Cybersecurity 2003

Update: Background Info about Booz Allen Hamilton and Magic Lantern (09/22)

New Cybersecurity Chief Named

CBS -Sept. 15, 2003

(CBS/AP) The Bush administration on Monday selected Amit Yoran, a respected software executive from Symantec Corp., as the nation's new cybersecurity chief inside the Department of Homeland Security.

Yoran's selection was announced to industry executives and other government officials. Yoran, who was not at the announcement, said he expects to report for work within a few weeks.

Following a compilation of links and analysis by Freedomfiles on the same issue (To be updated)

Cybersecurity expert warns of post-9/11 vulnerability http://www.computercops.us/article3129.html

Security in the Slow Lane http://www.computercops.us/article-topic-22.html

The death spiral Will IT ride today's approach to anti-worm and anti-virus software to certain doom? http://www.computercops.us/article3130.html

Social Engineering for Security http://www.computercops.us/article2934.html

http://www.computercops.us/

Blaster II ? Microsoft Warns of new security holes http://www.computerweekly.com/

Security: No place to hide http://www.computerweekly.com/

UN hosts Global Infosec conference computerweekly.com

"NYT Representative One advised me {FBI Agent} that the intruder {Adrian Lamo} had altered the Op-Ed database, adding a record for "Adrian Lamo" and personal information such as Lamo's cellular telephone number (i.e., (414) 505-HACK) and email address, and listing his expertise as "computer hacking, national security, communications intelligence."

"Based on my {FBI Agent} training and experience, I have learned {Lamo} had accessed a New York Times staff list; obtained the name and Social Security number of a former New York Times employee; and using that information logged onto the NYT Intranet as a "superuser".

{I've been working in the IT industry for years, being responsible for security, and I really want to see how anyone can get root by getting the name and SSN of a former employee of any company}

In December, he was praised by communications monolith WorldCom after he discovered - and helped fix - gaping holes in its intranet that threatened to expose the private networks of Bank of America, Citicorp and J.P. Morgan.

http://www.suprmchaos.com/bcEnt-Fri-030102.index.html

{So he hacks MCI, gets hired and praised by them to solve their problems and will now be charged among others because he hacked MCI Worldcom ?}

iDEFENSE is a global security intelligence services company, iDEFENSE provides advanced warning and analysis of threats to our clients' critical information infrastructure. But iDEFENSE goes well beyond the technical vulnerabilities and virus attacks. Our analysts examine hackers, incidents, geopolitical aspects, legal implications and policy decisions to see how a critical information infrastructure can be impacted.
http://www.techsec.com/html/TechnoSponsors2003.html

Executive team:
http://www.idefense.com/exec.html

Idefense working for Department of Homeland Defense
http://www.gcn.com/21_23/news/19575-1.html

HHS also has issued a request for proposals for a managed security services contract. Seligman hopes to award a contract in several weeks and have a system in place in about three months.

"We want a managed security service provider to be watching our perimeter and in some cases our interior with intrusion detection sensors on a real-time basis around the clock, and to be alerting us to abnormal incidences that they may see," he said.

Another recent enterprise initiative was to go departmentwide with a cyberthreat intelligence service from iDefense Inc. of Chantilly, Va.

Seligman piloted the service at CDC about two years ago before awarding iDefense a contract for all of CDC.

The service, called iAlert, gives subscribers daily, in-depth intelligence reports on threats such as viruses, worms and hackers so organizations have the data they need to combat them. Citing a recent experience, Seligman said CDC received an iAlert warning about malicious software in the wild with a .CPL file extension.

"We put an absolute blanket prohibition on having an attachment come in through e-mail with that file extension on it in advance of noticing any of it at the agency," he said. "That's an example of where [iDefense's] intelligence alerts helped us out before we ever experienced any negative outcomes."

HHS's one-year contract with iDefense is worth about $140,000, said Brian Kelly, chief executive officer of company.


HHS Boosting Cyber Security
http://www.fcw.com/fcw/articles/2003/0602/web-hhs-06-04-03.asp

The Department of Health and Human Services has expanded its contract with iDefense Inc. to provide cyberthreat intelligence to the entire department.

Reston, Va.-based iDefense will help the department protect its computers, networks and Internet functions with the company's iAlert intelligence service.

The service will provide intelligence reports to keep HHS officials aware of possible risks. The company delivers the intelligence reports via e-mail, a secure Web interface and wireless devices.

"The Department of Health and Human Services is setting the standard for proactive defense by uniformly equipping all of its agencies with the capability to quickly deploy countermeasures against emerging threats before they can cause any damage," iDefense vice president of intelligence operations John Frazzini said in a statement.

IDefense will provide the following services for HHS:

* Daily intelligence reports providing early warning notification and analysis on cyberthreats.

* Proactive countermeasure information, such as patches and workarounds, to avoid damage from the latest vulnerability.

* Profiles of threats, including individual and groups of hackers and areas of increased malicious cyberactivity.


State buying Cyberalert Service
http://www.fcw.com/fcw/articles/2001/

The State Department is buying an online service to provide its workers with daily news and bulletins related to Internet threats and security.

State intends to buy iAlert cybersecurity service on a sole-source basis from iDefense Inc. of Fairfax, Va., according to an announcement published on BidRadar, a Web service that alerts businesses to government contract purchases and requests for proposals.

A contract amount was not included in the announcement, and State offered no comment. A company spokesman said iDefense has yet to conclude a deal and so declined to talk about it.

But company spokesman Jerry Irvine did describe what iAlert provides:

From their desktops, customers log on to a secure Web site where they find up-to-date reports on viruses, hacker tools or activities—"anything that would potentially emanate from an online or cyber or electronic threat, or present a vulnerability to an organization," Irvine said.

Bulletins on cyberthreats, for example, would be followed up by in-depth analysis of the activity, including methods and location, he said.

According to the announcement, State will be able to subscribe to the service for a year.



National Security Risks of Cyber Threats

http://www.pbs.org/wgbh/pages/frontline/...

The Myth of Cyberterrorism

http://www.washingtonmonthly.com/features/2001/0211.green.html

Promise of Security

http://www.securitysoft.com/news/theenemywithin.html

Bugbear Worm: New Kind of Crime ?

http://www.msnbc.com/news/922529.asp


http://www.mmicommunications.net/pdf/iDEFENSE.pdf

Issue Date: 2/11/2003
Title: Don't Underestimate Cyberterrorists, Experts Warn
Author: Costello-Dougherty, Malaika
Publication: Medill News Service
Publication Date: 02/07/03
Security experts warn that America's enemies can exploit cyberspace to wreak havoc with the nation's public infrastructure, unless its online defenses are beefed up with the installation of security software and increased awareness among users of both the risks and ways to avoid them. A report by Dartmouth College's Institute for Security Technology Studies notes that cyberattacks designed to carry a political agenda are often harbingers for physical acts of terrorism, and warns that Internet-based assaults on information systems as well as public utility systems are "extremely likely" if the United States goes to war. IDEFENSE intelligence analyst Ken Dunham notes that a known hacker claiming allegiance to al Qaida has threatened to unleash a computer worm upon the United States if it attacks Iraq, and adds that this individual has the capability to do so. The Dartmouth report says that most cyberattacks are likely to be led by terrorist sympathizers, or hackers who do it for the thrill. Dunham cautions that hackers can use scanning tools available online that could enable them to find security holes in a matter of minutes, and can hinder the dissemination of information by altering or imitating legitimate Web sites. He adds that knowledgeable Web surfers can recognize spoofed sites by noticing the "@" symbol within the link. A recent Symantec report says that threat severity and computer vulnerabilities increased last year, and lists blended threats as the most pressing danger to Internet security; government agencies and security firms have joined forces to encourage users to deploy security software and adopt protective measures. "As long as we have vulnerabilities in cyberspace and as long as America has enemies, we are at the risk of the two coming together to severely damage our great country," declared White House cybersecurity adviser Richard Clarke in an email announcing his resignation.

http://www.lodisecurity.com/news/021103.htm





March 20, 2003
Microsoft has warned users that most versions of its Windows software have a "critical" flaw that, if exploited, can allow a hacker  to usurp control of a system or network when a victim visits a Web site or uses an e-mail program.
http://www.crmdaily.com/perl/story/21051.html

The company urged users of Windows 98 and all newer versions, including Windows XP , to download a patch, though it said newer versions of Outlook Express and Outlook 2002 are not susceptible.

The software giant said it is not aware of any attacks that exploit the vulnerability, which it first learned of in January, shortly after security research firm iDefense got word of the flaw from a UK-based researcher. iDefense said it alerted some of its clients to the flaw before the patch was officially made available.


June 18, 2003
SoBig Worm Rears Its Head Again
http://www.internetnews.com/infra/article.php/2224271

"The author of the SoBig.D worm likely waited a few days after security experts published information expecting a new variant to appear on the kill date of SoBig.C," said Ken Dunham, senior intelligence analyst for iDefense. "It's truly amazing to watch a series of worms be sequentially released, with such great success in the wild. SoBig.D spits in the face of traditional security measures, showing how important it is to have rapid response systems and intelligence programs in place to help respond to such threats."

While firms like Symantec and McAfee say the new worm's threat rating is low, iDefense has concluded it has a moderate severity rating. "SoBig.D is quickly gaining ground in the wild," Dunham said. "We recommend taking immediate action to mitigate this emerging threat. To effectively block against the e-mail component of this worm, simply block e-mail attachments such as .exe, .scr, and .pif at the gateway level."


June 26, 2003
Sobig.E Worm Spreads Rapidly Across The Internet
http://www.techweb.com/wire/story/TWB20030626S0006

Sobig.E was spreading Wednesday at a faster rate than its predecessor, Sobig.D, according to iDefense, a security intelligence firm. Most reports of the worm are from the United States, the United Kingdom and the Netherlands, the firm said.

More copies of Sobig.E are making it to the client level because .zip files "are commonly allowed through gateway filers where other file types are blocked," said Ken Dunham, iDefense senior intelligence analyst, in a prepared statement.



August 18, 2003
Blaster 'Fixer' Worm Sprouts New Versions
http://www.internetnews.com/infra/article.php/3065371

Ken Dunham, a manager at security specialist iDefense, said the new worm opens TCP port 707, which could lead to exploitation by a malicious actor. "This upgrades the threat significantly," Dunham said. 'Some may call this a good virus, but it can cause all sorts of problems when patches are applied to a computer, unbeknownst to the administrator of that computer," he added.

According to Dunham, the new Welchia copycat doesn't attempt to remove itself from an infected computer until the year 2004. "This may be an attempt for the worm to spread in the wild, patch vulnerable computers, until most computers successfully update against the RPC vulnerability exploited by DCOM RPC based worms," he explained.

iDefense's Dunham echoed calls for users to update against the DCOM RPC vulnerability. "Thousands of computers have been compromised with Trojans as well as hundreds of thousands of computers compromised by recent DCOM RPC based worms," he added.


August 29, 2003
Minnesota teen arrested in MSBlaster Case
http://www.gcn.com/vol1_no1/daily-updates/23373-1.html

Ken Dunham, malicious code intelligence manager at iDefense Inc. of Reston, Va., characterized him as a “script kiddy,” a derogatory term for a malicious hacker without the expertise to do original coding. But Dunham said arrests and prosecutions even at that level are important

If there is no accountability, there will be a lot of people who will decide to play on the dark side,” Dunham said. “We can’t rely on the morality of people. There must be consequences to have order on the Internet.”

The Ralekab worm first appeared three days ago, and three variants have been found so far. The new worm carries a backdoor Trojan horse and can update itself from a remote Web site, according to iDefense. But Ralekab might not get the opportunity to spread as far or as fast as Blaster.

“New worms like Welchia or Nachi (which actually patched the vulnerability), and aggressive patching are helping to patch computers vulnerable to remote procedure calls,” Dunham said. “As a result, this and future worms will likely have less success than former variants exploiting the same vulnerability.”


Evolution of Cross-Site Scripting Attacks
by David Endler - iDEFENSE Labs
http://www.net-security.org/article.php?id=113