300 Unknown Malware. Nailed with Check Point Threat Prevention Industry's best catch rate from Check Point Website

From Check Point page, found some interesting words based on recent 300 Unknown malware test:

In recent benchmark testing, 300 malicious files were scanned through Check Point Threat Emulation and other competitive products. The results found that Check Point outperformed all of the others.

HOW WE STACK UP
TO THE COMPETITION

SECURITY FINDINGS

ONLY Check Point caught ALL

300 Unknown Malware files.

Malware comes in all sizes.

Palo Alto Networks limits you to 1MB for PDF files.

Prevention

is more important than detection.

Palo Alto Networks and Fortinet only detect but cannot prevent unknown malware.

It is critical to scan inside SSL traffic.

FireEye does not scan inside SSL traffic.

Archived files need to be inspected.

Palo Alto Networks could not inspect .rar files.

Malware can propagate very quickly.

Real-time protection is required

Palo Alto Networks takes 30 minutes to update signatures.

Fortinet takes even longer.

Multi-protocol scanning

in one appliance

saves on total cost of ownership. 

FireEye needs a separate appliance for email protection

and for web protection.

Reference:

300 Unknown Malware. Nailed with Check Point Threat Prevention Industry's best catch rate

Advanced persistent threat

From Wikipedia, the free encyclopedia

Jump to: navigation, search

Advanced Persistent Threat (APT) APT is a set of stealthy and continuous computer hacking processes, often orchestrated by human(s) targeting a specific entity. APT usually targets organizations and or nations for business or political motives. APT processes require high degree of covertness over a long period of time. As the name implies, APT consists of three major components/processes: advanced, persistent, and threat. The advanced process signifies sophisticated techniques using malware to exploit vulnerabilities in systems. The persistent process suggests that an external command and control is continuously monitoring and extracting data off a specific target. The threat process indicates human involvement in orchestrating the attack.^[1]
APT usually refers to a group, such as a government, with both the capability and the intent to persistently and effectively target a specific entity. The term is commonly used to refer to cyber threats, in particular that of Internet-enabled espionage using a variety of intelligence gathering techniques to access sensitive information,^[2] but applies equally to other threats such as that of traditional espionage or attack.^[3] Other recognized attack vectors include infected media, supply chain compromise, and social engineering. Individuals, such as an individual hacker, are not usually referred to as an APT as they rarely have the resources to be both advanced and persistent even if they are intent on gaining access to, or attacking, a specific target.^[4]

Contents

[hide]

• 1 History and targets
• 2 APT characteristics
• 3 APT life cycle
• 4 Terminology
• 5 Mitigation strategies
• 6 See also
• 7 References
• 8 Further reading

History and targets[edit]

First warnings against targeted, socially-engineered emails dropping trojans to exfiltrate sensitive information were published by UK and US CERT organisations in 2005, although the name "APT" was not used.^[5] The term "advanced persistent threat" is widely cited as originating from the Air Force in 2006^[6] with Colonel Greg Rattray frequently cited as the individual who coined the term.^[7]
The Stuxnet computer worm, which targeted the computer hardware of Iran's nuclear program, is one example. In this case, the Iranian government might consider the Stuxnet creators to be an advanced persistent threat.
Within the computer security community, and increasingly within the media, the term is almost always used in reference to a long-term pattern of sophisticated hacking attacks aimed at governments, companies, and political activists, and by extension, also to refer to the groups behind these attacks.^{[citation needed]} Advanced persistent threat (APT) as a term may be shifting focus to computer based hacking due to the rising number of occurrences. PC World reported 81 percent increase from 2010 to 2011 of particularly advanced targeted computer hacking attacks.^[8]
A common misconception^[who?] associated with the APT is that the APT only targets Western governments. While examples of technological APTs against Western governments may be more publicized in the West, actors in many nations have used cyberspace as a means to gather intelligence on individuals and groups of individuals of interest.^[9][10][11] The United States Cyber Command is tasked with coordinating the US military's response to this cyber threat.
Numerous sources have alleged that some APT groups are affiliated with, or are agents of, nation-states.^[12][13][14] Businesses holding a large quantity of personally identifiable information are at high risk of being targeted by advanced persistent threats, including:^[2]

• Higher education^[15]
• Financial institutions

APT characteristics[edit]

Bodmer, Kilger, Carpenter and Jones defined the following APT criteria:^[16]

• Objectives — The end goal of the threat, your adversary
• Timeliness — The time spent probing and accessing your system
• Resources — The level of knowledge and tools used in the event (skills and methods will weigh on this point)
• Risk tolerance — The extent the threat will go to remain undetected
• Skills and methods — The tools and techniques used throughout the event
• Actions — The precise actions of a threat or numerous threats
• Attack origination points — The number of points where the event originated
• Numbers involved in the attack — How many internal and external systems were involved in the event, and how many people's systems have different influence/importance weights
• Knowledge source — The ability to discern any information regarding any of the specific threats through online information gathering (you might be surprised by what you can find by being a little proactive)

APT life cycle[edit]

Actors behind advanced persistent threats create a growing and changing risk to organizations' financial assets, intellectual property, and reputation^[17] by following a continuous process:

1. Target specific organizations for a singular objective
2. Attempt to gain a foothold in the environment, common tactics include spear phishing emails.
3. Use the compromised systems as access into the target network
4. Deploy additional tools that help fulfill the attack objective
5. Cover tracks to maintain access for future initiatives

The global landscape of APTs from all sources is sometimes referred to in the singular as "the" APT, as are references to the actor behind a specific incident or series of incidents.^{[citation needed]}
In 2013, Mandiant presented results of their research on alleged Chinese attacks using APT methodology between 2004 and 2013^[18] that followed similar lifecycle:

• Initial compromise — performed by use of social engineering and spear phishing, over email, using zero-day viruses. Another popular infection method was planting malware on a website that the victim employees will be likely to visit.
• Establish Foothold — plant remote administration software in victim's network, create network backdoors and tunnels allowing stealth access to its infrastructure.
• Escalate Privileges — use exploits and password cracking to acquire administrator privileges over victim's computer and possibly expand it to Windows domain administrator accounts.
• Internal Reconnaissance — collect information on surrounding infrastructure, trust relationships, Windows domain structure.
• Move Laterally — expand control to other workstations, servers and infrastructure elements and perform data harvesting on them.
• Maintain Presence — ensure continued control over access channels and credentials acquired in previous steps.
• Complete Mission — exfiltrate stolen data from victim's network.

In incidents analysed by Mandiant, the average period over which the attackers controlled the victim's network was one year, with longest – almost five years.^[18] The infiltrations were allegedly performed by Shanghai-based Unit 61398 of People's Liberation Army. Chinese officials have denied any involvement in these attacks.^[19]

Terminology[edit]

Definitions of precisely what an APT is can vary, but can be summarized by their named requirements below:^[3][4][20]

• Advanced – Operators behind the threat have a full spectrum of intelligence-gathering techniques at their disposal. These may include computer intrusion technologies and techniques, but also extend to conventional intelligence-gathering techniques such as telephone-interception technologies and satellite imaging. While individual components of the attack may not be classed as particularly "advanced" (e.g. malware components generated from commonly available do-it-yourself malware construction kits, or the use of easily procured exploit materials), their operators can typically access and develop more advanced tools as required. They often combine multiple targeting methods, tools, and techniques in order to reach and compromise their target and maintain access to it. Operators may also demonstrate a deliberate focus on operational security that differentiates them from "less advanced" threats.

• Persistent – Operators give priority to a specific task, rather than opportunistically seeking information for financial or other gain. This distinction implies that the attackers are guided by external entities. The targeting is conducted through continuous monitoring and interaction in order to achieve the defined objectives. It does not mean a barrage of constant attacks and malware updates. In fact, a "low-and-slow" approach is usually more successful. If the operator loses access to their target they usually will reattempt access, and most often, successfully. One of the operator's goals is to maintain long-term access to the target, in contrast to threats who only need access to execute a specific task.

• Threat – APTs are a threat because they have both capability and intent. APT attacks are executed by coordinated human actions, rather than by mindless and automated pieces of code. The operators have a specific objective and are skilled, motivated, organized and well funded.

Mitigation strategies[edit]

There are 100s of millions of malware variations, which make is extremely challenging to protect organizations from APT. While APT activities are stealthy and hard to detect, the command and control network traffic associated with APT can be detected at the network layer level. Deep log analyses and log correlation from various sources can be useful in detecting APT activities – it’s all about the logs. Agents can be used to collect logs (TCP and UDP) directly from assets into a syslog server. Then a Security Information and Event Management (SIEM) tool can correlate and analyze logs. While it is challenging to separate noises from legitimate traffic, a good log correlation tool can be used to filter out the legitimate traffic, so security staff can focus on the noises

The 11 scariest digital security stories of 2014 (so far)

http://www.pcworld.com/article/2364275/the-8-scariest-security-stories-of-2014-so-far.html

1. Bad moon rising

Barely halfway through 2014, the year's already poised to become the scariest yet for digital security—topping even 2013's massive Target breach. We’ve seen hacks against big-name retailers like eBay, Michael’s, and Neiman Marcus—plus hotels, online forums, and numerous other websites. The current tally of compromised credit cards from major breaches is closing in on 5 million, and online accounts?—half a billion.
Beyond active attacks, go-to encryption tool TrueCrypt was lost, and we've suffered through the single biggest web security lapse ever. As we close in on the halfway point for 2014, here are the 10 biggest security stories so far.

2. Heartbleed bleeds the web

Thousands of major websites worldwide scrambled in April after a nasty little flaw turned up in OpenSSL—a widespread tool for securing online communications, including HTTPS websites. Dubbed Heartbleed, this devastating bug threatened to expose usernames and passwords, user data, and even the SSL keys sites use to securely identify themselves. The problem was widespread: affected sites included Instagram, Netflix, and Tumblr.
Although it was a serious flaw, Heartbleed also inspired several major tech companies to fund poorly-supported open source projects. The first group to receive assistance—surprise!—was the OpenSSL Software Foundation.

3. TrueCrypt shuts up shop

In May, customers were shocked to be suddenly rerouted from the TrueCrypt encryption software's website to the project’s SourceForge page. There, they found this message: “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues.”
At first, it looked like a hoax or a hack, because TrueCrypt's advice to switch to Microsoft’s closed-source BitLocker encryption tool was diametrically opposed to the project's ideals. Several weeks later, however, TrueCrypt’s demise appears to be real. There are attempts to resurrect the project under new management, even as rumors about hidden Latin messages from TrueCrypt's developers swirl.

4. Breaches, breaches, and more breaches

A security review wouldn’t be complete without a roundup of major data breaches. EBay is the most notable victim: In May, the site announced a devastating data breach that included names, email and home addresses, phone numbers, dates of birth, and encrypted passwords. Reports put the number of affected users around 145 million.
Hobby retailer Michael’s joined eBay in the data breach Hall of Shame, along with AOL, Avast's online forums, Holiday Inn and Marriott Hotels, and Neiman Marcus. Restaurant chain P.F. Chang’s recently announced it was also investigating a data breach. And oh yeah, another 360 million usernames and passwords surfaced on hacker forums in February. Ugh.

5. La Oops

But sometimes, a breach deserves individual recognition—like the hack that Seagate-owned LaCie announced in April. The hard drive and peripheral storage maker said its online storefront had endured a whopping year-long data heist from March 27, 2013 to March 10, 2014. LaCie said it wasn’t sure what kind of data had been pilfered, but it may have included customer names, email addresses, credit card numbers, and card expiration dates. Crazy.

6. Ransom goes rampant

If 2013 was the year of the personal data breach, then 2014 is shaping up to be the year of digital hostages and ransomware. Malicious software that threatens to ruin your PC if you don’t pay a certain amount of money is an old game, but hackers upped the stakes in the early part of 2014. In late May, iOS users around the world woke up to find their iDevices locked via Apple's Find My iPhone service, with hackers demanding money to restore them. Then in June, security firm ESET found the first example of file-encrypting ransomware on Android. Sites like project-management web app Basecamp were also held ransom unless they paid up to stop distributed denial of service (DDoS) attacks.

7. GnuTu Fail

Heartbleed wasn’t the only significant SSL/TLS bug in 2014. In February and March, both Apple and the Linux community were scrambling to fix flaws in their implementations of online security protocols. In Apple’s case, someone had mistakenly included an extra 'goto fail' programming statement that left encrypted data sent via SSL/TLS open to capture by hackers.
In the Linux case, the GnuTLS library had a programming flaw exposing user data to potential breaches, similar to Apple’s 'goto fail' problem. In the case of GnuTLS, however, it’s suspected the programming flaw existed for as long as 10 years—prompting Linux community leaders to say, “Huh, Gnu knew?” ( Groan —Ed.)

8. Pliable crypto-currency

Bitcoin security hit a road bump in February: A flaw dubbed “transaction malleability” led to attacks against several Bitcoin exchanges, according to Bitcoin news site Coindesk. The flaw could theoretically allow an attacker to substitute a phony transaction for the original one, thus redirecting Bitcoins from the intended recipient to the attacker.
Transaction malleability was serious enough that it was an early theory as to why embattled Bitcoin exchange Mt. Gox closed its doors. Mt. Gox’s problems were later revealed to go deeper than a software bug, however, and a fix addressing transaction malleability was issued in March.

9. Outlook snoop

Government agents aren’t the only snoops who might be plundering your Outlook.com inbox. Microsoft might also take a peek…at least if you’re up to no good. In March, Microsoft ‘fessed that it snooped on the personal email of both a blogger and a former employee, seeking evidence that the employee was leaking proprietary company information to the blogger. (To its credit, Microsoft revamped its privacy policy after the backlash.)
The case highlights how American digital due-process is woefully inadequate. After all, private emails sitting on third-party servers should be considered just as private as those love letters stashed in the back of your closet.

10. Gameover for Gameover botnet

Two positive stories offer some hope.
In June, a global law-enforcement coalition temporarily disrupted a nasty botnet called Gameover ZeuS. Infected Windows PCs were harvested for personal data and also used to distribute Cryptolocker ransomware.
Gameover includes a peer-to-peer component, as well as online proxy servers and strong encryption, according to Krebs on Security. Gameover affects an estimated 500,000 to one million PCs worldwide, and the disruption—dubbed ‘Operation Tovar’—only served as a chance to clean up infected PCs. U.S authorities indicted Evgeniy Mikhailovich Bogachev, 30, of Anapa, Russia, on several criminal charges related to operating the botnet.

11. Google's end-to-end revenge

Revenge is a dish best served cold, and Google made sure its vengeance pie was well and truly cooled before serving it up to the National Security Agency. As the fallout over Edward Snowden's NSA revelations continues, Google announced it wanted to make end-to-end encryption for webmail easier to use with a new Chrome extension. Called End-to-End, the extension is currently in a public alpha phase and not yet ready for wide release. When it goes live, however, it will be one of several new projects promising to keep your most private emails secure from prying eyes and snooping government agencies.

http://www.pcworld.com/article/2453400/the-biggest-data-breaches-of-2014-so-far.html

The 5 biggest data breaches of 2014 (so far)

Martyn Williams @martyn_williams

• Jul 11, 2014 12:20 PM
• e-mail
• print

In the battle to keep your personal information private, it’s not just hackers you have to worry about but lax security and stupidity.
A survey of data breaches in the first six months of this year shows an increasing number of incidents in which data, including names and addresses, credit card and Social Security numbers, and medical records was lost to criminals or exposed.

More reading: The 8 scariest security stories of 2014 (so far), which examines the greater security landscape.

In many of the cases, the breaches were put down to poor data security practices or simple errors: like St. Vincent Breast Center in Indianapolis sending 63,000 letters containing information on upcoming appointments to the wrong people, or Stanford Federal Credit Union accidentally attaching a file with information on 18,000 customers to an email, or the thousands of paper medical records dumped at a public incineration site in York, Pennsylvania.
In other cases, laptops or thumb drives containing information were stolen—in some cases with apparently nothing more than the login password to protect the data.
One of the biggest such cases involving laptop theft occurred at the Torrance, California, office of Sutherland Healthcare Solutions, which lost eight laptops in a February break-in. The laptops contained medical information on almost 400,000 people in California, and their theft has sparked lawsuits.

IDGNS

Data breaches on the rise

According to the Identity Theft Resource Center, there have already been 395 data breaches in the U.S. this year that have been reported to regulators or covered by media outlets, a 21 percent increase over the same period last year.
Here are the top five data breaches of the first half of 2014, with an extra entry for eBay. That breach appears to be one of the largest yet, but the exact extent of the problem has not yet been divulged by the company, so it’s difficult to quantify how big it actually was.
eBay
The online retailer suffered one of the biggest data breaches yet reported by an online retailer. Attackers compromised a “small number of employee log-in credentials” between late February and early March to gain access to the company’s network and, through it, compromised a database that contained customer names, encrypted passwords, email addresses, physical addresses, phone numbers and dates of birth. The breach is thought to have affected the majority of the company’s 145 million members, and many were asked to change their passwords as a result.
Michaels Stores
The point-of-sale systems at 54 Michaels and Aaron Brothers stores “were attacked by criminals using highly sophisticated malware” between May 2013 and January 2014. The company said up to 2.6 million payment card numbers and expiration dates at Michaels stores and 400,000 at Aaron Brothers could have been obtained in the attack. The company received confirmation of at least some fraudulent use.
Montana Department of Public Health and Human Services
Triggered by suspicious activity, officials conducted an investigation in mid-May that led to the conclusion that a server at the Montana Department of Public Health and Human Services had been hacked. The server held names, addresses, dates of birth and Social Security numbers on roughly 1.3 million people, although the department said it has “no reason to believe that any information contained on the server has been used improperly or even accessed.”
Variable Annuity Life Insurance Co.
A former financial adviser at the company was found in possession of a thumb drive that contained details on 774,723 of the company’s customers. The drive was provided to the company by law enforcement as the result of a search warrant served on the former adviser. The thumb drive included full or partial Social Security numbers, but the insurance company said it didn’t believe any of the data had been used to access customer accounts. It’s not the first time the company has lost data on a thumb drive. In 2006, it wrapped up a lawsuit against a former financial adviser for downloading “confidential customer information” onto “a portable flash drive.”
Spec’s
A 17-month-long “criminal attack” on the Texas wine retailer’s network resulted in the loss of information of as many as 550,000 customers. The intrusion began in October 2012 and affected 34 of the company’s stores across the state. It continued until as late as March 20 this year, and the company fears hackers got away with customer names, debit or credit card details, card expiration dates, card security codes, bank account information from checks and possibly driver’s license numbers.
St. Joseph Health System
A server at the Texas health care provider was attacked between Dec. 16 and 18 last year. It contained “approximately 405,000 former and current patients’, employees’ and some employees’ beneficiaries’ information.” This included names, Social Security numbers, dates of birth, medical information and, in some cases, addresses and bank account information. As with many other hacks, an investigation wasn’t able to determine if the data was accessed or stolen.
Correction: A chart attached to this story was updated at 4:58 PM to correct a labeling error.

Russians Suspected In ‘Uroburos’ Digital Espionage Attacks

http://www.techweekeurope.co.uk/news/russian-intelligence-uroburos-malware-140494

Russian intelligence linked to super-sophisticated rootkit targeting high-profile organisations and nation states

On March 3, 2014 by Thomas Brewster 0

Russian government hackers are suspected of creating a highly-sophisticated piece of malware designed tosteal files from nation states’ digital infrastructure.

The Uroburos malware, named after an ancient symbol depicting a serpent or dragon eating its own tail that recently appeared in the Broken Sword 5 video game, worked in in peer-to-peer mode, meaning it can move across machines even if they’re not connected to the public Internet.

G-Data said Uroburos was “one of the most advanced rootkits we have ever analysed in this environment”.

Russian intelligence involved?

It works on both 32-bit and 64-bit Microsoft Windows machines, again pointing to a well-funded effort. It’s likely the Uroburos attacks went undetected for at least three years, as a sample of a rootkit driver was dated back to 2011.

“The development of a framework like Uroburos is a huge investment. The development team behind this malware obviously comprises highly skilled computer experts, as you can infer from the structure and the advanced design of the rootkit,” G-Data said.

“The design is highly professional; the fact the attackers use a driver and a virtual file system in two separate files which can only work in combination, makes the analysis really complicated. One needs to have the two components to correctly analyze the framework. The driver contains all of the necessary functionality and the file system alone simply cannot be decrypted.

“The network design is extraordinarily efficient, too; for an incident response team, it is always complicated to deal with peer-to-peer infrastructure. It is also hard to handle passive nodes, because one cannot quickly identify the link between the different infected machines.”

The Russian connection was made after researchers from G-Data discovered plenty of Russian-language strings in the code. They also found the malware searching for the presence of Agent.BTZ, malware used in attacks on the US in 2008, which were said to have been carried out by Russian spies.

The Agent.BTZ attack was initiated when a USB stick was deliberately left in a parking area belonging to the United States Department of Defense.

“We believe that the team behind Uroburos has continued working on even more advanced variants, which are still to be discovered,” G-Data added.

“We are sure of the fact that attacks carried out with Uroburos are not targeting John Doe but high profile enterprises, nation states, intelligence agencies and similar targets.”


俄罗斯在克里米亚的军事活动正成为全世界的焦点，而它在幕后的网络间谍战也正有条不紊的继续着。俄罗斯政府黑客被怀疑是间谍软件Uroburos的幕后作者。

Uroburos是一种p2p传播的恶意程序，被安全公司G-Data称之为至今发现的最先进rootkit恶意程序之一。Uroburos的间谍活动至少秘密进行了三年，G-Data称它的开发需要巨大的资金投入和经验丰富的专家。程序的源代码中包含了俄语字符串，并被发现在搜索另一个间谍软件Agent.BTZ，Agent.BTZ是涉及渗透进五角大楼的恶意程序。

俄罗斯悄然打响网络间谍战，Uroburos程序幕后作者

俄罗斯政府黑客被怀疑开发了一款高度复杂的恶意软件，用来从一些国家政府的基础数字设施窃取文件。

这款名为Uroburos的恶意软件是根据一种古老的符号——乌洛波洛斯来命名的，其形象符号是最近出现在冒险游戏断剑5中的衔尾蛇。这款恶意软件通过P2P模式运行，这也就意味着即使没有连接公网，这款软件仍然可以在机器间传播。

全球顶级杀软G-Data表示这是迄今为止发现的最先进的rootkit恶意程序之一。

俄罗斯情报部门参与?

俄罗斯悄然打响网络间谍战，Uroburos程序幕后作者

它可以适用于32位和64位系统。而Uroburos的间谍活动至少可以追溯到2011年，已经运行了至少三年而未被发现。

G-Data表示：

“像Uroburos这样框架的开发需要巨大的投资，我们从rootkit的结构和先进的设计推断，这款恶意软件的开发团队中显然有着大量经验丰富的计算机专家。”

“这种设计太专业了，事实上攻击者将驱动和虚拟文件系统完全独立开了，只有在这两部分组合起来才能正常工作，这就导致了对其分析起来便非常复杂。要想分析这个框架只有将两个组件正确组合起来。而驱动所包含的必要功能与单独的文件系统是无法实行解密的。”

“这种网络设计太高效了，对于一个事件响应来说，要完成p2p基础设施的处理往往是非常复杂的。因为不能快速识别不同受感染机器之间的联系，这就导致被动节点很难被处理。”

G-Data的研究者在这款软件的源代码中发现了大量的俄语字符，并被发现在搜索另一个间谍软件Agent.BTZ(一款在2008年用于渗透五角大楼的恶意软件)，这也就直指俄罗斯的间谍活动行为。

我们仍记得，当Agent.BTZ攻击发起时，有一个USB存储承载着Agent.BTZ在美国国防部的电脑间“流窜”。早在2008年，由于这种软件通过“U盘”来疯狂传播，因此美军暂时禁止官兵在任何军方电脑上使用U盘或者其他外置存储装置。

“我们相信，Uroburos的背后开发团队会继续致力于开发更先进的恶意软件变种，当然这还有待于我们进一步发现”，G-Data补充说明。

“我们可以确定的事实是Uroburos的目标绝不是张三李四王二麻子某个个人，而是高端企业、政府机关、情报机构和其他相关部门。”

NSA在RSA加密算法中设置了第二个后门程序

路透社曾在去年12月报道，美国国家安全局(NSA)与加密技术公司RSA达成了1000万美元的协议，要求在移动终端广泛使用的加密技术中放置后门。近日一组研究人员公布的调查结果更加令人震惊：当时RSA采用了两个由NSA开发的加密工具，而不是此前报道中的一个。

去年12月，两名知情人士称，RSA收受了1000万美元，将NSA提供的一套密码系统设定为大量网站和计算机安全程序所使用软件的默认系统。这套臭名昭著的“双椭圆曲线”(Dual Elliptic Curve)系统从此成为了RSA安全软件中生成随机数的默认算法。但问题随即出现，因为这套系统存在一个明显缺陷(即“后门程序”)，能够让NSA通过随机数生成算法的后门程序轻易破解各种加密数据。

此次来自美国约翰-霍普金斯大学、威斯康辛州立大学、伊利诺伊州立大学和另外几所大学的9位教授在一份研究报告中表示，他们已经发现了NSA在RSA加密技术中放置的第二个解密工具。

根据路透社获得的这份研究报告的复印件显示，这几位大学教授发现，这款名为“扩展随机”(Extended Random)的工具能够以比之前快几万倍的速度破解NSA目前采用的“双椭圆曲线”软件。

当路透社希望RSA对此事表态时，该公司并没有对上述教授的研究结果提出质疑。RSA表示，该公司从未故意降低任何产品的安全性。RSA还指出，“扩展随机”工具并未得到普遍应用，而且在过去六个月里这一工具一直在RSA的保护软件移除名单之列。

RSA首席技术官萨姆•库瑞(Sam Curry)向路透社表示：“我们本应该对NSA的意图产生更多的怀疑。我们曾经如此信任NSA，因为他们承担着保护美国政府和美国关键基础设施的重任。”

库瑞并没有说明，美国政府是否向RSA提供现金资助，以要求后者将“扩展随机”工具安装到该公司的BSafe安全软件套装中。

NSA的一位女新闻发言人拒绝对上述研究报告以及开发“扩展随机”工具的动机发表任何置评。

在过去数十年里，NSA一直在通过旗下的信息保护署(Information Assurance Directorate)与私人公司合作改进网络安全水平。在“9•11”事件后，NSA增加了监控范围，其中就包括此前面临严格限制的美国政府内部。

研究结果即将发表

2008年，在由美国国防部资助发表的一篇论文中，“扩展随机”被说成可以提高由“双椭圆曲线”系统生成的数字的随机性。但此次研究小组的成员则表示，他们发现随机性因此提高的程度极小，而由“扩展随机”后门程序发送出来的额外数据却大大降低了预测随机安全数字的难度。

本周一，此次研究小组已经在网上发布了他们研究报告的概要，并计划将包括全部研究结论的论文提交给在今年夏天召开的一个学术会议。这篇论文的合著作 者之一、美国威斯康辛州立大学的托马斯•里斯滕帕特(Thomas Ristenpart)表示：“我们并没有发现‘扩展随机’工具带来任何额外的安全保护作用。”

约翰-霍普金斯大学的马修•格林(Matthew Green)教授也表示，政府对“扩展随机”工具的官方解释很难不让人感到怀疑，尤其是考虑到“双椭圆曲线”此前刚刚被认定成为美国的一项标准系统。格林 颇为形象地打了个比喻：“如果说使用‘双椭圆曲线’好比玩弄火柴，那么再加上‘扩展随机’就好比你把自己浑身洒满汽油一般。”

Lessons Learned From 4 Major Data Breaches In 2013

http://www.darkreading.com/application-security/database-security/lessons-learned-from-4-major-data-breaches-in-2013/d/d-id/1140962?

Breach stats are declining, but data is still at risk from poorly protected databases, applications, and endpoints

In many respects the breach trends of 2013 have borne out some good news for the security industry. Unlike the past four to five years, this one has not been awash with mega database breaches of tens of millions of records containing personally identifiable information (PII). And according to statistics compiled by the Privacy Rights Clearinghouse, both the number of breaches publicly reported and the volume of records breached have declined. Last year at this time, the running count already totaled approximately 27.8 million records compromised and 637 breaches reported. This year, that tally so far equals about 10.6 million records compromised and 483 breaches reported. It's a testament to the progress the industry has made in the fundamentals of compliance and security best practices. But this year's record is clearly far from perfect.

When comparing year-to-date numbers, the volume of records breached went down a drastic 61.7 percent, while the number of reported breaches was only reduced by about 24.2 percent. This shows that breaches are still occurring at a fast clip -- it's just now the distribution of theft and compromise has spread out. Breaches are smaller, and according to security insiders, they're far more targeted. And frequently the theft is of IP or other digital property that could be even more damaging than customer records when stolen, but which are more difficult to quantify and don't make the statistical headlines.

Delving deeper into the specifics of breaches occurring this year, it is evident there's still work to do. As evidenced by the 2013 track record, valuable databases are still left unprotected and unencrypted, applications are still riddled with vulnerabilities, and users are still allowed to download huge quantities of information from sensitive databases and store them on poorly protected endpoints. To plead our case, Dark Reading has cherry-picked a few helpful examples and offered up some valuable lessons the industry can learn from these incidents.

Company Compromised: CorporateCarOnline.com
Breach Stats: 850,000 records stolen
The Details: Personal details, credit card numbers, and other PII from some of the biggest American names in professional sports, entertainment, Fortune 500 business, and politics were all stolen in this juicy heist of a plain text archive held by this company that develops a SaaS database solution for limo services across the country. Some of the big names on the list include Tom Hanks, Sen. Tom Daschle, and Donald Trump.

Lessons Learned: A key lesson is how the ingenuity of attackers knows no bounds when the most valuable financial and social-engineering-fueling information is at stake. According to KrebsOnSecurity.com, a quarter of the compromised card numbers were high- or no-limit American Express cards, and other information would prove a treasure trove for corporate spies or tabloid media players. Meanwhile, the company at hand paid absolutely no regard to the security of the information, without even trying to take the most basic of cryptographic measures to protect it.

[How do you know if you've been breached? See Top 15 Indicators of Compromise.]

Company Compromised: Adobe
Breach Stats: Nearly 3 million PII records, more than 150 million username/password combos, and source code from Adobe Acrobat, ColdFusion, ColdFusion Builder and other unspecified products were stolen.
The Details: This is the breach that just keeps unraveling as the hits keep coming more than a month after the compromise was first disclosed. Originally just though a compromise of 3 million PII records, it's now clear that Adobe is contending with the loss of a vast trove of login credentials, and, more startlingly, its source code.

Lessons Learned: Not only is the still-unfolding Adobe story a good teaching moment for how thoroughly a company can be owned by attackers once they've established a foothold in a corporate network, it's also a lesson on how dependent the entire enterprise ecosystem is on the security of its software supply chain. The potential ramifications could ripple out for a long while yet as a result of this breach.

Company Compromised: U.S. Department Of Energy
Breach Stats: PII stolen for 53,000 former and current DOE employees 
The Details: Attackers targeted DOEInfo, the agency's outdated, publicly accessible system built on ColdFusion for the office of its CFO. DOE officials say the breach was limited to PII about employees.

Lessons Learned: There were two big lessons here. First, patching always has been and always will be paramount. Second, organizations must think about reducing their attack surfaces by reconsidering which systems connected to sensitive databases should be left open on publicly facing websites.

Company Compromised: Advocate Medical Group
Breach Stats: 4 million patient records stolen
The Details: The theft of four computers from offices owned by this medical company exposed more than 4 million patient records in what officials are calling the second-largest loss of unsecured health information since notification to the Department of Health and Human Services became mandatory in 2009.

Lessons Learned: Health-care breaches are dominating the 2013 breach disclosure list thus far, but this one in particular is the most egregious. With patient records dating back to the 1990s compromised from a physical computer theft, it is clear that the basics in physical security, endpoint security, encryption, and data protection were all deficient. In particular, endpoint theft and loss in health-care issues seems to come up time and time again. It may be time for these organizations to reconsider how much data an endpoint is allowed to download and store from centralized databases.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

泄露事故统计数字正在逐步下降，但数据仍然面临着由数据库、应用以及终端保护不当所引发的严重风险。

从多个角度来看，2013年的数据泄露趋势已经得到有效扼制，这对于安全行业来说当然是个好消息。不同于过去四到五年，今年的记录当中不再充斥着大型数据库泄露所导致的数以千万计个人身份信息的外流。根据隐私权信息交流中心的调查，本年度公开报道的泄露事故数量及记录在案的泄露事故数量双双呈下降趋势。去年同期，得到确切统计的记录泄露数量已经达到约278万条，漏洞报告则为637份。而在今年，目前为止记录在案的泄露事故约为107万条，漏洞报告则为483份。这充分证明整个安全行业在合规性与安全最佳实践方面所迎来的进步——然而这样的战绩与理想目标相比仍然相去甚远。

在对年初至今的数字进行比较时，我们发现记录在案的泄露事故数量大幅降低了61.7%，然而报告提及的泄露事故数量则仅降低了24.2%。这表明泄露事故仍然快速发生——只不过如今的犯罪活动及违规事件开始逐步扩散而非集中于一点。泄露事件影响范围更小，而且根据安全业内人士的说法，此类恶意活动的目标也更为广泛。现在犯罪分子开始更多地窃取IP或者其它数字资产，由此引发的损失可能比客户记录本身更为严重——同时这也更加难以量化，无法提供头条新闻所必需的统计结果。

通过对今年发生的泄露事故的深入钻研，我们发现安全行业明显仍有大量工作要做。2013年的追踪记录证明，有价值数据库仍然没有受到严格保护与加密、应用程序仍然存在大量安全漏洞、用户们则仍然能够从敏感数据库中下载大量信息并将其保存在缺乏保护的终端当中。为了帮助大家更好地理解当前安全形势，我们选取了几项最具代表意义的实例，希望各位能够从中吸取可资借鉴的教训。

当事企业: CorporateCarOnline.com


泄露统计: 850,000份记录被盗

事故细节:作为全美最具知名度的专业体育、娱乐外加五百强企业，CorporateCarOnline.com拥有大量用户个人资料、信用卡号码以及其它个人身份信息，然而由于其开发出的全球豪车租赁SaaS数据库解决方案将全部信息以纯文本形式储存，最终导致这一切成为犯罪分子的囊中之物。名单中涉及不少大牌，包括汤姆·汉克斯、汤姆·达施勒以及唐纳德·特朗普等。

经验教训:最重要的教训在于认清这样一个现实：面对极具价值的财务与社会工程信息，攻击者们会爆发出极为可怕的技术能量。根据KrebsOnSecurity.com网站的调查，目前遭遇过违规活动的美国运通卡当中有四分之一为高额度甚至无限额度卡片，而且企业间谍分子或者娱乐小报记者也希望通过这类个人信息挖掘到有价值结论。与此同时，该公司在管理收支账目时完全没有考虑过信息安全性，甚至从未尝试采取任何最基本的加密措施。

当事企业: Adobe


泄露统计: 约三百万个人身份信息、超过1.5亿用户名/密码组合以及来自Adobe Acrobat、ColdFusion、ColdFusion Builder外加其它未说明产品的源代码惨遭窃取。

事故细节: 自最初的违规事件发生之后，接踵而来的更多攻击活动持续了一个多月之久，并最终导致了此次重大事故的发生。目前情况已经明确，Adobe正在努力恢复其失窃的大量登录凭证信息——更令人惊讶的是，连其产品源代码也一并泄露。

经验教训: 通过Adobe遭遇的这一轮震惊世界的攻击活动，我们不仅切身感受到攻击者在企业网络中建立根据地并夺取了整套业务储备控制权后所能带来的损害，同时也应学会在考虑将供应商引入软件供应链之前、考察对方在安全领域营造出了怎样的企业生态。作为此次泄露事故的后续影响，其潜在后果恐怕在很长一段时间内都无法彻底消除。

当事企业: 美国能源部

泄露统计: 53000位前任及现任能源部员工的个人身份信息遭到窃取

事故细节: 攻击者将矛头指向了DOEInfo——该机构利用ColdFusion所打造的、已经弃之不用的CFO办公室公开访问系统。能源部官员表示，此次泄露事故只限于内部员工的个人身份信息。

经验教训: 我们从中应该吸取两大教训。首先，安装补丁过去是、现在是、未来也将一直是最为重要的安全任务。其次，各机构必须通过重新审视与敏感数据库相对接的系统最大程度减少攻击面，保证只向公众开放必要的网站。

当事企业: Advocate Medical Group


泄露统计: 四百万病人记录遭到窃取

事故细节: 仅仅由于犯罪分子从办公室里偷走了四台由该公司拥有的计算机，最终导致了这起四百万病人记录丢失的事故——公司官方将此称为自2009年卫生部强制要求通告安全事故以来、美国发生过的第二大医疗信息泄露案件。

经验教训: 医疗行业的数据泄露事故在2013年的违规披露名单当中一直占据主导，但这一次的案件造成的影响显然特别恶劣。仅仅由于一台物理计算设备失窃就最终导致从上世纪九十年代至今的病人记录泄露，这充分暴露了该公司在物理安全、终端安全、加密以及数据保护等各个方面的全线失误。需要强调的是，终端设备被盗与丢失在医疗行业中已经屡见不鲜。现在这些机构可能需要尽快思考终端设备到底能够下载并保存多少来自中央数据库的信息。

从Target数据泄露得到的几点启示

2014-04-02 09:21 鹿宁宁编译 网界网 字号：T | T

任何从事网络安全的技术人员、管理人员以及供应商一定都已阅读并熟悉了美国参议院发布的“2013年Target数据泄露的杀伤链分析报告”。报告阐述了Target事件是如何发起、如何进行的，并列出Target应在每个阶段做些什么来预防、检测和响应事件。

AD：51CTO学院：IT精品课程在线看！

任何从事网络安全的技术人员、管理人员以及供应商一定都已阅读并熟悉了美国参议院发布的“2013年Target数据泄露的杀伤链分析报告”。报告阐述了Target事件是如何发起、如何进行的，并列出Target应在每个阶段做些什么来预防、检测和响应事件。

报告列出了整个Target事件过程，从最初的入侵、破坏到2013年12月19日Target发布公告。此外， 2014年3月26日，Target首席财务官约翰•穆里根在美国参议院商业、科学、和运输委员会作证词时，更新了Target数据泄露事件的前因后果。

报告指出了网络安全技术人员、管理过程等方面的一些基本常识错误。这些问题是证据确凿的，所以毋庸赘述。在此，笔者有一些额外的想法：

1 网络安全技能短缺影响了Target

环境、社会和治理研究报告(ESG)数据显示，39%的企业组织表示，其最大的事件响应挑战是“缺乏足够的员工”，28%的企业声称其在事件响应和检测上最大的挑战是“缺乏足够的技能”。《商业周刊》的文章显示，Target的安全操作中心(SOC)经理在10月离开了公司，正值数据泄露的前夕。其他SOC人员对其经理的技能过于依赖，因而网络攻击者恰恰趁机击中目标。ESG报告还假定网络罪犯能够提前使用一个默认的BMC软件产品的管理员密码。当然，也有可能仅仅是因为一个工作过度的IT安全和操作团队错过了这个明显的漏洞。最后，当FireEye反恶意软件系统及其在印度支持网络安全的人员发出警报时，Target的网络安全负责人却没有及时采取行动。显然，FireEye和印度团队已经各司其职，但这些警告后仍然需要Target的安全团队对于事件做进一步调查。

2 网络边界的概念是古代历史

10年前耶利哥早已警告过“消除边界”的必要性。自那时以来，尽管百般谨慎，却仍然难免事故。Target数据泄露事件始于其零售商之一，网络边界外的一个小的供热与空调公司。这只是盲目的猜测，但必须相信此公司不是由前NSA网络安全专家经营的。当然，第三方供应商、业务合作伙伴和客户都需要访问网络，但Target让这些所谓的外界人士只需提供基本的用户名和密码进行身份验证即可访问网络。所以Target在没有用适当方式管理网络供应链风险的情况下，武断地向外界开放了网络，犯了常识性错误。

3 事件响应已成为网络安全的瓶颈

信息安全很多最佳实践重视事故预防，包括硬件系统的配置、访问控制、杀毒软件等。2010年前后发生的APT[注]攻击事件证明，狡猾的攻击者都很善于规避现有的安全控制，所以安全行业将注意力转向各种事件检测和分析的工具。我们现在把三分之二的时间和精力放在攻击过程，但是事件响应呢?不幸的是，很难解决这一困境，因为事件响应是高度专业化的，需要精确的网络设备的详细信息，包括流量模式、历史记录、系统配置等。当Target SOC团队收到来自FireEye和印度的警报时，他有一个选择：调查警报，即当警报发生时，系统是如何被影响的，IP地址怎样做了妥协，是什么改变了网络系统等等，通过调查来剔除假的警报。这种调查过程需要花费时间、技能和高度的严谨。安全分析可以起作用，但是仍然需要专业的技术人员。Target团队未能做这些必要的工作，反而将赌注押在“假攻击”和真正数据泄露上。

4 基本的攻防手段仍然很重要

网络安全已成为一个对先进的技术技能要求颇高的行业，这已成为共识。Target可以在其POS系统上安装应用程序控制软件，以阻止安装所有未经许可的软件。最后，Target应该改变BMC软件上的默认密码，需要对管理员进行多重身份验证并监视所有特权用户活动。这是网络安全最基本的手段，也是最必要的。

随着越来越多的细节出来，显然Target会遭到些许调侃，但确定的是，从经验和上述研究分析的大量结论来看，参议院的报告远比大多数人想象的情况普通得多。在下一个大的数据泄露事件爆发时，对Target的关注很可能会很快消退。鉴于网络安全的状态，攻击是随时可能会发生的。