How your corporate domain name is managed?

Domain Names Security and Vulnerability Assessment - Answer the following questions...

• Where are your domain names registered?
  
• How much are you paying for it? (Is your brand really worth just $9.95 a year?)
  
• Who has access to change your DNS registration?
  
• Are those people trusted?
  
• How do you authenticate to make changes to your DNS registration?
  
• Is that authentication system adequate? (Are you using passwords or certificates?)
  
• What is the access recovery process for your DNS registration in the event that you loose your access credential? Is that recovery process secure?
  
• Have you locked out registrar transfers for your domain?
  
• Is your DNS Whois contact information up to date?
  
• Are you carefully monitoring the email addresses associated with the Whois contact information for your domain? (If not, you might loose your domain if someone complains about the accuracy of your Whois contact information or claims (even fraudulently) that you are infringing upon their trademarks.)
  
• How are you hosting your DNS records?
  
• If you are hosting your DNS with a third party, you need to ask all the access control questions that you asked about your DNS registrar - Who has access, how do they have access, and what is the recovery process...
  
• If you are hosting your own DNS, how are you managing the security of your DNS servers?
  
• What DNS records are you publishing? What process exists within your organization to create a new DNS record within your domain and how do old DNS records get expired?
  
• Are those processes connected with other business controls that need to be invoked whenever your organization publishes information on the Internet?

Hopefully, your organization has looked at these questions carefully and has mature processes, but the fact is that these issues are frequently overlooked, and represent a significant and widespread vulnerability on the Internet today.

Launch of First Operating System for Smart Grid Home Automation

Open software platform for energy management


The Fraunhofer Institute for Wind Energy and Energy System Technology (IWES) has founded the Open Gateway Energy Management Alliance (OGEMA) to promote an open energy management software platform that connects a customer's loads and generators to the control stations of the power supply system while also featuring a customer display for user interaction.


The software platform will enable end customers to automatically see the future variable price of electricity and shift energy consumption according to supply. Already today electricity is for free on the German Energy Exchange at times when large power plants have to be derated due to high feed-in from wind power. Using automated load-shifting, private households and small business should also benefit from such favorable electricity prices. Through the gateway platform's open nature, anyone will be able to convert concepts into software, even if they are not OGEMA participants.


The initiative involves the rapid development of numerous applications that will encompass the unique needs of private households, supermarkets, small businesses, and public institutions and help to harness the potential for energy efficiency which is not currently available. The OGEMA-provided interfaces also can be used by the developers of driver software for linking the gateway to devices and energy systems within the building as well as to the control stations of the energy suppliers.


Refer here for further details.

Six predictions for next year's greatest threats

2010 Cyberthreat Forecast From Kaspersky Lab

When asked about what will happen in 2009, a rise in global epidemics was at the top of Kaspersky Lab's prediction list. With the year not quite having closed out, Kaspersky Lab, a leading developer of Internet threat management solutions that protect against all forms of malicious software, has already seen that prediction to be true. 2009 was dominated by sophisticated malicious programs with rootkit functionality, Conficker, web attacks and botnets, SMS fraud and attacks on social networks.

With the start of 2010 quickly approaching, researchers and analysts from Kaspersky Lab have come up with a list of six predictions for what will be the New Year's greatest threats and newest attack vectors.

1. A rise in attacks originating from file sharing networks. In the coming year we will see a shift in the types of attacks on users, from attacks via websites and applications toward attacks originating from file sharing networks.
   
   
2. An increase in mass malware epidemics via P2P networks. In 2009 a series of mass malware epidemics has been "supported" by malicious files that are spread via file sharing networks. This method has been used to spread notorious threats such as TDSS and Virut as well as the first backdoor for Mac OS X. In 2010, we expect to see a significant increase in these types of incidents on P2P networks.
   
   
3. Continuous competition for traffic from cybercriminals. The modern cybercriminal world is making more and more of an effort to legalize itself and there are lots of ways to earn money online using the huge amount of traffic that can be generated by botnets. In the future, we foresee the emergence of more "grey" schemes in the botnet services market. These so-called "partner programs" enable botnet owners to make a profit from activities such as sending spam, performing denial of service (DoS) attacks or distributing malware without committing an explicit crime.
   
   
4. A decline in fake anti-virus programs. The decline in gaming Trojans witnessed in 2009 is likely to be repeated for fake anti-virus programs in 2010. Conficker installed a rogue anti-virus program on infected computers. The fake anti-virus market has now been saturated and the profits for cybercriminals have fallen. Additionally, this kind of activity is now being closely monitored by both IT security companies and law enforcement agencies, making it increasingly difficult to distribute fake anti-virus programs.
   
   
5. An interest in attacking Google Wave. When it comes to attacks on web services, Google Wave looks like it will be making all the headlines in 2010. Attacks on this new Google service will no doubt follow the usual pattern: first, the sending of spam, followed by phishing attacks, then the exploiting of vulnerabilities and the spreading of malware.
   
   
6. An increase in attacks on iPhone and Android mobile platforms. 2010 promises to be a difficult time for iPhone and Android users. The first malicious programs for these mobile platforms appeared in 2009, a sure sign that they have aroused the interest of cybercriminals. The only iPhone users currently at risk are those with compromised devices; however the same is not true for Android users who are all vulnerable to attack. The increasing popularity of mobile phones running the Android OS combined with a lack of effective checks to ensure third-party software applications are secure, will lead to a number of high-profile malware outbreaks.

Quote: Roel Schouwenberg, Senior Malware Researcher

Kaspersky Lab Americas

"Malware will continue to further its sophistication in 2010 with specific malware families requiring significant resources from anti-malware companies to adequately fight them. Third party program vulnerabilities will continue to be the target of choice by cybercriminals with Adobe continuing to be the main target. And finally I believe that with the introduction of real-time search, black hat SEO and social networks will become an even bigger focus of cybercriminals."

Press Release Dictionary:

1. File sharing network: A network where distributing or providing access to digitally stored information takes place.
   
   
2. P2P networks: A network where the architecture is composed of participants that make a portion of their resources directly available to other network participants, without the need for central coordination or hosts.
   
   
3. Denial of Service (DoS) attacks: An attack that attempts to make a computer resource unavailable to its intended users.
   
   
4. Fake anti-virus program: A malicious program disguised to look like a real anti-virus program. The fake program will usually trick users into paying money to 'clean' their machines from fake infections, thus causing the malicious program to gain control of the machine
   
   

Hackers puts the shine on Chrome OS

Free OS that don’t need a license or an antivirus

Less than two weeks ago, the source code for Google’s Chrome OS was released on November 19, 2009 under open source licensing as Chromium OS.

It took less than a day, for the first hacked Chrome OS developer build to go live on the Internet. Very soon it got torrented and hosted, courtesy of a geek celeb who goes why the name of Hexxeh.

The first build required 4GB, but a new and vastly improved ‘diet build’ is now available as a 300MB direct download, it extracts to a 950MB image that can run off a USB stick.

The OS is also available as a torrent on PirateBay, and lots of other trackers. What’s more, support is vastly improved in the newer builds. The minimalist OS can do nothing other than browse the Internet, eliciting snide remarks from a Linux fanbase. “Basically you get a Linux OS that can do nothing but look at Web pages.” But that misses the point.

This OS should work out exceedingly well on an aging PC or an underpowered netbook. It’s also great for your grandma or technically challenged siblings, as there will be little scope of it being infected with viruses or spyware. It cuts all the flab, and offers blindingly fast browsing speeds on underpowered PCs.

Hexxeh, who is also available on Twitter says that “In theory, we have even better compatibility that that chart suggests, that chart refers to compatibility on a fresh unaltered build. I’ve added the WiFi drivers from Ubuntu to this to try and fix the WiFi for people having issues.”

I haven't tested the Chromium OS myself and I personally think it is too early to comment or test. I'll keep you guys posted.

A Vision of Computing From Microsoft's Future Thinker

The way people interact with computers will wildly change

Over the next 10 years, how people interact with computers will evolve drastically, with hand gesture controls becoming as common as keyboards, and file selection being determined by eye scans instead of mouse movements, predicts Microsoft chief research and strategy officer Craig Mundie.

"Today, most people's interaction is through a screen--whether they touch it, type it, point or click, it's still just graphical user interface. While that's very powerful and has a lot of applicability, I think it will be supplemented in dramatic ways by what we call a natural user interface. Computers will soon be able to emulate the human senses of sight, hearing, speech, touch, and gesture, and combine them in multiple ways for people to interact with machines. The interactivity revolution will be fueled by new multiprocessor computers, which are expected to be widely available by 2012." He said.

Mundie says these new processors should provide a major performance gain, with some performances increasing by a factor of 100. One of the first major commercial applications of the new interface technology is expected to be released next year when Microsoft launches its new line of Xbox gaming consoles, which will completely eliminate the need for handheld controllers. The new gaming interface enables players to move and use gesture controls, with the system calculating in real time the angular position of the 22 major joints in the body.

Mundie envisions a day when users will simply be able to talk to their computers about solving problems. You should be able to describe the problem or the policy you want and the computer should be able to somehow implement that. Interesting.

Refer here to read more details.

Proper Use of English Could Get a Virus Past Security

Hackers could evade most existing antivirus protection by hiding malicious code within ordinary text

Johns Hopkins University security researcher Josh Mason says hackers could potentially evade most existing antivirus programs by hiding malicious code within ordinary text. Mason and colleagues have discovered how to hide malware within English-language sentences. Mason developed a way to search a large set of English text for combinations of words that could be used in malicious code.

This potential weakness has been recognized in the past, but many computer security experts believed that the rules of English word and sentence construction would make executing an attack through the English language impossible. Machine code requires the use of character combinations not usually seen in plain text, such as strings of mostly capital letters.

University College London security researcher Nicolas Courtis says malicious code hidden in plain language would be "very hard if not impossible to detect reliably." Mason and colleagues presented their research at the recent ACM Conference on Computer and Communications Security, but were careful to omit some of their methodology to avoid helping potential hackers.

I'd be astounded if anyone is using this method maliciously in the real world, due to the amount of engineering it took to pull off.

Refer here to read more details.

Facebook Offers Poor Personal Data Protection

Aware of the risks, but willing to take them

A study of Norwegian Internet users and social media found that people are willing to post their personal information on social media sites even when they are not aware how it will be used.

Conducted by SINTEF for the Norwegian Consumers' Council, the researchers found that 60 percent of Norweigan Internet users are on Facebook. SINTEF's Petter Bae Brandtzaeg and Marika Luders conclude that Facebook offers relatively poor personal data protection due to the service itself, its design, the level of competence of its users, and their lack of awareness of how to protect themselves.

Facebook has become an important arena for social participation in our personal environment. However, it is becoming ever more easy to gather and aggregate personal information, outside the control of users. Still, people are willing to post their personal information because so many other people use Facebook, and they rarely hear of unfortunate incidents. Respondents were usually not aware that Facebook uses personal information for commercial purposes, and their personal information also can be used against them, such as when they apply for a job.

The researchers say that people and objects will be woven together ever more closely by the next wave of Internet media such as Google Wave and mobile smartphones. This can make us even more vulnerable to failures of personal data protection.

Refer here to read more details.