Securing the Cloud

The Mobile Phone Spear-Phishing Experiment

ecozonac — Thu, 29 Oct 2009 19:34:48 +0000

Three of the most popular smartphones — iPhone, BlackBerry, and Palm Pre — fell victim to a recent spear-phishing experiment that sent users a phony LinkedIn invitation from “Bill Gates,” according to the security expert who conducted the research.

The experiment, which was aimed at measuring the effectiveness of email security controls in several major products and services, demonstrated just how powerful social engineering can be and how little technology can do about it. Joshua Perrymon, CEO of PacketFocus, sent a spoofed LinkedIn email to users in different organizations who had agreed to participate in the test; he was able to get his spoofed message through 100 percent of the time. He tested 10 different combinations of email security appliances, services, and open-source and commercial products; four major client email products; and the three major smartphone brands. (Full article)

Cloud computing’s dual identity

ecozonac — Thu, 29 Oct 2009 01:21:41 +0000

Gordon Haff is exploring the different opinions regarding the true nature (and definition) of cloud computing (read the full article here).

“… It’s not hard to understand why there is a fair bit of confusion. Cloud computing has become a sort of blanket term for where computing is going. Think of it as a synonym for “computing.next.” It represents a shift to an operational model in which applications don’t live out their lives on a specific piece of hardware and in which resources are more flexibly deployed than was the historical norm.

Cloud computing is therefore not a single technology or even a single approach but rather a collection of technologies and approaches that collectively represent the direction that computing is headed. I see nothing wrong with this. Many of the benefits espoused for these new approaches to computing are genuine. To the degree that “cloud computing” offers a convenient rallying point to get users headed there, that seems for the good. …”

Phishers publish your account username and passowrd

ecozonac — Tue, 06 Oct 2009 20:53:01 +0000

Lists containing tens of thousands of stolen email account usernames and passwords have shown up online over the past few days in what researchers say likely came out of multiple phishing attacks. (Read more…)

Phishing – hiding the tracks

ecozonac — Wed, 30 Sep 2009 01:50:03 +0000

A (presumably Eastern European) gang used infected and fake websites to spread a trojan, a piece of malicious code which, once installed, can access all the data on the infected machine.
From a command and control server hosted in the Ukraine, the code was installed on the computers of bank account holders.

The trojan received specific instructions about how much money to steal from each account as well as the details of the money mule’s account into which the money was transferred.

The code included very specific criteria to make sure the bank accounts of victims were not completely emptied and to ensure the amount being stolen was not so high that it would be detected by banks’ anti-fraud systems.

In 22 days they managed to get €300,000 ($440,000) in 22 days.
What’s really impressive is that the Trojan also modified the bank statement so that the user would not notice the unauthorized withdrawal. In once instance the statement was showing €53.94 was transferred. In fact €8,576 was stolen.

Just for fun . . . lost floppy drive

ecozonac — Tue, 22 Sep 2009 20:06:12 +0000

Courtesy of eatliver.com

Lost floopy drive

The “chat-in-the-middle” scam

ecozonac — Mon, 21 Sep 2009 12:03:06 +0000

RSA reports a new variety of phishing attacks where the user discloses his security credentials on the phishing site and is also presented with a live chat window, which presumably can get even more info out of the unsuspecting victim.

Ads – the new malware delivery format

ecozonac — Wed, 16 Sep 2009 09:21:21 +0000

Instead of hacking into major online sites to embed malware, malicious hackers are going in through the front door by exploiting security holes in systems for delivering ads.

It happened just days ago, for instance, to the Web site of The New York Times. The newspaper company informed readers on Sunday about a rogue ad that was popping up on its site. The ad warned visitors to NYTimes.com that their computer may be infected with a virus and redirected them to a site that purports to scan the computer and offers to sell antivirus software.

This is common behavior for what is known as fake security alerts, or “scareware,” designed to trick people into paying for something they don’t need. Use of this type of scam is on the rise.

Typically, the site hosting the rogue alerts has been compromised, or a worm, like Conficker, distributes the alerts directly to computers.

Read the rest of the article here…

Bruce Schneier on Cloud Security

ecozonac — Sat, 12 Sep 2009 10:21:27 +0000

http://www.v3.co.uk/vnunet/video/2240924/bruce-schneier-cloud-security

Shared via AddThis

iPhone 3.1′s anti-phishing: not better than nothing?

ecozonac — Fri, 11 Sep 2009 06:00:13 +0000

Here is another example of trying to create a perceived sense of security – the iPhone anti-phishing feature in principle sounds like a great idea, but it’s probably up there with the “anti-phishing toolbars”.

Inconsistent protection is in many ways worse than no protection at all, as it lulls users into thinking that they’re perfectly safe behind a brick wall. Unfortunately, that wall may be a lot more like a bead curtain

FULL ARTICLE

NIST.gov Presentations: Effectively and Securely Using the Cloud Computing Paradigm

ecozonac — Tue, 08 Sep 2009 15:31:23 +0000

NIST is posting its working definition of cloud computing that serves as a foundation for its upcoming publication on the topic (available below). Computer scientists at NIST developed this draft definition in collaboration with industry and government. It was developed as the foundation for a NIST special publication that will cover cloud architectures, security, and deployment strategies for the federal government.

Draft NIST Working Definition of Cloud Computing v15

Presentation on Effectively and Securely Using the Cloud Computing Paradigm v25