Finjan: Warning users or scaring up business?
301124
Security tools maker Finjan Software warned on Wednesday that it hadfound as many as 10 security flaws in the last update to Microsoft&#39;s flagship operating system, Windows XP Service Pack 2. In a statement
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
416981
To see the e-mail I get every day from readers about security issues is to develop a deep discomfort with the state of computing today. Keeping a Windows PC safe can demand a high degree of vigilance. -Rob Pegoraro
80690
DISCOVERING two new variants of the phone virus âCabir,â Finnish antivirus firm F-Secure has issued a warning against mounting virus attacks on mobile phones.
439828
Finjan Software, the leading provider of proactive secure content management solutions for enterprises, announces today 10 serious security vulnerabilities discovered by Finjan&#39;s Malicious Code Research Center (MCRC) in WindowsÂ® XP Service Pack 2 (SP2
643950
Businesses have more to worry about with end-user abuse and security lapses, research suggests.
632083
(InfoWorld) - Hackers are trying to play on business' fear of legal action from customers to trick them into downloading a harmful program distributed through e-mail. The e-mails purport to come from the Better Business Bureau, an organization that monitors and arbitrates disputes between consumers and businesses in the U.S. and Canada. The e-mails assert that a customer lodged a complaint against the recipient's business, according to a warning on the Web site of Websense, a security vendor. The e-mails contain aÂ Microsoft WordÂ attachmentÂ with the text of the supposed complaint and instructions for how to respond. But embedded in that document is a keylogging program that captures data on the victim's computer and then uploads it to a server in Malaysia. The keylogger is purposely mislabeled with a ".pdf" extension -- Portable Document Format -- another widely used document format, to make it look harmless, said Henry Gonzalez, Websense's senior security researcher. The trick is another variation of so-called "social engineering" methods used by hackers, which entice users to unknowingly install harmful programs on their computers. A Better Business Bureau branch warned of a similar kind of attack in February. At that time, the e-mails contained hyperlinks to malicious Web sites. Some kinds of malicious software can be installed on a user's computer merely by viewing a site engineered to exploit a vulnerability within a Web browser. The latest attack, using the Word document as the delivery vehicle for the malicious software, is a tactic hackers are increasingly employing. Â ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
402591
Question: We're in the early stages of startup and beginning to shop for technology. We'll need basic hardware and software, plus many other technology and Web-based services to sell online, service customers and keep it all secure.
13352
While security experts applaud Microsoft&#39;s recently released Service Pack 2, some companies that distribute their software over the Web are watching the product&#39;s introduction with dread and suspicion.
666596
Users of the popular QuickBooks small business accounting software have been warned that they risk losing data and control of their PCs to hackers.
273055
By Peter Healy, The Stamford Advocate, Conn.  Dec. 17--Imagine that you just told a friend via e-mail about your idea for a new product that might outsell the iPod. But if a computer hacker finds it and steals your secrets, a lifetime of work and billions in revenues could be lost.
246704
The security threats against business-technology systems continue to multiply. Not only do malicious worms and viruses such as Blaster and Bagle continue to wreak havoc, but security pros
392232
The company's new software might let private information go public. Also: A new website pays you to help your friends buy products  & hellip;. LAN operators start to gear up  & hellip;. and more.
302649
Beta search app creates vulnerabilities that may threaten your data's   security.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
320458
Web servers may be vulnerable to attack, security company warns.
540704
By Ryan, Jim T  REGION  Exploitive ads proliferate on World Wide Web  Computer experts are advising companies and Web surfers to be wary about what they double-click on, even when visiting trusted sites.