Rumores.
El secreto de predecir el futuro está en escuchar los rumores.
En algunas ocasiones, para el momento en que un rumor llega a nuestros oídos, se trata de algo que es prácticamente una realidad. Así que, conside…
As we wrote in our previous blog The Middle East and North Africa (MENA) region is basking in the joys of booming economic growth.
These are exciting times however, that said, such success also has its downsides. While e-commerce is on a rapid upward trajectory – particularly in the banking and travel sectors – it has made many MENA businesses highly attractive to the cybercriminals, who are out to cash in on any vulnerabilities they can exploit.
Just how open to the cybercriminals the region is can best be exemplified by the targeting of its oil and gas sector. Last year, it was the victim of a hacker attack known as Shamoon (aka W32.Disttrack), which is capable of wiping files and rendering several computers on a network unusable. Saudi Arabia’s national oil company Saudi Aramco itself came under fire, with 30,000 of its computers knocked out, resulting in its own network being taken offline. Only a few days later, in Qatar, computer systems at energy firm RasGas, one of the world’s largest producers of liquid petroleum gas, were also taken offline by a similar attack.
What exactly can Shamoon do, once it gets inside an organisation? A great deal of damage, is the answer. Using bespoke malware written to run on both 64bit and 32bit systems, it is able to:
But the level and scale of attacks go way beyond that. In some cases, they are designed to cause maximum disruption for political reasons. In other cases, it’s all about inflicting brand damage or manipulating the market. But mostly these assaults are driven by financial motives. And they are only increasing. As the MENA region’s economy prospers, the cybercriminals are out to do the same.
One favoured method of trapping the unsuspecting is by means of what is known as a ‘Watering hole’ web attack. Just as a lion will lurk unseen waiting for its prey when it comes out into the open to drink, believing it is safe, so, too, do the hackers seek out those with their guard down (Indeed one particularly successful (for the perpetrator that is) waterhole attack infected 500 organisations in a single day). Moreover, the intended victims that the attackers seek out are particular individuals or groups (organisation, industry or region, such as MENA) and then: Identifying which websites are used most often
Once that process is complete, the trap is sprung and the defenceless victim ensnared. Google, Apple, Twitter and Facebook have all been victims of such attacks after employees visited a site popular with iOS app developers.
For those intent on enjoying a share of MENA’s burgeoning prosperity, while avoiding the damage inflicted by the cybercriminals, it is vital that anyone who engages with your business remains safe and secure, particularly when conducting on line transactions. And the way to make certain of this is by using SSL and a trust mark such as the Norton Secured Seal
In fact, SSL certificates should be the starting point for any ecommerce site or anyone else that asks customers to submit personal information. Equally, for companies that don’t ask for personal information from visitors, SSL is still an absolute must, as it acts as a powerful protective barrier on line, keeping the cybercriminals at arm’s length. So, if you are operating in the region or looking to do so, you need to put a series of ‘Best Practice’ measures in place, such as:
Advanced Reputation Security: Detect and block new and unknown threats based on global reputation and ranking
Layered Endpoint Protection: use more than just AV – use full functionality of endpoint protection including heuristics, reputation-based, behaviour-based and other technologies; restrict removable devices and turn off auto-run to prevent malware infection
Layered Network Protection: Monitor globally for network intrusions, propagation attempts and other suspicious traffic patterns, including using reputation-based technologies; network protection is more than just blacklisting
Security Awareness Training: ensure employees become the first line of defence against socially engineered attacks, such as phishing, spear phishing, and other types of attacks.
Website Security Solutions from Symantec: SSL certificates with added website malware scans and web vulnerability assessment to ensure your site cannot be compromised by hackers.
Most of all, you need to create and enforce security policies, so that all confidential information is encrypted – and monitor globally for network intrusions, propagation attempts and other suspicious traffic patterns, including using reputation-based technologies.
On which note, according to a survey carried out recently by the independent web research organisation Baymard Institute, in conjunction with Google, the Norton Secured Seal is by far the most trusted – nearly 13% ahead of its nearest rival (http://baymard.com/blog/site-seal-trust). It was shown to be the seal that gave customers the strongest sense of trust when purchasing online, making it the de facto choice.
For any business intent on capturing and keeping customers in the MENA region by establishing the highest levels of trust and trustworthiness, such reassurance will play a major role in the days ahead, as the internet spreads its reach even farther and e-commerce gathers ever greater momentum.
To learn more please visit go.symantec.com/ssl
There has been recent media coverage around a new online banking Trojan, publicly known as Neverquest. Once Neverquest infects a computer, the malware can modify content on banking websites opened in certain Internet browsers and can inject rogue forms…
ワードサラダは、ベイジアンスパムフィルタを回避するためにスパマーが考案した手法です。スパマーの教科書に載るような古典的な手口ですが、この戦術も最先端のスパム対策フィルタリング技術によって、効果が激減しています。
ベイジアンポイズニングの一種であるワードサラダは、まったく無関係な単語が並んだ文字列です。ごく正常で、一般の文章でも見かけるような単語だけが使われているので、ベイジアンフィルタからすれば、ワードサラダを用いた電子メールには、正常なデータが大量にあるにすぎません。ワードサラダがよく使われるのは HTML 形式です。無意味なタグで URL が分断されているため、スパムと思しき URL をアナライザで追跡するのが困難になります。ワードサラダでは、最新ニュースや間近に迫ったイベントなど最新のキーワードを追加するのが最近の傾向です。
映画『ワイルド・スピード』シリーズへの出演で知られるポール・ウォーカーさんの逝去も、スパマーが悪用している最近の一例です。ポール・ウォーカーさんの悲報の数時間後には、「PAUL WALKER」という名前をワードサラダに使った「かんじきスパム」、つまり一撃離脱タイプのスパムが確認されています。ファンがやきもきしながら検死報告を待っていたこともあって、彼の名前は検索キーワードとしても上位を占めています。当初は、命を取り留めたという誤報も流れたほどでした。
図 1. ワードサラダで「PAUL WALKER」というキーワードを使った電子メールの本文
該当するスパムは、このワードサラダ部分を除けば、ポール・ウォーカーさんに関するニュースとはまったく無関係です。プレビューされるのは、テレビや電話、インターネットの広告スパムであり、件名は以下のとおりです。
件名: Cheap Cable-TV, Internet & Phone – Free Equipment, Premium Channels & Install（ケーブルテレビ、インターネット、電話を格安で – 機材も設置も有料チャンネルも今なら無料）
差出人: ~CABLETVSpecialS* <[name]@[domain].com>（~CABLETVSpecialS* <[名前]@[ドメイン].com>）
図 2. スパムのプレビュー
ポール・ウォーカーさんを悼む一方で、これもスパマーがスパムを拡散するためにはどんな手段もいとわないという格好の例であることを忘れないようにしてください。
ポール・ウォーカーさんに謹んで哀悼の意を表します。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
クリスマスシーズンは、いろいろなものが緩みがちな季節です。それが「なぜ」かは明白ですし、「どこ」かといえば財布のひもに決まっています。
笑いごとではなく、計画を立てて支出を見直しましょう。手持ちの資金に限りがあることは自分が一番よくわかっていますが、あなたの次にその価値をわかっているのは、あなたのことをいろいろと詮索している何者かです。その手口は驚くほど簡単です。ちょっとした欲や、ほんの少しの不安、わずかばかりの緊急性を煽り立てるだけで、固い決心などすぐに吹き飛んでしまいます。うかうかと騙されてしまった直後に後悔しても後の祭りです。クリスマスに向けて一所懸命に貯めていた大切なお金を一瞬にして盗み取られてしまいます。ここまでの話が遠回しに思えてピンとこなかった場合でも、次のようなフィッシングのサンプルを少し解析してみればよくわかるでしょう。
フィッシングメールのヘッダーは以下のとおりです。
件名: [Brand name] is giving you a chance to shop for free!（[ブランド名] で無料のお買い物ができるチャンス!）
差出人: “[Brand name] Card” [name]@[domain].com（”[ブランド名] カード” [名前]@[ドメイン].com）
図 1. クリスマスを狙うフィッシング攻撃に使われているスパムメール
この電子メールは、有名な金融機関から送られてきたように見え、クリスマス向けに「無料クーポン券」を進呈すると謳っています。また、クーポン券を受け取るためと称して「Kindly Click here now（ここをクリックしてください）」と書かれたリンクも含まれており、2013 年 12 月 31 日までの期間限定だと書かれています。
このクーポン券はユーザーが確認した後に送られてくるという点に特に注意してください。つまり、このクーポン券を受け取るには、まずクリックする必要があるということです。ためらわずにクリックしてしまうことは簡単ですが、まず用心しなければなりません。クリスマスともなれば、至るところ詐欺のワナだらけです。
金銭を伴う取引には十分に注意し、不審な点がないかどうか確認したうえで、確実に安全だとわからない限り、電子メールに記載されたリンクはクリックしないでください。騙されないように、電子メール中のリンクが本当に記載どおりの金融機関のものであることを確かめる必要があります。パスワードは定期的に変更し、予測のできない強力なものを使用してください。また、パスワードを他人に知られないようにしてください。
こうした宣伝文句は魅力的ですが、結局は金銭的な被害を受けることになるだけです。後からいくら嘆いても、失ったものを取り戻すことはできません。シマンテックは、オンラインの不正行為やフィッシング攻撃からユーザーを保護するために全力を尽くしますが、詐欺などの犯罪行為を防ぐために基本的なセキュリティ対策（ベストプラクティス）に従うことをお勧めします。
安全で楽しいクリスマスをお過ごしください。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
Yesterday, a number of Twitter users were duped into following fake Twitter accounts known as @VerifiedReport and @MagicReports. Both accounts claimed to be part of a Twitter experiment between users, news organizations, and journalists, and foll…
The value of Bitcoin has surged dramatically in recent weeks, fuelling fears that a bubble is forming around the virtual currency. As investors pile in, a crash in Bitcoin prices isn’t the only thing they have to worry about. There has been a spate of incidents in recent weeks in which Bitcoin wallet and banking services have been attacked and millions of dollars worth of the currency stolen.
Figure 1. Size of recent Bitcoin heists (US$ value on November 29)
The current round of attacks began on November 7, when Australian Bitcoin wallet service Inputs.io announced that it had closed its doors after two attacks resulted in around 4,100 Bitcoins (US $4.34 million at the time of writing) being stolen. Inputs.io said the attackers were able to bypass two-factor authentication due to a flaw on the server host side. The attacks left the site unable to pay all of its user balances.
Why did people keep their Bitcoins with Inputs.io? One of the services it offered was that it “mixed wallets up”, swapping Bitcoins around between users. It effectively was a type of anonymizing service, making Bitcoin transactions harder to track. However, giving Inputs.io that level of access to Bitcoin wallets may have left it more vulnerable to attack.
Inputs.io was run by a young Australian who goes by the moniker of TradeFortress. Following the theft, he gave an interview to Australia’s ABC news, denying that he taken the Bitcoins himself. Interestingly, he said that he wasn’t going to report the incident to the police. “The police don’t have access to any more information than any user does when it comes to Bitcoin. Some say it gives them control of their money,” he said.
Within days, there was another incident, this time in China. GBL, a Bitcoin exchange, suddenly closed its doors on November 11. Approximately US $12.7 million in investors’ money disappeared along with the site. A closer look at GBL revealed that it wasn’t all it claimed to be. It asserted it was licensed by the Hong Kong government, but it transpired that it was simply registered as a business there and had no license to operate as a financial services company.
This incident was quickly followed by news of an attack on Czech exchange, Bitcash.cz. Roughly 4,000 people were affected by the breach, which saw the equivalent of $514,000 taken by attackers. Obviously this haul wasn’t enough as the attackers then used Bitcash.cz email addresses to send emails to site users, claiming that they were using a U.S. recovery firm to retrieve the stolen money and asking for 2 Bitcoins from each user to cover the costs.
The most recent incident involved BIPS, a Danish Bitcoin payment processor and wallet provider, which this week confirmed it was the target of a coordinated attack that resulted in a breach of its systems. The company said that several consumer wallets had been compromised. It is estimated that around 1,295 Bitcoins (worth approximately US $1.37 million) were taken in the attack, but most of the Bitcoins stolen belonged to the company itself rather than customers. Following the attacks, BIPS has said that it will close its consumer wallet services to focus on merchant processing.
While Bitcoin is commonly talked about as being secure, that, in essence, refers to the fact that it cannot be counterfeited, at least not yet. However, it doesn’t mean that it can’t be stolen, as these recent thefts have illustrated.
What can Bitcoin owners do to prevent theft? Given the kind of attacks we have witnessed, proper due diligence on where you are storing Bitcoins should be a priority. For example, GBL claimed that it was licensed in Hong Kong, but it wasn’t. Similarly, while Inputs.io’s service of mixing wallets up might have appealed to the privacy conscious, the level of access it had to user funds was a possible security risk.
After Inputs.io was attacked, its owner TradeFortress said: “I don’t recommend storing any Bitcoins accessible on computers connected to the internet”. The attack on BIPS also prompted its chief executive Kris Henriksen to change his opinion on the security of online wallets. He went as far as to advise his customers to avoid online wallets altogether.
While a lot of people think that the only way to store Bitcoins is in online, virtual wallets, it is also possible to store them offline. This involves creating a wallet that is stored on an offline device, such as a USB key and then sending your Bitcoins to this wallet address. The best practice procedure for creating an offline wallet is somewhat lengthy, but it is, in theory at least, safer than online storage. Technically, the Bitcoins themselves remain online. What is being taken offline is the means of accessing them, the private key.
It is also possible go one step further in offline storage, by taking electronic devices out of the equation entirely and creating a paper wallet. However, a paper based wallet bears the same risk as cash. It needs to be stored somewhere securely.
Online service providers have also begun to beef up their own security. Mt.Gox, ones of the world’s biggest Bitcoin exchanges, has implemented an additional layer of security by introducing a One Time Password (OTP) card, which will be shipping to all of its users immediately. The company said that the card can be used on its own or in conjunction with other two factor authentication methods, such as a Yubikey, a USB key the user must insert to verify their identity.
Once the user has input the card into their preferences on Mt.Gox, they can configure their account to require an additional password on login. Pushing a button on the card will generate a unique password for every login.
The upsurge in Bitcoin theft is more than likely linked to the fact that the value of the currency has shot through the roof in recent weeks. At the time of writing, one Bitcoin was valued at approximately $1,060. Its value has grown by more than 45 times this year and much of the gains have come in recent weeks. One month ago, it was trading at around $190.
The result of this boom is that what were once relatively minor holdings of Bitcoin can now be quite valuable. Nothing illustrates this better than the story of the IT professional who realized he had thrown out a laptop with a wallet containing 7,500 Bitcoin. He had mined the Bitcoins himself in 2009 and at the time they were only worth a few dollars.
Figure 2. Bitcoin/US$ exchange rate for the past six months (Credit: bitcoincharts.com)
Since then, their value has increased dramatically, with occasional dips along the way. When Silk Road, the underground drugs bazaar was shut down by the FBI in early October, it led to some speculation that the value of Bitcoin would plummet, since the currency is widely used in the underground. While there was a sell-off in the immediate aftermath of the bust, Bitcoin recovered within days and then began to climb quickly.
Part of the surge may be attributable to the fact that regulators are beginning to take the currency more seriously. For example, the U.S. Senate’s Homeland Security and Governmental Affairs Committee last week held a hearing on virtual currencies, at which the Department of Justice’s representative described Bitcoin as a “legal means of exchange”. Committee chairman Tom Carper meanwhile said Congress and government needed to develop “smart, sensible, and effective policies” around the currency.
However, Bitcoin’s steep appreciation has led to widespread fears that a bubble is forming. One look at the graph charting its dollar exchange rate is enough to prompt questions. While the number of businesses accepting Bitcoin as a form of payment has undoubtedly grown, it has not been at the same rate as its appreciation. Instead, speculation appears to be driving much of the current boom and, as history has shown; such buying frenzies can often end in tears.
Word Salad, a workaround method invented by spammers to counter Bayesian spam filtering, is an old trick in the spammer’s manual, but cutting edge anti-spam filtering technology has made this ploy blunt.
As a form of Bayesian poisoning, Word Salad is an incongruous string of words. It uses words that are very legitimate and can be seen in any form of legit prose. From the perspective of Bayesian filtering, there is a large volume of legit data in emails which employs Word Salad. The word salad are often seen in the form of HTML, where nonsensical tags are used to break URLs up so analysers will have a hard time tracking down the spammy URL. The latest trend in word salad is to add the most current keywords, like the hottest news or an upcoming event.
The demise of Paul Walker, the ‘Fast and Furious’ franchise star, in a fiery car accident on Saturday, is the latest example exploited by spammers. Within hours of this breaking news, Symantec observed snowshoe spam or hit-and-run attacks, using “PAUL WALKER” in Word Salad. This topic is a highly searched topic at the moment, as his fans anxiously wait for his autopsy report. Earlier on, there was also fake news circulating claiming that Paul Walker has survived the crash.
Figure 1: An email body with the keyword “PAUL WALKER” using word salad.
The spam in discussion had no relevant ties to any news on Paul Walker, except for the Word Salad. The preview is that of a TV/Phone/Internet promo spam which has the headers below:
Subject: Cheap Cable-TV, Internet & Phone – Free Equipment, Premium Channels & Install
From: ~CABLETVSpecialS* <[name]@[domain].com>
Figure 2. A preview of the spam
As we remember Paul Walker, we should also be reminded this is another example of how spammers don’t hesitate to manipulate various incidents in their bid to promote spam.
RIP Paul Walker.