CTO Security Report


600,000+ Mac Computers Infected

While this kind of activity wouldn’t rouse much attention from those esconced in WinTel (Windows and Intel) architechures, it is much less common for Mac users to be impacted by infections on this scale so quickly.  The infection, called Flashback, is installed via a Java vulnerability (CVE 2012-0507) which was patched in February by Oracle.

Apple purportedly denied Oracle the ability to directly patch it’s Macs and only recently released the Java update this week, meaning that the window of infection for Mac users was about 50 days.  This is a long gap for those defending against the infection, which has now spread to over 600,000 users with what looks like an intent to create a botnet.

Read More: http://www.bbc.co.uk/news/science-environment-17623422
How to Remove: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml

Facebook Mobile Security Vulnerability:

When you authenticate against a service, you are typically provided something called a token.  A token is typically a long, hard-to-guess string of letter and numbers which uniquely identifies you to the system, and prevents you from having to submit your username and password every time you want to interact with the system.  It is a convenience.  Tokens become a security vulnerability, however, when they are stolen in order to allow someone to masquerade as you (for a period of time until you logout).  Tokens should not be stored in plain text if possible.

Unfortunately, this is exactly what Facebook mobile does for it’s mobile application on iOS and Android — it stores the token in plaintext and the permissions of the file are such that they allow other applications to read from it.  More concerning is that even if this is fixed, the way that the token is used by games that leverage facebook means that specific game applications could be leaving the token in plain sight as well.

Facebook is reportedly working on a fix that will secure the token from rouge applications or USB downloading (the finder of the vulnerability has written code to steal tokens automatically from iOS devices) but hasn’t yet released a fix for this.  It may only be a matter of time before we see some Android malware varients geared to take advantage of this to threaten Facebook users and applications which use its services for authentication.

Read more: http://www.pcworld.com/article/253278/facebook_security_hole_found_on_iphone_android_devices.html
Anonymous Strikes Chinese Government:

Anonymous has targeted the Government of the Peoples Republic of China and successfully defaced ~500 websites this week as part of a campagine to educate Chinese users on how to subvert goverment censorship of the internet.  Anonymous has often targeted NGO and Governmental organizations alike for censorship, and it is likely that we will see this campagin continue and expand.  China, like the United States, has many governmental organizations with web presences that are likely untested, soft targets for hackers.

Read More: http://www.theregister.co.uk/2012/04/05/anonymous_china_hacks/

Anonymous #OPGLOBO Begins

This week Brazilian hackers affiliated with Anonymous began hammering Brazilian media empire Globo for its history of and current censorship and strong governmental ties.  Hackers quickly enumerated the many domains and subdomains owned by the company and launched a variety of attacks against them including scripting injection fuzzing and distributed denial of service.  At the time of writing, several sites owned by Globo are so slow as to be unusable and attacks are still occurring.

Read More: http://www.ehackingnews.com/2012/04/opglobo-brazilian-tv-network-and-other.html

New Cybersecurity Bill Working Through Congress:

The Cyber Intelligence Sharing and Protection Act or CISPA for short is a bill introduced to Congress which is designed to make computer security laws easier to enforce by allowing ISP’s and security companies to more easily collect information on and share information about computer security both with each other and especially with Uncle Sam.

Already portions of Internet communities are in unrest about this bill because of its ability to indemnify information collection and sharing by and to private companies and the subversion of many privacy laws.  Proponents of the bill argue that this information is needed to slow the flood of stolen intellectual property flowing out of the United States on a daily basis.

Some proponents of this bill include companies such as IBM, Intel, and Facebook, but we saw similar corporate sponsorship of other wildly unpopular bills in their early days as well, so that really doesn’t mean much.

You can read the full text of the bill here: http://www.gpo.gov/fdsys/pkg/BILLS-112hr3523ih/pdf/BILLS-112hr3523ih.pdf
And a fairly impartial presentation of the bill here:
http://www.digitaltrends.com/web/watch-out-washington-cispa-replaces-sopa-as-internets-enemy-no-1/

Sign up for your free CTOvision Pro trial today for unique insights, exclusive content and special reporting.

CTOvision Pro Special Technology Assessments

We produce special technology reviews continuously updated for CTOvision Pro members. Categories we cover include:

  • Analytical Tools - With a special focus on technologies that can make dramatic positive improvements for enterprise analysts.
  • Big Data - We cover the technologies that help organizations deal with massive quantities of data.
  • Cloud Computing - We curate information on the technologies enabling enterprise use of the cloud.
  • Communications - Advances in communications are revolutionizing how data gets moved.
  • GreenIT - A great and virtuous reason to modernize!
  • Infrastructure  - Modernizing Infrastructure can have dramatic benefits on functionality while reducing operating costs.
  • Mobile - This revolution is empowering the workforce in ways few of us ever dreamed of.
  • Security  -  There are real needs for enhancements to security systems.
  • Visualization  - Connecting computers with humans.
  • Hot Technologies - Firms we believe warrant special attention.

 

Recent Research

Request Your Invite to the 20 May 2014 Andreessen Horowitz Fed Forum in DC

Amazon Hopeful that Fire TV will Spread

What The Enterprise IT Professional Needs To Know About Git and GitHub

3D Printing… At Home?

Tech Firms Seeking To Serve Federal Missions: Here is how to follow the money

Creating The New Cyber Warrior: Eight South Carolina Universities Compete

Mobile Gamers: Fun-Seeking but Fickle

Update from DIA CTO, CIO and Chief Engineer on ICITE and Enterprise Apps

Pew Report: Increasing Technology Use among Seniors

Finding The Elusive Data Scientist In The Federal Space

DoD Public And Private Cloud Mandates: And insights from a deployed communications professional on why it matters

Intel CEO Brian Krzanich and Cloudera CSO Mike Olson on Intel and Cloudera’s Technology Collaboration

solid
About BryanHalfpap

Bryan Halfpap is a software programmer, technology analyst and writer and a driving force behind the security reporting at CTOvision.com He is a frequent speaker at events and conferences including Defcon. You can find him on twitter: @crypt0s