Read Complete Article »

Security firm FireEye has been tracking an Iranian hacking group that has moved from simple defacement of websites to actively targeting Western defense contractors and those within Iran's borders who are trying to circumvent the regime's censorship firewall.

The hacking group, calling itself the Ajax Security Team, has been active for the last five years. FireEye has been tracking the group on online forums, and says it began life as a loose collection of individuals getting together to find flaws in websites that would allow for defacement with pro-Iranian messages.

But these attacks have now stopped – the last was recorded last December – and the AST has been using its own custom malware to get into the espionage business. The team developed malware dubbed Stealer which, while not particularly advanced, has proven rather effective.

Stealer is built into a CAB extractor, and once activated, writes itself onto the target's drive as IntelRS.exe. This then adds in a backdoor to the target system that communicates with command and control servers over FTP, a keylogger, and screenshot collector.

The first target of the group has been Western defense companies, particularly those in the aerospace industry. The group registered the domain aeroconf2014[.]org, similar to the IEEE Aerospace conference website, and sent out emails to companies in the field with a phony login page.

If the recipient tried to register for the conference, they would be prompted to download proxy software to access the site, which is when the Stealer software gets onto the target's system. FireEye's director of threat research Darien Kindlund told El Reg that these kind of attacks are still ongoing by the group.

The malware is quite primitive in that it doesn't seek to exploit a zero-day vulnerability but instead relies on social engineering to get the user to install the malware. Nevertheless, that's still an effective tactic, he said, and multiple companies are under attack as a result of the code.

The second target for the group is Iranian citizens looking to get uncensored information via free proxy services. FireEye has tracked numerous cases of the malware being embedded in software such as Proxifier or Psiphon.

Over the course of their research, FireEye found data from 77 infected individuals, the bulk of whose computers had their clocks set to Iran Standard Time and were using Persian language settings.

Given the choice of targets, Kindlund said that it was likely that the group is either state-sponsored or state-supported. While one member of the hacking group has tried spreading malware for pecuniary gain, the bulk of their activities have been intelligence-gathering.

"The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities," FireEye's report concludes.

"While the relationship between actors such as the Ajax Security Team and the Iranian government remains unclear, their activities appear to align with Iranian government political objectives."



source

Linux admins need to get busy patching, as a newly discovered bug has emerged in the kernel's tty handling – and it lets logged-in users crash the system, gain root privileges, or otherwise modify and access data they shouldn't.

This memory corruption flaw is certainly nothing like OpenSSL's remotely exploitable Heartbleed – CVE-2014-0196. But this local root hole is problematic where users are sharing the same Linux host in the cloud.

Here's how US-CERT described the issue:

“The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the 'LECHO & !OPOST' case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.”

A user only needs shell access to be in a position to exploit the programming blunder.

The bug was introduced in 2009 with version v2.6.31-rc3 of the kernel. Before that, as noted at this Novell SUSE security discussion, “pty [the pseudo-terminal – El Reg] was writing directly to a line discipline without using buffers”.

Ubuntu has been patched, Red Hat is working on a fix for its Enterprise Linux 6 and Enterprise MRG 2 distos (RH Enterprise Linux 5 isn't affected). OpenWall has also patched. Debian's patches will arrive here.

There's an unreliable proof-of-concept here.



source

According to the Ponemon Institute's ninth annual Cost of Data Breach Study, the consolidated total cost of a data breach increased 15% in the last year, to $3.5 million. But some experts say those figures likely underestimate the full scope of the damage.

Duncan Fisken, senior vice president and general manager for EMEA at RedSeal Networks, believes the actual cost of a breach is considerably higher than the consolidated average of $145 per record that Ponemon estimates, even though that in and of itself represents an increase of more than 9% year-over-year.

"These figures are likely to be very conservative and may well be confined to the actual cost of the breach remediation and measurable loss of revenue,” Fisken told Infosecurity in an email. “There are other hidden costs which are much harder to quantify, for example reputational damage, illustrated by the battering a company’s share price can take in the wake of a much-publicized breach as in the Target case, further hit by [CEO] Steinhafel’s departure. Reputational damage can also be the area from which there's the longest road to recovery. Most would agree that the cost of recovering a lost customer is many multiples of the cost of acquiring a new customer in the first place.”

Other collateral costs that cannot be overlooked are those associated with recruiting new C-level executives; Target has had to find a new CIO and now a new CEO, he pointed out. “Executive searches at this level can often be long and expensive affairs. More difficult to monetize are the opportunity costs incurred during the ‘rebuilding’ period.”

The Ponemon report also revealed that the probability of a company having a data breach involving 10,000 or more confidential records is 22% over a two-year period – and that most IT departments don’t feel prepared. Only 38% of Ponemon study respondents said they have a security strategy to protect their IT infrastructure, and the majority of companies (50%) have low or no confidence that they are making the right investments in people, process and technologies to address potential and actual threats.

Those results run counter to findings in a new survey from Tripwire, which found that 64% of respondents have confidence in their incident response plan. And 40% of retail and financial organizations said that they only need two to three days to detect a breach.

“It is great that recent breaches have increased cybersecurity awareness and internal dialogue,” said Dwayne Melancon, CTO for Tripwire, in a statement. “However, the improved internal communication may be biased by a false sense of security. For example, 95% of respondents said they would be able to detect a breach on critical systems within a week. In reality, nearly all of the recent publicly disclosed breaches have gone on for months without detection.”

Melancon continued, “Furthermore, only 60% of respondents believe their systems have been hardened enough to prevent the kind of data loss similar to that seen in recent high profile breaches. These attitudes seem to indicate a high degree of overconfidence or naiveté among information security practitioners. I believe a number of these organizations may be in for a rude awakening if their systems are targeted by criminals.”

Fisken noted that the situation will only worsen over time if attitude changes aren’t made. "Networks are becoming ever more complex as enterprises grow through acquisition and the need to seek more innovative ways to differentiate themselves against their competitors; this is now true of almost every market vertical,” he said. “The increasing complexity and size of networks presents the CISO with the significant problem of preparedness; the need to be in proactive mode, rather than reactive; to predict threats by having sight of the attack surface of the network and, more especially, what those attack vectors mean in terms of the exposure of business-critical assets to would-be attackers.”


source

The Tor Network cannot protect internet users from state sponsored hackers and cyber criminals, according to a security expert.