Spyware, viruses, & security forum: NEWS - September 28, 2012

.. attacks

Security firm Prolexic Technologies released a whitepaper today aimed at helping organizations use their firewalls more effectively to fight distributed denial-of-service (DDoS) attacks.

DDoS attacks have emerged as a favorite weapon of hacktivists. But no matter who is doing it, the impact for businesses can be significant. As recent poll of 1,000 IT professionals by security provider NeuStar revealed just how much: according to the study, 67 percent of those in the retail industry said a DDoS attack would cost them more than $100,000 per hour.

Security firm Prolexic offers anti-DDoS services. According to its report, while firewalls can serve as a Band-Aid to block malicious traffic, they are not built to handle the massive loads of traffic that can accompany a DDoS attack.

"To ensure that you use a firewall to its best advantage in a DDoS protection strategy, you should first be aware of the difference between stateful and stateless firewalls and what each are designed to do," the report says.

Stateful firewalls, the report states, are designed to monitor regular levels of traffic and stop small amount of stateful attacks, and they often fail in the event of a DDoS.

Continued : http://www.securityweek.com/report-examines-limitations-firewalls-fighting-ddos-attacks

From TrendLabs Malware Blog:

Recently, I talked at the VB2012 conference in Dallas about one of the recent developments in today's threat landscape: the increasing prevalence of police ransomware. Earlier, Trend Micro published a white paper discussing this threat, titled The "Police Trojan" (pdf).

The idea behind ransomware is relatively simple: the cybercriminals block the user from accessing their own computer. This continues until the user pays the cybercriminal money in order to unlock their system. We first saw this type of threat in Russia back in 2005 to 2006.

More recently, we've seen this threat spread to other countries. Using geo-location, users are presented with a notice - supposedly from local police - that they have committed some crime, and to unlock their PC they need to pay a "fine" of some sort.

As we looked into this threat, we found that this threat was, in someways, similar to previous fake antivirus threats. Multiple gangs produce their own variants; the social engineering is very good at getting users to pay up, and new versions are appearing all the time. Affiliate programs are also used to monetize this threat.

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/police-ransomware-how-to-get-your-malware-noticed/

The news yesterday that Adobe had been compromised and that the attackers were able to get valid Adobe signatures on a pair of malware utilities is one of the more worrisome and troubling stories in what has become a year of huge hacks and historic change in the security industry. Adobe was forthcoming with many of the details of the attack, but the ones that were omitted are the ones that really make a difference in this instance.

As in most of these cases, what we know is mostly the results of the attack. We know that the attackers found a weak spot somewhere on Adobe's corporate infrastructure and found a way in. Adobe has not identified what the vulnerability was, where the compromised machine sat on its network or how the attackers were able to compromise it in the first place. Was it a phishing email, a la the RSA hack? Or was it something less pedestrian? We don't know.

We do know that once the attackers were inside, they began moving around until they found the machine that they were really interested in: a build server. They got there by using what Brad Arkin, Adobe's top security and privacy official, said were techniques typically seen from APT-style attackers.

"We believe the threat actors established a foothold on a different Adobe machine and then leveraged standard advanced persistent threat tactics to gain access to the build server and request signatures for the malicious utilities from the code signing service via the standard protocol used for valid Adobe software," Arkin said.

Continued : https://threatpost.com/en_us/blogs/whats-meaning-adobe-certificate-attack-092812

See: Security Advisory: Adobe to Revoke Code Signing Certificate

Early in the month, we reported that the top US Bitcoin exchange, Bitfloor, had a security breach that resulted in a theft of Bitcoins worth $250,000. At the time it was very much up in the air as to whether Bitfloor would be able to resume operation, but today it has announced that it is back in business.

Founder and operator Roman Shtylman took to Google+ to make the announcement, although the pre-theft funds are still frozen. New deposits will be accessible as normal. "As funds are available for repayment, they will be dispersed on a pro-rated basis," said Shtylman.

"Bitcoin funds for repayment will be purchased using revenue from fees. This will ensure that as Bitfloor grows I am able to continue operation to recover the stolen funds over time."

Bitfloor is also pursuing investment opportunities to recover funds for its customers more quickly.

Shtylman has made a number of security improvements to the exchange to prevent a similar theft occurring. Client funds will be put into cold storage — stored on a computer that is not networked — while a hot wallet will cover daily transactions, ensuring that if someone does gain access again, no customer deposits are at risk.

Continued : http://thenextweb.com/insider/2012/09/28/after-250000-theft-bitcoin-exchange-bitfloor-reopens/

Also:
Bitcoin exchange Bitfloor attempts comeback after $250,000 heist
Bitcoin Trading Floor Reopens After Daring Online Heist