Out of Office Documents (Registered Required)
[Source:www.windowsitpro.com]
Microsoft released its new Microsoft Office Isolated Conversion Environment (MOICE), which converts Office 2003's binary format files into the more secure Office Open XML format used by Office 2007.
Promising antispam technique gets nod
[Source:www.news.com.com]
A key Internet standards body gave preliminary approval on Tuesday to a powerful technology designed to detect and block fake e-mail messages. It's called DomainKeys Identified Mail, and it promises to give Internet users the best chance so far of stanching the seemingly endless flow of fraudulent junk e-mail.
Strange spoofing technique evades anti-phishing filters
[Source: www.theregister.com]
A Reg reader has produced screen shots that demonstrate a powerful phishing technique that's able to spoof eBay, PayPal and other top web destinations without triggering antiphishing filters in IE 7 or Norton 360. Plenty of other PayPal users are experiencing the same ruse, according to search engine results.
Spam Attack Steals High-Level Execs' Data
[Source: www.news.yahoo.com]
The Better Business Bureau has issued a fraud alert regarding the resurgence of a spam attack that targets high-level executives in various industries.
The spam e-mails purport to be sent by the BBB in an effort to entice users to click on a malicious link. The SANS Institute reported a similar wave of targeted spam attacks using the BBB name in March.
Six in California indicted for online bank fraud
[Source: www.theregister.com]
Six California men accused of breaking in to online bank accounts and funneling out the proceeds have been indicted for bank and wire fraud and money laundering. The 53-count indictment could carry a sentence of as much as 30 years in prison and a fine of $1m.
Phishing Activity Trends - Report for the Month of April, 2007
[Source:www.antiphishing.org]
The number of unique phishing websites detected by APWG rose to 55,643 in April 2007, a massive jump of nearly 35,000 from March resulting from aggressive sub-domain phishing tactics by which phishers started using the tactic of putting a large numbers of phish URLs on the same domain.