July 5, 2011

The recent attack on the official website of Philippine Vice President Jejomar Binay could just be the start of more attacks on government websites.

Costin Raiu, Kaspersky Lab Global Research and Analysis Team Director, says the government must put in place their own defense strategies against attacks on government websites. They must also conduct security audits of their servers as soon as possible to identify potential vulnerabilities.

“First of all, it’s important to have an anti-DDoS (distributed denial-of-service) plan – be it from increasing the internet bandwidth to purchasing a specific anti-DDoS service plan,” Raiu says.

DDoS is done by overwhelming a target website with visits from different sources until the site crashes from handling too many visits.

Raiu adds that in case vulnerabilities are found, the websites’ servers must go offline temporarily to reduce damage.

“Past logs should be analyzed for previous probes which could have uncovered bugs than can now be exploited,” he says.

“Given the past incidents of this kind, it is expected that the attack will consist of a DDoS flood designed to bring down the server and make it unreachable. It’s possible the confidential information will be sought after, so the defense strategies would be multiple,” Raiu warns.

According to the Kaspersky expert, even with the best ways to protect websites, there could still be attacks that might get through. As such, Raiu says governments must have contingency plans in place to ensure continued operations of the websites.

“Of course, a highly sophisticated targeted attack will always succeed–this is why there should be mitigation steps as well as disaster recovery procedures–like backups, server replacement/relocation and redundancy,” Raui said.

Website hacking is one of the oldest forms of cybercrime. The defacement of a website is intended to insult the owners and sometimes as a hobby. Later, these attacks became a form of game for hacker groups.

When websites of government offices are defaced, the attackers are doing more than just a hobby; they may be sending out a message of disrespect and one goal is to show people that they are not protected by their government. The attacks could be in a form of website defacement though other techniques include DDoS.

Aside from the defacement of the official website of the Vice President, other government websites have also fallen victim to hackers. These include the Department of Labor and Employment (DOLE), Philippine Nuclear Research Institute (PNRI), and the Food and Drug Administration (FDA). Last year, the websites of the Technical Education and Skills Development Authority (TESDA), the Department of Interior and Local Government (DILG), and the Philippine Information Agency (PIA) were also hacked.

Similar attacks on Malaysia’s government websites were done by a group of hackers.

The recent Stuxnet worm attack is sparking lots of discussion and speculation about the intent, purpose, origins and — most importantly – the identity of the attacker and target.

Kaspersky Lab has not seen enough evidence to identify the attackers or the intended target but confirms that this is a one-of-a-kind, sophisticated malware attack backed by a well-funded, highly-skilled attack team with intimate knowledge of SCADA technology.

SCADA or supervisory control and data acquisition refers to computer systems that monitor and control industrial, infrastructure, or facility-based processes. Similar systems are widely used in oil pipelines, power plants, large communication systems, airports, ships, and even military installations globally.

Kaspersky Lab believes that the Stuxnet work attack could only be conducted with nation-state support and backing.

“I think that this is the turning point, this is the time when we got to a really new world, because in the past there were just cyber-criminals, now I am afraid it is the time of cyber-terrorism, cyber-weapons and cyber-wars,” said Eugene Kaspersky, co-founder and chief executive officer of Kaspersky Lab.

Speaking at the Kaspersky Security Symposium with international journalists in Munich, Germany, Kaspersky described Stuxnet as the opening of “Pandora’s Box.”

“This malicious program was not designed to steal money, send spam, grab personal data. No. This piece of malware was designed to sabotage plants, to damage industrial systems,” he said.

“I am afraid this is the beginning of a new world. The 90’s was a decade of cyber-vandals, 2000’s was a decade of cybercriminals, I am afraid now — it is a new era of cyber-wars and cyber-terrorism,” Kaspersky added.

Researchers at Kaspersky Lab independently discovered two of the of the four, separate zero-day vulnerabilities that the worm exploits, which they reported directly to Microsoft. Kaspersky Lab analysts then coordinated closely with Microsoft during the creation and release of patches or software fixes for these vulnerabilities.

In addition to exploiting four zero-day vulnerabilities, Stuxnet also used two valid certificates (from Realtek and JMicron) which helped to keep the malware under the radar for quite a long period of time.

The worm’s ultimate aim was to access Simatic WinCC SCADA.

The inside knowledge of SCADA technology, the sophistication of the multi-layered attack, the use of multiple zero-day vulnerabilities and legitimate certificates bring the public to an understanding that Stuxnet was created by a team of extremely skilled professionals who possessed vast resources and financial support.

The target of the attack and the geography of its outbreak (primarily Iran) suggest that this was not a regular cyber-criminal group. Moreover, security experts at Kaspersky Lab who analyzed the worm code insist that Stuxnet’s primary goal was not to spy on infected systems, but to conduct sabotage. All the facts listed above indicate that Stuxnet development was likely to be backed by a nation state, which had strong intelligence data at its disposal.

Kaspersky Lab believes that Stuxnet is a working – and fearsome – prototype of a cyber-weapon, that will lead to the creation of a new arms race in the world.  This time it will be a cyber-arms race.

The Philippines disappeared from the top 20 countries that received malware attacks after being in the list for several months, according to a report by leading Internet security and content management developer Kaspersky Lab.

Bangladesh took on the 19th place of the Philippines, which received 1.25 percent of infection attacks.

The Philippines also slid in the list of countries having servers that host malicious applications from 8th place in Q1 of 2010 to 18th place in Q2. This is primarily due to the falling popularity of the Philippines as a host for malicious applications.

However, Kaspersky Lab virus analyst Yury Namestnikov said that while this is a positive trend for the Philippines, this does not mean that the attacks have lessened.

Namestnikov stressed that the change is only 0.2 percent for the Philippines and there was even a spike in activity of the peer-to-peer (P2P) worm Palevo, which also serves as bot-client. He warned that this particular worm is very efficient as an infected computer will be fully controlled by the source of the Palevo. It can spread through instant messengers like MSN, USB flash drives, and other P2P applications such as BearShare, Ares P2P, iMesh, Shareaza, Kazaa, among others.

He also warned that the IM-Worm.Win32.Sohanad.bm has been detected in over 20 percent of the Asian region making it the 4th most common malware. Namestnikov warned that this prevalence of the IM-Worm.Win32.Sohanad.bm could increase in the coming months.

“The serious development of the Internet in the Philippines during the last several months together with slow growth of security awareness will likely cause this country to make a comeback in the Top 20 list very soon,” Namestnikov said.

Meanwhile, over half a billion computer-related attacks using malicious applications have been detected and blocked during the months April to June 2010 in 288 countries, Kaspersky Lab reported.

This number showed that the growth of infection attempts have grown by an average of 4.5 percent per month over a period of three months. Meanwhile, the total number of malicious applications increased by 0.7 percent during this period with 8,540,223 detected.

The company reported that 203,997,565 infection attempts were detected. The most common malicious software infection came from Trojan.Win32.Generic having 12.02% of all infections. This has remained at the top of all vulnerabilities since the first quarter of this year.

Twenty-seven percent of these attacks were malicious scripts injected by cybercriminals into a variety of websites in the hope of targeting vulnerable computers. Exploits in Adobe Reader remained the most common.

Kaspersky Lab also indicated that it has detected 33,765,504 vulnerable files and applications in users’ computers. This indicated that one in four computers had at least seven unpatched applications, which could lead to attacks by malicious software. The most common attacks against a single application is Microsoft Office Excel having 39.45 percent of all known vulnerabilities.

botnets – groups of malicious applications running automatically and independently – remained at the top of malware incidents. The company detected the creation of new bots, worth noting of which is ZeuS (Zbot) Trojan. A new modification for this particular botnet was detected in April this year that had a relatively unsophisticated code that attacked .exe files. ZeuS which primarily targeted online banking accounts.

Another new botnet-making applications detected is TwitterNET Builder. While largely a proof-of-concept application, TwitterNET Builder builds new botnets using the social networking tool Twitter as a command-and control-center. One of the new botnets that came out using TwitterNET Builder is Backdoor.Win32.Twitbot, which can download and run files, conduct distributed denial-of-service (DDOS) attacks, and open websites specified by the bot’s owners.

While bots created using TwitterNET Builder were easily detected and eliminated, it points to potential use of popular social networking service to attack people’s computers.

Among the countries where attacks remained prevalent during the Q2 of 2010 are China (17.09 percent), Russian Federation (11.36 percent), India (9.30 percent), United States (5.96 percent), Vietnam (5.44 percent), Germany (2.65 percent), Malaysia (2.37 percent), Saudi Arabia (2.19 percent), France (2.14 percent), and Ukraine (2.11 percent) at 10th place.

August 6, 2010

Kaspersky Lab, a developer of secure content management solutions, announced the release of the latest versions of its flagship consumer products Kaspersky Internet Security 2011 and Kaspersky Anti-Virus 2011. The new products, according to the company, feature innovative cutting-edge technologies to provide more accurate detection and an even faster response to any IT threats.

Kaspersky Internet Security 2011 and Kaspersky Anti-Virus 2011 will not just sit idle until the PC becomes infected, the new versions provide real-time proactive protection – constantly monitoring the system to detect any type of potential threats and prevent any destructive activity. They provide reliable isolation of untrusted Internet resources, giving users the reassurance that their digital environment is clean, safe and free from digital threats and unwanted intrusion. They do this in background mode and do not make constant demands on the users in order to do their job efficiently.

Kaspersky Internet Security 2011 and Kaspersky Anti-Virus 2011 also incorporate a full range of new and improved technologies, many of which are unique to Kaspersky Lab products. The newly-implemented System Watcher technology, for instance, monitors all system events in full – creation and modification of files, system calls and changes to the system registry. The new solutions incorporate reputation rating services.  That means information about a known object is received in real-time without the need for it to be scanned locally. The information is sourced from Kaspersky Lab’s databases that are constantly updated by the company’s experts. Both products include improved proactive protection from new, as yet unknown, threats based on scanning for typical threat symptoms. More importantly, all the main modules are updateable, which means that should completely new types of threats emerge, the products’ features can be updated without having to reinstall the solution from scratch.

July 23, 2010