Cybersecurity

More on ‘Researchers Hijack Storm Worm to Track Profits’

Always good for information on the spam economy, Brian Krebs of the Washington Post has just published a truly fascinating article: Researchers Hijack Storm Worm to Track Profits. Bottom line: a one-in-twelve-million conversion rate of spam to sales seems to be enough to keep the spam economy going. The article covers a project by researchers at UC San Diego and UC Berkeley, who managed to infiltrate the Storm Worm bot network and take over a small portion of it. more

The Advanced Persistent Threats (APT) Deception

Most of the good thrillers I tend to watch have spies and assassins in them for some diabolical reason. In those movies you'll often find their target, the Archduke of Villainess, holed up in some remote local and the spy has to fake an identity in order to penetrate the layers of defense. Almost without exception the spy enters the country using a fake passport; relying upon a passport from any country other than their own... So, with that bit of non-fiction in mind, why do so many people automatically assume that cyber-attacks sourced from IP addresses within China are targeted, state-sponsored, attacks? more

On the Success of Malware

There's often a lot of discussion about whether a piece of malware is advanced or not. To a large extent these discussions can be categorized as academic nitpicking because, at the end of the day, the malware's sophistication only needs to be at the level for which it is required to perform -- no more, no less. Perhaps the "advanced" malware label should more precisely be reattributed as "feature rich" instead. more

Internet Society Activities at EuroDIG 2016: Trust, Collaborative Security, Zero Rating and More…

Over the next two days (9-10 June), the European Dialogue on Internet Governance (EuroDIG) takes place in Brussels, Belgium. With a theme of "Embracing the digital (r)evolution", EuroDIG has a full agenda and Internet Society staff will be participating in many aspects of the programme. For us, a primary focus will be at 11:30 CEST (UTC+2) on Thursday, June 9, when our President and CEO Kathy Brown opens the first Plenary with a keynote speech. more

April 8 2014: A World Less Secure

Not long after the message that Microsoft will stop updating Windows XP from 8 April onwards, after extending it beyond the regular life cycle for over a year already, came the soothing message that malware will be monitored for another year. That may be good news to some, but the fact remains that this is not the same as patching. Remaining on XP leads to a vulnerable state of the desktop, lap top and any other machine running on XP; vulnerable to potential hacks, cyber crimes, becoming part of a botnet, etc. more

The Recent DDoS Attacks on Banks: 7 Key Lessons

Starting in mid-September, one of the largest and most sophisticated DDoS attacks ever targeted the titans of American banking. Initially, victims included Bank of America, JPMorgan Chase, Wells Fargo, PNC Bank, and U.S. Bancorp. In the weeks to come, others would also feel the pain. Websites crashed, customers were unable to make transactions and IT professionals and PR gurus went into panic mode. Leon Panetta, U.S. Secretary of Defense, said the attacks foreshadowed a "Cyber Pearl Harbor." more

Four Steps to an Effective Brand Protection Program

Internet use has become ever more pervasive. With around five billion global users, it generates an economy of around 15% of global gross domestic product (GDP); that's around $15 trillion and is a figure that's growing 2.5 times faster than GDP itself. This makes the internet an attractive channel for infringers. Phishing and other fraud tactics, selling counterfeit goods online, and digital piracy are primary areas of concern. more

Y2038: It’s a Threat

Last month, for the 20th anniversary of Y2K, I was asked about my experiences. (Short answer: there really was a serious potential problem, but disaster was averted by a lot of hard work by a lot of unsung programmers.) I joked that, per this T-shirt I got from a friend, the real problem would be on January 19, 2038, and 03:14:08 GMT. Why might that date be such a problem? On Unix-derived systems, including Linux and MacOS, time is stored internally as the number of seconds since... more

Upcoming Domain Pulse 2008 Within Central Europe

Domain Pulse, the yearly get-together of the German-speaking registries of nic.at (Austria), Denic (Germany) and SWITCH (Switzerland) is happening on February 21 and 22 in Vienna. The conference alternates between the countries -- last year it was Switzerland, this year Austria and next year Germany... Domain Pulse covers everything in the domain name arena from management of the DNS, what's happening in each of the ccTLDs, after market and domaining, security threats to the DNS and internet as well as wider issues affecting the internet's development such as internet governance. more

Canada’s Electronic Spy Agency Makes Its Malware Analysis Tool Public

Canada's Communications Security Establishment (CSE) which rarely discloses detail of its activities has taken the "unprecedented step" of releasing one of its own cyber defense tools to the public, in a bid to help companies and organizations better defend their computers and networks against malicious threats. more

In Network Security Design, It’s About the Users

One of the longstanding goals of network security design is to be able to prove that a system -- any system -- is secure. Designers would like to be able to show that a system, properly implemented and operated, meets its objectives for confidentiality, integrity, availability and other attributes against the variety of threats the system may encounter. A half century into the computing revolution, this goal remains elusive. more

The Multinational Nature of Spam

I received a spam message the other day that went to my Junk Mail Folder. I decided to take a look at it and dissect it piece by piece. It really is amazing to see how spam crosses so many international borders and exploits so many different machines. Spammers have their own globally redundant infrastructure and it highlights the difficulties people have in combating the problem of it. more

A Cynic’s View of 2015 Security Predictions - Part 3

A number of security predictions have been doing the rounds over the last few weeks, so I decided to put pen to paper and write a list of my own. However, I have a quite a few predictions so I have listed them over several blog posts. After all, I didn't want to bombard you with too much information in one go! Part three examines the threats associated with data breaches. more

Project Honey Pot: 1 Billion Spammers Served

Coen Dijkgraaf writes: "Project Honey Pot is a community of tens of thousands of web and email administrators from more than 170 countries around the world who are working together to track online fraud and abuse. The Project has been online since 2004 and each day receives millions of email and comment spam messages which are catalogued and shared with law enforcement and security partners. On Wednesday, December 9, 2009 at 06:20 (GMT) Project Honey Pot received its billionth email spam message. For the full article and some intersting statistics about spamming, see 1 Billion Spammers Served." more

FCC Releases New U.S. Anti-Bot Code

The Online Trust Alliance (OTA) joined a unanimous vote at the Federal Communications Commission's (FCC) Communications Security, Reliability and Interoperability Council (CSRIC) meeting today, approving the voluntary U.S. Anti-Bot Code of Conduct for Internet Service Providers (ISPs), also known as the ABCs for ISPs. As a member of the CSRIC appointed by FCC Chairman Julius Genachowski, the OTA has been working with the FCC and leading ISPs to develop this voluntary Code. more