Interessante: http://www.stopbadware.org/
StopBadware.org is a "Neighborhood Watch" campaign aimed at fighting badware.
There are several commonly recognized terms for specific kinds of badware - spyware, malware, and deceptive adware. Badware is malicious software that tracks your moves online and feeds that information back to shady marketing groups so that they can ambush you with targeted ads. If your every move online is checked by a pop-up ad, it's highly likely that you, like 59 million Americans, have spyware or other malicious badware on your computer.
Relatório: Trends in Badware 2007, What internet users need to know is StopBadware's 2007 update on the state of badware on the web.
Storm Worm
Um site com informação actualizada sobre o Storm Worm, o "estado da arte" em malware:
Storm Tracker
http://www.trustedsource.org/TS?do=threats&subdo=storm_tracker
O texto introdutório é particularmente interessante.
Storm Tracker
http://www.trustedsource.org/TS?do=threats&subdo=storm_tracker
O texto introdutório é particularmente interessante.
Centrais eléctricas vulneráveis a ataques pela Internet
Um relatório recente reporta que as centrais eléctricas da maior produtora de electricidade pública dos EUA, a Tennessee Valley Authority (TVA), estão vulneráveis a ataques feitos através da Internet. O problema é aquele de que falei já várias vezes e que estamos a estudar no projecto CRUTIAL: a rede de controle está ligada à rede corporate que está ligada à Internet.
Fonte: SANS NewsBites
http://www.sans.org/newsletters/newsbites/newsbites.php?vol=10&issue=41&rss=Y#sID200
Fonte: SANS NewsBites
http://www.sans.org/newsletters/newsbites/newsbites.php?vol=10&issue=41&rss=Y#sID200
geração automática de exploits a partir de patches
É do conhecimento geral que os patches publicados por empresas como a Microsoft são usados pelos hackers para gerar exploits. Também é do conhecimento geral que o tempo entre publicação de patch e aparecimento de exploit tem vindo a descrescer. O que é novo é uma técnica para gerar exploits automaticamente a partir de patches:
Patches pose significant risk, researchers say
http://www.securityfocus.com/news/11514
A notícia discute um artigo publicado este mês por investigadores de Carnegie Mellon e mais duas universidades. Passe a propaganda, mas formação Carnegie Mellon em segurança está disponível na FCUL em Lisboa, através dos Mestrado em Segurança Informática e Doutoramento em Informática.
O artigo:
Automatic Patch-Based Exploit Generation
David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng
Abstract
The automatic patch-based exploit generation problem is: given a program P and a patched version of the program P', automatically generate an exploit for the potentially unknown vulnerability present in P but fixed in P'. In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update.
Patches pose significant risk, researchers say
http://www.securityfocus.com/news/11514
A notícia discute um artigo publicado este mês por investigadores de Carnegie Mellon e mais duas universidades. Passe a propaganda, mas formação Carnegie Mellon em segurança está disponível na FCUL em Lisboa, através dos Mestrado em Segurança Informática e Doutoramento em Informática.
O artigo:
Automatic Patch-Based Exploit Generation
David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng
Abstract
The automatic patch-based exploit generation problem is: given a program P and a patched version of the program P', automatically generate an exploit for the potentially unknown vulnerability present in P but fixed in P'. In this paper, we propose techniques for automatic patch-based exploit generation, and show that our techniques can automatically generate exploits for vulnerable programs based upon patches provided via Windows Update.
In many cases we are able to automatically generate exploits within minutes or less. Although our techniques may not work in all cases, a fundamental tenet of security is to conservatively estimate the capabilities of attackers. Thus, our results indicate that automatic patch-based exploit generation should be considered practical. One important security implication of our results is that current patch distribution schemes which stagger patch distribution over long time periods, such as Windows Update, may allow attackers who receive the patch first to compromise the significant fraction of vulnerable hosts who have not yet received the patch. Thus, we conclude update schemes, such as Windows Update as currently implemented, can detract from overall security, and should be redesigned.
What does this mean?
Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it. Thus, Microsoft should redesign Windows Update. We propose solutions which prevent several possible schemes, some of which could be done with existing technology.
Privacidade e documentos Word
Não é novo mas vale a pena ver. Embora o artigo diga respeito ao MS-Word, outros editores de texto ou de outros tipos de dados podem ser afectados:
Strike that out, Sam
http://lcamtuf.coredump.cx/strikeout/
do autor do livro Silence on the Wire, que não sendo académico é uma leitura leve e interessante.
Strike that out, Sam
http://lcamtuf.coredump.cx/strikeout/
do autor do livro Silence on the Wire, que não sendo académico é uma leitura leve e interessante.
Novos tipos de ataques?
Ataques contra firmware ou contra a BIOS...
"Most computer security coverage focuses on the PC realm, but Rich Smith, head of HP's Systems Security Lab, has identified a potential security flaw within a network's physical hardware rather than a typical desktop or server system. Smith's report focuses on a class of devices he refers to as Network Enabled Embedded Devices (NEEDS for short), and how such systems could be attacked at the firmware level through a process he refers to as "phlashing." Attacking system firmware isn't a new tactic—the CIH/Chernobyl virus was capable of overwriting BIOS firmware back in 1998—but focusing such attacks on network hardware would be an unusual step, and could prove quite successful in at least the short term."
Artigo completo: http://arstechnica.com/news.ars/post/20080520-phlashing-attacks-could-render-network-hardware-useless.html
Fonte: Ars Technica
"Most computer security coverage focuses on the PC realm, but Rich Smith, head of HP's Systems Security Lab, has identified a potential security flaw within a network's physical hardware rather than a typical desktop or server system. Smith's report focuses on a class of devices he refers to as Network Enabled Embedded Devices (NEEDS for short), and how such systems could be attacked at the firmware level through a process he refers to as "phlashing." Attacking system firmware isn't a new tactic—the CIH/Chernobyl virus was capable of overwriting BIOS firmware back in 1998—but focusing such attacks on network hardware would be an unusual step, and could prove quite successful in at least the short term."
Artigo completo: http://arstechnica.com/news.ars/post/20080520-phlashing-attacks-could-render-network-hardware-useless.html
Fonte: Ars Technica
Fraudes na internet
A Direcção Geral do Consumidor editou "O Livro Negro dos Esquemas e Fraudes na NET". Tem uma série de "esquemas" bem conhecidos mas que convém divulgar.
Ataque à TPM
A TPM é um chip com diversas funções criptográficas que está a ser comercializado com inúmeros PCs actuais. O interesse é inegável mas é também sabido que não está imune a ataques físicos. O primeiro de que tenho conhecimento é este:
TPM Reset Attack
http://www.cs.dartmouth.edu/~pkilab/sparks/
No YouTube:
TPM Reset Attack
http://www.cs.dartmouth.edu/~pkilab/sparks/
No YouTube:
Subscribe to:
Posts (Atom)