Your Ad Here
Showing posts with label SANS. Show all posts
Showing posts with label SANS. Show all posts

Friday, February 27, 2009

Free GIAC Certification with SANS OnDemand Training

Sign up for any SANS OnDemand course before Friday, March 13, 2009, and
you'll receive the corresponding GIAC certification attempt for free (a
$499 value)! To register for this offer, simply go to
http://www.sans.org/info/38839 and use the discount code OD_GIAC.

Also for this limited time, receive the corresponding GIAC
Certification/S.T.A.R. attempts free with any OnDemand Flex Pass! Go to
http://www.sans.org/info/38844 for information on our OnDemand Flex
Passes.

According to student feedback, SANS OnDemand - Online Training and
Assessments is simply one of the best tools to prepare for the GIAC
exams.

"I have several GIAC certs. My highest exam scores are from when I use
OnDemand training." - Brad Fulton, SMS Data Products

Not sure online training is for you? Try any of our OnDemand course
demos at http://www.sans.org/info/38839
.

With SANS OnDemand, students receive:
* 4-months access to our comprehensive 24/7 online training and
assessment system
* A full set of course books and hands-on CDs and/or downloadable .mp3
audio files - all for you to keep even when your online access expires
* Synchronized online courseware and lectures
* Integrated assessment quizzes throughout the course
* Access to OnDemand Virtual Mentors
* Labs & hands--on exercises
* Progress Reports

Sometimes the realities of limited travel budgets or the difficulty of
being out of the office or home for a week make it impossible to attend
a live training event. With SANS OnDemand online training and assessment
program, you have access to SANS' high quality, intensive, immersion
training at your convenience - anytime, anywhere.

If you have any questions about SANS OnDemand, write to
ondemand@sans.org or call us at (301)654-7267 [Monday - Friday, 9:00
a.m. - 8:00 p.m. Eastern Standard Time].

And remember that every SANS OnDemand purchase earns you points towards
future OnDemand training! http://www.sans.org/info/38834

Be sure to tell your friends and colleagues about this great opportunity!


Kind Regards,

Kimie Cabreira
Director
SANS OnDemand

**************************

SANS is pleased to announce our new Training and Events Calendar - an
easy way to see what opportunities are available to you during the
coming month! The current calendars are now available for download from
http://www.sans.org/info/7926. For another option, consider SANS' seven
ways to Train Without Travel at: http://www.sans.org/info/28689.

SANS' Webcasts are free live Web broadcasts that allow you to hear a
knowledgeable speaker while viewing presentation slides that you
download in advance. To learn more or to subscribe to our Webcast
calendar go to http://www.sans.org/info/13271.

Tuesday, February 24, 2009

SANS NewsBites Vol. 11 Num. 15

Cool new gift to the security community from the folks at the Internet
Storm Center: a daily summary of information security events as a 5-10
minute "stormcast". See: isc.sans.org/podcast.html , or search iTunes
for "Stormcast". Each Stormcast is made available between 0 and 3am GMT
so it is ready for many readers for a morning commute)

The sleeper story of the year is the first one. The CAG will
revolutionize first federal and defense industrial base cyber security,
then security product procurement, and then (very quickly) banking
security and critical infrastructure security. If you work in any place
with data that really matters, test your current controls against what
is published in the CAG (don't check whether you have policies, rather
use the measures of effectiveness in the CAG to test the quality of your
controls.) For consultants, the biggest new business opportunities will
go to the large consulting companies who are first to make the
transition from FISMA reporting or ISO auditing to CAG implementation
and testing.

Alan
*************************************************************************
SANS NewsBites February 24, 2009 Vol. 11, Num. 15
*************************************************************************
TOP OF THE NEWS
US Consortium Releases Consensus Security Audit Guidelines
Nevada Bill Will Be Amended to Avoid Criminalizing RFID Research
Proposed Legislation Would Require Retention of Internet Use Data for Two Years
Another Payment Processor Security Breach
THE REST OF THE WEEK'S NEWS
LEGAL ISSUES
Starbucks Facing Lawsuit Over Laptop Theft
POLICY AND LEGISLATION
Pending NZ Copyright Law Put On Hold
VULNERABILITIES
US-CERT Warns of Proxy Server Flaw
DATA BREACHES, LOSS & EXPOSURE
Three Breaches at Univ. of Florida Gainesville in as Many Months
ATTACKS & ACTIVE EXPLOITS
Targeted Attacks Exploit Unpatched Adobe Flaw
Unauthorized Patch Posted for Adobe Flaw
STUDIES AND STATISTICS
More Than Half of Former Employees Took Company Data

************************* Sponsored By Q1 Labs **************************

Leverage Log Management to Boost Your Enterprise IT Security: Collect
and manage event logs from your entire IT infrastructure; Effectively
reduce and prioritize millions of network and security events; Quickly
and easily search and report on events in real time and over an extended
period of time. A COMPLIMENTARY WHITE PAPER FOR SANS READERS:
http://www.sans.org/info/38964
*************************************************************************
TRAINING UPDATE
- - SANS 2009 in Orlando in early March - the largest security training
conference and expo in the world. lots of evening sessions:
http://www.sans.org/

- - Looking for training in your own Community? http://sans.org/community/
For a list of all upcoming events, on-line and live: www.sans.org
*************************************************************************

TOP OF THE NEWS
--US Consortium Releases Consensus Security Audit Guidelines
(February 23, 2009)
A consortium of security experts from government and industry has
released the Consensus Audit Guidelines (CAG), a list of 20 controls
that government and private industry organizations must implement to
protect against and mitigate the effects of cyber attacks. For each
control, the CAG details attacks that it stops or mitigates, how to
implement and automate the control, and how to determine whether the
control is implemented effectively. The CAG consortium includes the
organizations that know how actual attacks are being executed (NSA Red
and Blue teams,US-CERT, DC3, DoE Nuclear labs, and more.) The CAG is
available for public comment through March 23, 2009. The full guidelines
may be found at: http://www.sans.org/cag/
http://www.theregister.co.uk/2009/02/23/cybersecurity_gold_standard/ http://news.cnet.com/8301-1009_3-10169583-83.html?part=rss&subj=news&tag=2547-1009_3-0-20
http://fcw.com/Articles/2009/02/23/cyber-controls.aspx
http://federaltimes.com/index.php?S=3957648
http://www.informationweek.com/news/security/government/showArticle.jhtml?articleID=214502467&subSection=News
[Editor's Note (Northcutt): I hope you will take a few minutes out of
your busy day and take a look at these. You are going to see some
initials to the left of the controls. QW stands for Quick Win. The big
suggestion I have is to look over the quick wins and see if you can get
a few of those in place. Great job on these and I hope we start to see
thought leaders take advantage of this.]

--Nevada Bill Will Be Amended to Avoid Criminalizing RFID Research
(February 20, 2009)
A bill currently before the Nevada state legislature would effectively
criminalize the activity of people researching radio frequency
identification (RFID) security threats. The bill's sponsor plans to
introduce amendments to ensure it will not affect people conducting
legitimate research. Currently, the bill makes it a felony to "possess,
read or capture another person's personal identifying information
through radio frequency identification." Nevada hosts two well-known
conferences, Defcon and Black Hat, at which demonstrations of RFID
weaknesses are likely events.
http://www.theregister.co.uk/2009/02/20/nevada_rfid_skimming_bill/
http://news.cnet.com/8301-1009_3-10168749-83.html?part=rss&subj=news&tag=2547-1009_3-0-20
http://www.leg.state.nv.us/75th2009/Bills/SB/SB125.pdf

--Proposed Legislation Would Require Retention of Internet Use
Data for Two Years
(February 20, 2009)
US legislators have introduced a bill that would require extensive
logging of Internet use. The proposed legislation aims to help police
with investigations. All ISPs and wireless access point operators would
be required to retain logs of users' activity for a minimum of two
years. The law would apply not only to large ISPs, but also to private
homes that have wireless access points or wired routers that use the
Dynamic Host Configuration Protocol as well as small businesses,
libraries, schools and government agencies.
http://www.cnn.com/2009/TECH/02/20/internet.records.bill/index.html?eref=rss_tech
[Editor's Note (Northcutt): That is really nifty, an economic stimulus
package for disk drive manufacturers! Seriously, this is a dumb idea,
fraught with problems, how are we going to collect that volume of
information, then how do we protect it and what do we do when it is
misused.
(Ranum): Absurd. Basically, they are proposing to require extensive
logging of usage patterns for every single internet access point in the
US. It amounts to an enormous unfunded mandate to home users,
cybercafes, airport wireless terminals, hotels, etc. The malefactors
targeted by this law - presumably child porn traders and terrorists and
whatnot - would be able to easily hide their actions anyway.
(Ullrich): At the ISC, this issue has been the focus of our reader
comments this week. I would like to quote one of them, provided by Jerry
Rose: "This is like the difference between policies and procedures. The
law needs to be like policies. It must be worded to stand the test of
time - independent of changing technologies. Procedures must change
often in order to keep up with technological changes. This would be
represented by the method of prosecution of a defendant.]

--Another Payment Processor Security Breach
(February 23, 2009)
Advisories on the websites of several financial institutions suggest
that a cyber security breach has occurred at an as yet unnamed card
payment processor; this incident is separate from the Heartland Payment
Systems breach. The Tuscaloosa Federal Credit Union issued a statement
saying that "while it has been confirmed that malicious software was
placed on the processor's platform, there is no evidence that accounts
were viewed or taken by the hackers." The compromised data in this
breach include account numbers and expiration dates of payment cards
used in card-not-present transactions over the course of the last 12
months. Visa and MasterCard have started notifying banks affected by
the breach.
http://www.securityfocus.com/brief/913
http://www.databreaches.net/?p=1686
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128429&source=rss_topic17
http://www.alabamacu.com/moreServices/idTheft.html
http://www.tvacu.com/tvacu/News.asp?111

********************* SPONSORED LINKS *********************************
1) What are the ten technical tips most penetration tester don't know
but should. Penetration Testing and Ethical Hacking Summit June 1-2.
http://www.sans.org/info/38969

2) Read Stephen Northcutt's interview with John Pirc of IBM on the topic
of Securing the Intelligent Network.
http://www.sans.org/info/38974
*************************************************************************

THE REST OF THE WEEK'S NEWS
LEGAL ISSUES
--Starbucks Facing Lawsuit Over Laptop Theft
(February 23, 2009)
A Starbucks employee has filed a class action lawsuit against the
company in response to a data security breach that occurred on October
2008. A laptop containing the names, addresses and Social Security
numbers (SSNs) of approximately 97,000 Starbucks employees was stolen
last fall; the suit alleges fraud and negligence, and seeks an extension
of the one year of credit monitoring the company offered as well as
unspecified damages and assurances that Starbucks will be required to
undergo regular third party security audits.
http://www.networkworld.com/news/2009/022309-starbucks-sued-after-laptop-data.html

POLICY AND LEGISLATION
--Pending NZ Copyright Law Put On Hold
(February 20 & 23, 2009)
New Zealand Prime Minister John Key has delayed the effective date of
an impending copyright law by one month due to physical and digital
protests that the proposed legislation goes too far. The law would
require Internet service providers (ISPs) to sever the connections of
individuals suspected of repeat copyright infringement. Prime Minister
Key is hopeful that by March 27 a "voluntary code of practice' can be
worked out; if not, Section 92A, as the amendment to the Copyright Act
is known, will be suspended.
http://news.cnet.com/8301-1023_3-10169519-93.html
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128330&source=rss_topic17

VULNERABILITIES
--US-CERT Warns of Proxy Server Flaw
(February 23, 2009)
The US Computer Emergency Readiness Team (US-CERT) has issued a warning
about an architectural flaw in some proxy servers that could be
exploited by attackers to connect "to any website or resource the proxy
can connect to," including Intranets that should be off limits. Several
dozen products have been updated; administrators should ensure they have
installed the most recent versions to secure their networks.
http://www.kb.cert.org/vuls/id/435052
http://www.theregister.co.uk/2009/02/23/serious_proxy_server_flaw/

DATA BREACHES, LOSS & EXPOSURE
--Three Breaches at Univ. of Florida Gainesville in as Many Months
(February 22, 2009)
The University of Florida in Gainesville has reportedly experienced
three data security breaches in a three month period. The most recent
incident involved a server that allowed faculty to host online course
material and exposed personally identifiable information of 97,200
faculty, staff and students who were active at the university between
1996 and 2009. A breach in January of this year involved an LDAP
Directory Server configuration error and exposed personally identifiable
information of about 100 people. Finally, in November 2008, an
intrusion compromised personally identifiable information of more than
330,000 current and former College of Dentistry patients who had been
seen at the school since 1990.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=knowledge_center&articleId=9128398&taxonomyId=1&intsrc=kc_top

ATTACKS & ACTIVE EXPLOITS
--Targeted Attacks Exploit Unpatched Adobe Flaw
(February 19 & 20, 2009)
Targeted attacks exploiting an unpatched critical vulnerability in Adobe
Reader have been detected. The flaw is known to affect Adobe Reader
versions 8.1.3 and 9.0.0 running on Windows XP SP3; other versions of
Windows are likely to be vulnerable as well. Adobe reader running on
OS X and Linux machines was not tested. Adobe has issued an advisory
warning of a critical buffer overflow vulnerability in both Reader and
Acrobat. Adobe plans to have patches ready for version 9 of the
programs by March 11, with patches for versions 8 and 7 to follow
shortly thereafter.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128278&source=rss_topic17
http://www.theregister.co.uk/2009/02/20/adobe_reader_exploit/
http://gcn.com/Articles/2009/02/20/PDF-zero-day-exploit.aspx
http://news.cnet.com/8301-1009_3-10168266-83.html?part=rss&subj=news&tag=2547-1009_3-0-20
http://www.adobe.com/support/security/advisories/apsa09-01.html
http://www.us-cert.gov/cas/techalerts/TA09-051A.html

--Unauthorized Patch Posted for Adobe Flaw
(February 23, 2009)
A vulnerability researcher has posted an unauthorized patch for a
critical buffer overflow flaw in Adobe Reader that is being actively
exploited. Adobe acknowledged the vulnerability last week and said it
would have a fix prepared by March 11. The homemade patch, a
replacement .dll, addresses only the Windows version of Adobe 9.0 and
offers no guarantees. The flaw affects versions 7, 8 and 9 of both
Adobe Reader and Adobe Acrobat. Users can also protect themselves from
attacks by disabling JavaScript.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9128428&source=NLT_PM
[Editor's Note (Ullrich): Aside from the patch, a number of sources
posted scripts to disable javascript processing in PDFs. These scripts
may be a safer method to mitigate this exploit and some can be
implemented via group policy.
(Northcutt): This could be a very good time to try Firefox and NoScript:
http://noscript.net/ ]

STUDIES AND STATISTICS
--More Than Half of Former Employees Took Company Data
(February 23, 2009)
The Ponemon Institute interviewed 945 US adults who had been laid-off,
fired, or changed jobs within the last year and found that more than
half took company information with them when they left their former
positions. The rationales for taking the data included help getting
another job, help starting their own business, or simple revenge. All
of the participants in the survey had access to proprietary information,
including customer data, employee information, financial reports,
software tools and confidential business documents. The survey also
found that just 15 percent of the companies examined the paper and/or
electronic documents their former employees took with them when they
left.
http://news.bbc.co.uk/2/hi/technology/7902989.stm
http://www.theregister.co.uk/2009/02/23/insider_threat_survey/
http://news.cnet.com/8301-1009_3-10170006-83.html?part=rss&subj=news&tag=2547-1009_3-0-20
[Editor's Note (Schultz): What the Ponemon Institute's study did not
show is just how bad ex-employee activity can get after a company folds.
I have heard numerous accounts about computer crimes (including brazen
thefts of servers) by ex-employees that ostensibly occurred after High
Tower Software collapsed. Sadly, despite all the reported illegal
activity, no complaints have been filed with law enforcement, nor has
anyone been charged with any crime. ]

**********************************************************************
The Editorial Board of SANS NewsBites

Eugene Schultz, Ph.D., CISM, CISSP is CTO of Emagined Security and the
author/co-author of books on Unix security, Internet security, Windows
NT/2000 security, incident response, and intrusion detection and
prevention. He was also the co-founder and original project manager of
the Department of Energy's Computer Incident Advisory Capability (CIAC)

John Pescatore is Vice President at Gartner Inc.; he has worked in
computer and network security since 1978.

Ron Dick headed the National Infrastructure Protection Center (NIPC) at
the FBI and is the incoming President of the InfraGard National Members
Alliance - with 22,000 members.

Stephen Northcutt founded the GIAC certification and currently serves
as President of the SANS Technology Institute, a post graduate level IT
Security College, www.sans.edu.

Johannes Ullrich is Chief Technology Officer of the Internet Storm
Center.

Ed Skoudis is co-founder of Inguardians, a security research and
consulting firm, and author and lead instructor of the SANS Hacker
Exploits and Incident Handling course.

Rohit Dhamankar is the Director of Security Research at TippingPoint,
where he leads the Digital Vaccine and ThreatLinQ groups. His group
develops protection filters to address vulnerabilities, viruses, worms,
Trojans, P2P, spyware, and other applications for use in TippingPoint's
Intrusion Prevention Systems.

Prof. Howard A. Schmidt is the President of the Information Security
Forum (ISF) and author who has served as CSO for Microsoft and eBay and
as Vice-Chair of the President's Critical Infrastructure Protection
Board.

Tom Liston is a Senior Security Consultant and Malware Analyst for
Inguardians, a handler for the SANS Institute's Internet Storm Center,
and co-author of the book Counter Hack Reloaded.

Dr. Eric Cole is an instructor, author and fellow with The SANS
Institute. He has written five books, including Insider Threat and he
is a senior Lockheed Martin Fellow.

Mason Brown is one of a very small number of people in the information
security field who have held a top management position in a Fortune 50
company (Alcoa). He is leading SANS' global initiative to improve
application security.

Marcus J. Ranum built the first firewall for the White House and is
widely recognized as a security products designer and industry
innovator.

Mark Weatherford, CISSP, CISM, is Executive Officer of the California
Office of Information Security and Privacy Protection.

Alan Paller is director of research at the SANS Institute

Clint Kreitner is the founding President and CEO of The Center for
Internet Security.

Brian Honan is an independent security consultant based in Dublin,
Ireland.

David Hoelzer is the director of research & principal examiner for
Enclave Forensics and a senior fellow with the SANS Technology
Institute.

Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, (and for
free posters) or to update a current subscription, visit
http://portal.sans.org/

SANSFIRE 2009 in Baltimore, MD

SANS will be in Baltimore, MD for SANSFIRE 2009 on June 13-22 - once
again powered by the Internet Storm Center! We are assembling a program
that will surpass all past SANSFIRE events in terms of courses, talks,
vendor demonstrations, and opportunities for career advancement. At
SANSFIRE 2009 you will be provided with new information about new
threats, and you can acquire the solid foundation in InfoSec that you
need to stay on top of them. Why not choose SANSFIRE 2009 and Baltimore
as the backdrop for your training this summer?
(http://www.sans.org/info/38869)

The course schedule for SANSFIRE 2009 features a full lineup of SANS
classics in the disciplines of audit, security, management, and legal.

"SANS offers the real-world experience that other training venues
can't." - Tom Boyd, Medco

Turbo-charge your career! Consider one of these BRAND NEW cutting-edge
courses:
- IT Security Audit Essentials Bootcamp (AUD429)
- ITIL Essentials for Security Management (MGT435)
- Log Management In-Depth: Compliance, Security, Forensics, and Troubleshooting (SEC434)
- Secure Code Review for Java Web Apps (DEV534)
- Secure Coding in .NET: Developing Defensible Applications (DEV544)
- Developing Exploits for Penetration Testers and Security Researchers (SEC709)

Three NEW Forensics Courses!

- Computer Forensic and E-discovery Essentials (SEC408)
- Network Forensics (SEC558)
- Drive and Data Recovery Forensics (SEC606)

Register early for these best selling courses below to ensure you'll get
a seat!

- Security 401: SANS Security Essentials Bootcamp Style
- Security 504: Hacker Techniques, Exploits & Incident Handling
- Security 560: Network Penetration Testing and Ethical Hacking
- Security 508: Computer Forensics, Investigation, and Response
- Management 512: SANS Security Leadership Essentials for Managers with Knowledge Compression(tm)
- Management 414: SANS(r) +S(tm) Training Program for the CISSP(r) Certification Exam
- Audit 507: Auditing Networks, Perimeters & Systems
- Security 503: Intrusion Detection In-Depth
- Security 610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
- Security 301: Intro to Information Security
- Security 501: Advanced Security Essentials - Enterprise Defender - NEW
- Management 525: Project Management and Effective Communications for Security Professionals and Managers

To learn more about all the courses being offered at SANSFIRE 2009,
please visit http://www.sans.org/info/38874
. There you will find a large
selection of classic and new courses.

Complete your SANS training experience with a GIAC certification
attempt! Many of our five- and six-day courses offered at SANSFIRE 2009
are associated with a GIAC Certification. Put the skills you'll learn
to practical use and join the thousands of GIAC certified professionals
who make the info sec industry safe! Visit
http://www.giac.org/info/38659 for more information and register for
your certification attempt today!

SANS training is well-known for being relevant and pragmatic. All SANS
instructors are industry leaders and experts who understand the
challenges you face on a daily basis. Their real-world experience
increases the practical value of the course material. Here are some
comments from SANSFIRE 2008 alumni:

"SANS is great about giving me both the knowledge and hands-on
experience needed to truly expand my security abilities and bring that
back to my job." - Brad Moore, A. Teichert & Son, Inc.

In addition to SANS courses held during the day, we offer you evening
events where you can learn about the new Web application honeynet. Come
and discover how to secure your service-oriented architectures and how
to deal with new forms of malware. At the evening talks the Internet
Storm Center incident handlers will provide extraordinary insights into
actual attacks that have taken place over the past year. These special
presentations are free to all registered attendees. You'll learn about
current threats and how the SANS Internet Storm Center can help you in
your fight against these threats. Nothing fosters information sharing
and trust building better than face-to-face meetings like SANSFIRE 2009.
Most of our volunteer incident handlers will be present at this event,
giving you unprecedented opportunities to get to know these fantastic
people.

"This was very good. There is a reason I come to SANS -- to really
learn something. Especially now that you guys do things for the
non-technical." - Pat Reddic, DTRA, another SANSFIRE 2008 alumnus

Classes will be held at the Hilton Baltimore. This full-service, upscale
hotel places you within walking distance of Baltimore's Inner Harbor,
Harborplace and the Gallery, Oriole Park at Camden Yards, and the
National Aquarium in Baltimore. Discounted rates are available for SANS
students, and they include complimentary high-speed Internet in your
guest room. The SANS rate of $197 S/D is available through June 13, so
take advantage of this special offer and make your reservations today!
http://www.sans.org/info/38879

"Getting hands-on experience with the latest tools and having fun
learning gives SANS an edge no other training organization has yet
mastered." - Jason Fowler, UBC

Get the training you need to work better and faster as a security
professional. Start making your training and travel plans now to join
us for SANSFIRE 2009! (http://www.sans.org/info/38869)

Kind regards,
Stephen Northcutt
President
The SANS Technology Institute, a postgraduate computer security college

**************************

SANS is pleased to announce our new Training and Events Calendar - an
easy way to see what opportunities are available to you during the
coming month! The current calendars are now available for download from
http://www.sans.org/info/7926. For another option, consider SANS' seven
ways to Train Without Travel at: http://www.sans.org/info/28689.

SANS' Webcasts are free live Web broadcasts that allow you to hear a
knowledgeable speaker while viewing presentation slides that you
download in advance. To learn more or to subscribe to our Webcast
calendar go to http://www.sans.org/info/13271.

Monday, January 5, 2009

SANS Institute Security Newsletter for Computer Users

SANS Institute Security Newsletter for Computer Users
Volume 6, Number 1 January 2009
************************************************************************
In This Issue
1. Consumer Awareness: Spyware Q&A - 2. Ten Do-It-Yourself Computer
Security Tips - 3. Scams and Hoaxes - 4. Microsoft and Apple Security
Updates
************************************************************************
A formatted version of the OUCH newsletter can be found at
https://www.sans.org/newsletters/ouch. You can subscribe to OUCH on
the same site. Send your comments to OUCH@sans.org.
************************************************************************
1. Consumer Awareness: Spyware Q & A
Q: What is spyware?
A: Spyware is malicious software installed on your computer without
your knowledge or consent that monitors or controls your computer
use. It may be used to send you pop-up ads, redirect your computer to
websites, monitor your Internet surfing, or record your keystrokes,
which could lead to the theft of your personal information.

Q: How can I tell if my computer is infected with spyware?
A: Your computer may be infected with spyware if:
- - It slows down, malfunctions, or displays repeated error messages
- - It won't shut down or restart
- - It serves up a lot of pop-up ads, or displays them when you're not
surfing the web
- - It displays web pages or programs you didn't intend to use, or
sends emails you didn't write.
Other signs include:
- - Your browser takes you to sites other than those you type into the address box
- - Your home page changes suddenly or repeatedly
- - New and unexpected toolbars
- - New and unexpected icons in the system tray (at the lower right
corner of your screen)
- - Keys don't work (for example, the "Tab" key that might not work
when you try to move to the next field in a webform)
- - Random error messages

Q: What should I do if I think my computer is infected?
A: Stop shopping, banking, and other online activities that involve
usernames, passwords, or other sensitive information. Spyware could
be sending your personal information to identity thieves. Write down
the model and serial number of your computer, the name of any software
you've installed, and a short description of the problem. Your notes
will help you give an accurate description to the technician. At the
office, report the problem to your IT help desk, network administrator,
or information security officer. At home, if your computer is covered
by a warranty that offers technical support, contact the manufacturer,
your Internet Service Provider (Comcast, AT&T, Time Warner, Verizon,
Qwest, Earthlink, etc.), or a trusted computer consultant.

More information: http://www.onguardonline.gov/topics/computer-security.aspx

************************************************************************
2. Ten Do-It-Yourself Computer Security Tips

a. Treat your computer like a machine. Computers need regular
maintenance. If you ignore problems or put off fixing them, you risk
more than the smooth functioning of your system. You may be inviting
Bad Guys to steal your information or take over your system and use
it to attack other computers.
More information: http://www.microsoft.com/atwork/getstarted/maintain.mspx
http://helpdesk.coloradocollege.edu/index.php/tips-and-how-to/maintain-your-computer/maintain-your-macintosh-computer/

b. Use email wisely. Email is not private. Never send personal or
sensitive information by email. Never view, open, or even click on
email attachments unless you know who sent it, why they sent it,
and what's in it. Even messages forwarded to you by friends might
contain infected attachments and links that will shuttle you off to
dangerous websites.

c. Don't assume your security software is working. Familiarize yourself
with the security software installed on your computers. Do you have
a complete suite of anti-virus, anti-spyware, and a two-way software
firewall? Identify onscreen icons and messages that indicate your
security software is enabled and working. If an icon is not there, if
its color or shape has changed, or if you see a message that says your
security software isn't working, is out of date, or needs attention,
take action to correct the problem immediately.

d. Keep your software up-to-date. Many software products, including
Windows and Mac OS X, have built-in automatic updaters. Make sure these
are turned on. Some software products require manual updating. Know
which are which on your computer. Not sure? Visit the website of the
software manufacturer for tips on updating your software. Consider
installing Secunia's free Personal Software Inspector, which provides
extensive details on the software installed on your computer, and gives
you direct links to update programs that are older and potentially
not secure
More information: http://www.microsoft.com/protect/videos/Updates/UpdatesHi.html
http://support.apple.com/kb/HT1338
http://www.download.com/Secunia-Personal-Software-Inspector/3000-2162_4-10717855.html

e. Regard the Internet as a bad neighborhood at 2:00 AM. In 2008 about
1.5 billion people were using the Internet worldwide, and the number of
websites approached 200,000,000. With that many apples in the barrel,
it's anybody's guess how many are rotten. The steady growth of Web
commerce attracts not only ordinary scammers, pirates, and thieves, but
also national and multi-national organized crime syndicates. Criminal
activity for financial gain is the single largest driver of massive
increases in Internet threats, and bringing Internet criminals to
justice remains a challenging task. Practice online safety. Protect
your privacy, your identity, and your money.
More information: http://www.microsoft.com/protect/videos/Phishing/PhishingMSHi.html &http://www.microsoft.com/protect/videos/Privacy/privacy-hi.html

f. Ratchet up your browser's security. Malicious hackers and
virus writers can infect your computer by taking advantage of low
security settings in your browser software and enticing you to
visit a malicious website. You can help limit your chances of being
attacked by increasing your security settings and conducting business
or entering sensitive information only on secure websites. Look for
addresses that begin with https:// and check for the yellow security
lock icon at the bottom of your browser window.
More information: http://www.microsoft.com/protect/computer/advanced/browsing.mspx
http://news.cnet.com/8301-13880_3-9896427-68.html
http://www.microsoft.com/protect/yourself/phishing/spoof.mspx

g. Back up your data. Here is a simple, basic backup plan. Plug a
good-sized, formatted, blank thumb drive (or "USB stick") into your
computer. Double click on it and open a directory. As you work on your
latest project and it comes time to take a break, save your work,
close those crucial files, and drag copy them into the directory of
the thumb drive. The more important your project is and the closer you
get to the deadline, the more often you should pause to make a copy
of your crucial files. The more often you backup, the less you stand
you lose. After you've made a backup by whatever means, check to make
sure that the copies are complete and that they work. At the office,
check with IT about using a thumb drive. Some organizations do not
allow them.

h. Protect sensitive information, especially when you use a public
computer. It's best to avoid typing your credit card number, or
other financial or sensitive information into any public computer, but
sometimes you can't avoid it. Don't save your logon information. Don't
leave a public computer unattended with sensitive information on the
screen. Web browsers keep a record of your passwords and every page
you visit, even after you've closed them and logged out. Learn how
to erase your tracks. Watch for over-the-shoulder snoops.
More information: http://www.microsoft.com/protect/yourself/mobile/publicpc.mspx
http://support.mozilla.com/en-US/kb/Clearing+Private+Data
http://www.usyd.edu.au/ict/switch/troubleshooting/cache.shtml#safari

i. Be careful with wireless networks. Secure your own wireless network
by enabling and using wireless encryption that scrambles the data
transmitted between your PC and your wireless router. Check your
WAP (wireless access point) to find out what kinds of encryption it
can provide. Out of the box, the encryption on most WAP's will be
shut off. The most effective encryption is WPA2 (Wireless Protected
Access version 2). Use a strong password for your WPA2 encryption
key. Before you connect to someone else's wireless network, make
sure it's a legitimate hotspot: Nefarious types have been known to
set up pirate WAP's with familiar names like "wayport" or "t-mobile,"
and then use them to capture passwords and other private data. Verify
that your two-way software firewall is turned on, and that filesharing
is off. Always turn your Wi-Fi networking off when you're not at
a hotspot.
More information: http://www.pcworld.com/article/130330/how_to_secure_your_wireless_network.html
http://arstechnica.com/guides/tweaks/wireless-security.ars

j. Know your limits, and when you reach them, get expert advice.
Not sure what the error message means? Don't know why you got that
pop-up? Puzzled because a familiar website has asked you for a password
or other sensitive information unexpectedly? Not sure whether or
not you should allow that program to access the Internet? Ask before
you do the wrong thing. Contact your network administrator, IT Help
Desk, your computer manufacturer's technical support department,
your Internet Service Provider (ISP), or a trusted computer consultant.

************************************************************************
3. Scams and Hoaxes
- - Nigerian "419" Scam Meets the FBI
Consumers continue to be inundated by emails purportedly from
the FBI. Many of the emails currently in circulation claim to be
an "official order" from the FBI's Anti-Terrorist and Monetary
Crimes Division, from an alleged FBI unit in Nigeria, confirming
an inheritance, or containing a lottery notification millions of
dollars. Recipients are instructed to furnish personally identifiable
information (PII) and are often threatened with some type of penalty,
such as prosecution, if they fail to do so. But these emails are scams,
are not from the FBI, nor does the FBI ever send unsolicited emails
of this nature.
More information: http://www.fbi.gov/cyberinvest/escams.htm

- - Airline Ticket Scam
This email scam targets holiday travelers. Recipients get a .zip file
attached to a message about an airline ticket and an ominous mention
of a credit card balance. It appears to come from legitimate major
airlines including Delta, JetBlue, Continental, American Airlines and
Virgin America. This .zip attachment appears to contain a purchase
invoice and flight ticket. But if you open the attachment, malicious
code may be installed on your system.
More information: http://blogs.zdnet.com/security/?p=2299

- - IRS Phishing Scam Targets US Immigrants
The Internal Revenue Service is warning taxpayers not to respond to
a mass email phishing scam, which appears to target immigrants. The
emails, purporting to come from "noreply@irs.gov," include attached
fake forms that ask unwitting taxpayers to fax in personal bank
account numbers. The e-mail may have a cover letter from a person
identifying herself as IRS public relations employee Laura Stevens,
who instructs recipients to fill out the attached W-4100B2 form. The
attached form W-4100B2 does not exist but is similar to the IRS'
W8-BEN form. The form requests such information as the person's birth
date, Social Security number, mailing address, bank account number
and signature. The IRS never contacts taxpayers by email.
More information: http://www.zimbio.com/Exposing+Scams/articles/1020/IRS+Warns+Phishing+Scam+Targeting+Immigrants

************************************************************************
4. Microsoft and Apple Security Updates
Microsoft and Apple provide free security updates for their software
products. Windows: Microsoft issues patches for all Microsoft
products on the second Tuesday of each month as well as out-of-cycle
patches on any day of the month. The next scheduled release date
is January 13th. Check manually too, once every two weeks, to make
sure all of the updates have been installed. More information:
http://www.microsoft.com/athome/security/default.mspx OS X: Updates
are issued frequently, and their contents may differ depending on
which processor is in your Mac (PPC or Intel).
More information: http://www.apple.com/support/downloads/
iPhones: Must be updated manually: http://docs.info.apple.com/article.html?artnum=305744

************************************************************************
Copyright 2009, SANS Institute (http://www.sans.org)
Editorial Board: Bill Wyman, John York, Barbara Rietveld, Alan Reichert, Alan Paller.
Permission is hereby granted for any person to redistribute this in
whole or in part to any other persons as long as the distribution
is not being made as part of any commercial service or as part
of a promotion or marketing effort for any commercial service or
product. We request that redistributions include attribution for the
source of the material. Readers are invited to subscribe for free
at https://www.sans.org/newsletters/ouch.

Friday, December 12, 2008

SANS OnDemand Security Times Newsletter

SECURITY TIMES SPECIAL

As a thank you for receiving our SANS OnDemand Security Times
Newsletter, you may take an additional 5% off our listed current
specials through December 26.

For single courses, see http://www.sans.org/info/35939 for our current
offer. Use discount code "T1_add5" for a total of 30% off any OnDemand
course.

For groups or multiple courses, take an additional 5% off our lowest
listed pricing at http://www.sans.org/info/35944.

Check out our Free OnDemand Demos at http://www.sans.org/info/35949
************************************************************************
WHAT'S UPCOMING?

For courses currently being developed in OnDemand, take advantage of our
30% Development Discount. For a full list of upcoming courses, go to
http://www.sans.org/info/35954
************************************************************************
EARN REWARDS POINTS

Receive one OnDemand Reward Point for every dollar that you spend for
SANS OnDemand training, including the OnDemand Bundle. To begin
receiving reward points, visit http://www.sans.org/info/35959
************************************************************************
SECURITY TIP

Whether you are a small Mom & Pop shop or a multinational corporation,
your employees are almost certainly leveraging sites with user generated
content. User generated content sites (e.g. Myspace, Youtube, Facebook,
Craigslist, Blogger, and Flickr) are routinely in the top 20 most
visited websites.

From a numbers perspective, it goes without saying that your
employees/colleagues/superiors, and likely you, are users of these
popular sites. Although the most obvious risk posed by employee usage
of these sites is productivity loss [1], perhaps the more serious risk
is posed by the break-neck speed with which these sites are allowing
active user generated content and applications to flourish [2][3].
Therein lies part of the appeal, but so too, some of the risks. In order
for these sites to be useful, users configure their browsers to allow
this content to run virtually unfettered. However, the risk posed by
active content isn't the point of this article either [4]...

A somewhat less discussed "feature" of sites containing user generated
content is the significant information disclosure posed by users from
your organization. Imagine, if you will, that you were being targeted
by an attacker. Of course, _you_ aren't being targeted, but just bear
with me... Perhaps you have really done a bang up job hardening your
perimeter, patching systems, etc., such that you feel relatively secure
in your overall security program and architecture. If an attacker could
find a trusted insider that was willing to disclose details regarding
the products, programming languages, patch levels, etc., in use at your
organization, could it subvert some of those feelings of security? In
effect, social networking sites are a veritable treasure trove for
attackers wishing to gain this type of intelligence. What's more,
sometimes they are able to gain this information without engaging in
even the most rudimentary of social engineering attacks. For instance,
users with profiles on LinkedIn frequently list their resume, including
both specialties and employers, for the world to see. This and other
information is like gold to an attacker. This type of information,
coupled with attackers armed with information mining tools like Maltego
(i.e., Rapleaf and Spock transforms) can really lower the bar for a
successful targeted attack [5].

Now that the little thought experiment is over, let's think about the
primary assumption - you are being targeted by an attacker. Some of you
fully accept this as a given, but most of you likely dismiss this
without much thought (we are too small, no one has heard of us, why
would anyone come after us). Well, consider that restaurants in West
Monroe, LA (pop. 12,951)[6] were part of a group of restaurants in
Mississippi and Louisiana targeted by a ring of thieves harvesting
credit card numbers [7]. If something as innocuous as a family owned
diner can be targeted for an attack, then certainly any organization can
become a likely target.

The risks associated with websites, in general, and social networking
sites, in particular, are discussed in several SANS courses available
via OnDemand (AUD507, MGT512, SEC401 and SEC502). The social
engineering and reconnaissance exposure made possible by these sites is
explored in SEC560.

For more info on these courses, visit:
AUD507: Auditing Networks, Perimeters & Systems
(http://www.sans.org/link.php?id=1032&mid=6)
MGT512: SANS Security Leadership Essentials For Managers
(http://www.sans.org/link.php?id=1032&mid=62)
SEC401: SANS Security Essentials
(http://www.sans.org/link.php?id=1032&mid=61)
SEC502: Perimeter Protection In-Depth
(http://www.sans.org/link.php?id=1032&mid=17)
SEC560: Network Penetration Testing and Ethical Hacking
(http://www.sans.org/link.php?id=1032&mid=937)

Seth Misenar
SANS OnDemand Virtual Mentor

1: "Facebook 'costs businesses dear' " -
http://news.bbc.co.uk/2/hi/technology/6989100.stm
2: More than 33,000 Facebook applications -
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/07/23/BU7C11TAES.DTL
3: More than 400,000 registered Facebook developers -
http://www.facebook.com/press/releases.php?p=48242
4: "Elaborate Facebook Worm Spreading" -
http://www.techcrunch.com/2008/08/07/elaborate--facebook-worm-virus-spreading/
5: "Maltego Part I - Intro and Personal Recon" -
http://www.ethicalhacker.net/content/view/202/24/
6: U.S. Census Bureau, 2007 Population Estimates -
http://factfinder.census.gov
7: "Attacks Continue on Retail Stores, Restaurants" -
http://www.darkreading.com/security/perimeter/showArticle.jhtml?articleID=211201193

Tuesday, December 2, 2008

US Department of Defense's decision to ban the use of USB drives and other removable data storage devices

Classified US Systems Breached: Attacks on US War Zone Computers Prompts Security Crackdown

The Los Angeles Times is reporting that the US Department of Defense's decision to ban the use of USB drives and other removable data storage devices was prompted by a significant attack on combat zone computers and the US Central Command that oversees Iraq and Afghanistan. The attack is believed to have originated in Russia. While no specific details about the attack were provided, it is known that at least one highly protected classified network was affected.

http://www.latimes.com/news/nationworld/nation/la-na-cyberattack28-2008nov28,0,6441140.story

Saturday, November 29, 2008

SANS OnDemand training free GIAC Certification attempt

Sign up for SANS OnDemand training before December 8, 2008, and you'll
receive the corresponding GIAC Certification attempt for free (a $499
value)! To register for this offer, go to
http://www.sans.org/info/35724 and use the discount code ODEY_GIAC.

Also for this limited time, receive free GIAC Certification attempts
with any OnDemand Flex Pass! Go to http://www.sans.org/info/35924 for
information on our OnDemand Flex Passes.

Sometimes the realities of limited travel budgets, or the difficulty of
being out of the office or home for a week, make it impossible to attend
a live training event. With SANS OnDemand online training and assessment
program, you have access to SANS' high quality, intensive, immersion
training at your convenience - anytime, anywhere. And according to
student feedback, OnDemand is simply one of the best tools to prepare
for GIAC exams.

"I have several GIAC certs. My highest exam scores are from when I use
OnDemand training." - Brad Fulton, SMS Data Products

Not sure online training is for you? Try any of our OnDemand course
demos at http://www.sans.org/info/35724
.

With SANS OnDemand, students receive:
- Up to 4-months access to our 24/7 online training and assessment system
- Full set of course books and hands-on CDs
- Synchronized online courseware and lectures
- Integrated assessment quizzes throughout the course
- Access to OnDemand Virtual Mentors
- Labs & hands-on exercises
- Progress Reports

If you have any questions about SANS OnDemand, write to
ondemand@sans.org or call us at (301)654-7267.

And remember that every SANS OnDemand purchase earns you points towards
future OnDemand training! http://www.sans.org/info/35729

Be sure to tell your friends and colleagues about this great
opportunity!

Kind Regards,

Kimie Cabreira
Director
SANS OnDemand

**************************

SANS is pleased to announce our new Training and Events Calendar - an
easy way to see what opportunities are available to you during the
coming month! The current calendars are now available for download from
http://www.sans.org/info/7926. For another option, consider SANS' seven
ways to Train Without Travel at: http://www.sans.org/info/28689.

SANS' Webcasts are free live Web broadcasts that allow you to hear a
knowledgeable speaker while viewing presentation slides that you
download in advance. To learn more or to subscribe to our Webcast
calendar go to http://www.sans.org/info/13271.

To change your subscription, address, or other information, visit
http://portal.sans.org. If you wish to have your name removed from our
mailing list, visit the site above, click on "update your account" and
check the box "Do not send any e-mail."

*******************************