Europol Warns Organized Cybercrime Is Booming

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), National security, Terrorism, Cyber Terrorism & Related Crimes, Science & Related Space Technology, Social Media, Technology & Digital Security Comments Off

May 202013

Europol Warns Organized Cybercrime Is Booming

There may be a recession in Europe, but business is booming for cyber-criminals.

Security Week
by Famidan Y. Rashid
March 19, 2013

There are an estimated 3,600 organized crime groups currently operating in Europe, the European Union law enforcement agency Europol said in its 2013 EU Serious and Organised Crime Threat Assessment study released Tuesday. While international drug trafficking remained the most active organized crime activity in the EU, cybercrime is a growing crime area as criminals take advantage of the Internet to “generate illicit profits at low risk,” the study found.

Criminals are relying on the increasingly interconnected world to form a networked community of heterogeneous, international groups, Europol said. These individuals groups are no longer defined by their nationality, geographic region, or type of criminal activity. Organized crime can now operate on an international basis, “with a business-like focus on maximizing profit and minimizing risk,” said Rob Wainwright, director of Europol.

“A new breed of organized crime groups is emerging in Europe, capable of operating in multiple countries and criminal sectors,” said Wainwright.

The volume of cybercrime activity, such as phishing and click fraud scams, is expected to increase, according to Europol. The increase “will closely mirror the growth of the attack surface, as the Internet becomes even more essential to everyday life,” the report warned.

Thanks to the Internet, organized crime groups are able to access a large pool of victims, obscure their activities, and carry out a wide range of activities within a shorter period of time and on a larger scale, Europol found. Fraud, particularly online fraud, is an especially lucrative business for criminals. Fraud causes losses of billions of Euros per year in the EU, the report found.

Europol also said criminal groups are using online scams to fund traditionally offline crime, such as child exploitation rings.

“Cybercrime in the form of large scale data breaches, online frauds and child sexual exploitation poses an ever increasing threat to the EU, while profit-driven cybercrime is becoming an enabler for other criminal activity,” according to the report.

As more users shift to using mobile devices as their primary way of going online, criminals will increasingly target those devices. “Malware affecting these devices has already been seen, although mobile botnets have not yet been fully realized,” Europol warned.

Cybercrime is booming due to a lack of security awareness among European organizations and users, Europol said. For example, people and organizations “expose” themselves as targets by making their data freely available on social networking sites.

Organizations also have not fixed ongoing security flaws in their infrastructure, giving the criminals easy access. Security remains a “concern and challenge” as organizations outsource administrative, maintenance and development tasks, and effective prevention measures are still relatively expensive to deploy.

The report identified crime areas including illegal immigration, human trafficking, counterfeiting, cybercrime, drug trafficking, and money laundering, within the EU. The report also highlighted illicit waste trafficking and energy fraud as emerging threats.

The information in the 2013 SOCTA report is based on intelligence collected from various law enforcement databases, other information provided by the government, and Europol’s own extensive collection of data. The Council of Justice and Home Affairs Ministers are expected to use the report’s findings and recommendations to define priorities for the next four years.

Direct Link: http://www.securityweek.com/europol-warns-organized-cybercrime-booming

Microsoft to Close Critical IE Security Holes on Patch Tuesday

Articles of Interest Comments Off

May 152013

Microsoft to Close Critical IE Security Holes on Patch Tuesday

Security Week
by Brian Prince
May 9, 2013

Microsoft to Close Critical IE Security Holes on Patch Tuesday

Microsoft is prepping fixes for close to three dozen vulnerabilities for this month’s Patch Tuesday, including critical issues affecting Internet Explorer.

Tucked in among the 10 security bulletins is one aimed squarely at the Internet Explorer 8 zero-day vulnerability being exploited in the wild. Microsoft has already issued a “Fix It” tool this week to offer protection in lieu of a patch. According to the company, the issue is due to the way IE accesses an object in memory that has been deleted or that has not been properly allocated. By exploiting the issue, an attacker could potentially remotely execute code.

“In all cases, however, an attacker would have no way to force users to view the attacker-controlled content,” Microsoft noted. “Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker’s website, or by opening an attachment sent through email.”

The vulnerability has been at the center of a spate of water holing attacks that have roped in a number of sites, including the U.S. Department of Labor site.

All totaled, 33 vulnerabilities are expected to be fixed. Just two of the bulletins are rated ‘critical’, while the other eight are considered ‘important.’ Both critical bulletins address issues in Internet Explorer. The remaining bulletins are focused on issues in Windows, Microsoft Lync, Microsoft Office and Microsoft Windows Essentials.

“With ten bulletins, eight important this month, we have seen 45 to date in 2013, or 10 more bulletins than last year at this time,” said Paul Henry, security and forensic analyst at Lumension. “This tells me Microsoft is continuing to dig deeper into their code base to uncover lower level vulnerabilities. This is good news and I believe the trend toward higher numbers of important bulletins will continue given Microsoft’s apparent commitment to proactively discovering and patching security issues in their code.”

“As always, I recommend patching the important bulletins based on what programs you’re using,” he said. “Looking through the bulletins, Bulletin 4 is probably the most interesting, affecting all versions of Windows, from XP through Windows RT and Windows 8. This is a spoofing issue, which we don’t see very often in Microsoft bulletins. I’ll be very interested to see what this one turns out to be on Tuesday.”

Direct Link: http://www.securityweek.com/microsoft-close-critical-ie-security-holes-patch-tuesday

Australian police arrest senior member of LulzSec hacking group

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Social Media, Technology & Digital Security Comments Off

Apr 262013

Australian police arrest senior member of LulzSec hacking group

Yahoo News
by Jane Wardell / Reuters
April 24, 2013

Reuters/Reuters – Australian Federal policemen arrest the self-proclaimed leader of the international hacking group LulzSec, the collective that claimed responsibility for infiltrating and shutting down the CIA website, in this photo released by the Australian Federal Police on April 24, 2013. REUTERS/Australian Federal Police/Handout

SYDNEY (Reuters) –

Australian Federal Police have arrested the self-proclaimed leader of the international hacking group LulzSec, the collective that claimed responsibility for infiltrating and shutting down the CIA website.

Police said the 24-year-old IT worker, who held a position of trust at an international company, was arrested in Sydney on Tuesday evening and charged with hacking offences that carry a maximum penalty of 10 years.

Glen McEwen, manager of cyber crime operations at Australian Federal Police, said the man was detained at work, where he had access to sensitive information from clients including government agencies.

LulzSec, an offshoot of the international hacking group Anonymous, has taken credit for hacking attacks on government and private sector websites, including the Central Intelligence Agency (CIA), Sony Pictures, a unit of Sony Corp, 20th Century Fox and Nintendo.

Anonymous – and LulzSec in particular – became notorious in late 2010 when they launched what they called the “first cyber war” in retaliation for attempts to shut down the Wikileaks website.

The name LulzSec is a combination of “lulz”, another way of writing “lols” or “laugh out loud”, and security.

Australian police said the unnamed Australian man, who used the online moniker “Aush0k”, was known to international law authorities.

His arrest comes a week after an American member of LulzSec, Cody Kretsinger, was sentenced in a Los Angeles court to a year in prison followed by home detention. Kretsinger, who used the online handle “Recursion”, pleaded guilty in a plea agreement with prosecutors.

Court documents in that case revealed that Anonymous leader “Sabu”, whose real name is Hector Xavier Monsegur, had provided the FBI with information on fellow hackers after pleading guilty to hacking offences.

The Australian hacker has been charged with two counts of unauthorized modification of data to cause impairment and one count of unauthorized access to a restricted data system after a government website was attacked earlier this month.

“Let me make it extremely clear to everybody out there, this is not harmless fun, this is serious,” McEwen said at a press conference.

McEwen said the man posted in online forums frequented by other members of LulzSec that he was the group’s leader.

“There were no denials of his claims of being the leader,” McEwen told reporters.

The man has been granted bail and will appear before a court next month.

LulzSec allegedly broke into Australian government department and university websites in 2011. Anonymous last year took around 10 Australian government websites offline, protesting plans to force ISPs to store more user data and make it available to security services.

(Additional reporting by Michael Sin; Editing by Paul Tait and Jeremy Laurence)

Direct Link: http://news.yahoo.com/australian-police-arrest-senior-member-lulzsec-hacking-group-012243724–finance.html

The Firewall: From Past to Present… and Beyond

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Firearms, Weapons & Personal Safety, National security, Terrorism, Cyber Terrorism & Related Crimes, Social Media, Technology & Digital Security Comments Off

Apr 252013

The Firewall: From Past to Present… and Beyond

Security Week
by Nimmy Reichenberg
April 11, 2013

The Firewall: From Past to Present… and Beyond

The firewall – it’s been around since the dawn of the commercial internet, but it has been and remains a vital layer in the network security defense.

There has been recent discussion about its place in the network today, but as with any technology that stays viable in new times, the firewall has evolved. Let’s take a quick trip back in time to understand how far the firewall has come and then fast-forward to what we can expect in the future.

• Flashback to early 1990: The first generation firewall inspected “packets” transferred between computers on the Internet. Inspections were performed on each packet, looking at the source, destination, port, etc. and primarily only covered the first 3 layers of the OSI model.

• Going one layer up the OSI Model: The firewall’s next step was moving up to layer 4 in the OSI model and performing stateful inspection. Whereas packet filtering looked only at an individual packet at a time, with stateful packet inspection, firewalls could retain packets until there was enough information to make a sound yes/no decision. Stateful firewalls are still widely used today though that is shifting.

• We are currently in the age of firewall acronyms. Firewalls have picked up more capabilities, and more marketing buzzwords!

The Firewall

* UTM – Unified Threat Protection. It’s a bird, it’s a plane… no… it’s a firewall… and a whole lot more. UTM devices provide firewalls, Anti-virus, IPS, etc. – all bundled in one appliance.

* NGFWs – Next-generation firewalls. With Next-Gen firewalls, we get to layer 7 control as these devices are designed to filter traffic based on application and user traffic as well traditional means. NGFWs additionally can integrate IPS into the firewall’s decision to block malicious traffic. Having the ability to incorporate its ability into the firewall’s decision-making process is just another step in its evolution. There is some debate whether it’s best to have IPS as a standalone or integrated with your firewall, but integration is where we’re heading.

Sidenote: I recently participated on a panel discussing the current state of the firewall, which was moderated by Mike Rothman of Securosis and included Pankil Vyas of GM, Patrick Bedwell of Fortinet and Ryan Liles of NSS Labs.

One of the questions from the audience was “what’s the difference between a UTM and a NGFW?” To summarize the thoughts from my peers on the panel, it was basically agreed that it’s more semantics than anything else, with small potential differences around performance (UTMs being thought of as more mid-market and NGFWs more for the enterprise).

• Where we go from Next-Generation firewalls and UTMs to next is up for debate, but here are some ideas to consider:

* Further integration of security capabilities. We’ve already seen a lot of integration with UTMs and NGFWs and we’re getting beyond just throwing more tools on a box and actually integrating the data and capabilities to get faster and better decisions made. One possible evolution would be to have a SIEM correlate data from the gateway and dynamically adapt the firewall rules to mitigate specific threats – this is a ways off still I think, but this type of integration will certainly continue as more intelligence and automation are built into and cross-pollinated across these solutions.

* Hypervisor level firewalls which inspect and enforce a policy on VM-to-VM traffic. We’re just at the beginning stages of adoption and hypervisor level firewalls will not replace dedicated firewalls operating at or near wire speeds, but as organizations begin to mix workloads with different security requirements on the same physical box, there will be more demand for these firewalls.

* Cloud-based firewalls. Spinning up servers on Amazon or Rackspace? What about managing the security policy of those servers? We are starting to see emerging technology that offers security in the cloud that matches the elastic and dynamic nature of cloud environments.

* I think the way firewalls and their policies are managed will also change. It’s already underway. It’s one thing to manage all of the rules that allow traffic to be filtered at different points in the network and based on different criteria, but at the end of the day a firewall is there to allow or block traffic.

With networks becoming increasingly complex, and with these allow/block decisions impacting many stakeholders, instead of looking at these devices from strictly a firewall/security perspective, I believe that at least in large organizations we’ll start to see more decisions made from the perspective of a business application. By business application I mean as an example a credit card processing service that is vital for an ecommerce company to run/make money. If a firewall rule is preventing the application from working or slowing down its performance, the company suffers. It’s a new way of looking at how firewalls are managed and it’s evolving… stay tuned!

I hope you enjoyed this journey down the firewall memory lane and a look into the crystal glass of what is possible down the road. I want to make sure it’s clear that firewalls are here to stay, it’s just that the firewall as we’ve known it is changing. What was considered a firewall is now much more and while names may get fuzzy with deeper levels of integration, the firewall’s place in the network is cemented.

Direct Link: http://www.securityweek.com/firewall-past-present-and-beyond

One in five data breaches are the result of cyberespionage, Verizon says

Articles of Interest, Crimes & Criminal Activity (Organized Crime, Narcotics, Predators, Cyber Crime, Cyber Stalking, UnSolved), Social Media, Technology & Digital Security Comments Off

Apr 252013

One in five data breaches are the result of cyberespionage, Verizon says

Verizon’s data breach investigations report covering 2012 includes information on cyberespionage-related breaches for the first time

Computer World
by Lucian Constantin
April 22, 2013

China leads in 2013 Data Breach Investigation Report

IDG News Service –

While the majority of data breaches are the result of financially motivated cybercriminal attacks, cyberespionage activities are also responsible for a significant number of data theft incidents, according to a report that will be released Tuesday by Verizon.

Verizon’s 2013 Data Breach Investigations Report (DBIR) covers data breaches investigated during 2012 by the company’s RISK Team and 18 other organizations from around the globe, including national computer emergency response teams (CERTs) and law enforcement agencies. The report compiles information from more than 47,000 security incidents and 621 confirmed data breaches that resulted in at least 44 million compromised records.

In addition to including the largest number of sources to date, the report is also Verizon’s first to contain information on breaches resulting from state-affiliated cyberespionage attacks. This kind of attack targets intellectual property and accounted for 20% of the data breaches covered by the report.

In more than 95% of cases the cyberespionage attacks originated from China, said Jay Jacobs, a senior analyst with the Verizon RISK team. The team tried to be very thorough regarding attribution and used different known indicators that linked the techniques and malware used in those breaches back to known Chinese hacker groups, he said.

However, it would be naive to assume that cyberespionage attacks only come from China, Jacobs said. “It just so happens that the data we were able to collect for 2012 reflected more Chinese actors than from anywhere else.”

The more interesting aspects of these attacks were the types of tactics used, as well as the size and industry of the targeted organizations, the analyst said.

“Typically what we see in our data set are financially motivated breaches, so the targets usually include retail organizations, restaurants, food-service-type firms, banks and financial institutions,” Jacobs said. “When we looked at the espionage cases, those industries suddenly dropped down to the bottom of the list and we saw mostly targets with a large amount of intellectual property like organizations from the manufacturing and professional services industries, computer and engineering consultancies, and so on.”

A surprising finding was the almost fifty-fifty split between the number of large organizations and small organizations that experienced breaches related to cyberespionage, the analyst said.

“When we thought of espionage, we thought of big companies and the large amount of intellectual property they have, but there were many small organizations targeted with the exact same tactics,” Jacobs said.

There is a lot of intelligence-gathering involved in the selection of targets by these espionage groups, Jacobs said. “We think that they pick the small organizations because of their affiliation or work with larger organizations.”

In comparison to cyberespionage, financially motivated cybercrime was responsible for 75% of data breach incidents covered in the report and hacktivists were behind the remaining 5%.

One noteworthy finding of this report is that all threat actors are targeting valid credentials, Jacobs said. In four out of five breaches, the attackers stole valid credentials to maintain a presence on the victim’s network, he said.

This will hopefully start to raise some questions about the widespread reliance on single-factor password-based authentication, Jacobs said. “I think if we switch to two-factor authentication and stop being so reliant on passwords, we might see a decrease in the number of these attacks or at least force the attackers to change” some of their techniques.

Fifty-two percent of data breach incidents involved hacking techniques, 40% involved the use of malware, 35% the use of physical attacks — for example ATM skimming — and 29% the use of social tactics like phishing.

The number of breaches that involved phishing was four times higher in 2012 compared to the previous year, which is probably the result of this technique being commonly used in targeted espionage campaigns.

Despite all the attention given to mobile threats during the past year, only a very small number of breaches covered by the Verizon report involved the use of mobile devices.

“For the most part, we are not seeing breaches leverage mobile devices as of yet,” Jacobs said. “That’s a pretty interesting finding that’s kind of counter-intuitive in light of all the headlines saying how insecure mobile devices are. That’s not to say they’re not vulnerable, but the attackers currently have other easier methods to get the data.”

The same holds true for cloud technologies, Jacobs said. While there have been some breaches involving systems that are hosted in the cloud, they were not the result of attacks exploiting cloud technologies, he said. “If your site is vulnerable to SQL injection, it doesn’t matter where it’s hosted — in the cloud or locally. The kind of breaches we’re seeing would occur regardless of whether the system would be in the cloud or not.”

The Verizon report includes a list of 20 critical security controls that should be implemented by companies and which are mapped to the most prevalent threat actions identified in the analyzed dataset. However, the level to which every company should implement each control depends on the industry they’re part of and the type of attacks they’re likely to be more exposed to.

Direct Link: http://www.computerworld.com/s/article/9238611/One_in_five_data_breaches_are_the_result_of_cyberespionage_Verizon_says?taxonomyId=82&pageNumber=1

Older Entries