Cyber Intrusion during November 2006
In total 340 Indian websites were defaced during this month. Mostly the websites under .com domain were defaced by the hacker groups. A chart depicting Top Level Domain(TLD) wise defacements is shown in the figure.
The vulnerabilities likely to be in web servers which have exploited for the defacements are:
Apache mod_auth_kerb "der_get_oid()" Off-By-One Vulnerability
November 25, 2006
CIVN-2006-120
PHPMyAdmin Multiple cross-site scripting Vulnerability, NukeAI Module for
PHP-Nuke "AIbasedir" Variable Remote File Inclusion Vulnerability
November 27, 2006
CIAD-2006-44
PHP-Nuke "modules/News/index.php" SQL Injection Vulnerabilities
November 29, 2006
CIVN-2006-122
Statistics of Defaced Indian Websites in November 2006
Any proxy server that doesn't restrict its client base to its own set of clients and allows any other client to connect to it, is known as an open proxy server. An open proxy server will accept client connections from any IP address and make connections to any Internet resource.
CERT-In tracked 83 open proxy servers functioning in India during November 2006. All the concerned ISPs were alerted immediately to shut down the open proxy servers. A bar chart of open proxy servers tracked during this year is shown in the figure.
Statistics of Open Proxy Server tracked during 2006 (up to November)
The critical and medium vulnerabilities in various Operating Systems, Application software and Network devices discovered during November 2006 and their countermeasures alongwith wide-spreading malicious code like virus/ worm/Trojan are given below:
Microsoft Visual Studio WMI Object Broker ActiveX Code Execution Vulnerability
Microsoft Internet Explorer WScript.Shell Object Arbitrary Code Execution Vulnerability
Microsoft XML Core Services XMLHTTP ActiveX Control Code Execution Vulnerability
LibPNG Graphics Library PNG_SET_SPLT Remote Denial of Service Vulnerability
Multiple Vulnerabilities in Linux
OpenSSH Privilege Separation Monitor Vulnerability
Information Disclosure
Vulnerability
/writeup.jsp?docid=2006-111201-3853-99
[Source: CNN News]
WASHINGTON (CNN) -- A Department of Homeland Security advisory cautioning that al Qaeda may be planning cyber attacks on banking and financial institution Web sites was issued out of an abundance of caution, although there is no corroboration, a DHS spokesman told CNN Thursday.
The threat apparently was posted on a jihadist Web site, the spokesman said. It was discovered Nov. 27 by DHS and translated. The department decided to send an advisory out to financial institutions out of caution.
The Ongoing Evolution of Online Fraud
[Source: Symantec]
In September, Symantec released the tenth edition of the Internet Security Threat Report. A quick comparison with the first edition of the Report, released in January of 2002, shows just how dramatically the threat landscape has changed.
Phishing attacks now using phone calls
[Source: USA Today]
SAN FRANCISCO — And consumers thought they were safe by not clicking on links in unsolicited e-mails.
Now comes a new batch of phishing scams that rely on an old tool — the phone — to trick people into giving away their personal information.
Vishing — short for voice phishing — is one of the latest iterations of phishing, a long-running e-mail scam that instructs recipients to click a link in the e-mail to confirm data such as their Social Security number and credit card number. But the link is really connected to a bogus website where the data are stolen.
NIST Special Publication 800-100 Information Security Handbook: A Guide for Managers
[Source: NIST]
NIST is proud to announce the release of Special Publication 800-100, Information Security Handbook: A Guide for Managers . This Information Security Handbook provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program.
Bot spreads through anti-virus, Windows flaws
[Source:The Register]
University security experts warned administrators on Monday that a bot program has started to spread by exploiting five patched Microsoft vulnerabilities and a six-month-old flaw in Symantec's anti-virus software.
The bot program, identified as W32.Spybot.ACYR by Symantec, has compromised a small number of systems at various universities, including about 30 systems at the University of Arkansas and another 150 systems at the University of New South Wales in Australia.
MCAfee Avert Labs Unveils Predictions For Top Ten Security Threats In 2007 As Hacking Comes Of Age
[Source: SecurityNewsPortal.com]
Professionalism of Malware Threats to Watch in 2007 Include Increase in Password-Stealing Web sites, More Spam and Likelihood of Hackers Targeting Video
SANTA CLARA, Calif., November 29, 2006—McAfee, Inc. (NYSE: MFE) today announced its top ten predictions for security threats in 2007 from McAfeeâ Avertâ Labs. According to McAfee Avert Labs data, with more than 217,000 various types of known threats and thousands more not yet identified, it is clear that malware is increasingly being released by professional and organised criminals.