View full post on Exploit-DB updates

But scammers are exploiting Google Docs to phish for passwords and sensitive information.

View full post on Naked Security – Sophos

Hackers took control of two satellites for few minutes

According to a US report recently claimed that hackers had managed to interfere with two military satellites, but one expert argues the amount of energy required would be too great for ordinary hackers.
The hackers took control of the Landsat-7 and Terra AM-1 satellites for a grand total of 12 minutes and two minutes respectively.
One might

View full post on The Hacker News [ THN ]

Facebook has received notice that U.S. antitrust regulators will give its proposed purchase of the popular photo-sharing app maker Instagram a lengthy investigation, an industry source said. Facebook has received a “second request” from the Federal Trade Commission, essentially a request for relatively large amounts of data that the regulators will sift through to ensure that the deal complies with antitrust law.

• Read the article: Reuters

View full post on GigaLaw.com Daily News

View full post on The Security Skeptic

Keeping Malware in Check

A limitation of antivirus (AV) agents is they often do not evaluate the entire known malware sample found running on a system. Polymorphic and mutating viruses make it possible for one AV vendor to detect a malicious sample and another to completely miss it. It’s not feasible to run every AV program available on the market today in your network to make up for gaps in coverage. Nessus already helps you with malware detection, for example:

• Nessus reports if the scanned host is on a known botnet list, communicating with a known botnet IP, or hosting malicious content associated with botnet propagation.
• Nessus audits your antivirus agent by reporting if it’s misconfigured or has out-of-date rules.

Tenable’s research team recently added new functionality to Nessus which will detect known malware running on your Windows scan targets. Below is an overview of how this new feature works:

1. Nessus authenticates to the Windows system.
2. Nessus enumerates the list of running processes on the system.
3. For each process, a cryptographic hash is generated.
4. Nessus performs an encoded DNS lookup to the Tenable DNS server, which is configured to track known malware.
5. If the process is found to be malicious, the plugin logs the results with information about the malware found.

You can watch a short video on how to configure and run this plugin below:

Plugin Output & Reference Web Pages

If you are already running credentialed scans against Windows targets, ensure that plugin #59275 “Malicious Process Detection” is enabled. The results will appear with a “High” severity rating as follows:

Click for larger image

You will notice several interesting things in the above plugin output. First, the MD5 checksum of the malicious process is listed as matching known malware. The file path on the system where the malware resides is listed next, along with the Process ID (PID) of the process when the scanned was performed. An abbreviated list of AV products that consider the file identified to be malware comes next, including a report of how many AV vendors in total believed it was malware and the total number of sources.

A URL is provided to learn more about the malware identified. If you visit the URL in the plugin output, you will see something similar to the page below:

Click for larger image

For this example, I’ve used WinArpAttacker to trigger the malicious process detection (to avoid having to infect my systems with “real” malware). The above report provides some useful information, including how often this malware is detected (84% in the case of WinArpAttacker) and a list of each AV vendor’s name for it (Example, and my favorite, Sunbelt calls it “HackTool.Win32.ArpAttacker.3020 (not malicious)”).

Requirements

In order for the Malicious Process Detection plugin to run properly, the following requirements must be met:

• Credentials for scanning a Windows target with Nessus
• The ability for the Nessus scanner to perform DNS lookups to the Internet

Conclusion

It should be noted that this plugin is not a replacement for AV software. Nessus only checks the running processes at the time of the scan, whereas an AV product can detect file system writes and executions, plus attempt to prevent infection in near real time. However, this new functionality in Nessus adds the ability to check your systems running processes against 25 AV products, without having to run them all on your network and systems.

View full post on Tenable Network Security

A bane for U.S.-based cloud providers for several months now has been the assumption among cloud customers and service providers outside the U.S. – especially in Europe – that the Patriot Act gives the U.S. more access to cloud data than other governments. The idea, then, is that it’s safer to store your data with a cloud provider in a location free from such governmental access. A recent study debunked this Patriot Act cloud notion by showing that, in fact, other governments have just as much access as the U.S. for national security or law enforcement reasons.

The study, published by the global law firm Hogan Lovells (.pdf), looked at the laws of ten countries, including the U.S., France, Germany, Canada and Japan, and found each one vested authority in the government to require a cloud service provider to disclose customer data. The study showed that even countries with strict privacy laws have anti-terrorism laws that allow for expedited government access to cloud data.

“On the fundamental question of governmental access to data in the cloud, we conclude …that it is not possible to isolate data in the cloud from governmental access based on the physical location of the cloud service provider or its facilities,” wrote Christopher Wolf, co-director of Hogan Lovells’ privacy and information practice, and Winston Maxwell, a partner in the firm’s Paris office.

In a blog post, Dave Asprey, vice president of cloud security at Trend Micro, said the research “proves a bigger point; that your data will be disclosed with or without your permission, and with or without your knowledge, if you’re in one of the 10 countries covered.”

The only solution to this problem, he added, is encryption. But how encryption keys are handled is critical; encryption keys need to be on a policy-based management server at another cloud provider or under your own control, Asprey wrote. Now, Trend Micro has a vested interest here since it provides encryption key management, but it’s a point worth noting for organizations concerned about protecting cloud data not just from governments, but from cybercriminals.

For another examination of the Patriot Act’s impact on cloud computing, check out the article by SearchCloudSecurity.com contributor Francoise Gilbert. She looks at the rules for the federal government to access data and how they undercut concerns about the Patriot Act and cloud providers based in the U.S.

View full post on Security Bytes

View full post on Techworld.com security

View full post on Twitter / ProtectMyID

View full post on SANS NewsBites

View full post on SANS NewsBites

View full post on Techworld.com security

View full post on Naked Security – Sophos

A French court ruled that Google is not responsible for filtering content on YouTube, dealing a blow to French broadcaster TF1 which sought damages for copyrighted sports and movies which ended up on the video-sharing website. TF1 claimed 141 million euros in damages but was ordered to pay 80,000 euros of Google’s legal fees.

• Read the article: Reuters

View full post on GigaLaw.com Daily News

View full post on Techworld.com security

Get “Fitness for Geeks” today using code DEAL and save 50%!

This sale ends at 2:00 AM 2012-05-31 (PDT, GMT-8:00).

View full post on O’Reilly News and Commentary

Earlier today, while doing our daily data mining, we came across a new variant of ZeuS 2.x. It includes a new backdoor command called: win_unlock. Very interesting, turns out this slightly modified ZeuS 2.x includes a ransomware feature.When th…

View full post on The Security Blog » Latest InfoSec Threat Research & News | TheSecurityBlog.com

A Thai web editor is due to hear whether she will be jailed for hosting defamatory postings about the monarchy on her website, amid a growing clamour for the law to be changed. The case has stirred fierce debate in Thailand, where strict laws against defaming the royal family have prompted accusations that authorities are trampling on free speech.

• Read the article: AFP

View full post on GigaLaw.com Daily News

read more

View full post on Stay Safe Online blogs

View full post on View network-security jobs – TEKsystems.com