Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
Privacy Businesses Your Rights Online

Spyware for Corporate Espionage 216

Posted by michael from the outlook-deemed-harmful dept.
therufus writes "Late in July, an e-mail that hit employee in-boxes at a British credit card and finance company carried a secret payload--spyware capable of recording confidential corporate data and sending it over the Net."
This discussion has been archived. No new comments can be posted.

Spyware for Corporate Espionage More

Spyware for Corporate Espionage

Comments Filter:

  • Nothing new... (Score:5, Funny)

    by Anonymous Coward on Thursday November 20, 2003 @11:34AM (#7520019)
    Most of my company's data already goes right to our competitors already. What with our fancy new wireless network. Check it out - SSID: linksys, no wep, no wpa...

  • Here is an idea. (Score:3, Insightful)

    by Omni Magnus ( 645067 ) on Thursday November 20, 2003 @11:35AM (#7520026)
    Don't open Emails that you have no clue who they came from. This is just common sense.

    • Re:Here is an idea. (Score:5, Insightful)

      by binaryDigit ( 557647 ) on Thursday November 20, 2003 @11:46AM (#7520160)
      Don't open Emails that you have no clue who they came from. This is just common sense.

      That line of defense fails when only 1 person forgets this fact (or as a permutation of the following) and the "virus/worm" spreads itself by having the from address of the newly infected person. Plus, it doesn't take a lot of effort to find out who the IT or some other higher up in a company is and use their name as the sender of the email.

    • BS !! (Score:5, Insightful)

      by AftanGustur ( 7715 ) on Thursday November 20, 2003 @11:51AM (#7520195) Homepage


      Don't open Emails that you have no clue who they came from. This is just common sense

      Come one, grow up, we're no longer 6 years old and there is no good reason why we should be forced to live in fear of our emails !!

      If a email can do all kinds of bad stuff to your computer, it is the fault of the one who wrote the email software, period..

      Don't try to blame the victim because he was simply using the software for what is it supposed to do ...

    • Re:Here is an idea. (Score:3, Interesting)

      by gclef ( 96311 )
      The one problem with this is salescritters. They expect to get emails from unknown folks...those are called sales leads. Of course, salescritters are also notorious for being fools (no, your customers will never write to say "I LOVE YOU"), but your attitude ignores that some people need to open emails that come from unknown sources.

    • Don't open Emails that you have no clue who they came from. This is just common sense.

      Except that most Outlook users use the "Preview Pane" feature, which means all the scripts/"tracking images" get executed as soon as you click on the message and it shows up in that Preview Pane. Since you can't delete the message without clicking, it's a catch-22.

      For this reason, we're moving away from Outlook, and also purchasing Adaware Pro licenses for our workstations. We are a financial institution and having so

      • Or you could just turn off the preview pane. View, Preview Pane, (click on it to toggle).

        Not that you shouldn't move away from Outlook, it's just that your reasoning is lame and contrived.
    • I'm running a small business.

      I need to read mails from unknown people, because those are... my new customers!

      How about remove Outlook and Internet Explorer instead and installing a secure email infrastructure. I have never ever, not even once, felt the need to not open an email because it might be insecure.

      Advocating not opening emails is even worse than running exploitware from Microsoft in the first place.
    • Correction, don't use email clients that automatically run attachments when you open messages.
    • Don't open Emails that you have no clue who they came from. This is just common sense.

      I tried to e-mail to you, but I didn't get a reply...<bud-dum-dum> Thanks, I'm here all week.

      For a while now, almost every e-mail worm sends out e-mail to addresses found in the victim's address book. In other words, a huge amount of viruses and worms are, or appear to be, coming from people that you know and trust.

      Short of reviewing the Recieved: headers on every e-mail, you really have no clue who they cam

  • Here's our nightmare scenario in the military.... (Score:5, Interesting)

    by i_want_you_to_throw_ ( 559379 ) * on Thursday November 20, 2003 @11:35AM (#7520027) Journal
    Some enterprising cracker is going to encapsulate a key logger into a piece of spyware, it is going to have a logic bomb in it so it will self destruct (the purpose to gather info and then leave no trace) , it will record passwords and other info, and that info will be sent back to some third party possibly a hostile government.

    It's going to happen. Here's why it's troublesome and mod me down if you must but our operation has a blind allegiance to Redmond and the IM folks are not particularly bright. We have had network problems in the past. China has opted to bet the farm on Linux after seeing the Windows Source Code.

    As one of the few Linux developers here, I fear a nightmare is coming. I would really welcome any ideas that anyone has about how we combat this or put our minds at ease.

    Redmond related flames go to /dev/null.
    • I second that, it would not be too hard to either write the key logger or the logic bomb - for that matter it would not nessecary need to destroy the entire program, just anything that can be used to track back to the oginator. The biggest problem in preventing something such would be to control the vectors through which it could be introduced to the network (i.e. Users running e-mail attactments), because once the program is on the network the damage has been done.
      • The advantage of completely wiping the key logger is that if you destroy the evidence that they've been hacked, they'll never raise their suspicions, and you're much more likely to get away with whatever you're going to use those passwords for.

        Otherwise some administrator browses through someone's machine two months later, trying to figure out why it's so slow, and says "oh, shit..." - and then security clamps down like a {pick useful crude metaphor here}. It's far easier to slip in when noone's the wiser.
      • I disagree...it is MUCH better to have the entire program destroyed and no trace left whatsoever that the key logger/trojan/whatever you want to call it was there. That way a post mortem could not determine whether a specific machine was compromised.

        What would be scarier to you if you were in charge of machines with valuable data on them - a warning that said there was a potential breach, and check here, here and here to see if you were affected, or a warning that said there was a potential breach, howeve
    • As one of the few Linux developers here, I fear a nightmare is coming. I would really welcome any ideas that anyone has about how we combat this or put our minds at ease.

      Well we know that a lot of these get around even secured networks because of the users. However, in most of these networks there is a competent admin who runs a firewall, but can't run ad-aware on every machine constantly (and if that were feasible, damage might already be done in one user session).

      So here's my idea, which maybe is a

    • Re:Here's our nightmare scenario in the military.. (Score:5, Insightful)

      by zeux ( 129034 ) on Thursday November 20, 2003 @12:34PM (#7520606)
      China has opted to bet the farm on Linux after seeing the Windows Source Code.

      I think that China choose Linux not because of Windows source code but because Windows is the product of an American company.

      But maybe I'm wrong.

    • Re:Here's our nightmare scenario in the military.. (Score:4, Informative)

      by borgboy ( 218060 ) on Thursday November 20, 2003 @12:38PM (#7520645)
      Are you talking about the US Millitary? Siprnet is rather closely watched, computers are audited for unauthorized applications, people get in serious trouble for installing unauthorized software on a secure network machine. It isnt connected to the internet. Ever.
      And if you're not talking about siprnet, then that machine/person/network just really isn't important enough to worry about - from a national security perspective.
      • You can deduce an awful lot about classified matters if you can gather enough sensitive but unclassified data. Much as I despise Admiral Poindexter of Iran-Contra and DODs Total Information Awareness Program, he has quite rightly pointed out this problem in the past. But his proposed cure, which involves stopping the publication of some scientific research among other things, is likely worse than the disease.
        • Yes, you can [deduce]. I agree with you 100% and, to an extent, that will always be a problem, especially in non-totalitarian societies. However, in that case, the spyware will have to remain in place undetected for long periods of time, forwarding large quantities of data to be analyzed. This greatly increases the risk of the spyware being discovered on any military network, siprnet or not. Not that it cannot be done, but those are exactly the kinds of traffic patterns that are monitored for, even on uncla
      • But I thought that Siprnet was connected to the internet in the context the the transmissions over the interent? Granted a Siprnet computer cannot access the general internet and such associated websites and ect; however, it does need a means for communication between bases.

      • Siprnet is rather closely watched, computers are audited for unauthorized applications, people get in serious trouble for installing unauthorized software on a secure network machine. It isnt connected to the internet. Ever.

        You sir, are either ignorant or full of it. Not only is SIPRNET connected to the regular net, so are other more highly classified networks. Don't believe me? Go ask anyone that has worked in a SCIF for more than a year how many times their MS systems (on the "secure" network") have

      • machine/person/network just really isn't important enough to worry about - from a national security perspective

        offtopic wrt main topic but, what about SCADA [pbs.org] attacks?

        PBS did an excellent show on CyberWarfare [pbs.org] highlighting that it's the points of weakness where attacks are most likely to occur. Milnet [ic.ac.uk], siprnet, etc may be secured but could any *western* city be without power for a period of 6 months? Think asymmetric [af.mil] not conventional and you can appreciate how real such threats are taken [pbs.org].

    • We have had network problems in the past. China has opted to bet the farm on Linux after seeing the Windows Source Code.

      Even worse, maybe China never intended to use Windows but just wanted the source so that they might discover more vulnerabilities.

  • Priceless... (Score:3, Funny)

    by gpinzone ( 531794 ) on Thursday November 20, 2003 @11:36AM (#7520042) Homepage Journal
    Designing a spyware program: $153

    Bulk emailing said program: $35

    Obtaining thousands of credit card numbers: Priceless

  • Stop Spyware at the Source (Score:4, Insightful)

    by Ridgelift ( 228977 ) on Thursday November 20, 2003 @11:36AM (#7520048)
    Dubbed the Consortium Of Anti-Spyware Technology Vendors and led by the creators of the popular Ad-Aware and Pest Patrol software programs, the group is trying to create standard definitions of "spyware," "adware" and other pests, and give best-practices recommendations to the companies that want to avoid being blocked by their software.(emphasis added)

    Once again, the main technical problem lies with Windows. Spyware is just another form of malware, which takes advantage of defects in the operating system to gain access.

    I would hope that the Consortium Of Anti-Spyware Technology Vendors would promote Linux, Mac and other operating systems that are better equipped to rebuff malware attacks.
    • Funny. Microsoft is to blame for spyware issues, but Kazaa, et. al. aren't the problem when it comes to piracy.

      Love the double standard. LOVE IT.

      • Funny. Microsoft is to blame for spyware issues, but Kazaa, et. al. aren't the problem when it comes to piracy.

        Love the double standard. LOVE IT.

        Sorry, but I don't see the connection that you are trying to make between these two situations. The closest I can get is that some Microsoft products have subsurface design flaws that create opportunities for lawbreakers, while Kazaa is openly designed to offer opportunities to circumvent some laws in addition to other lawful uses. But I can't tie these sepa

        • The connection he's trying to make is that when KaZaA spreads spyware to 10s of millions of people, it is largely ignored by the /. crowd. Most comments come to KaZaA's defence, saying Sharman Networks is the white knight trumpeting P2P legitimacy in the face of the 800lb gorilla (RIAA/MPAA), and could do no wrong. Then when an article comes up about Spyware distribution, which usually occurs through less-than-obvious installation on the back of programs like KaZaA, /. comments latch on to the less-common
      • No double standard. Kazaa does exactly what it says it's going to do. Microsoft's platform has a whole bunch of unexpected (and harmful) side effects.

        If Kazaa started infecting people with viral code (outside of the spyware we all *know* it ships with) and people turned a blind eye, *then* there'd be a double standard.

        -HubCity

      • In the security context, Kazaa is actually much more to blame than Microsoft. Kazaa installs New.Net and other intrusive applications that compromise the privacy of their users. It is true that Microsoft Media Player and Windows Update also collect data on the habits of the userbase, but AFAIK their software isn't quite so intrusive.

        In the context of preserving intellectual property, Kazaa is to blame to some extent, but perhaps less so than Microsoft, Cisco, the phone companies and other infrastructure p

      • ?????

        Kazaa functions as intended. This saves their users money.

        Microsoft software does not. This costs their users money.

        See the difference?

        To put it another way...
        Funny. Ford is to blame for gasoline explosions, but screwdrivers, et. al. aren't the problem when it comes to hotwiring.
      • Piracy was around long before Windows and Kazaa. I'd say that Kazaa/Napster is only a really big problem in the US and not so much in Europe. The reason I'm leaving out the rest of the world is because they have always had people cooking up bootleg copies of everything.

        The record companies have always been losing money to organized piracy rings. The only reason they're coming down so hard in the US and soon in Europe is because they managed to legislate themselves something other than civil remedies.

        Oh, an

      • Using a program as it was designed (to read email), comes with the un-intended consequence of opening yourself and your company to a number of security holes.

        Now, with Kazaa, whatever you want to share, is your business. As far as I know, it doesn't have any unintended side effects. (Except the spyware it comes with, but thats a different story.)

        Anyway, I fail to see why this is a double standard, and why this post is +5 insightful.
      • Microsoft allows people other than the owners of computers to run malicious programs without the owners consent or knowlege. This is not a controversial statement. Microsoft has released patch after patch to supposedly fix problems that were supposedly fixed long ago. I understand that bugs happen, and sometimes old ones even get reintroduced, but the sheer number of patches coming out of Redmond indicates that there is a far more pervasive problem than a few borked buffers.

        Kazaa allows people to knowingly
      • I would hope that the Consortium Of Anti-Spyware Technology Vendors would promote Linux, Mac and other operating systems that are better equipped to rebuff malware attacks.

      Maybe I'm being overly cynical here, but would it not make much more sense for them to promote platforms where spyware is a problem? After all, it's the classical problem of any organization with an agenda: if the problem goes away, they become irrelevant themselves...
    • Once again, the main technical problem lies with Windows.

      True, but it's really not limited to them. Thus, if you install mozilla, it comes with java and javascript enabled by default. These may be a lot more secure that MS's scripting schemes, but they are channels for software that you might not want installed.

      We really need education to help people understand why it's never a good idea to let software download code and run it automatically. Any scripting facility should be turned off. It should be of

  • Strong Policy Required (Score:3, Interesting)

    by Anonymous Coward on Thursday November 20, 2003 @11:37AM (#7520055)
    I work for a Fortune 500 financial institution. We have very stringent requirements for our customer information. For instance, if any bank manager decides to take any client information to work over the weekend, he/she must get approval from 25% of the clients that he will work on. This is according to FCC regulations especially if said bank manager is using a wireless router with Verizon.

    We also frown upon expedient use of inter-office e-mail for non-productive purposes. We found that the best way to rationalize our procedures is to make the frequent example of an employee who refuses to follow the rules.

    Another point where we emphasize data security is in the discardation process of obsolete hardware. We make sure that any media has been de-magnetized (in case of floppies and CDs), exposed to ultraviolet light in case of Hard disk drives, or combusted for tape media.

    So far our security record has been 100% according to our internal auditing firm.

    Which is nice.
    • What does UV light do to hard disks? Last time I looked, aluminium castings and pressed aluminium were pretty much UV-opaque. And, the oxide layers on the platters aren't UV sensitive either.

    • Re:Strong Policy Required (Score:4, Funny)

      by drayzel ( 626716 ) on Thursday November 20, 2003 @12:22PM (#7520483)
      So far our security record has been 100% according to our internal auditing firm.


      Your password is ji5ppii9

      Your desktop wallpaper is that of a large blonde woman and 3 kids.

      You spend 4 hours a day at slashdot.org, 2+ at espn.com and an hour at goatse.cx

      The most used applications on your computer are SOL.EXE, IEXPLORE.EXE and MSWORD.EXE

      You chronicaly respond to "Lenghten The Size Of Your Weed" and "See Her Naked" spam e-mails.


      Your internal auditing firm is 100% useless.
    • On that note. I tried using a large bulk tape eraser on a HD the other day. I passed over it, tried all angles of attack, held it on the drive for minutes at a time, and even tried some of the the above while the HD was running on a working system. It did not do any checksums of the data before and after but I really thought it would have caused some serious damage, it appeared to do nothing. It did demagnatize all the monitors within 10 feet though.

      There was a myth busting style show on cable last mo
    • exposed to ultraviolet light in case of Hard disk drives,

      Wow, so you guys are doing absolutely nothing to a HDD then.....

      hard drives write MAGNETICALLY. Ultraviolet light will do absolutely nothing, espically if you dont open the drive.

      solution? wrap the drive in a degauss coil and leave it on for an hour, then put the drive in a drill press and drill 4-5 holes in through the platter.

      unless they are the NSA or other government agency, they wont get your data.
    • So far our security record has been 100% according to our internal auditing firm.

      So, you pay your cleaners more than minimum wage?

      It's amazing what people can do with the passwords written on yellow sticky tape stuck to the bottom of your keyboard.. Or a keyghost [keyghost.com] for that matter.. Or even just having their kid hook up a wireless AP to your secure LAN hidden under a desk on bring-your-kid-to-work-day..

  • Good.... (Score:3, Interesting)

    by Predathar ( 658076 ) on Thursday November 20, 2003 @11:37AM (#7520057)
    maybe if more companies get hit by these things, more BIG companies, more pressure might be applied to help solve the problem, more tougher laws? Higher fines?

    And it has to be more than the USA that makes these laws, we need Asia and Europe to follow and nail these people.

  • Sneaks (Score:4, Interesting)

    by dolo666 ( 195584 ) * on Thursday November 20, 2003 @11:39AM (#7520076) Journal
    My question is about sneaks. There are software packages that sneak spyware onto systems currently, but little is published about how to prevent this from happening. New technology circumvents anti-spyware using .Net and other features that hide the programs running. Similar uses for .Net is used by Counterstrike hacks, for cheating.

    My guess is that while we keep putting energy toward blocking spyware, and detecting it, the same energy is being put toward inventing it. Is this a battle between good and evil? It would seem so.

    Generally, I run anti-spyware programs on a frequent basis, but is it enough? Likely not. A watchdog organization, at the governmental level, is required, not just a committee. Committees come and go, but their findings should go toward an ethical standards legal department, or some kind of funded watchdog that has a declaration of what an ethical software package is, and what crosses the line. Penalties involving more than fines are in order, too, or you get people who just want to break even or make some dough, but are willing to risk fines. Espionage is illegal. Maybe that law applies, but IANAL...

    • Re:Sneaks (Score:3, Insightful)

      by Tuxedo Jack ( 648130 )
      Yes, it's becoming vaguely "Star Wars"-ish. Darth Gator versus PepiMK Skywalker... oy, there's something I never wanted to see. However, at the school district where I work, we're coming up with an interesting method of combating spyware: lawsuits against the companies. Since the spyware is often found on elementary school computers, and it's children who download it, the technical staff has considered lawsuits. IANAL, but it goes something like this: the children are obviously minors, and when they clic
    • 1) Sure, putting the government in control of something is the perfect solution. After all, look at the level of competition, ethics, and innovation in the auto industry! And hey, how `bout that patent bureau. Your "there otta be a law" rambling is great, as long as you only want to run software made large companies. No open-source of shareware software makers could afford to get certified. And what the hell good would it do? Criminals break the law, it's *what they do*, they'll write their malware no matte

  • Is anyone surprised? (Score:4, Insightful)

    by blankinthefill ( 665181 ) <blachanc@nospam.gmail.com> on Thursday November 20, 2003 @11:40AM (#7520096) Journal
    I'm not. This is the logical conclusion (Or beginning) to the "virus age" that we've been experiencing. And I think the articale is wrong in some respects, like their thinking that the script kiddies and such are long gone. They are still here, and are having nore effect than ever as they modify already dangerous viruses, making it harder to block and stop them. And tell me, when has broad ranging legislation really helped anyone? Untill it's proven effective, I will remain wary of anything of the sort.

  • Questions... (Score:5, Insightful)

    by frodo from middle ea ( 602941 ) on Thursday November 20, 2003 @11:41AM (#7520107) Homepage
    Pardon my ignorance, but...

    • What kind of stupid sys-admin allows .vbs, .js , .exe, .sws attachements thru the corporate email ?
    • What kind of idiot sys-admin would allow the corporate users , to run their PCs with admin previleges , so that any unwanted junk s/w be installed on their PCs ?
    • Which genius allows unrestricted access to confidential corporate data to its users ?
    • Why do the corporate firewalls not block out-bound traffic to all ports but a select few HTTP/SSL ect ?
    • Please bear in mind that in the UK computer personnel get appointed on the following scale:-

      1) If their CV looks "impressive" eg qualifications count more than experience

      2) If they can bluff their way through an interview

      3) If they have no clue whatsoever to do the job they're appointed to

      In answer to your questions:-

      1) A lazy or clueless sysadmin
      2) See above answer

      3) See above answer
      4) Ha ha ha - most companies here aren't even running firewalls - the reason the firewall doesn't block outbound traffi
      • Please bear in mind that in the UK computer personnel get appointed on the following scale:-

        And this is different to anywhere else?

        • Here education (regarding computers) is:-

          a) minimal
          b) usually things nobody will ever use in their job unless they become teachers
          c) taught by teachers who have a lower grasp of the subject than some of their students
          d) computer courses are taken by people not interested in computers - but because they think it'll look good on their CV & they'll earn more money
          e) was seen for a very long time as a "technical subject" and therefore received less attention than core National curriculum subjects & oth
    • What kind of idiot sys-admin would allow the corporate users , to run their PCs with admin previleges , so that any unwanted junk s/w be installed on their PCs ?

      Most places that have developers for one. Not saying this is right, but is almost always the case. And no, developers aren't that much smarter than the general population when it comes to not installing/executing things that maybe they shouldn't.

      Which genius allows unrestricted access to confidential corporate data to its users

      But if the

    • Re:Questions... (Score:5, Insightful)

      by jdreed1024 ( 443938 ) on Thursday November 20, 2003 @11:55AM (#7520236)
      What kind of stupid sys-admin allows .vbs, .js , .exe, .sws attachements thru the corporate email ?

      The sys-admin who is told by the CEO to remove the e-mail blocks, because someone wants to e-mail him a self-extracing zip file (.exe).

      What kind of idiot sys-admin would allow the corporate users , to run their PCs with admin previleges , so that any unwanted junk s/w be installed on their PCs ?

      The sys-admin who gets in trouble when he yelled at Bobby the Intern (who happens to be the CTO's nephew) for installing Kazaa on his machine. Ditto for the sys-admin who was told to turn the PHB's account into an Administrator account so he could install MS Entertainment Pack.

      Which genius allows unrestricted access to confidential corporate data to its users ?

      The genius who tried to secure the confidential corporate data with X.509 certificates and/or passwords, but was then told to remove them, because the VIPs were complaining about having to remember too many passwords.

      Why do the corporate firewalls not block out-bound traffic to all ports but a select few HTTP/SSL ect ?

      Because then the PHB can't use AIM to chat with his friends.

      Seriously, I worked as a sys-admin in an environment like this. You wouldn't believe the number of safety procedures that the CEO/CTO/PHB wanted to circumvent to make life easier for themselves. Unless you have a CTO who understands security and will stand up to the rest of the VIPs, you're doomed. Completely and utterly doomed.

      I attempted to implement the passwd changing program with cracklib support to prevent users from picking stupid passwords. That lasted about a week before I was told to take it away.

      There was a brief period of time where we went around and killed off IE on the desktop machines, because there were too many damn vulnerabilities. That lasted about 2 weeks before the CEO told us that the researchers couldn't use "this Netscape thing".

      Repeat for many other events. Bottom line is anyone who is not a sys-admin knows two things: routine and usability. However, implementing propert security requires changing at least one of those, if not both. And therein lies the problem.

      • Too true. People are almost always the weak link in security. When a sysadmin tries to use technological measures to overcome some of the more predictible ones (strong passwords, blocked attachments and ports, etc...), users revolt. (okay, they actually whine, but you get the idea)

        STRONG SECURITY || USABILITY

        Take your pick... you can't have 'em both

      • Re:Questions... (Score:5, Interesting)

        by frodo from middle ea ( 602941 ) on Thursday November 20, 2003 @12:18PM (#7520445) Homepage
        I can sympathise with you , but you do realise that you are working (or have worked) for one idiot CEO.

        Two years ago I was working for a major bank's international head office, and the security there was paranoidal. It was a sys-admins dream come true.

        • No internet access, except for only those who need it. only http and https allowed.
        • No FTP or telnet, only ssh allowed, and ssh server , configured to allow access only from a very restricted subdomain
        • All system/sys DB accounts disabled after initial setup. No database with customer data could go live unless the system/sys a/cs were disabled
        • Audit loggig of every data that goes in-out
        • Root password split btween 3 persons, i.e. all three have to be present to log in as root..priceless
        • A new password generated for every previleged a/c login. i.e. password valid for only one login
        • so gosh, what did you do there?

          Twiddle your thumbs will all the free time you had not having to go clean up windows boxes? :)

          Nice setup though. I wish microsoft great plains was that accomodating.

          Steven V.

      • Re:Questions... (Score:3, Interesting)

        by laci ( 37234 )
        How about delaying the delivery of suspicious attachents by half an hour? If you get 10 emails (not necessarily the same addressee) with the same attachment within half an hour then declare it a virus/worm and do not deliver it. If no other copy arrives within half an hour then it is likely to be safe to deliver.

        So just replace the attachment with a message stating that the attachment will be delivered in half an hour. If you get a call from the CEO then you'll know that the attachment was legit and you ca
      • This is a great example of how to think like the enemy.

        If you have a $300 lock on a $200 door surronded by $10 wall panel, what are going to take the sledgehammer to?

        This also leads to another point, if you do security well and nothing happens, then no one knows, but you end up pissing every one off. If you do not do it right, no one is pissed until something happens, then everyone knows.

        User obliteration is the only way that I know of to remove insecure nodes from a network.

    • Re:Questions... (Score:2, Interesting)

      by wcdw ( 179126 )
      But the problem is that *all* of those questions are moot in the world of laptops and VPNs. It is MUCH harder to defend against virii (et alia) from the inside of the network.

      And who is going to tell the CEO that he can't bring his laptop (that his kid infected twelve ways from Sunday last night) into the office? Or that he can't *send* .vbs, .exe, et alia attachments? (Including to other employees, obviously.)

      Likewise, VPNs are a *wonderful* tool. The convenience of being able to transparently access

      • But the problem is that *all* of those questions are moot in the world of laptops and VPNs.

        It gets worse - some people I know work for a company whose stated policy is to enable mobile computing. Whenever an old desktop is aged out, it's replaced with a laptop that the user is expected to take home at the end of each day. Sure, corporate policy also dictates certain anti-virus and personal firewall software, but virus signatures are not always up to date, and the personal firewall almost certainly does

    • Re:Questions... (Score:3, Interesting)

      by nearlygod ( 641860 )
      1. I block all executable email at the server but PHBs will not let me block .zip files.

      2. After two managers complained that they couldn't install any of software that they wanted because they didn't have Admin priviledges, the PHBs decided that everyone should have Admin rights so they could install anything that they want "within reason."

      I just felt like sharing.
      • decided that everyone should have Admin rights so they could install anything that they want "within reason."

        Which translated, no doubt, into Kazaa, assorted IM programs and enough Spyware to cripple some machines and reduce avaiable network bandwidth by 70%.

    • Re:Questions... (Score:5, Informative)

      by Samus ( 1382 ) on Thursday November 20, 2003 @12:03PM (#7520307) Journal
      Why do the corporate firewalls not block out-bound traffic to all ports but a select few HTTP/SSL etc?
      I think any decent sized corporation with a firewall admin does this already. The problem starts when you have protocols designed to circumvent firewall security. SOAP is nothing really but rpc over http on port 80. You can block whatever ports you want but as long as you have an outbound port opening somebody can find a way to use it.

      What kind of idiot sys-admin would allow the corporate users , to run their PCs with admin previleges , so that any unwanted junk s/w be installed on their PCs ?

      Again it doesn't really matter. All the buffer overflow exploits that have happened recently didn't make a check to a security manager to see if they could install a piece of software. Nimda, code red etc just installed themselves.

      What kind of stupid sys-admin allows .vbs, .js , .exe, .sws attachements thru the corporate email ?
      If you haven't seen the list of attachments outlook 2003 won't let you send you'll laugh your ass off when you do. Its basically any document that you can create with a Microsoft tool with a few of their competitors thrown in for good measure(pdf!?). I still think people will find ways to socially engineer their way around that one.
      Which genius allows unrestricted access to confidential corporate data to its users ?

      Doesn't really matter. If the pc of someone who is authorized to view that data is comprimised the cracker gets the keys to the kingdom.
    • Lots of sys admins let all kinds of files through. Our network admin let through all those executables until the code Red Virus hit us, and hit us hard. Even then, it took a few months.

      Then there's programs like Omniform. It's the software package one department uses to manage all their electronic forms from the state departments. Thousands of documents are involved, and management on down is married to Omniform.

      Problem is, you need to be running as an admin on the local machine for the poorly coded s

  • Conflict of Interest (Score:3, Funny)

    by Anonymous Coward on Thursday November 20, 2003 @11:42AM (#7520114)
    Ooooh! I'm so torn between my desire for a safe internet and my hatred of credit card companies.

    See? Bad things do happen to bad people!

  • What steps can be taken to ensure that there isn't some rogue keylogger running on an OS X system?
    • Well,

      If there are programs that you run normally, and you know the whole list, you could write a little daemon to keep track of the process list. If something else starts running, have it alert you. Sort of a less-sophisticated version of tripwire. Of course, the attacker could name his executable the same as yours, or overwrite yours, but it is better than nothing.

  • This happens quite a lot (Score:4, Insightful)

    by nodwick ( 716348 ) on Thursday November 20, 2003 @11:53AM (#7520218)
    There's an article in Dvorak's column in this month's PC Magazine (near the middle) [pcmag.com] describing how a day trader used a key logger to steal someone's brokerage password via a similar scheme. From the article:
    Using an alias, Dinh began prowling around in an online stock-chat forum, until he got the e-mail addresses of some of the traders. Using yet another alias, he then e-mailed these folks the key-logging backdoor, claiming in a long letter that he was beta-testing a new stock-charting software system and wondering whether they could help.

    Apparently, one unsuspecting sucker executed the software and wasn't suspicious when it didn't really do anything. Now Dinh had a backdoor and simply key-logged until he found the guy's online brokerage information and password. He could buy and sell from the guy's account.

    Apparently he used the other account as a dump for derivatives that he needed to offload quickly. Of course the person in the story should obviously have been more careful about clicking on attachments, but one lesson here is that as people become increasingly wired, the value of logins and passwords is becoming high enough that stealing those is as valuable or more than credit card numbers. This is especially true if you think about how much you can do financially online -- many people use the Internet almost exclusively for bill payments, stock transactions, money transfers, etc.

  • No need to worry (Score:3, Funny)

    by Space cowboy ( 13680 ) on Thursday November 20, 2003 @11:54AM (#7520225) Journal
    Microsoft is now focussing on security, so there's no need to worry any more :-)

    Since we're 110% confident that all those dedicated knowledgeable MS administrators will be keeping up-to-date with all the patches, and that with the new focus, MS software will soon be completely immune to viruses, who cares about any of this stuff ?

    Simon.
    [removes tongue from cheek]

  • Confidential data (Score:3, Interesting)

    by Decameron81 ( 628548 ) on Thursday November 20, 2003 @11:55AM (#7520233)
    The problem here is at several different levels. You can no longer expect nowadays to be protected by simply closing your doors to the outside world (ie. protecting your computer against outside attacks), but you also have to learn how to protect your computer from internal attacks. The risk of having a program already installed in your computer trying to access your data is quite higher these days than it was a few years ago, and for this very reason corporations should spend more time trying to develop encrypted systems for data storage and tighter policies aimed at improving their security systems.

    It's also necessary to protect your data against your very own employees when they are not supposed to be able to see it. And I can say that often this is not the case.

    Another important and necessary step is to instruct people using computers to work on security. And this is often not the case either.

    Diego Rey

  • Don't fear the kiddies.... (Score:4, Insightful)

    by ajs ( 35943 ) <ajs@a[ ]com ['js.' in gap]> on Thursday November 20, 2003 @11:58AM (#7520270) Homepage Journal
    As a sysadmin that has been dealing with security issues in financial and other corporate settings for well over a decade, I can tell you that the fear-factor on kiddies with their viruses starts to fade over time. However, what I've noticed happening is that people are coming to accept these relatively benign viruses, root-kits, etc as a fact of life, and they seem to be forgetting that where kiddie-hack-of-the-week can succede there WILL ALWAYS BE a small, but worrisome number of clueful people exploiting the opening.

    Most often those people are insiders, so you have the added worry that things like firewalls are useless (do you sniff email for viruses on internal mail? do you have unpatched servers that only intenal users have access to?), and they may be able to convince others that you think you can trust to look the other way.

    Security is one of those ugly balancing acts. Ultimately, it's a losing game because once a determined cracker with a clue sets their sights on you, you're done for. No amount of security is sufficient... really (yes, even a gasketted vault with armed guards CAN be cracked). The key is risk-vs-reward and always trying to make sure that some poor clueless bastard out there is an easier target than you.
  • Attacks like these raise an interesting question: Where are the good coporate spyware detection systems? I want to see a system that can be managed centrally and sends all spyware notifications to a centralized datatbase. McAfee and Symantec don't have anything worthwhile. Does anybody know of a system like this?

  • Big Deal (Score:2, Insightful)

    by Anonymous Coward
    The only thing that's news here is that someone caught it. God knows how much information is redistributed / modified this way (there are at least a dozen similar methods I can think of personally that any self-respecting spy, corporate or otherwise, must be using). That this one was caught just shows that people that aren't professionals are getting into the game.

    I have the pessimistic view that anything you know that someone else knows must be public knowledge (certainly to any member of the public that

  • Obligatory Spyware Blocking Software Post (Score:3, Informative)

    by unassimilatible ( 225662 ) on Thursday November 20, 2003 @12:11PM (#7520392) Journal
    At least for those with Windows boxes. My two favorites:

    Spybot S&D [safer-networking.org] It's free and it "innouculates." Regular updates too.

    Spywareblaster [javacoolsoftware.com]. A little reduncancy, and it has a nice Flash killing tool as well.

    Honorable mention:

    Peer Guardian [xs.tech.nu]. In addition to RIAA IP address killing, it prevents loading of DoubleClick ads and snoopware. Regular blocklist updates, and IP addy's may be manually added.

  • idiots always open attachments... (Score:4, Insightful)

    by gamlidek ( 459505 ) on Thursday November 20, 2003 @12:22PM (#7520484)
    *Yawn* So what? Idiots will always open email attachments from unknown recipients and ultimately execute some sort of hidden code on their machine mainly because they can't figure out how to turn that stuff off or stop clicking on everything they see. I'd love to blame M$ here, but it really is the techno-weenies that do it to themselves by pretending they know how to use a computer, yet no matter how many times they're told "don't open attachments" they do it anyway. I love it when the email software is set up to autoexecute this stuff by default so they don't even know about it. RTFM, people!

    -gam

  • Flash drives? (Score:4, Interesting)

    by tambo ( 310170 ) on Thursday November 20, 2003 @12:43PM (#7520700)
    So here's a (marginally) related thought.

    Vendors routinely give out free stuff at conferences, and one of the popular ones these days (actually halfway useful!) is a free 32mb USB key. And of course, every such key comes with plug-n-pray drivers so you can plug it in and start writing to it.

    They could easily include some network code in the driver that sends every document you write on the key to the company that sold the device. Of course, obscure this process: send only during idle periods; encrypt the document; send the files to some anonymous file dump in Malaysia or something that's only known and accessible by the company...

    Since these devices are routinely given freely to corporate representatives, this might net a high percentage of corporate documents, some of which might be valuable.

    - David Stein

    • In this case, my counter would be that you know the vendor... or at least, you should know the vendor and at least trust them somewhat. If "unknown company X" gives me something with a burned disc or whatever I'm going to be a bit suspicious. If well-known/respected company Y gives it to me, I'm a bit more trusting.

      The main differential is that virus writers are in many ways untracable and anonymous. Most of the people presenting at a conference should be traceable in some form, and thus accountable.
    • There's a standard USB Storage interface, and every modern OS (i.e. everyone but SCO) comes with its own drivers for treating devices which use that interface like removable drives. There's no obvious reason for a USB storage device vendor to produce their own drivers (which would require installation, whereas the OS drivers should just work when you plug the device in); if you've actually seen one with custom drivers maybe you really should be suspicious.

  • to the MS Outlook virus-propagation problem.

    It's simple - create an Outlook virus which emails a Windows activation-code cracking program to everyone in the victim's address book. Then the virus would redirect the user to the warez sites where they could download "free" copies of Windows.

    I can just about guarantee that Microsoft would have a patch within days, if not hours. After that, auto-execute for email attachments would be a thing of the past.

  • They should be writing definition files that detect and remove all spyware. Turn it on by default and make it optional to remove. In my opinion they are a much larger threat than viruses. Essentially, they're legal trojans.

    Of course many AV companies are scared to do this becuase of ligitation, but a line has to be drawn somewhere. Not to mention the AV program itself might be spyware if it sends data home about the user. Even "anonymous" data should be considered spyware.

    Also, how about certification

Slashdot Top Deals

"The eleventh commandment was `Thou Shalt Compute' or `Thou Shalt Not Compute' -- I forget which." -- Epigrams in Programming, ACM SIGPLAN Sept. 1982

Close