"Stay Safe" Cyber Security Blog : malware

Flying Pigs at the Turn of the Tide: Microsoft is finally emerging as a leader the cyber security industry

tarwine — Tue, 23 Jun 2009 18:31:00 GMT

Microsoft has been dealing with cyber treats for years both internally and with our customers, but just in case you haven’t noticed; there has been a significant change in the tide from both in the focus of such malevolent attacks and public perception of Microsoft ability to deal with those threats effectively.

To see the trends in Cyber Warfare, one needs to just read some of the headlines in The Latest Microsoft Security Intelligence Report or News articles and the focus of recent attacks now on the rise.

Just take a look at some recent news articles:

February 24^th 2009 – SQL Attacks - Half a Million Sites Already Owned -”Current epidemic of online SQL injection attacks maintains that over a half million sites were victimized by the threats during 2008 alone”

April 3^rd 2009 – VMware exploits - just how bad is it? - “When Tony reported on the release of new VMware patches on April 4th, we didn't immediately spot that the same day there was also a release of a for-pay exploit against CVE-2009-1244 (announced in VMSA-2009-0006). Seems a few days later, there is also a white paper available -for pay as well-, and now also a flash video of the alleged exploit showing a XP client OS exploiting a Vista host OS (launching calc.exe). The video also comments that they get a data leak back from the host to the client”

April 14th 2009 - Attack Sneaks Rootkits Into Linux Kernel - “A researcher at Black Hat Europe this week will demonstrate a more stealthy way to hack Linux “. “One of bonuses of this [approach] is that most kernel module rootkits make a lot noise when they are inserting [the code]. This one is directly manipulating" the memory, so it's less noticeable, he says”

April 16^th 2009 - iBotnet: Researchers find signs of zombie Macs – “Writing in the current issue of Virus Bulletin (subscription required), researchers Mario Ballano Barcena and Alfredo Pesoli found two malware variants — OSX.Iservice and OSX.Iservice.B — using different techniques to obtain the user’s password and take control of the infected Mac machine”

Contrast this with the trend of positive security reports from Gartner, Av-Comparatives and other Security experts raving about Microsoft’s SDL, security software and best practice guidance.

March 25^th 2009 - Gartner: No need to wait for Windows 7 SP1 - A Gartner analysis report recommends IT departments to depart from the usual SP1 milestone when deciding to deploy Windows 7

"Conventional wisdom has been that organizations need to wait for the first Service Pack to ship before they deploy a new client OS. This used to be a necessity. The availability of beta software to test the new product was not as broad as it is today, and people expected the initial release to be buggy and unstable. The first Service Pack usually would ship approximately nine to 12 months after the initial OS shipment, and would usually represent a marked improvement in stability. Today, SP1 does not represent the milestone it used to"

May 20^th 2009 - Adobe to release security updates a la Patch Tuesday - “Adobe said on Wednesday it will release quarterly security updates to coincide with Microsoft's Patch Tuesday as part of a new approach to product security for Adobe Reader and Acrobat. “

“All new code and features for Adobe Reader and Acrobat have been put through a Secure product Lifecycle that is similar to Microsoft's much-touted Security Development Lifecycle.”

June 10^th 2009 - Microsoft Ranks First in AV-Comparatives May Edition for Proactive Detection Testing! – “We are #1 this time! And it is our first time scoring Advanced+ in AV-comparatives testing. We scored very well on both ends: second best in detection rate and we had the fewest false positives. AV-Comparatives.org published the May edition of the proactive/retrospective testing of the May Edition….Our detection rate was…the second best among the participants, and we had the fewest false positive samples.

For details, please check AV-comparatives May edition published below: http://www.av-comparatives.org/images/stories/test/ondret/avc_report22.pdf”

June 29^th 2009 - Pigs fly! Microsoft leads in security – “Microsoft's success with Security Development Lifecycle has security experts buzzing and offers lessons…Many of the world's most knowledgeable security experts are urging their favorite software vendors to follow in the footsteps of Microsoft.

"Microsoft becomes high priest of secure software development." - CNET

“As an industry we should recognize the sea change in Microsoft's approach to security… and encourage other vendors to follow Microsoft's lead." - SANS NewsBites

“In 2004 Microsoft was a couple years into its Trustworthy Computing Initiative but it remained the software company IT security practitioners hated with glee.... That's not so much the case today." -- Computerworld

"As repugnant as it sounds, Apple will need to take a page from Microsoft's book in this area. Years of combating viral threats, malware, and so on - CrunchGear

“It isn't just press talk alone. Every common security and vulnerability metric shows Microsoft's software security has dramatically improved over the years, especially compared to its main competitors. Vulnerabilities found by employees and external researchers are down well over half from just a few years ago. For some products, such as IIS and SQL Server, the improvement is startling going from dozens of exploits a year to barely a handful over five years.”

“Hackers have moved on from focusing on Windows holes to attacking third-party applications or social engineering the end-user as the primary attack vector. Patch Tuesday was derided when it first appeared. Now it has become a model for many other popularly attacked products, and vendors not using a regularly scheduled patch period are being asked to get on board by their customers.”

“I challenge you to find anywhere near the amount of free resources on improving your software security from any other source.”

Summary:

Microsoft has made contributions with The Microsoft Security Development Lifecycle (SDL). This SDL framework along with Microsoft’s free security tools, patch Tuesday example, and Microsoft’s Forefront Security products, have forced the trend of attacks to shift to 3^rd party and applications and low hanging fruit, and simultaneously bolstered Microsoft reputation as not only a security player, but a leader in the industry.

Look for more to come with the Forefront “Stirling” wave and Windows 7

Online Internet Safety Resources

tarwine — Mon, 30 Jul 2007 08:00:00 GMT

Here are some resources from the Microsoft' Internet Safety Toolkit below to help keep you kids and family safe online:

• StaySafe.org (http://www.staysafe.org) - Educational site intended to help consumers understand both the positive aspects of the Internet as well as how to manage a variety of safety and security issues that exist online

• Be Web Aware (http://www.bewebaware.org) - National, bilingual public education program on Internet safety designed to ensure that young Canadians benefit from the Internet, while being safe and responsible in their online activities

• Safe Kids Worldwide (http://www.safekids.org) - Global network of organizations whose mission is to prevent accidental childhood injury, a leading killer of children 14 and under

• WebSafe Crackerz (http://www.websafecrackerz.com) - Interactive games and puzzles designed to help teenagers and offer strategies for dealing with different situations online including spam, phishing, and scams

• GetNetWise (http://www.getnetwise.org) - Public service offered by a coalition of Internet industry corporations and public interest organizations that want Internet users to be only "one click away" from the resources they need to make informed decisions about their and their family's use of the Internet

• iSafe (http://www.isafe.org) - Worldwide leader in Internet safety education; incorporates classroom curriculum with dynamic community outreach to empower students, teachers, parents, law enforcement, and concerned adults to make the Internet a safer place

• International Centre for Missing & Exploited Children (http://www.icmec.org) – Global agency that promotes the safety and well-being of children through activism, policy development and multinational coordination

• Interpol (http://www.interpol.int) - International police organization that facilitates crossborder police cooperation, and supports and assists all organizations, authorities, and services whose mission is to prevent or combat international crime

• UNICEF (http://www.unicef.org) – Global advocate for the protection of children's rights dedicated to providing long-term humanitarian and developmental assistance to children and parents in developing countries

• ECPAT (http://www.ecpat.net) - Network of organizations and individuals working together to eliminate the commercial sexual exploitation of children

• INHOPE (http://inhope.org) - International association that supports Internet hotlines in their aim to respond to reports of illegal content to make the Internet safer

• Childnet International (http://www.childnet-int.org) - Non-profit organization that works in partnership with others around the world to help make the Internet a great and safe place for children

• SafeKids.com (http://www.safekids.com) – Resources to help families make the Internet and technology fun, safe, and productive

• Net Family News (http://netfamilynews.org) – Non-profit public service providing a forum and "kid-tech news" for parents and educators in more than 50 countries

• Microsoft Security At Home (http://www.microsoft.com/protect) – Information and resources to help the public protect their computers, protect themselves, and protect their families

• Center for Safe and Responsible Internet Use (http://csriu.org) – Organization providing provide outreach services addressing the issues of the safe and responsible use of the Internet Microsoft Internet Safety Toolkit | 21

• WiredSafety (http://www.wiredsafety.org) – Online safety, education, and help group that offers help for online victims of cyber-crime and harassment, assistance to law enforcement worldwide on preventing and investigating cyber-crimes, and information on all aspects of online safety, privacy and security.

• National Council for Motherhood and Childhood (http://www.nccm.org.eg) – Egyptian organization dedicated to supporting childhood and motherhood from a rights-based approach

• NetAlert Limited (http://netalert.net.au) – Non-profit community organization established by the Australian government

In addition to these education resources above, I have also provided a list of Family Protection Software reviewed on:

http://www.filterguide.com/ratings.htm

Best Parental Control Software Review - "Editor's Choice"

http://www.filterguide.com/ratings.htm

Safe Eyes InternetSafety.com	Parental Control – SafeEyes Platinum content filter and parental control filter monitoring software will allow you to block porn, popups and more. *"Editor's Choice"*
NetNanny NetNanny.com	Content Filtering – Net Nanny internet filtering software was produced to filter, stop, and monitor internet porn sites. *"Editor's Choice"*
ContentPrtoect ContentWatch.com	Content Filtering – ContentPrtotect is now combined with the Net Nanny web filter and is listed as one of our top filters. *"Editor's Choice"*
BSafeOnline BSafeHome.com	Parental Control Software – Use the BsafeHome parental controls for internet blocking of porn and sits that are objectionable. *"Editor's Choice"*
Cybersitter CyberSitter.com	Cybersitter content filter software stops profanity, sex, nudity and pornography internet web sites from your computer.
Actmon ActMon.com	Internet Blocking Software – Act Mon Computer Control internet filtering software will keep an eye on and filter computer and PC workstations.
CyberPatrol CyberPatrol.com	Internet Filter Software Review – CyberPatrol 7 will watch who is permitted admittance to the internet, and filter everyplace those users surf on the internet.
Guardian Monitor GuardianSoftware.com	Internet Filters Software – Guardian Monitor monitors Peer to Peer, instant messaging, chat rooms, emails and websites.
ChildwebGuardian ChildWebGuardian.com	Internet Parental Software – Childwebguardian blocks profanity, sex, nudity, violence, adult websites, pornography, and more.
ComputerCop ComputerCop.com	Parental Controls Filters – ComputerCOP scans and views a computer, allowing parents a easy way to locate if the computer system has been incorrectly used.
SOS KidProof	Parental Control Internet Filter – SOS KidProof is the most far-reaching, well-featured software program offered for protecting and viewing your children’s website activity.

While I cannot guarantee the reliability of these 3^rd party sites and services, I do hope these resources are a helpful start in educating yourself and others about online cyber threats and responsible ways to deal with those threats.