So this week, Google finally announced that they were leaving the Chinese market as we all expected. The end result was that their google.cn searches were being redirected to their equivalent search results from the Google Hong Kong site. These uncensored results are being displayed in simplified Chinese so they are targeted to the People's Republic. That's a very clever way of bypassing the Chinese law that dictates that searches for certain terms within China have to be censored. That very law is what enacted the Great Firewall of China, which blocks many web sites from being accessed from inside the country. I'm not sure if their Honk Kong site redirection will be very effective in reality though because if a Chinese person searches a censored topic and Google HK provides a list of real-world uncensored results, that person will still be unable to access those sites from within the great Firewall of China. It would be sort of like making the wall transparent: you can see through it but you're still trapped behind. I could be wrong but it looks as if the Google stand for liberty is pretty futile.
What's worse, if they try to serve the sites from their cache, they run the risk of being blocked by the Chinese government, therefore leaving their HK site out of the wall.
Google have marketed their move out of the country in a very clever way as the defenders of democracy and free speech but I don't have very clear what their real intent is. There's a theory that says that their business in China was doomed to begin with, that they can't possibly beat Baidu as the number one search engine in the mid-term and they already wanted out. If this theory were true, Google would be using the Free Speech fight as a way of covering their retreat. Whatever their real reason is, there's something nobody can deny: they are masters at marketing.
Showing posts with label IT industry. Show all posts
Showing posts with label IT industry. Show all posts
Thursday, March 25, 2010
Friday, March 12, 2010
It's botnet shutdown season
Lately it seems to be botnet-takedown season. For one, Microsoft went the legal route and ask a judge permission to reroute domain name servers related to the Waledac botnet in order to shut it down permanently. Actually, the process is more complicated than that but the domain server procedure was the only non-technical issue that needed external approval.
Then, Panda announced that after a few months of investigation, they provided enough data to the police so they could apprehend three criminals behind a huge botnet managed from Spain. Second takedown of the month and a pretty big one at about 13 million bots involved.
Lately, a few industry researchers followed quite a few Zeus Command and Control servers to a single provider and managed to cut their internet connection, therefore stopping those botnets from working at all. After a few reconnections and counter-attacks by the provider, apparently it's shutting down for good. Third take-down of the month!
These three stories have a single enemy in common: botnets. They have quickly become the biggest enemy of the computer user, but that's not new. What's more recent is the fact that they have become so popular among criminals as a quick way of making money that the criminal underground is steaming with new tools to create and maintain botnets for profit. This "new" software category has become a market that criminals are exploiting to trade with other criminals. Of course there's also fraud in there but who are you going to complain if a fellow criminal scammed you? There are figures like the garant who can verify if the seller is legit. It's some sort of escrow system where some trusted people check the product before the transaction goes through. It's like a real market where malware weapons are being exchanged for money.
Botnet-DIY Kits like Zeus are being sold by thousands of dollars. Piracy is so rampant that the Zeus author has put anti-piracy measures in place. Now, there are some other groups that regularly crack those protections and sell pirated versions of the kit for a lower price. Honor among pirates is a thing of the past and the poor user is the one who will suffer.
The only hope we have is to keep hammering C&C centers, disconnecting them from the internet until they all get the message that letting criminals establish botnets is as bad as being accomplices of the criminal act. This is the only way of getting rid of "bulletproof" hosting providers that ignore abuse complaints and are uncooperative with the police. I hope we keep taking botnets down... it's been a good month.
Then, Panda announced that after a few months of investigation, they provided enough data to the police so they could apprehend three criminals behind a huge botnet managed from Spain. Second takedown of the month and a pretty big one at about 13 million bots involved.
Lately, a few industry researchers followed quite a few Zeus Command and Control servers to a single provider and managed to cut their internet connection, therefore stopping those botnets from working at all. After a few reconnections and counter-attacks by the provider, apparently it's shutting down for good. Third take-down of the month!
These three stories have a single enemy in common: botnets. They have quickly become the biggest enemy of the computer user, but that's not new. What's more recent is the fact that they have become so popular among criminals as a quick way of making money that the criminal underground is steaming with new tools to create and maintain botnets for profit. This "new" software category has become a market that criminals are exploiting to trade with other criminals. Of course there's also fraud in there but who are you going to complain if a fellow criminal scammed you? There are figures like the garant who can verify if the seller is legit. It's some sort of escrow system where some trusted people check the product before the transaction goes through. It's like a real market where malware weapons are being exchanged for money.
Botnet-DIY Kits like Zeus are being sold by thousands of dollars. Piracy is so rampant that the Zeus author has put anti-piracy measures in place. Now, there are some other groups that regularly crack those protections and sell pirated versions of the kit for a lower price. Honor among pirates is a thing of the past and the poor user is the one who will suffer.
The only hope we have is to keep hammering C&C centers, disconnecting them from the internet until they all get the message that letting criminals establish botnets is as bad as being accomplices of the criminal act. This is the only way of getting rid of "bulletproof" hosting providers that ignore abuse complaints and are uncooperative with the police. I hope we keep taking botnets down... it's been a good month.
Friday, January 22, 2010
Patch or die, an out-of-band story
As I discussed in my last post, the vulnerability in Internet Explorer used against Google and other big companies was a pretty big deal. The reason being that this kind of security hole can be exploited to run malware when a web page is visited. This concept is not new, in fact it's been with us since 2006-2007. When the attacked is performed successfully the victim just visits a web site with the affected browser and becomes infected with malware. In the background, the web page exploits the hole and instructs the flawed browser to download the malicious component and run it.
In the Google case, the hole affected all Internet Explorer versions from 6 to 8. Microsoft announced that the exploit as written would not affect version 7 and 8 if you had enabled a security option called "DEP" (this is on by default though). After the exploit was made public, people modified it to attack effectively all Internet Explorer versions so the DEP suggestion didn't help.
At some point, the French and German governments recommended publicly to not to use Internet Explorer as your browser of choice. With this much pressure coming from all sides, Microsoft today finally released the patch in a special release, something they don't like to do (for some weird unknown reason... if it's necessary, it should be done).
Apparently, Microsoft had known about this flaw in their software since September but it has been sitting in their queue for quite a while until the bad guys discovered it and took advantage. We probably won't ever know the full story, but from the outside it doesn't look very responsible to leave something unsolved for so long waiting for a disaster to happen.
This issue, in my opinion, opens an internal debate in Microsoft about how their patching process should work going forward. It's clear that the current workflow is failing and there should be a way to fix it somehow. This is not the last time we are going to suffer a zero-day exploit attack so the more prepared we are, the better we'll fare when it comes.
In the Google case, the hole affected all Internet Explorer versions from 6 to 8. Microsoft announced that the exploit as written would not affect version 7 and 8 if you had enabled a security option called "DEP" (this is on by default though). After the exploit was made public, people modified it to attack effectively all Internet Explorer versions so the DEP suggestion didn't help.
At some point, the French and German governments recommended publicly to not to use Internet Explorer as your browser of choice. With this much pressure coming from all sides, Microsoft today finally released the patch in a special release, something they don't like to do (for some weird unknown reason... if it's necessary, it should be done).
Apparently, Microsoft had known about this flaw in their software since September but it has been sitting in their queue for quite a while until the bad guys discovered it and took advantage. We probably won't ever know the full story, but from the outside it doesn't look very responsible to leave something unsolved for so long waiting for a disaster to happen.
This issue, in my opinion, opens an internal debate in Microsoft about how their patching process should work going forward. It's clear that the current workflow is failing and there should be a way to fix it somehow. This is not the last time we are going to suffer a zero-day exploit attack so the more prepared we are, the better we'll fare when it comes.
Friday, January 15, 2010
Google vs. China, round 1
The biggest news in security this week has been the open war between Google and the China government. The way it's evolving, it looks like there's more to it.
First, Google disclosed that they had an attack coming from China trying to steal information from certain Chinese human rights advocates. They also mentioned that "at least twenty" other big-profile companies were attacked in much the same way. They are so sure that the attacks came from the Chinese government that they threatened with withdrawing their presence from the country. They managed to convince the US government that this was the case, presumably with really good evidence.
Then, Adobe announced almost instantly that they had detected targeted attacks against them and they were investigating further. Recently, they had been patching lots of newly-discovered vulnerabilities in their Reader product that could be used to run code remotely in machines. People naturally linked these two facts and understood that the mass attack to Google, Adobe and the rest of the companies was performed via a trojanized PDF file sent by email. "Vast espionage campaign" and the likes...
After that, the Chinese government gave an official statement somewhat.... muddled. They said that "China's internet is open and the government encourages development of the internet". That sounds pretty crazy, given the lengths they've gone to censor search engine results. To date, Google China still censors certain results by virtue of the agreement they made with the Chinese government back in 2006.
Just today, news surfaced about a 0-day exploit for Internet Explorer, which seems to be the culprit of the attacks to Google and the others. So it wasn't a PDF hole but an Explorer hole after all. Better yet, it might have been both attacks at the same time. Microsoft hasn't patched the hole yet but they're on it.
Lastly, there is a theory that says that, given that Google's market share is so low in China, Google already wanted out of a market it couldn't compete in. If that is true, they could have used this as an excuse to get out of there, while exposing the government for what they are doing wrong (censoring, hacking, etc.)
My conclusion: While I don't have the clear evidence that apparently Google has, I still believe that the Chinese government has a hand in censoring certain information in the Internet and if that means hacking gmail accounts, they'll make sure it gets done. That is reprehensible and I think that Google should fight the "freedom-of-speech-Internet war with the Chinese government to the last breath and not leave the country. I don't think that's their intention anyway because even if their market share is only 30% in China, 30% of a billion users is still a big market to have. This won't end here though, I'm sure I'll have more chances to comment further on this story.
First, Google disclosed that they had an attack coming from China trying to steal information from certain Chinese human rights advocates. They also mentioned that "at least twenty" other big-profile companies were attacked in much the same way. They are so sure that the attacks came from the Chinese government that they threatened with withdrawing their presence from the country. They managed to convince the US government that this was the case, presumably with really good evidence.
Then, Adobe announced almost instantly that they had detected targeted attacks against them and they were investigating further. Recently, they had been patching lots of newly-discovered vulnerabilities in their Reader product that could be used to run code remotely in machines. People naturally linked these two facts and understood that the mass attack to Google, Adobe and the rest of the companies was performed via a trojanized PDF file sent by email. "Vast espionage campaign" and the likes...
After that, the Chinese government gave an official statement somewhat.... muddled. They said that "China's internet is open and the government encourages development of the internet". That sounds pretty crazy, given the lengths they've gone to censor search engine results. To date, Google China still censors certain results by virtue of the agreement they made with the Chinese government back in 2006.
Just today, news surfaced about a 0-day exploit for Internet Explorer, which seems to be the culprit of the attacks to Google and the others. So it wasn't a PDF hole but an Explorer hole after all. Better yet, it might have been both attacks at the same time. Microsoft hasn't patched the hole yet but they're on it.
Lastly, there is a theory that says that, given that Google's market share is so low in China, Google already wanted out of a market it couldn't compete in. If that is true, they could have used this as an excuse to get out of there, while exposing the government for what they are doing wrong (censoring, hacking, etc.)
My conclusion: While I don't have the clear evidence that apparently Google has, I still believe that the Chinese government has a hand in censoring certain information in the Internet and if that means hacking gmail accounts, they'll make sure it gets done. That is reprehensible and I think that Google should fight the "freedom-of-speech-Internet war with the Chinese government to the last breath and not leave the country. I don't think that's their intention anyway because even if their market share is only 30% in China, 30% of a billion users is still a big market to have. This won't end here though, I'm sure I'll have more chances to comment further on this story.
Thursday, December 17, 2009
Blocking malware with bureaucracy
It's well known that modern malware is primarily web-based. This means that if your computer somehow got infected, chances are you visited an infectious website at some point. Some time ago, bad guys used to use pornographic sites as hooks to infect but nowadays it's either hacked sites or lure sites.
Maybe your regular bookmarked page that you visit every day might have been compromised and is now infectious (this happens more often than you think). Maybe your next Google search is poisoned in a way that it redirects to a site somewhere that infects your computer (this happens mostly with 'popular' search terms but more and more often with all sorts of words you might throw at Google).
The bad guys obviously need to create new domains to host these infectious sites but the good guys take the sites down as soon as possible. We're then in a vicious circle of bad guys creating bad domains very often and good guys looking for them to disconnect them. Curiously enough, the Chinese domains are the most used for malicious purposes (that means that blahblah.cn is more likely to be malicious than blahblah.es, for example).
As a counterattack, the Chinese domain authority revealed earlier this week that they would require new domain registrations to submit paperwork in five days (this is, real physical paper applications in the post). Some others are quickly following suit with rumors that RU domains (that's Russia) will be next in January.
Now, five days is a very long time to have a domain spreading malware. In fact, most malicious domains have done their job by their third or fourth day so it is my belief that this initiative, while a step in the right direction, will not be as useful as they intended it to be. It's a pity that well intentions are not enough in the fight against cyber crime. If it was up to me, I'd raise the real paperwork to two full weeks and wouldn't give them the domain name until then. It's good for their business I'm not in charge.
Maybe your regular bookmarked page that you visit every day might have been compromised and is now infectious (this happens more often than you think). Maybe your next Google search is poisoned in a way that it redirects to a site somewhere that infects your computer (this happens mostly with 'popular' search terms but more and more often with all sorts of words you might throw at Google).
The bad guys obviously need to create new domains to host these infectious sites but the good guys take the sites down as soon as possible. We're then in a vicious circle of bad guys creating bad domains very often and good guys looking for them to disconnect them. Curiously enough, the Chinese domains are the most used for malicious purposes (that means that blahblah.cn is more likely to be malicious than blahblah.es, for example).
As a counterattack, the Chinese domain authority revealed earlier this week that they would require new domain registrations to submit paperwork in five days (this is, real physical paper applications in the post). Some others are quickly following suit with rumors that RU domains (that's Russia) will be next in January.
Now, five days is a very long time to have a domain spreading malware. In fact, most malicious domains have done their job by their third or fourth day so it is my belief that this initiative, while a step in the right direction, will not be as useful as they intended it to be. It's a pity that well intentions are not enough in the fight against cyber crime. If it was up to me, I'd raise the real paperwork to two full weeks and wouldn't give them the domain name until then. It's good for their business I'm not in charge.
Wednesday, December 9, 2009
Whitelisting... again
I recently read an article about two conflicting points of view regarding the validity of the current antivirus software... the old "antivirus is dead" tune. The negative side of the article talked about the great idea of "whitelisting"... again.
The proponents of whitelisting say that it would be easier to control what we want to run in our PCs (the good programs) rather than detect what we don't want (viruses and other bad stuff). I see the logic and it all sounds good until you go down to the details: you cannot realistically say "allow all Microsoft programs" based on what the tag in each program says because viruses can also tag themselves as being from Microsoft (yes, they are that smart).
Whitelisting technologies instead base their identification on the characteristics of each one of the protected programs. It's just as antivirus but in the reverse: they identify goodware, not malware. The problem they are facing at the moment is the staggering amount of legitimate programs being released every day. Just to keep up with every program in the Windows operating system is shockingly complicated.
If you consider how many applications are contained within a normal Windows installation plus the amount of different languages Microsoft supports, that's already quite a lot of work. Now, keeping up to date with all the service packs and patches being released monthly, there's not a chance a company can be 100% successful at it. Imagine adding your "calc.exe" in Korean to the white list after it changed in the last security patch. Not that the Windows calculator changes much or gets many patches but you get the idea.
If you add to the mix all the rest of vendors: ranging from Adobe (and their Flash, Reader, Photoshop in all languages, versions and respective patches) to all device driver vendors, I don't think it's doable at all. So I side in with Schneier on this one: you do need antivirus although it's not the security panacea and it won't solve all your problems. I still think regular antivirus is better than nothing or even better than any current whitelisting solution. There, I said it.
The proponents of whitelisting say that it would be easier to control what we want to run in our PCs (the good programs) rather than detect what we don't want (viruses and other bad stuff). I see the logic and it all sounds good until you go down to the details: you cannot realistically say "allow all Microsoft programs" based on what the tag in each program says because viruses can also tag themselves as being from Microsoft (yes, they are that smart).
Whitelisting technologies instead base their identification on the characteristics of each one of the protected programs. It's just as antivirus but in the reverse: they identify goodware, not malware. The problem they are facing at the moment is the staggering amount of legitimate programs being released every day. Just to keep up with every program in the Windows operating system is shockingly complicated.
If you consider how many applications are contained within a normal Windows installation plus the amount of different languages Microsoft supports, that's already quite a lot of work. Now, keeping up to date with all the service packs and patches being released monthly, there's not a chance a company can be 100% successful at it. Imagine adding your "calc.exe" in Korean to the white list after it changed in the last security patch. Not that the Windows calculator changes much or gets many patches but you get the idea.
If you add to the mix all the rest of vendors: ranging from Adobe (and their Flash, Reader, Photoshop in all languages, versions and respective patches) to all device driver vendors, I don't think it's doable at all. So I side in with Schneier on this one: you do need antivirus although it's not the security panacea and it won't solve all your problems. I still think regular antivirus is better than nothing or even better than any current whitelisting solution. There, I said it.
Thursday, December 3, 2009
Google Chrome OS: Just some thoughts
In a recent announcement from Google, they told us how their operating system will be an open-sourced Linux-modified kernel with a heavy emphasis on the web. The system will only allow you to surf the web and to do it as fast as it possibly can. They even have created hardware specifications to provide a great user experience (this is corporate-speak for "to be really really fast"). As a user, all this is something to look forward to.
Having a computer (or phone or other mobile device) that can boot up and get you working on web-based applications in 7 seconds or less sounds pretty damn good but there's another side to it. We've been saying for a long time how our current Windows monoculture is a boon for the bad guys because it allows them to have a minimal development with lots of potential victims. Since the main infection vector nowadays is the web, can future threats attack this new ChromeOS through the big windows that is the browser? It certainly looks like a possibility.
In the same way that criminals today are attacking MacOS, it's not far-fetched to predict that in a year and a half, they could be creating nasty things for ChromeOS. Will this change the threat landscape radically? Probably not. But I think it will change the way we see the internet.
If most of us already use the computer mainly to work with the web, Chrome will only reaffirm us in the belief that a browser is all we need. My main worry is that, in such a scenario, offline content will be a thing of the past so we'll tend to keep more of our digital resources online. That means more things for the bad guys to target. Information-stealing will be king in the underground world. It's quite bad now but it can only get worse from there on.
I'm looking forward to check Chrome OS out anyway.
Having a computer (or phone or other mobile device) that can boot up and get you working on web-based applications in 7 seconds or less sounds pretty damn good but there's another side to it. We've been saying for a long time how our current Windows monoculture is a boon for the bad guys because it allows them to have a minimal development with lots of potential victims. Since the main infection vector nowadays is the web, can future threats attack this new ChromeOS through the big windows that is the browser? It certainly looks like a possibility.
In the same way that criminals today are attacking MacOS, it's not far-fetched to predict that in a year and a half, they could be creating nasty things for ChromeOS. Will this change the threat landscape radically? Probably not. But I think it will change the way we see the internet.
If most of us already use the computer mainly to work with the web, Chrome will only reaffirm us in the belief that a browser is all we need. My main worry is that, in such a scenario, offline content will be a thing of the past so we'll tend to keep more of our digital resources online. That means more things for the bad guys to target. Information-stealing will be king in the underground world. It's quite bad now but it can only get worse from there on.
I'm looking forward to check Chrome OS out anyway.
Thursday, November 12, 2009
The Wildlist vs. Reality
Back in the day of the virus outbreaks there was a distinction between "in-the-wild" viruses and "zoo" viruses. These words are not very used these days anymore but back then were pretty important.
The first group, "in-the-wild" viruses, were those that were actively infecting computers. The second group, "zoo" viruses, were those that may have infected computers in the past but were not infecting them anymore for various reasons. They could have been programmed as an intellectual exercise and never actually released, maybe they had a very low impact to begin with but their infection rate had dropped to zero or any other reason for them to be sitting in virus archives fetching dust. This was some sort of virus graveyard, the place where viruses went to die.
Obviously the antivirus industry was very concerned about the first group but not very much about the second one, even though they had to detect them to avoid reinfections from old backups (they had to make sure that none of the animals in the zoo could come back from the dead). Since there was a real need to know what viruses were really "in-the-wild", an independent organization was created for this purpose: enter the WildList.
The idea was very good: a bunch of knowledgeable people from the security industry would send samples of viruses they estimated to be in-the-wild. Those files found to be in agreement by many researchers were then published as part of the official "WildList"... simple and effective. Viruses that made it into the list had the dubious honor of being officially "infecting" people. Everybody was protected from them and therefore happy (except people who got infected but at least they had been warned who the enemy was!).
Now, back to 2009... the situation today is wildly different (pun intended). Today, a normal user gets infected from a malicious web page with a virus and chances are nobody else in the whole world has seen the same exact executable. The bad guys craft them in such a way that they are slightly different every time yet they have the same functionality. Is that in-the-wild? it's clearly not in the zoo but no two users will completely agree it's the same exact virus, let alone two virus researchers. Those samples will never end up in that list. Believe it or not, the list is still made in the exact same way as it was in 1999. What is its real use nowadays?
This topic came up the other day when some customer came to one of our training guys asking why on earth a company claims to receive 2000 samples a day (or was it an hour?) yet the WildList only contemplates 800 viruses "in-the-wild" each month in the world. These numbers have quickly grown apart over the years to the point that the WildList in its current state is helping nobody and the users start wondering why the WildList still exists. The irrelevance of the WildList has already been put forth this week by some companies and I couldn't agree more with them. Unless there's a big shakeup in the way it's being collated, the WildList is obsolete, pointless, useless, dead. Goodbye, WildList.
The first group, "in-the-wild" viruses, were those that were actively infecting computers. The second group, "zoo" viruses, were those that may have infected computers in the past but were not infecting them anymore for various reasons. They could have been programmed as an intellectual exercise and never actually released, maybe they had a very low impact to begin with but their infection rate had dropped to zero or any other reason for them to be sitting in virus archives fetching dust. This was some sort of virus graveyard, the place where viruses went to die.
Obviously the antivirus industry was very concerned about the first group but not very much about the second one, even though they had to detect them to avoid reinfections from old backups (they had to make sure that none of the animals in the zoo could come back from the dead). Since there was a real need to know what viruses were really "in-the-wild", an independent organization was created for this purpose: enter the WildList.
The idea was very good: a bunch of knowledgeable people from the security industry would send samples of viruses they estimated to be in-the-wild. Those files found to be in agreement by many researchers were then published as part of the official "WildList"... simple and effective. Viruses that made it into the list had the dubious honor of being officially "infecting" people. Everybody was protected from them and therefore happy (except people who got infected but at least they had been warned who the enemy was!).
Now, back to 2009... the situation today is wildly different (pun intended). Today, a normal user gets infected from a malicious web page with a virus and chances are nobody else in the whole world has seen the same exact executable. The bad guys craft them in such a way that they are slightly different every time yet they have the same functionality. Is that in-the-wild? it's clearly not in the zoo but no two users will completely agree it's the same exact virus, let alone two virus researchers. Those samples will never end up in that list. Believe it or not, the list is still made in the exact same way as it was in 1999. What is its real use nowadays?
This topic came up the other day when some customer came to one of our training guys asking why on earth a company claims to receive 2000 samples a day (or was it an hour?) yet the WildList only contemplates 800 viruses "in-the-wild" each month in the world. These numbers have quickly grown apart over the years to the point that the WildList in its current state is helping nobody and the users start wondering why the WildList still exists. The irrelevance of the WildList has already been put forth this week by some companies and I couldn't agree more with them. Unless there's a big shakeup in the way it's being collated, the WildList is obsolete, pointless, useless, dead. Goodbye, WildList.
Subscribe to:
Posts (Atom)