AU Blogspot

               Thanks to Nick Cueva for permission to use this Photo. 

There isn’t a profitable business segment today that isn’t competitive and that even includes the SPAMMING industry.  Two of the biggest Spamming organizations, Nugache and Storm are currently going at each other head to head to dominate the SPAM/malware market.  Yes, there is a market for SPAM and malware.  Surprised?  These organizations are not owned and operated by legitimate business people.  No in is yet sure who is behind Storm but many IT security experts feel that Nugache is linked to the Russian Mob, aka the Russian Business Network. 

Both of these organizations distribute SPAM through Zombie networks and both have been involved in highly criminal activities.  Zombie networks are composed of PC’s across the globe, which have been compromised by some type of Trojan Horse which allows the Zombie controllers to then use them to send SPAM, conduct phishing attacks or other types of illegal activities.   Each of these organizations control hundreds of thousands of computers.  Take Storm for example.  Some IT security experts have estimated that the Storm Zombie network, called the Storm Botnet, runs anywhere from one to fifty million computer systems.   Even the most conservative estimates place the size somewhere around 150,000 to one million.  The Storm Botnet in 2007 accounted for 8% of all malware on Microsoft Windows computers. 

This year, Storm has an extremely viable competitor, Nugache.  Although its zombie technology is not as sophisticated as Storm’s (for instance, Storm is somehow able to send SPAM in the native language of the receiver while Nugache cannot) Nugache has a big thing going for it right now, price.  In an attempt to unseat Storm from its botnet dominance, Nugache has initiated a price war.  Nugache will send one million emails for only $100.  For $800 you can send 10 million emails. 

It is because of the ridiculously meager amount of money that is required to SPAM a million people that SPAMMING is very profitable, even if the response rate to SPAM is only .01%.   It is the sophistication of these controllable zombie networks that worry IT security professionals.  Many fear that the current war for control of the malware market is only the beginning of this illegal destructive industry.

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University

The 2008 Global Information Security Workforce Study was recently released.  A total of 7,548 professionals in the field were surveyed.  The complete study can be downloaded at https://www.isc2.org/cgi-bin/content.cgi?category=510 

The most interesting headline from the study was the fact that 70 percent of all respondents reported that their own employees are the biggest threat to their organization’s security.  This is contrary to the common belief that organizations must throw most of their resources at the outside perimeter of the organization’s network to prevent outsiders from accessing their network.   

This premise is supported by a recent finding that email is now no longer the number one manner in which viruses access an organization’s network.  With the ease at which employers now bring in thumb drives, personal laptops and PDA’s.  Network security plans must focus on an umbrella approach that guards the entire network. 

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University

   Thanks to NASA, ESA-Hubble Collaboration for permission to use Photo. 

One of the security weaknesses experienced with laptops and other portable computer devices for many years is the simplicity in which their drives could be compromised if the device is stolen.  This was especially true before Windows XP and Windows 2000 when a thief could simply install a second operating system on the laptop, logon to the new operating system and gain admin rights to all the data on the drive. 

Windows XP and Windows 2000 introduced EFS, Encryption File System, which allowed users to encrypt files of their choosing.  Because the encryption was centered on an encryption key based upon the original operating system, an intruder couldn’t access that file simply by accessing it through another operating system.  However, this required the user to individually encrypt every file or folder in order to protect all of their data.  Needless to say, the majority of users failed to do this.   

Microsoft has introduced a new technology called BitLocker with Windows2008 and premium flavors of Windows Vista.  BitLocker encrypts the entire drive, including the Windows system files necessary for startup and logon, which could give an intruder the ability to discover passwords and logon information.  What’s more, BitLocker utilizes a feature called Integrity checking which analyzes the early boot components and helps to ensure that data decryption is performed only if those components appear unmolested and that the encrypted drive is located in the original computer.  This prevents thieves from stealing your hard drive and putting it into another computer to access the data. 

It will also make it much easier for organizations to recycle old computers as they will not have to worry about erasing data on machines being decommissioned as the drives will be inaccessible.  BitLocker is a great new addition to the Windows operating system and should be implemented by any organization or individual that works with sensitive data.

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University

            Thanks to Donovan Mueller for permission to use this Photo. 

It’s standard practice that if you have an always-on Internet connection, then you should have a firewall, implemented in either hardware, such as a router, or in software.  But even if you are using a dial-up connection, you really need a software firewall to protect you from intrusions.  You would be surprised at the number of attempts to get into your PC a good software firewall will block on a PC using dial-up.  A firewall will also notify you of attempts to go out to an Internet website.  You can then allow or disallow the outbound traffic.  You would want legitimate programs such as Windows to access the company’s website for update purposes, but you’re safer to block any programs that you don’t recognize from doing so.  Be sure to check for correct spelling.  Say you have Symantec’s anti virus program on your PC and have set it up for automatic virus signature updates.  Your firewall will ask you whether you want to grant the program permission to go outbound.  But some malware could identify itself as Symantek.  Should you allow it to access the Internet, you could be in for an unpleasant surprise. 

Yes, it’s unfortunate that there are so many nasty things that can happen to your computer.  And thwarting such attempts can cost you time and money, but you really need to do this.  At minimum you need a firewall, an anti-virus program, and an anti-spyware utility.  You’ll also need to update the anti-virus and anti-spyware programs’ signature files at least once a week, as well as scanning with each at least once a week, more frequently if you are online daily.then you should have a firewall, implemented in either hardware, such as a router, or in software.  But even if you are using a dial-up connection, you really need a software firewall to protect you from intrusions.  You would be surprised at the number of attempts to get into your PC a good software firewall will block on a PC using dial-up.  A firewall will also notify you of attempts to go out to an Internet website.  You can then allow or disallow the outbound traffic.  You would want legitimate programs such as Windows to access the company’s website for update purposes, but you’re safer to block any programs that you don’t recognize from doing so.  Be sure to check for correct spelling. 

Say you have Symantec’s anti virus program on your PC and have set it up for automatic virus signature updates.  Your firewall will ask you whether you want to grant the program permission to go outbound.  But some malware could identify itself as Symantek.  Should you allow it to access the Internet, you could be in for an unpleasant surprise. 

Yes, it’s unfortunate that there are so many nasty things that can happen to your computer.  And thwarting such attempts can cost you time and money, but you really need to do this.  At minimum you need a firewall, an anti-virus program, and an anti-spyware utility.  You’ll also need to update the anti-virus and anti-spyware programs’ signature files at least once a week, as well as scanning with each at least once a week, more frequently if you are online daily.

Dave Ronan
Computer Training Instructor
Ashworth University

               Thanks to radiorover for permission to use this Photo.

The following interview with Robert Moore illustrates the apathy that is still amazingly apparent in the IT industry today despite the strong awareness of IT vulnerabilities and the importance of tightening security for all organizations and even home users.  It also shows how easy it is for even computer novices to break into network devices.   

A quick Google search for sites showing the default passwords for just about any computer or network device sold on the market in the past decade can be easily found.  Many of these sites are not developed for malicious purposes.  The fact is that network devices are constantly resold and recycled.  This requires that the device be reset to its default configuration to erase the settings made by the original owner.  In order for the new owner to configure the device, he or she must know the default password credentials in order to access the device.  Because the original device documentation is often missing, these default password sites are vital. 

These sites make it even more important to immediately change the password for any newly purchased network device.  Recently, I heard a high school student inform me that he regularly accesses his neighbor’s wireless router by using the default logon for the device.  By doing this, the student can use his neighbor’s DSL connection for free.

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University

 
                Thanks to J. Parks for permission to use this Photo.

Microsoft recently unveiled their Forefront Security Application Suite that provides antivirus protection as well as Spam and spyware protection.  Forefront provides network protection at client, server and enterprise edge level.  Due to the pricing and licensing structure that Microsoft offers their enterprise customers for their products, Forefront is sure to make a big splash on the marketplace and offer strong competition to industry leaders such as Symantec and Norton.   As a network security specialist, it’s absolutely vital that you stay in tune with soon to be mass-market security applications such as Forefront, so be sure to check into this blog often as I continue providing weekly updates.  Let me know if you have any questions and feel free to share your thoughts in the comments section.  We’ll talk again soon…

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University

              Thanks to foundphotos for permission to use this Photo. 

The SANS Institute, an organization dedicated to computer security training, certification and research recently released their Top Ten Cyber Security Threats for 2008.  Below is a summary:
           

1. Attacks via web browser vulnerabilities, particularly plug-incomponents such as QuickTime and Flash.  Many of these plug-ins are rarely updated. 
2. The growing sophistication of Botnets.  The most popular exampleis the Storm Trojan which accounted for one in twelve virus infections only a week after its release.  This new breed of botnets uses peer-to-peer control rather than a centralized controller that can be eliminated. 
3. Cyber espionage, particularly economic espionage conducted bynation states 
4. As Mobile phones are become general purpose computers, worms,viruses, and other malware will increasingly target them 
5. Insider attacks by rogue employees, consultants and contractors.These threats will result in the further limiting of the cyber rights and abilities of employees. 
6. Identity theft performed by persistent bots.  These bots notonly target email addresses, bank accounts information and passwords but even the cyber behavior of users that can be later used forextortion. 
7. Increasingly malicious spyware 
8. Web Application Security Exploits are constantly being targetedas so many applications today are web based and can be targeted by hackers. 
9. Social Engineering continues to be widely utilized.  Phony taxscams are very popular today. 
10. Infected Consumer Devices such as USB drives that can containmalicious code or espionage based applications that can attack acomputer in a matter of seconds when the USB drive is inserted into a computer. 

Brad Rudisail
Computer Network Technician-Network Security Instructor
Ashworth University