US Cert Cisco UCS Director Default Credentials Vulnerability

Cisco has released a security advisory to address a vulnerability in Cisco Unified Computing System (UCS) Director. This vulnerability could allow an unauthenticated, remote attacker to take complete control of the affected device due to a default root user account created during installation. Successful exploitation of this vulnerability would provide the attacker with full administrative rights to the system.

US-CERT encourages users and administrators to review the Cisco Security Advisory and apply the update provided to address this vulnerability.

Source and Full Story Here: https://www.us-cert.gov/ncas/current-activity/2014/02/21/Cisco-UCS-Director-Default-Credentials-Vulnerability

US Cert Cisco UCS Director Default Credentials Vulnerability

Cisco has released a security advisory to address a vulnerability in Cisco Unified Computing System (UCS) Director. This vulnerability could allow an unauthenticated, remote attacker to take complete control of the affected device due to a default root user account created during installation. Successful exploitation of this vulnerability would provide the attacker with full administrative rights to the system.

US-CERT encourages users and administrators to review the Cisco Security Advisory and apply the update provided to address this vulnerability.

Source and Full Story Here: https://www.us-cert.gov/ncas/current-activity/2014/02/21/Cisco-UCS-Director-Default-Credentials-Vulnerability

Set up centralised agency to deal with cyber crimes: Par Panel

A parliamentary committee has recommended that a centralised agency be set up to deal with cyber crime as the country has been witnessing a sharp increase in such cases over the past few years.

The Standing Committee on Information Technology, chaired by Rao Inderjit Singh, pointed out that there are several agencies involved in maintaining separate data on cyber crime cases in India.

"The committee fail to understand as to how Department of Electronics and Information Technology (DEITy) concertises its cyber security strategies when so many agencies are involved in data collection and maintenance and when there is absence of any centralised monitoring system and centralised maintenance of data relating cyber fraud," the panel said.

Presently, the national Crime Records Bureau (NCRB) maintains data on cyber fraud, while data related to Internet financial frauds along with the quantum is maintained by the Reserve Band and the CBI.

The committee said it has been informed that DEITy regularly interacts with the banks, RBI and CBI regarding cyber fraud related actions like prevention, investigation, support, technical advisories, promotion of best practices and compliance's.

Source and Full Story: http://www.business-standard.com/article/pti-stories/set-up-centralised-agency-to-deal-with-cyber-crimes-par-panel-114021201096_1.html

Set up centralised agency to deal with cyber crimes: Par Panel

A parliamentary committee has recommended that a centralised agency be set up to deal with cyber crime as the country has been witnessing a sharp increase in such cases over the past few years.

The Standing Committee on Information Technology, chaired by Rao Inderjit Singh, pointed out that there are several agencies involved in maintaining separate data on cyber crime cases in India.

"The committee fail to understand as to how Department of Electronics and Information Technology (DEITy) concertises its cyber security strategies when so many agencies are involved in data collection and maintenance and when there is absence of any centralised monitoring system and centralised maintenance of data relating cyber fraud," the panel said.

Presently, the national Crime Records Bureau (NCRB) maintains data on cyber fraud, while data related to Internet financial frauds along with the quantum is maintained by the Reserve Band and the CBI.

The committee said it has been informed that DEITy regularly interacts with the banks, RBI and CBI regarding cyber fraud related actions like prevention, investigation, support, technical advisories, promotion of best practices and compliance's.

Source and Full Story: http://www.business-standard.com/article/pti-stories/set-up-centralised-agency-to-deal-with-cyber-crimes-par-panel-114021201096_1.html

Smugglers, Drug Traffickers and Pirates Using IT

Maritime fraud is becoming more common and one cause is computer hacking, says maritime insurer Skuld. As both the greater reliance on IT and electronic trading platforms and documents increases, so does the need to stay ahead of the game played by fraudsters. There is a “cost” of course, to greater security, both in terms of investing in better technology and processes, but also in potential business opportunities.


Cyber Fraud is a rapidly developing area of risk for all companies across all industries. The key to successful fraud is having enough convincing information and knowledge to make the target believe that a transaction is genuine. Information theft is therefore a key element in fraud, and cyber-attacks can facilitate the wholesale theft of vast amounts of confidential information.

Source and Full Story Here: http://www.maritime-executive.com/article/Smugglers-Drug-Traffickers-and-Pirates-Using-IT-2014-02-10/

Smugglers, Drug Traffickers and Pirates Using IT

Maritime fraud is becoming more common and one cause is computer hacking, says maritime insurer Skuld. As both the greater reliance on IT and electronic trading platforms and documents increases, so does the need to stay ahead of the game played by fraudsters. There is a “cost” of course, to greater security, both in terms of investing in better technology and processes, but also in potential business opportunities.


Cyber Fraud is a rapidly developing area of risk for all companies across all industries. The key to successful fraud is having enough convincing information and knowledge to make the target believe that a transaction is genuine. Information theft is therefore a key element in fraud, and cyber-attacks can facilitate the wholesale theft of vast amounts of confidential information.

Source and Full Story Here: http://www.maritime-executive.com/article/Smugglers-Drug-Traffickers-and-Pirates-Using-IT-2014-02-10/

US Cert Vulnerability Summary for the Week of February 3, 2014

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology(NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit theNVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:


High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0


Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9


Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.


The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:


High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0


Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9


Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying informaton, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.


Source: https://www.us-cert.gov/ncas/bulletins/SB14-041

US Cert Vulnerability Summary for the Week of February 3, 2014

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology(NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit theNVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:


High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0


Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9


Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.


The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:


High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0


Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9


Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying informaton, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.


Source: https://www.us-cert.gov/ncas/bulletins/SB14-041

US Cert Alert (TA14-017A) UDP-based Amplification Attacks

Systems Affected


Certain UDP protocols have been identified as potential attack vectors:
DNS
NTP
SNMPv2
NetBIOS
SSDP
CharGEN
QOTD
BitTorrent
Kad
Quake Network Protocol
Steam Protocol
Overview


A Distributed Reflective Denial of Service (DRDoS) attack is an emerging form of Distributed Denial of Service (DDoS) that relies on the use of publicly accessible UDP servers, as well as bandwidth amplification factors, to overwhelm a victim system with UDP traffic.
Description


UDP, by design, is a connection-less protocol that does not validate source IP addresses. Unless the application-layer protocol uses countermeasures such as session initiation, it is very easy to forge the IP packet datagram to include an arbitrary source IP address [7]. When many UDP packets have their source IP address forged to a single address, the server responds to that victim, creating a reflected Denial of Service (DoS) Attack.

Recently, certain UDP protocols have been found to have particular responses to certain commands that are much larger than the initial request. Where before, attackers were limited linearly by the number of packets directly sent to the target to conduct a DoS attack, now a single packet can generate tens or hundreds of times the bandwidth in its response. This is called an amplification attack, and when combined with a reflective DoS attack on a large scale it makes it relatively easy to conduct DDoS attacks.

To measure the potential effect of an amplification attack, we use a metric called the bandwidth amplification factor (BAF). BAF can be calculated as the number of UDP payload bytes that an amplifier sends to answer a request, compared to the number of UDP payload bytes of the request.

The list of known protocols, and their associated bandwidth amplification factors, is listed below. US-CERT would like to offer thanks to Christian Rossow for providing this information to us.
ProtocolBandwidth Amplification FactorVulnerable Command
DNS28 to 54see: TA13-088A [1]
NTP556.9see: TA14-013A [2]
SNMPv26.3GetBulk request
NetBIOS3.8Name resolution
SSDP30.8SEARCH requestCharGEN 358.8 Character generation request
QOTD 140.3 Quote request
BitTorrent 3.8 File search
Kad 16.3 Peer list exchange
Quake Network Protocol 63.9 Server info exchange
Steam Protocol 5.5 Server info exchange

Impact
Attackers can utilize the bandwidth and relative trust of large servers that provide the above UDP protocols to flood victims with unwanted traffic, a DDoS attack.
Solution

DETECTION

Detection of DRDoS attacks is not easy, due to their use of large, trusted servers that provide UDP services. As a victim, traditional DoS mitigation techniques may apply.

As a network operator of one of these exploitable services, look for abnormally large responses to a particular IP address. This may indicate that an attacker is using your service to conduct a DRDoS attack.

Source: https://www.us-cert.gov/ncas/alerts/TA14-017A

US Cert Alert (TA14-017A) UDP-based Amplification Attacks

Systems Affected


Certain UDP protocols have been identified as potential attack vectors:
DNS
NTP
SNMPv2
NetBIOS
SSDP
CharGEN
QOTD
BitTorrent
Kad
Quake Network Protocol
Steam Protocol
Overview


A Distributed Reflective Denial of Service (DRDoS) attack is an emerging form of Distributed Denial of Service (DDoS) that relies on the use of publicly accessible UDP servers, as well as bandwidth amplification factors, to overwhelm a victim system with UDP traffic.
Description


UDP, by design, is a connection-less protocol that does not validate source IP addresses. Unless the application-layer protocol uses countermeasures such as session initiation, it is very easy to forge the IP packet datagram to include an arbitrary source IP address [7]. When many UDP packets have their source IP address forged to a single address, the server responds to that victim, creating a reflected Denial of Service (DoS) Attack.

Recently, certain UDP protocols have been found to have particular responses to certain commands that are much larger than the initial request. Where before, attackers were limited linearly by the number of packets directly sent to the target to conduct a DoS attack, now a single packet can generate tens or hundreds of times the bandwidth in its response. This is called an amplification attack, and when combined with a reflective DoS attack on a large scale it makes it relatively easy to conduct DDoS attacks.

To measure the potential effect of an amplification attack, we use a metric called the bandwidth amplification factor (BAF). BAF can be calculated as the number of UDP payload bytes that an amplifier sends to answer a request, compared to the number of UDP payload bytes of the request.

The list of known protocols, and their associated bandwidth amplification factors, is listed below. US-CERT would like to offer thanks to Christian Rossow for providing this information to us.
ProtocolBandwidth Amplification FactorVulnerable Command
DNS28 to 54see: TA13-088A [1]
NTP556.9see: TA14-013A [2]
SNMPv26.3GetBulk request
NetBIOS3.8Name resolution
SSDP30.8SEARCH requestCharGEN 358.8 Character generation request
QOTD 140.3 Quote request
BitTorrent 3.8 File search
Kad 16.3 Peer list exchange
Quake Network Protocol 63.9 Server info exchange
Steam Protocol 5.5 Server info exchange

Impact
Attackers can utilize the bandwidth and relative trust of large servers that provide the above UDP protocols to flood victims with unwanted traffic, a DDoS attack.
Solution

DETECTION

Detection of DRDoS attacks is not easy, due to their use of large, trusted servers that provide UDP services. As a victim, traditional DoS mitigation techniques may apply.

As a network operator of one of these exploitable services, look for abnormally large responses to a particular IP address. This may indicate that an attacker is using your service to conduct a DRDoS attack.

Source: https://www.us-cert.gov/ncas/alerts/TA14-017A

Hulu Blocks Tor

I run a Tor relay on my home network on a BeagleBone Black. It’s certainly not the fastest Tor relay out there, but it’s inexpensive, small, and doesn’t affect my home network. But more importantly, it allows users who are censored to access the Internet and the Tor project helps protect privacy online. The Tor project, IMHO, is one of the best open source projects around.


As a non-exit relay, one does not typically encounter many issues as none of the Tor traffic exits my relay to the open Internet. For those seeking a description of Tor traffic, there is a great infographic on the EFF site. Anyway, I tried to watch Family Guy and I was presented this:

Source and Full Story Here: http://datko.net/2014/02/07/hulu_blocks_tor/

Hulu Blocks Tor

I run a Tor relay on my home network on a BeagleBone Black. It’s certainly not the fastest Tor relay out there, but it’s inexpensive, small, and doesn’t affect my home network. But more importantly, it allows users who are censored to access the Internet and the Tor project helps protect privacy online. The Tor project, IMHO, is one of the best open source projects around.


As a non-exit relay, one does not typically encounter many issues as none of the Tor traffic exits my relay to the open Internet. For those seeking a description of Tor traffic, there is a great infographic on the EFF site. Anyway, I tried to watch Family Guy and I was presented this:

Source and Full Story Here: http://datko.net/2014/02/07/hulu_blocks_tor/

Information Technology is a Moving Target

NIST's finalized cybersecurity framework receives mixed reviews

By Taylor Armerding
January 31, 2014 — CSO — There has never been a successful catastrophic cyberattack on North America's critical infrastructure (CI) — yet.

[Adoption, privacy biggest topics as NIST Cybersecurity Framework nears February deadline]


The National Institute of Standards and Technology's (NIST) Cybersecurity Framework 1.0, to be issued Feb. 13 in response to an executive order from President Obama, aims to keep it that way.

But there is considerable debate within the security community about whether it will improve the protection of CI, which includes transportation, energy, food, water, financial services and other systems.

Some, like Andrew Ginter, vice president of industrial security at the Canadian firm Waterfall Security Solutions, contend that it takes a misguided approach to the magnitude and complexity of the threats.

Ginter wrote in a recent blog post that the framework is too complicated for top management and board members of Industrial Control Systems (ICS). Worse, he said, it, "leads senior management to ask the wrong kinds of questions about the security of critical infrastructure sites," by focusing on "actuarial" risk rather than the capabilities of the most sophisticated potential attackers.

The question, he said, should not be, "How many times was the North American power grid taken down by a cyber assault in the last decade, and what did each such incident cost? The answer is, of course, zero."

Instead, he said, it should be, "When our most capable enemies attack us, what is the most likely outcome?"

Joe Weiss, managing partner at Applied Control Solutions, has argued for years that government organizations like NIST and ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) are too focused on "compliance" and not enough on real security.

Source and Full Story: http://www.csoonline.com/article/747554/nist-s-finalized-cybersecurity-framework-receives-mixed-reviews

Information Technology is a Moving Target

NIST's finalized cybersecurity framework receives mixed reviews

By Taylor Armerding
January 31, 2014 — CSO — There has never been a successful catastrophic cyberattack on North America's critical infrastructure (CI) — yet.

[Adoption, privacy biggest topics as NIST Cybersecurity Framework nears February deadline]


The National Institute of Standards and Technology's (NIST) Cybersecurity Framework 1.0, to be issued Feb. 13 in response to an executive order from President Obama, aims to keep it that way.

But there is considerable debate within the security community about whether it will improve the protection of CI, which includes transportation, energy, food, water, financial services and other systems.

Some, like Andrew Ginter, vice president of industrial security at the Canadian firm Waterfall Security Solutions, contend that it takes a misguided approach to the magnitude and complexity of the threats.

Ginter wrote in a recent blog post that the framework is too complicated for top management and board members of Industrial Control Systems (ICS). Worse, he said, it, "leads senior management to ask the wrong kinds of questions about the security of critical infrastructure sites," by focusing on "actuarial" risk rather than the capabilities of the most sophisticated potential attackers.

The question, he said, should not be, "How many times was the North American power grid taken down by a cyber assault in the last decade, and what did each such incident cost? The answer is, of course, zero."

Instead, he said, it should be, "When our most capable enemies attack us, what is the most likely outcome?"

Joe Weiss, managing partner at Applied Control Solutions, has argued for years that government organizations like NIST and ICS-CERT (Industrial Control Systems Cyber Emergency Response Team) are too focused on "compliance" and not enough on real security.

Source and Full Story: http://www.csoonline.com/article/747554/nist-s-finalized-cybersecurity-framework-receives-mixed-reviews

Latest Sites of Breaches in Security Are Hotels

SAN FRANCISCO — In the latest in a spate of online attacks affecting American businesses, White Lodging, which manages hotel franchises for chains like Marriott, Hilton and Starwood Hotels, is investigating a potential security breach involving customers’ payment information.

White Lodging Services Corporation, which works with 168 hotels in 21 states, confirmed that it was examining the data breach.

The intrusion into its systems was first posted by Brian Krebs, a security blogger, on Friday, when he reported that the breach might have resulted in the fraudulent use of hundreds of credit and debit cards used for payment at Marriott hotels between March 2013 and the end of the year.

Mr. Krebs was also first to report the hacking of consumer data from Target, Neiman Marcus and Michaels, the arts and crafts retailer.

Source and Full Story :http://www.nytimes.com/2014/02/01/technology/latest-sites-of-breaches-in-security-are-hotels.html?_r=0

Latest Sites of Breaches in Security Are Hotels

SAN FRANCISCO — In the latest in a spate of online attacks affecting American businesses, White Lodging, which manages hotel franchises for chains like Marriott, Hilton and Starwood Hotels, is investigating a potential security breach involving customers’ payment information.

White Lodging Services Corporation, which works with 168 hotels in 21 states, confirmed that it was examining the data breach.

The intrusion into its systems was first posted by Brian Krebs, a security blogger, on Friday, when he reported that the breach might have resulted in the fraudulent use of hundreds of credit and debit cards used for payment at Marriott hotels between March 2013 and the end of the year.

Mr. Krebs was also first to report the hacking of consumer data from Target, Neiman Marcus and Michaels, the arts and crafts retailer.

Source and Full Story :http://www.nytimes.com/2014/02/01/technology/latest-sites-of-breaches-in-security-are-hotels.html?_r=0

I have to admit I needed a laugh.

Hackers deface Angry Birds website following NSA spying claims

January 29, 2014 — IDG News Service — The official Angry Birds website was defaced by hackers following reports that U.S. and U.K. intelligence agencies have been collecting user information from the game and other popular mobile apps.

Some users trying to access the www.angrybirds.com website late Tuesday were greeted by an image depicting the Angry Birds game characters accompanied by the text "Spying Birds." The U.S. National Security Agency's logo was also visible in the image.

The NSA and Britain's Government Communications Headquarters (GCHQ) have been working together to collect geolocation data, address books, buddy lists, telephone logs and other pieces of information from "leaky" mobile apps, The New York Times reported Monday based on documents provided by former NSA contractor Edward Snowden.

Mobile apps commonly collect data about their users and share it with advertising networks, which then use the information to build user profiles for targeted advertising.

A secret 20-page GCHQ report from 2012 contained code needed to extract the profiles generated when Android users play Angry Birds, The New York Times reported. It's not clear if and how this data collection happens, but the reports were apparently enough to anger some hackers.

Source and Full Story : http://www.csoonline.com/article/747318/hackers-deface-angry-birds-website-following-nsa-spying-claims

I have to admit I needed a laugh.

Hackers deface Angry Birds website following NSA spying claims

January 29, 2014 — IDG News Service — The official Angry Birds website was defaced by hackers following reports that U.S. and U.K. intelligence agencies have been collecting user information from the game and other popular mobile apps.

Some users trying to access the www.angrybirds.com website late Tuesday were greeted by an image depicting the Angry Birds game characters accompanied by the text "Spying Birds." The U.S. National Security Agency's logo was also visible in the image.

The NSA and Britain's Government Communications Headquarters (GCHQ) have been working together to collect geolocation data, address books, buddy lists, telephone logs and other pieces of information from "leaky" mobile apps, The New York Times reported Monday based on documents provided by former NSA contractor Edward Snowden.

Mobile apps commonly collect data about their users and share it with advertising networks, which then use the information to build user profiles for targeted advertising.

A secret 20-page GCHQ report from 2012 contained code needed to extract the profiles generated when Android users play Angry Birds, The New York Times reported. It's not clear if and how this data collection happens, but the reports were apparently enough to anger some hackers.

Source and Full Story : http://www.csoonline.com/article/747318/hackers-deface-angry-birds-website-following-nsa-spying-claims