The purpose of this site is to present security issues for the corporate and the individual user.  News
and issues re. the actual security situation will be updated as often as possible to serve partly as one
of the Internet's security references and to some extent as an operational tool for security people.
 

Direct Links to Relevant Security Sites
The table below can be used as your daily index to the most relevant security information vital for
running a secured installation, be it large or small.  Always check out the "Virus News" and the "Malware
/ Attack News" as part of your daily routine. "Windows Issues" may also be of interest, at least monthly.

The table above is updated often, so as to contain direct links to useful and time-saving sites. 
If you have any comments, please send an e-mail to admin@stealthsecure.net

           

Latest News 

More on GOOOOOOOOOOOOGLE and their China Syndrome (13.+ 15. Mar 2010)
Remember the debacle re. the attacks on Google mid February?
C: more @ the Register: Google's China Syndrome
After a quiet period, and the behind-the-scenes bit by Hillary Clinton,
Google is back, fighting. (Hope they stick to their guns).  Over at TOM's
Hardware, there's a good article "China Warns of 'Consequences' in Google's Plans".
This is really interesting - and might result in a very protracted battle, potentially
ending  with Google's (previously aired) option to withdraw from China (+ DE-INDEX China!)
Update: At TechEYE, there is an update re. the potential consequences of Google's stand against
the oppressive government of China. Seems there are already moves against Google, instigated
by the government for companies (especially foreign ones) associated with Google in any way.

Testing the National BCPs, Scope = USA (21. Feb 2010)
17th Feb.2010 the Bipartisan Policy Center (BPC) conducted the Cyber ShockWave exercise.
A test of a wide-ranging set of disasters to occur at the same time, to evaluate readiness
and response options.  Link to article: Cyberattack cripples US (You mean you missed it?)
No word on findings unfortunately, but may be forthcoming in a CNN documentary.

A misfiring update patch - may cause XP to blue screen (11. Feb 2010 - updated)
The Register reports that MS10-015 KB977165 has caused a number of blue screen episodes, as detailed
on SANS. The problem is random, but none the less very frustrating for those affected.
UPD: Seems most of those affected were actually victims of a Root Kit infection (the TDSS Root Kit)
PRVX has a very thorough documentation of the TDSS Root Kit and the advanced further development
of it, and the way it is deployed - this should be mandatory reading. (The whole sentence is a hyper link)

WGA - or not? (11. Dec. 2008 updated 11. Feb 2010)
Remember the debacle and court case re. WGA? It's all over and decided now.


Nick Farrell at Fudzilla reports that the WGA case is settled - Microsoft won.
So, that's it, WGA is legal, in principle. 

Annoucement re.Cyber Security Month (both in the US and in Denmark)
       
As part of the Cyber Security Month initiative, President Obama explains why security consciousness
is very important when dealing with the Internet, both from a corporate perspective, but also in
relation to what each of us can do.  Two practical references to security sites are given:
OnGuardOnLine.gov & DHS.gov/CYBER, so that  everyone can get practical advice. A very clear
and constructive announcement - an example to follow in the EU.

Interesting Google server RAM observations (Oct 2009)
Google has conducted a very interesting piece of research re. memory errors in their server parks.
This is referred to in the article at the Register, 13th October 2009, here.  The bottom line seems to
be that the harder a memory bank is pushed, the more random errors will occur - temperature is not
the most critical factor, within reasonable limits of course.
This is documented in a report in collaboration with the university of Toronto and the entire report
can be downloaded here: DRAM Errors in the Wild: A Large-Scale Field Study. 
It is of special interest to security-minded users, that ECC-DRAM is of very real importance, and is
of course critical in 24/7 environments.  It has always been a requirement in the server business,
but it is very illuminating to see the actual reasons WHY - so never again doubt the relevance of ECC,
please.

Interesting Google search parameter settings (Sep 2009)
An interesting use of the search parameter qdr (Query Date Range) has been identified by Ran Geva,
CEO of Omgili. It is used to specify the time parameter for the search, for example within the last hour
or second(s). See below examples:
Hour
http://www.google.com/search?q=PCI-DSS&hl=en&rlz=1C1GGLS_enUS340US342&tbo=1&tbs=qdr:d
Minutes
http://www.google.com/search?q=PCI-DSS&hl=en&rlz=1C1GGLS_enUS340US342&tbo=1&tbs=qdr:n
Second(s)
http://www.google.com/search?q=PCI-DSS&hl=en&rlz=1C1GGLS_enUS340US342&tbo=1&tbs=qdr:s30 
(The "30" is the number of seconds in this example.)
Quite useful if you want to the the absolute latest news on a subject, here "PCI-DSS".

Don't forget Internet safety - get inspired here:

Intel's Processor Road map in relation to security (June - Aug 2009)
The Core i7, which is very successful, is undergoing some changes in the future. To make
better way for Core i5, it seems the models 920, 940, 950 and 965 will disappear by end-of-year.
See Bit-tech.net, this article.   All is not lost for X58 workstation owners craving the immense
throughput (coding/decoding, etc.) of this platform.  Even though the remaining 975 will likely
still cost upwards of USD1000, the X58 also supports the new XEON (W)X5X0 family.   Specifically,
several boards from ASUS and DFI support ECC-ram, so long as the processor supports it.
You can also use non-ECC ram, as the processor can fall back to this mode, but this would be defeating
the purpose of using an I7 XEON (W3520'es have been used).   Already a few have tried it, with great success:
i4memory.com/forums (Xeon W3520 + DFI UT X58-T3EH8)
So, chin up - and X58 also seems to support the 2010 6-core XEON; might need a BIOS update.
That is confirmed now.   And 27th August, an additional article in the Inquirer details a test of the
Intel Xeon W3580 CPU and Asus P6T7 WS mainboard - with excellent results.

America's prosperity depends on the Digital Infrastructure (June 2009)
     
The Internet, wireless networks etc. is so critically important to America's economy and for any
future developments that President Obama has made an announcement of a central office at
the White House to coordinate and report to the president on cyber security.  Interestingly,
hacker tools can now termed as "Weapons of Mass Disruption".  And Conficker is mentioned;
that's a first for sure (strengthening this malware's candidature for "Malware of the Year 2009"). 
The most striking point of this very important speech is however, that computers, networks
and other parts of the US National infrastructure, are to be treated as a national, strategic asset -
How about corporations try this approach for a (big) change?   
This might be the greatest moment for the entire security industry - in the coming months we shall
see if this announcement will be picked up on by industry researchers, the specialist and general press.

Link to video:         http://www.whitehouse.gov/video/President-Obama-on-Cybersecurity/
Link to speech:       Remarks-by-the-President-on-Securing-Our-Nations-Cyber-Infrastructure

More Windows SEVEN (April 2009)
Not exactly "more of a good thing" - eWeek.com has an interesting article about the testing of
Windows 7 RC1. There is a good analysis of XP Mode (XPM) and the possible consequences of
implementing this solution in a corporate environment. Bottom line: two desktop platforms to support,
configuration and security integration, server management (+ upgrade to 64-bit servers), and of course,
real compatibility. See more at eWeek.com

Windows SEVEN - If we're lucky, it might be the first decent OS since Windows 2000 from MS
(April 2009)

Why is that? First, performance and stability has been done thoroughly this time around. (many references
support this claim). Now another big-ticket issue seems to have been addresed: C O M P A T I B I L I T Y
Tom's Hardware Guide has the story: "Windows XP Comes Integrated into Windows 7" 
Says it all, but the way it seem to have been done is very well thought through: An actual instance to
Windows XP SP3 runs in a sandbox environment (XPM), enabling all the traditional business apps. to be run. 
That was not possible under VISTA (MEII) 

On the other hand, is XPM all it's cracked up to be?  It might be a very good idea to test XPM with all
relevant business applications before implementing Windows 7, if The Inquirer's thesis is correct as in:
"XP Mode in Windows 7 is a scam - It won't do what you think" by Charlie Demerijan.  Well, Charlie D.
is usually not entirely positive about products from Redmond, but the article's hypothesis seems well
researched - so there is definitely grounds for serious testing of Windows 7 RC1 - XPM.

Adobe Reader's continuing Story of Vulnerabilities and failure to patch timely (April 2009)
Since Adobe's PDF Reader has had such a long history of serious vulnerabilities, F-Secure now
recommend that you use open-source alternative. We agree - see below article from Pdfreaders.org:

Copyright (C) Free Software Foundation Europe, Generated by Webgen on 2009-04-15 01:16:55.
Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
-----------------------------------------------------------------------------------------------------------------------------
(Source of above article: http://pdfreaders.org/)

The continuing Story of Conficker (April 2009)
10th April, Conficker started downloading and installing the W32.Waledac malware which executes
as a rogue Anti spyware application, which tries to trick people into paying UDS49.95 for "Anti-spyware".
See more here.  The W32.Waledac malware is in itself not a high-level threat; it has been detectable
and removable since 23rd December 2008, so it should not be a problem for any users who have updated
and patched their Windows PCs + have updated AV-signatures. 

Disabling WGA - or not? (11. Dec. 2008)
Remember the debacle and court case re. WGA? Here is a refresher:


Just to remind everyone that WGA is legally classified as spyware.
Consequently, it is interesting to note that, over at Overclockers.com, Damir Lukic has written
a good how-to on how to permanently disable the entire WGA. Link to the article,
How To Disable WGA For Good

It you follow the suggested procedure, however, you will not be able to download optional
Windows Genuine Advantage software.  Monthly updates  are still OK. Here is the reversal procedure:

So, it is a choice between removing the functionality of proven spyware versus the full functionality
of Microsoft's extra offerings. When you reverse the process, Microsoft Update insists on re-installing
WGA - and everything is back to normal; as in now Microsoft again continually monitors all software
installation/removal. . .

Even more about the  DNS-patch-saga (10. aug. 2008)
A documented, and successful attack on a fully patched DNS is proving a bit worrying:

On his blog, Evgeniy Polyakov shows what appears to be solid documentation of a
successful attack. The only good news is that this was on a dedicated Gigabit network,
and that it took around 10 hours to execute.

Re. Patch Tuesday July: DNS patch (MS08-037) (13th July 2008)
Apparently this was a lone patch for a certain problem. Far from it:
It's about a fundamental flaw in Domain Network Server(s); the way a URL(www.IBM.com)
is transposed into an IP-address (129.42.60.216).
Read this in-depth article at Security Focus:

An good insight into what really went on behind the curtains, and as to why it is
so important to test and apply the relevant corrections to all DNS-related equipment:
- Windows 2000 & XP PC's,
- Windows 2000, 2003 & 2008 Server,
- Domain Name Servers (CISCO, Juniper, TrendNet, etc.)
Time will show, how successful this was/is.

Drive-by Infection - much more common that the old Virus (03rd July 2008)
Finally a solid piece of research to DOCUMENT F-Secure's report per 1st Half 2008,
in which Mikko Hyppönen details the massive growth in the drive-by download which leads
to Trojans, keyloggers, etc, ad libitum.  This Swiss report, "Examination of vulnerable online
Web browser populations and the 'insecurity iceberg'" by Stefan Frei, Thomas Dübendorfer,
Gunter Ollmann, Martin May provides clear examples and very thorough statistics concerning
this state of affairs.  The worst, and most obvious prerequiste, is the lazy general public. 
This means us, the PC users: We are simply not diligent enough when it comes to patching up
the browsers that we use.  This paves the way for infected websites' malicious code which largely
depends on the use of unpatched weaknesses.   As always, please remember:
95% of (KNOWN) malware CANNOT run on fully patched systems.
That means, however, that not only the operating system must be fully updated,
but of course also all other applications that you might have installed.

VISTA - The Successor getting ready? (22nd January 2008)
VIENNA development plans have been accelerated, according to the Inquirer.
This seems to be Microsoft's final admission that VISTA really WAS a big mistake.
The following screenshot is claimed to come from Windows Seven:

Whatever the origin: a nicer place to be than the cold mountain lakes of VISTA. . .

VISTA - The Final Nail in the Coffin? (19th January 2008)
When people start making well-made parodies of your product - you're in BAD shape.
This video at Blip.tv is simply fantastic, and really looks like a studio effort.
(Internet Explorer best supports this site)  An unauthorized screen shot:

And furthermore - What is Sir Bill Gates really saying here:

Another "Final Nail": InfoWorld has launched a campaign "Save Windows XP".
This is going a bit further than just being unhappy with a "great new product".
Here is the article: "Save Windows XP! The clock is ticking"  and the petition:
                                

Even more about VISTA (13th January 2008)
VISTA's "Long Goodbye" - ie. the file copy bug is still causing problems, as reported here at the Register
KB931770 was supposed to cure this, but seems not to be effective.
But then there is VISTA SP1 - that ought to work.  Apparently not, as The Register's reader Tonya
reports - as she still seems to need 36843 days to copy 80,8 GB. At Microsoft TechNet a problem log of
528 entries discusses issues with and fixes to this problem.  It should be noted that some users have
almost solved the problems, by modifying many system settings, such as disabling the Windows Search
service, tweaking Vista's User Account Control settings and setting Network Interface Cards at half
duplex or auto negotiate.  When VISTA SP1 is released and hopefully quality-controlled, however,
it needs to work as well as, or better than XP, or else VISTA cannot possibly be considered relevant
for the enterprise market or for the loud niche computer enthusiast market. 

Hasta la VISTA . . .Microsoft! (27th November 2007)
The VISTA operating system due for it's first SP (Service Pack) gets another going over, this time
by Mountain Devil Software.  The conclusion is that while VISTA does get a bit better with SP1,
it is still no match for XP.  When XP runs with SP3-beta (close to final version) the gap widens again,
by 4 seconds, in a specific test.  Here is the reference to the original article in CIO TODAY, and the
more colorful version in The Inquirer.

SKYPE Scam and Rougue AntiSpyware (14th November 2007)
A good composite attack being distributed to SKYPE users; however some AV-vendors are on top of it.
There is no "Security Center" in SKYPE. . .  SKYPE will, however, alert users if a third-party application
wants to use resources or tag along - this works quite well.

Time Synchronization . . . (11th November 2007)
Not exactly news, but here's a link to a very thorough document from NIST re. timely (!) and accurate
updating of computer clocks - vital in a network, and also important for stand-alone machines.
Why: Because of security in general, as one of the elements in accurate forensics, and for Internet trading.

VISTA - Totally Unusable . . . (13th October 2007)
Some real  BAD news: Downloading a piece of subscription software (Webroot SpySweeper):
Windows ME-II (VISTA) estimated, initially 1 HOUR 11 MINUTES, later 3 HOURS 4x MINUTES . . .

After 1 hour, this discouraging status window caused absolute frustration. . .

As an alternative XP was launched. Here the estimate was, guess what; 1 MINUTE 20 SECONDS
and it managed to do this even faster . . .  (1 minute 11 seconds)
This is a live example of why VISTA (ME-II) is just UNUSABLE.  The VISTA, by the way still treats
a 4Mb/Sec ADSL like a 57 Kbits modem line connecting to f.ex. www.ibm.com. 
The entire communications interface simply needs re-writing - no further comment necessary.

VISTA - Microsoft's Albatross and MORE . . . (29th September 2007)
The time is up for VISTA according to this article at the Inquirer, pointing to the original article by
Don Reisinger in "The Digital Home".  While this may be a somewhat drastic conclusion, the facts
concerning VISTA's history provide solid grounds for serious reconsideration regarding VISTA's future.
Corporate and private users alike are staying away from this OS for mulitiple, valid, technical reasons.
Combined with Microsoft's tacit admission that all is not well in VISTA-land, by prolonging the shelf life
of XP and making available an "XP-downgrade program", is further evidence that things may not even
be on the mend for this ailing OS.  A few facts: 

1. There is still serious performance issues re. file handling, anyone can try this for themselves,
2. Very poor Internet browsing performance,
3. Driver issues - yes, it has improved quite a bit during the past 7 months, but not enough,
4. Huge network configuration challenges, AND some serious compatibility issues,
5. Unworkable user experience (UAC) - causing serious loss of productivity,
6. Very high computer hardware requirements, while STILL losing performance.
   (The above issues have been noted at our own installation, and quoted HERE)

ALL the above issues, plus many others, will need to be corrected, and must prove to be stable for
at least 6 months before any corporate users will feel comfortable launching a VISTA upgrade program.
The same can be said for many private users, for whom a significant investment in a new computer
may be a non-trivial issue.  One can only wonder, how well Microsoft feels all this is going. . .

A new STORM WORM - Important Update, Giant BOTnet ready for action!
The honeypot e-mail account now picks up ONE e-Greeting card per day;
maybe millions of other accounts/users get them as well. . .  More at Malware News

VISTA - Admission from Microsoft - finally, 26th July 2007
As everyone knows, VISTA has not been the most successful software release, but it is a significant
step to take for Microsoft to publicly admit failure.  The Register discusses the issues and point to
the fact, that only 650 applications were VISTA ready by the time of launch - an all time low.
Acer and Dell were forced by customers to re-launch Windows XP as preferred installation OS.

F-Secure's Half-year Malware Report - well-researched as always:
EXCELLENT half-year statement from F-Secure - please take the time to see/hear
Mikko Hypponen's report at the F_Secure Blog, it is really good and quite thorough.

Here's SKYPE - with a warning:


UPDATE: VISTA's Long Goodbye   Deleting files in VISTA can take HOURS for large multi-media
files... Apparently a result of either a basic construction flaw or a result of DRM measures
(often called DRM infection by now).  This article at The Register explains the details. 
This is not just a user issue. Corporations need to make sure this issue is corrected before
any roll-out takes place.

The biggest Internet Heist of all Time (TJX) May 2007)
A good article at The Register reveals the attack angle and the methods used to fraudulently use up to
45.7 MILLION credit & debit card numbers. There is also an assessment of just how much this will end
up costing TJX - not good!

SKYPE update (4th April 2007)
A very clear explanation at Heise Security explains the trick behind SKYPE's virtual routing technique.
Scary for corporate network administrators. . .

Wondering about VISTA? (4th March 2007)
Putting VISTA in perspective, now that the OS is on the market, or, in the Wild if you prefer,
the first rounds of practical experience have been gained, like missing drivers.  And so it is also
possible to make valid guesstimates at the implementation schedules around the globe.  One very
good article at The Register argues that VISTA might "spread" significantly slower than XP or
Windows 2000.  The article also points to very healthy issues for the computer industry in general,
however not for the costumers.

And now to something completely different: "Piracy worked for us"  (01 February 2007)
According to New York Times pirated software helped Romania  build a vibrant technology
industry, Romanian President Traian Basescu told the company's co-founder Bill Gates on Thursday.
 
"Piracy helped the young generation discover computers. It set off the development of the
IT industry in Romania," Basescu said during a joint news conference with Gates.

"It helped Romanians improve their creative capacity in the IT industry, which has become
famous around the world ... Ten years ago, it was an investment in Romania's friendship
with Microsoft and with Bill Gates."   Full article at New York Times.

Yet another Word vulnerability - unpatched, like the 3 previous ones from December
When the infected Word document is opened, it uses an exploit to drop some files onto
the computer. These files are back door Trojans that enable an attacker to gain remote
access to your computer. It was discovered by Symantec, 25th January 2007.


The NORDEA Phishing Incident, 19th January 2007,updated 25th January:
Reported World wide, the phishing actually took place during the past 15 months.
It was the "Rakning.exe" ie. Haxdoor infection which was reported in August 2006.
The malware was well-made, however, using a root-kit to conceal the installation.
 
Now, perhaps Information Security will be taken a BIT more seriously. . .
Many links to this interesting piece of news: The INQUIRER, The Register,  C|NET
(You know you've made it BIG when you get on C-NET. . .),  ZDnet.uk and on
the Indian site AnandTech's DailyTech. 
An article in the New York Times 25th January supplies the latest  news regarding
the investigation, here: Online Nordic Banking Theft Stirs Talk of Russian Hacker

Nature Imitating Art, 12th January 2007:
 The Pirate Bay wants to acquire a micro nation to establish a safe haven for "freedom of
information enthusiasts". The specific location is the micro nation and platform Sealand, just 10
kilometers off the English coastline. This is almost parallel to "Cyber Nation" described in
Tom Clancy's co-authored best-seller of the the Net Force series (2001).  And the objectives
may also be similar and one can be fairly sure that, if The Pirate Bay is successful, a new large
Internet site and perhaps also a shady ISP will see the light of day.  So, the scene could be set
for a virtual nation, with a very real economy. Let's see how this one turns out, and especially
how the international community reacts to this scenario...

http://www.fantasticfiction.co.uk/c/tom-clancy/cybernation.htm

ADOBE Vulnerability, 10th January 2007:
The Chaos Computer Club hacker group in Germany recently discussed an Adobe Acrobat Reader flaw
that affects both Firefox and Internet Explorer browsers. While initially thought to only cause exposure
to random code on Web sites, the vulnerability can also expose the contents of a user's local hard
drive to hackers. To address the problem, upgrade to Adobe Reader 8 immediately, or install
the patch from Adobe: http://www.adobe.com/support/security/bulletins/apsb07-01.html

Quicktime flaw, 10th January 2007:
Secunia has a critical warning re. APPLE Quicktime 7.x, which may affect all platforms that are able
to run this software. The vulnerability is caused due to a boundary error when handling RTSP URLs.
This can be exploited to cause a stack-based buffer overflow via a specially crafted QTL file with
an overly long (more than 256 bytes) "src" parameter (e.g. "rtsp://[any character]:[>256 bytes]").
Successful exploitation allows execution of arbitrary code and requires that the user is e.g. tricked
into opening a malicious QTL file or visiting a malicious web site.
The vulnerability is confirmed in version 7.1.3.100 (Windows version) and affects both
Microsoft Windows and Mac OS X versions.

ID Theft Gang busted... but managed to hide large parts of their operation. 18th December 2006
This may be the largest organized ID Theft bust yet, read on at: ZDnews.uk


VISTA - Revolutions?    

Microsoft's new operating system, VISTA is named thus to engender a feeling of new
horizons of performance, productivity, etc., as VISTA is also another word for "horizon". 
However, there is also a whole new "VISTA" in the EULA - new horizons of LIMITATIONS!

While there has already been some discussion re. the limitations in transferring a VISTA
license from an old computer to a new one, the following article at Security Focus raises
very disturbing issues for those in the hardware/security business who need to test an
operating system, and as a consequence, will have to move the system around on different
platforms.  It also concerns the use of virtualization, which is prohibited (but technically
fully possible) except for the Business and Ultimate versions.  See the article here.
(Source: Scott Granneman, Security Focus)

Great article at Toms Hardware on malware and the necessary countermeasures 
- Welcome to Your Worst Malware Nightmare   It is really a good eye-opener. . .
The moral of the story is that at least a 4 - layer malware solution is REQUIRED today.
Our recommendations go far beyond this for stand-alone workstations; a full 10-layer solution
(including hardware) combined with best practice procedures including a weekly scanning
using 3 extra scanners should be used.
This has proven 100% effective! (Measured over a 3 year period) 
So, one might have to live with a few "security stumbles" where all this great security
accidentally falls over each other and prevents the full display of certain
Web sites, but such is the price for bullet-proof security.

Per 30th October 2006 there are 154.696 known variants of malware "available"
on the Wild Wild Web - do you feel lucky?

NEWS!: Have a look at F-Secure's  World map service - Very well designed and informative!

WGA - creating debate and a lawsuit
Intended to be the legal instrument of Microsoft this software is landing Microsoft in court.
(See more at "Malware News")  This is because the software can be legally classified as malware.
There are issues both for the private and the corporate user.

New trend emerging: De-perimeterization. 
As companies increasingly need borderless environments, either through multiple acquisitions or
working in changing geographical situations, the cell-based security principle is gaining ground,
perhaps to become a new industry standard. See more at: www.opengroup.org/jericho

Incident Watch

To keep current when outbreaks occur the following two sites offer a good overview:

   
HackerWatch.org                             dshield.org                         

 (back)
 

Send mail to admin@StealthSecure.net with questions or comments about this web site.
Copyright © 2005 - 2010 StealthSecure.net - Copyright of all documents and other content belonging to this site by StealthSecure.net. 
It is illegal to copy or redistribute this information in any way without the expressed written consent of StealthSecure.net.
Adverse consequences of the uses of, or reliance upon, information obtained from StealthSecure.net cannot be made
attributable to the owner(s) of StealthSecure.net.                                                                          Last modified: 01/02/10