Internet confidence must be at an all time low, with news headlines of escalating costs of online crime and phishing scams that exploit ignorant users, set to become an everyday occurrence.
But last week`s security roundup is not only gloom and doom. On the upside, the justice system abroad seems to be working to some degree, with authorities arresting phishing culprits in Bulgaria whilst a bot-net offender bites the dust in California.
Vendors have also been kept busy patching their systems and between them, Cisco, Oracle and F-Secure managed to remedy some 83 vulnerabilities.
Who should be held accountable?
In case you`re the type of person who commemorates important events in history, here`s a new one to add to your list. Last week, according to anti-virus firm F-Secure, it`s officially been 20 years since the release of the world`s first PC virus.
It`s officially been 20 years since the release of the world`s first PC virus, according to anti-virus firm F-Secure.
Mariette du Plessis, events programme director, ITWeb
Not quite something to celebrate though, unless you`re a hacker or cracker that is. In the good old days malcontents wrote viruses for the recognition, but today it`s done for money. The two main ways to get it are identity theft by installing a key logger, or by creating a slaved PC (zombie) controlled by a trojan.
It will certainly be interesting enough to see what kind of viruses we will be talking about in another 20 years. If recent security threat reports are anything to go by, don`t be too surprised if your everyday household appliances are next on the list.
Banks remain easy targets for the new generation of cyber-criminals and they`re also likely to pay the highest price this year.
The Anti-Phishing Working Group last week reported a sharp rise in the number of phishing attacks, with financial companies still being the primary target at nearly 95% of attacks in November, up from 86% in October.
This trend is presenting banks with a new kind of threat - the risk of losing customers in droves. The UK Financial Services Authority (FSA), for one, predicts that 77% of UK users would rather close their accounts if banks started refusing to reimburse customers for Internet fraud.
UK banks are not alone. Online crime in the US alone reportedly caused $67.2 billion in damages last year, according to a survey conducted by the FBI. The findings were based on a poll of 2 066 organisations, nearly 90% of which had experienced a computer security incident over the past 12 months.
From stupid to Zombies
Unlike weather forecasts, the one prediction we can bet money on this year is that things will steadily get worse.
IBM has joined the prophets of doom and gloom, and also singled out gullible [or stupid] employees, zombie PCs and targeted attacks as the biggest threats. Big Blue`s 2006 Security Outlook report predicts that cyber-criminals will shift their attention from penetrating system security defenses to enticing employees to execute trojans and other malware to gain access to systems.
IBM also warned that employees could cause trouble by inadvertently leaking confidential information through blogs, and that attackers will start using instant messaging to control networks of zombie computers.
Worms, of course, are the one sure way cyber-criminals can gain access to our PCs and they`re still high on the top 10 lists of threats.
Last week, a worm relying on a combination of user stupidity and supposedly salacious content started making the rounds. The Nyxem-D worm (AKA Blackmal-E), which claims to offer pictures from the Kama Sutra, arrives as the infectious payload of email messages with spoofed sender addresses claiming to offer obscene pictures or pornographic movie clips.
A new phishing scam that targets Yahoo! users also emerged last week. Users get a message via Yahoo!`s instant messenger asking them to "click on this website". Following the link takes you to what appears to be Yahoo!`s photo service. But the site, hosted in the US, has nothing to do with Yahoo! If users enter their user name and password to the site they will receive an error message and their account details are forwarded to a third party.
Patching the holes
On the upside, the criminal justice system scored a point or two for the good guys last week. In California, a 20-year-old man pleaded guilty to four of 17 federal charges that he sold access to networks of compromised PCs and made money from illicitly installed adware.
In Bulgaria, Microsoft helped the authorities arrest eight individuals who were allegedly running an international phishing operation intended to steal personal information from Web users around the world.
Vendors were also kept busy last week patching holes. Cisco Systems has issued two patches for problems with its Call Manager VOIP software, one of which could have allowed hackers to launch a denial of service attack against the user`s systems.
Oracle definitely gets the most patches award of the week. It delivered fixes for some 80 vulnerabilities in its software products, addressing flaws that could be exploited to gain knowledge of certain database information, to overwrite arbitrary files, and to conduct SQL injection attacks.
F-Secure also issued a critical security patch for its anti-virus engine after a flaw was discovered that could crash the protection software.
Linux versus Windows
Good news for Linux followers is that Linux vendors are finally stepping up their security focus and both Novell and Red Hat are now building application security into their Linux offerings.
While Novell is working at integrating its longstanding security tools, such as identity management, into its SuSE Linux distribution, users can expect to see Red Hat build out offerings on top of technology it acquired from Netscape, including a directory server and a certificate management system.
To end the weekly security roundup on a somewhat positive note, there`s also a bit of good news for Windows users.
Contrary to rumours circulating on the Net, Microsoft did not intentionally back door the majority of Windows systems by means of the WMF vulnerability. Although it is a serious issue that should be patched straight away, the idea that it`s a secret back door is quite preposterous.
Sources used: ITWeek, ZDNet, The Register.
Share