Earlier this week, I wrote how modern day targeted attacks don’t lend themselves to today’s security solutions. I’d like to follow up those thoughts by exploring strategies for combating these types of highly calculated threats.
While organizations focus on their business growth, they are also forced to contend with cyber criminals targeting their corporate networks to steal valuable information that can make them lots of money. As a result, evolving fraud professionals are truly changing how businesses protect their private data and fight cyber crime. Continue reading this post…
Yesterday, we saw yet another example of how antivirus — not malicious code — can leave thousands of PCs useless.
What intended to be a routine McAfee software update to its antivirus definitions for corporate customers has likely turned into a costly nightmare for the antivirus software maker and many of its customers. Instead of updating the security software, the faulty virus definitions removed the Svchost.exe file, a critical component of the Windows operating system. Continue reading this post…
Targeted cyberattacks that use sophisticated social engineering techniques to exploit network vulnerabilities are creating advanced persistent threats (APT) to enterprise security models like never before. According to the article, “Targeted cyberattacks test enterprise security controls,” these threats pose a more immediate danger to sensitive data of U.S. commercial entities than a full-fledged cyberwar. George Kurtz, a long time colleague of mine and CTO of McAfee, expects these types of attacks to continue.
“These attacks have demonstrated that companies of all sectors are very lucrative targets. [APTs are] the equivalent of the modern drone on the battlefield. With pinpoint accuracy, they deliver their deadly payload, and once discovered — it is too late.”
One of the methods the article suggests to protect systems from targeted attacks is using a whitelist to allow specific traffic over its networks while excluding everything else. Continue reading this post…
On Saturday, a faulty update for 64-bit Windows systems caused the BitDefender anti-virus software to flag thousands of legitimate Windows and BitDefender files as potential threats to the system. According to an article by Brian Krebs, “Bad BitDefender Antivirus Update Hobbles Windows PCs,” the glitch caused quite a stir with users who expressed their concerns on the antivirus firm’s Twitter page.
BitDefender later issued a statement to users saying it was creating a patch that would restore the quarantined files. The company also posted a partial recovery for users to follow, but that was met with more disconcerting Tweet’s from users saying that after following the instructions they were still unable to boot up their computers.
To make matters worse, BitDefender has also reportedly warned users that malware writers are issuing fake downloads that fix the problem. The company is advising users to download the fix only from its website.
This story appears to be another example of the escalating problems antivirus solutions are experiencing with bad system updates. The inability to effectively stop malicious code from exploiting system vulnerabilities is causing more work and frustrations for security professionals and users, alike. Including application whitelisting as part of a company’s endpoint security strategy not only prevents malicious code from executing, but also eliminates the risks that can accompany updates.
Last week, a new exploit technique was disclosed that bypasses a critical Windows security feature, DEP (data execution prevention), as well as an ASLR security enhancement for address space layout randomization.
In the article, “New exploit technique nullifies major Windows defense,” some researchers worry that a proof-of-concept code published by Google security software engineer, Berend-Jan Wever, could actually lead to more successful attacks against Microsoft’s newer operating systems.
While Wever claims the proof-of-concept doesn’t do any harm because it’s wrapped around an exploit of a bug in Internet Explorer 6 (IE6) that was patched years ago, MicroTrend’s Ria Rivera wrote in the company’s malware blog that the exposure could be used to further enhance exploits, and expects to see it used within exploits soon.
“After Wever released his heap-spraying exploit codes in 2005, a lot of new exploits started using that technique. It would thus be not far-fetched that the release of this new proof-of-concept could lead to the same scenario — new exploits could start using ‘return-to-libc’ to achieve DEP bypass.”
With so many data compromises arising from the latest disclosed vulnerability it seems so clear that now is the time to completely re-evaluate the way we approach desktop security. Vulnerabilities lose their power when you address the core issue of controlling what applications are allowed to run on your system in the first place whether these applications were added by a user or by malicious code exploiting a security hole.