Cybersecurity Act of 2009 2nd Version Still Controversial

The new draft of the Cybersecurity Act of 2009 appears to be causing as much controversy as the original proposal, which may give the President power to shut down the Internet in the case of an emergency.

The bill seeks to determine when and how the President could intervene in public and private information systems by limiting internet traffic to critical networks for national security reasons or in the case of an emergency.

It has come under scrutiny from a range of first amendment advocacy groups which have raised alarm about government interference.

More information on the Cybersecurity Act of 2009 can be located here:

http://www.eff.org/deeplinks/2009/09/cybersecurity-act-returns-with-a-fresh-coat-of-paint

http://www.huliq.com/7504/85556/senate-cybersecurity-act-2009-could-shut-down-internet

http://www.foxnews.com/politics/2009/08/28/senate-president-emergency-control-internet/

Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Microsoft Internet Explorer Cookie Path Attribute Vulnerability

Date of Discovery: 17.11.2004
Criticality: Critical
Affects: Microsoft Internet Explorer 6.x

Compromise From: From remote
Compromise Type: Hijacking

Summary
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

Detailed Description
A vulnerability has been reported in Internet Explorer, which potentially can be exploited by malicious people to conduct session fixation attacks.

The vulnerability is caused due to a validation error in the handling of the path attribute when accepting cookies. This can potentially be exploited by a malicious website, if the trusted site supports wildcard domains or the domain name contains the malicious sites domain, using a specially crafted path attribute to overwrite cookies for the trusted site.

The vulnerability has been reported in Internet Explorer 6.0 SP1 on Microsoft Windows XP SP1. Microsoft Windows XP SP2 is reportedly not affected.

Note: Successful exploitation also requires that the trusted site handles cookies and authentication in an inappropriate or insecure manner.

Solution
Update to Windows XP SP2.

Disable cookies except when needed.

CVE Reference
CVE-2004-1527

FAA Data Breach - Personal Data Of 45,000 Exposed

Personal data of 45,000 exposed in FAA data breach, agency warns employees of potential threat, but isn't saying how the breach occurred

Source: Dark Reading.com

Firefox update to 3.0.6 is out...

The Firefox update to 3.0.6 is out. It fixes a couple of vulnerabilities, one of them labeled critical.

Fixed in Firefox 3.0.6
MFSA 2009-06 Directives to not cache pages ignored
MFSA 2009-05 XMLHttpRequest allows reading HTTPOnly cookies
MFSA 2009-04 Chrome privilege escalation via local .desktop files
MFSA 2009-03 Local file stealing with SessionStore
MFSA 2009-02 XSS using a chrome XBL method and window.eval
MFSA 2009-01 Crashes with evidence of memory corruption (rv:1.9.0.6)

See http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.6

Twitter has suffered a rash of security related issues in the past weeks

Twitter has suffered a rash of security related issues in the past weeks. First it was a Phishing attack.

Phishing is the act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft. The e-mail directs the user to visit a Web site where they are asked to update personal information, such as passwords and credit card, social security, and bank account numbers, that the legitimate organization already has. The Web site, however, is bogus and set up only to steal the user’s information (http://www.webopedia.com/TERM/P/phishing.html).

These attacks lead Twitter users to a drive-by malware site. A drive-by download or malware is a program that is automatically downloaded to your computer without your consent or even your knowledge.

Then hackers used Twitter’s own support tools to gain control of 33 member accounts -- including that of President-elect Barack Obama, CNN's Rick Sanchez, and pop star Britney Spears.

As a Twitter participant, I found this to be very interesting and as always I will increase my awareness while using Twitter or any online tool.

Source:
http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212700635&subSection=Attacks/breaches

http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212700834&subSection=Attacks/breaches

Recent Internet Explorer Security Flaw Endangers Your Privacy

A programming bug in Microsoft’s Internet Explorer (IE), the default web browser on Windows-based computers, allows hackers to take control of users’ PCs by tricking them into visiting unsafe websites.

Microsoft admitted that a serious flaw in security has left the majority of the world’s Internet users exposed to attacks from hackers hoping to steal personal data and passwords.

Microsoft estimates two million computers have already been affected and that 1 in 500 Internet users may have been exposed.

Consultants at SecurityOrb.com advise computer users to switch to an alternative Internet browser, such as Firefox or Google Chrome, to avoid the hackers who have so far corrupted an estimated 10,000 websites.

Microsoft said that it is considering the release of an emergency update to correct the flaw.

The Koobface Worm

The Koobface worm is spreading through Facebook. The Koobface worm is a worm designed specifically to spread over social-networking sites and it is spreading spam messages out to Facebook members. The motive is to enable hijacking and click fraud.

The messages offer subject lines like "You look so funny on our new video" and offer a link to a video site that pretends to have a movie clip. When the user follows the link, they are redirected to one of many different compromised hosts, according to SecurityOrb.com. Finally, the user is urged to download or open a file named flash_player.exe. That file is a new Koobface variant.

Recommendation, be aware and run an updated anti-virus software.

IE Browser Security Update

An unpatched vulnerability found in Internet Explorer 7 also affects older versions of the browser as well as the latest beta version

The IE 7 exploit is spreading at a faster pace now due to at least one site that is exploiting the vulnerability is being SQL injected to other websites. More information can be found here.

Terror Suspects Used 'Wardriving' and Un-Secure Wireless Access Points in India Bombing

Terror Suspects Used 'Wardriving' and Un-Secure Wireless Access Points in India Bombing

Securing wireless LANs has to be a priority to help protect the US national security posture. Insecure wireless networks allow malicious individual to access a communication media, conduct illegal activities and remain undetected.

Techniques like wardriving are prime examples on how this can occur. Wardriving is the act of searching for Wi-Fi wireless networks by a person in a moving vehicle, using a portable computer.

Unfortunately, this technique in conjunction with non-secured wireless access points may have aided in the recent terrorist attacks in India.

A recent report stated:

After discovering that a militant group allegedly responsible for a series of bombings there recently may have sent their warning emails of the attacks via unsecured wireless LANs.

The police said the suspects used WiFi scanners to detect open WiFi networks and then remotely sent their email messages from those networks, claiming responsibility in advance of bombings in Delhi and Ahmedabad.

My view on this matter is employing better education and monitoring on wireless equipment at the user and ISP level. Also vendors should have the equipment shipped security closed as compared to open. This would allow the user to think about security as the equipment is being installed and configured.

10 Tips for Cyber Monday Safety

I have written and talk about the security issues associated with Cyber Monday which will occur on Dec. 1. 2008. Cyber Monday is the name given by online retailers and e-commerce experts to the Monday following the Thanksgiving holiday. With its Black Friday counterpart in actual store-based traffic, analysts have pointed to significant spikes in online shopping on Cyber Monday. Coined in 2005, Cyber Monday was fueled by promotions such as free gifts and free shipping as well as by the faster Internet connections many people had at home.

Here is an interesting article on how to stay safe this upcoming shopping year.

From: http://www.bankinfosecurity.com/

10 Tips for Cyber Monday Safety
November 28, 2008 - Linda McGlasson, Managing Editor


Financial institutions that want to help their customers avoid the season's thieves online will be ready & willing - ready with advice and willing to answer questions.

Here's a list of some of the top advice from computer security vendors and experts for those brave souls that will venture into Cyber Monday shopping expeditions.

1. Know Thy Seller. A good rule of thumb to follow is if the merchant isn't someone you've done business with before, be wary of them. If you got an unsolicited email touting their site, don't click on it or open it. A good way to check up on a merchant is to get information through the Better Business Bureau or through comparison shopping sites such as buysafeshopping.com.

2. Run a Clean Machine. Having the latest updated anti-virus, anti-malware installed on your PC should be a priority. A whopping 20 percent of computers don't run these software or even have a firewall in place. If you need help, ask. It's better to be protected than fearing you'll look like a dummy because you don't know how to update your PC. Good places to get information about security software include the Department of Homeland Security's US-CERT.gov, StaySafeOnline.info or OnGuardOnline.gov. Be sure to buy your software from reputable, well-known AV companies.

3. If In Doubt, Delete! When opening email, be smart. Most people can recognize spam mail or email that doesn't belong in their inbox. When in doubt, delete an email. Spam or unsolicited email can often contain links, which if clicked on, can infect a PC.


4. Look For Security Signs. When on a company's Internet site, check for the following security signals to ensure you're where you're supposed to be. Note if the web address begins with "https" -- this means you're on a secure server using SSL encryption. Also look for a padlock icon at the bottom of the browser page. Click on it and you'll see the site address. The address will match the web site address at the top of the page. If they don't match, get off the site immediately. Using the latest browsers including Microsoft Internet Explorer 7 or Firefox 3 will allow you to see "green" visual cues on websites with extended validation (EV) SSL Certificates.

5. Check Your Credit Report.This isn't just something you should do during the holidays, but year 'round, and at minimum at least once a year with all three of the credit reporting companies, Experian, TransUnion, and Equifax. Regularly monitoring your credit card and institution account transactions online keeps unapproved users from pilfering your money and reduces the chance of you falling victim to identity theft.

6. Password Sharing A BIG No-No. This is one of the biggest problems that security professionals face at corporations, and consumers are just as lax with friends and families sharing passwords. If you do happen to share a password to a website with your family or a friend or two, don't use the same password for your online banking account or other sensitive site.

7. Don't Fall For A Cheap Price. The old adage "There's a sucker born every minute" was said long before the Internet was invented, but criminals are still out there plying their fake designer watches, clothes, electronics and other items to foolish shoppers who think they're getting the real deal at a discount price. If a website is offering an item for a extremely low price, beware. That $20 iPod Nano isn't worth the box it will arrive in. Usually the end result is only the disappointment of getting a shoddy knock-off. But paying with a credit card could also open you up to fraud and other charges on your card you didn't expect, and may also open you to identity theft if you've given out other information.

8. No Address or Phone Means No Deal. If you do find a small merchant that has just the item you're looking for at an unbelievable price, see if they've got an address and phone number. Call and ask for more information or a catalog. Your call goes to voice mail? Watch out; you may have wandered onto a criminal's website. If you do get someone on the phone, ask questions about their privacy policy and refunds or resolution policy. If you don't like what you hear, go somewhere else. Print out and keep receipts of all transactions to back up any return requests.

9. Use Credit, Not Debit. Credit cards are the safest method for online purchases. Experts advise not to use debit cards for online purchases because they pull money directly from your bank account. If something goes wrong, or turns out to be fraudulent, it can take months to get your money back. If you are able to get it back. The Federal Trade Commission says federal law limits liability to $50 in charges if someone uses your credit card fraudulently. You could also use third-party escrow services such as PayPal.

10. Shop At Home. Avoid sharing computers, just like you should avoid sharing passwords. Performing sensitive transactions such as giving out credit card numbers or checking your online bank account should be done at a computer only you use. Logging in and doing these transactions on shared computers at libraries or other places where anyone can use them is dangerous. Hackers can easily install a keylogger onto the computer, and it captures everything that is typed onto the keyboard, including sensitive information like passwords, credit card numbers and bank account numbers.

Black Friday and Cyber Monday could bring disasters...

Black Friday and Cyber Monday could bring disasters...

The weekend after Thanksgiving marks the massive start of the holiday shopping season. But it’s also become the time when hackers come out to play, creating mischief and mayhem for unsuspecting computer users.

The term Cyber Monday refers to the Monday immediately following Black Friday, the ceremonial kick-off of the holiday online shopping season in the United States between Thanksgiving Day and Christmas. Whereas Black Friday is associated with traditional brick-and-mortar stores, "Cyber Monday" symbolizes a busy day for online retailers. The premise was that consumers would return to their offices after the Black Friday weekend, making purchases online that they were not able to make in stores. Although that idea has not survived the test of time, Cyber Monday has evolved into a significant marketing event, sponsored by the National Retail Federation's Shop.org division, in which online retailers offer low prices and promotions.

Types of Wireless Attacks

Standard wireless communication occurs when the end user and the wireless access point are able to communication on a point-to-point basis without interruptions. There are many attack variations in existence against wireless networks that breaks the standard communication format. These attacks includes the denial of service attacks, the man in the middle attacks and the WEP key-cracking attack to name a few and are described below.

Denial of Service (DoS) attacks
The objective of a Denial of Service (DoS) attack is to prevent authorized users access to legitimate network resources by denying them service. A DoS occurs when the malicious attacker sends an abundant of garbage data to the wireless access point choking all other communications to legitimate users.

Man-in-the-middle attacks
A man-in-the-middle attack consists of a malicious user (hacker) inserting themselves into the data path between the client and the AP. In such a position, the malicious attacker can delete, add, or modify data. The man-in-the middle attack also enables the malicious attacker access to sensitive information about legitimate users such as username and passwords, credit card numbers and social security.

War driving
Wardriving is the mapping of wireless access points (WAP) by driving or walking through populated areas carrying wireless equipment such as a laptop or a PDA to detect active wireless access points. The tools used for this are available freely off the Internet in the form of Netstumbler and Ministumbler (http://www.netstumbler.com/). Once the malicious attacker located vulnerable wireless access points, they are able to mount attacks to other locations under the cover the compromised network.


Wired Equivalent Privacy (WEP)
The Wired Equivalent Privacy (WEP) authentication consists of each frame being encrypted as it is transmitted to the wireless access point. WEP possess many deficiencies such as the ability to be compromised within a short period of time. Hackers can fairly easily decode WEP-encrypted information after monitoring an active network for less than one day. An application such as WEPCrack (wepcrack.sourceforge.net/) is a freely available tool often used to implement such an attack.

Behind Sarah Palin’s E-Mail Breach

From: SecurityOrb.com


Email security in one of the most overlooked issue end users often neglect when implementing security on their systems. This may be due to the complexity of what occurs from the time you login to your email account, write an email and send it off to its destination point. Did you know that when you send email messages, they do not go directly to recipient mailboxes? Internet Service Providers (ISPs) stores copies of all your email messages on its mail servers before it tries to deliver them.

Just recently, hackers broke into the Yahoo! Email account of The Republican Vice-Presidential Candidate Sarah Palin. She used her Yahoo! Email for official business as Alaska's governor and the hackers posted some of her email content on the Internet. The FBI and Secret Service are investigating this matter. Industry best practices usually shy away from using free email services such as Yahoo, Hotmail and Gmail to conduct sensitive, governmental and private company business. This is why Palin has taken criticism for using private email to conduct government business, which some critics feel it is a way to circumvent various public record laws.

The Department of Justice (DOJ) stated, an investigation will begin into the group who hacked into Sarah Palin’s email and posted messages on the internet. Intercept of private email communication - even of a public figure - is a federal offense. Not only can the original hackers be charged, but all those who posted the messages as well.

Rick Davis, John McCain's campaign manager, issued this statement about reports that Sarah Palin's personal email has been hacked:
"This is a shocking invasion of the Governor's privacy and a violation of law. The matter has been turned over to the appropriate authorities and we hope that anyone in possession of these emails will destroy them. We will have no further comment."

SecurityOrb.com has posted seven (7) tips to aid users in conducting better email security practices:

1. Properly log out of your email program when you are done. Do not just exit out of the browser.
2. Clear cache, history and passwords when you are done, especially at public computers
3. Limit the amount of personal and financial information via email
4. Do not share your account with another user
5. Do not use simple and easy to guess passwords
6. Use encryption when necessary
7. Properly exit out of the browser when you have logged out of the email application.

Hackers knocked Comcast.net offline

Hackers knocked Comcast.net offline

Comcast.net domain name records were altered to enable hackers to redirect Internet traffic to their own server

Hackers knocked Comcast.net offline late Wednesday night, preventing customers from getting to their Comcast Web mail and account records on the company's Internet portal.
Free IT resource

* Tech-Ed 08|Microsoft's largest tech conference|June 08 in Orlando
* Sponsored by Microsoft

Related Stories

* Hacker compromised Red Cross earthquake relief site
* Comcast to buy Plaxo for social networking
* Popular Tags
comcast,, hackers

The criminals somehow got their hands on passwords used to alter domain-name registration information with Comcast's registrar, Network Solutions, said Susan Wade, a Network Solutions spokeswoman. With access to the Comcast.net record, the hackers were able to switch the DNS (Domain Name System) servers associated with Comcast.net and redirect Internet traffic to their own server. They also added offensive comments to the Comcast.net record.

Visitors who went to Comcast's portal between approximately 11 p.m. Eastern time Wednesday and 12:30 a.m. Thursday were greeted with either a "Site under construction" message or a cryptic note reading: "KRYOGENIKS EBK and DEFIANT RoXed COMCAST sHouTz To VIRUS Warlock elul21 coll1er seven," an apparent reference to the hackers who had compromised the site and to their friends.

This attack is connected to recent defacement of the MySpace.com profiles of Justin Timberlake, Hilary Duff and Tila Tequila, said security researcher Dancho Danchev.

No one knows how the hackers gained access to Comcast's Network Solutions account. In the past, registrars have been tricked into handing over control of Internet domains. But Danchev said that lately, criminals have also been using phishing attacks to try to take control of Web domains.

Throughout Thursday, the Comcast.net Web page continued to experience problems. For many visitors, the page was missing graphics and had the look and feel of an early 1990s Web site.

"We believe that our registration information at the vendor that registers the Comcast.net domain address was altered, which redirected the site, and is the root cause of today’s continued issues as well," Comcast said Tuesday in a statement. " We have alerted law enforcement authorities and are working in conjunction with them.”

Neither Comcast nor Network Solutions can say how the hackers got their hands on the Comcast password, but this type of problem is not unheard of, Wade said. "It's not frequent, but it does happen," she said.

There are steps that companies can take to secure their domain name registration accounts, Wade said. "We tell folks, especially big companies, to consolidate domains so you have someone in charge of all the domains," she said. "We encourage people to update their passwords on a regular basis and make sure the passwords are complicated."