New Online Banking Trojan Program Combines Zeus and Carberp Features

How sweet is this? Zberp, the new threat, has a wide range of features, and is sure to provide hours of fun and challeges to security mavens.

Commenting on this, Lancope CTO, TK Keanini, said, "Attackers continue to innovate and are not afraid of borrowing techniques from one another. The trend is definitely to leverage toolkits and libraries from each other, as no one bad guy has to code it all himself anymore.

Another trend is that most of their communication channels are encrypted so this is bad news for packet inspection tools. Even if you capture terabytes of packets, the payloads are encrypted. This is where Netflow and IPFIX flow analysis comes in handy because directionality and other behavioural traffic patterns can identify infections even if the channels are using SSL.

As attackers continue to innovate, it is time that defenders do the same. Get creative, think like the adversary and be creative with your countermeasures. This is exactly what the adversary does not want you to do."

Russia, China urge to develop and introduce rules for information security

First, I don't believe this for a minute. It's like Cold War propaganda. But wait, we're now in a new Cold War.

But you'd think they'd have better translators for this stuff.

I just finished the latest novel from Tom Clancy, Inc., Command Authority. What's interesting about this, aside from Tom, like L. Ron Hubbard, writing books from the grave, is how closely the book comes to recent events in the Ukraine. Of course, the Putin-liked Russian leader controls all media and is given to long diatribes against enemies, internal and external, real and imaginary.

So, I decided to read the last year or so of the Russian English-language press to see how they covered the lead to the Russian invasion of the Urkaine.

What I found, and this applies to the Chinese English-language press, were barely literate articles, many penned by "Americans." What this amounted to was illiterate propaganda. The outrageous claims were funny enough (and I know our politicians are wont to make outrageous claims that can't be substantiated), but the writing was abysmal. (One editorial printed the lyrics to "Feel Like I'm Fixin' to Die Rag" verbatim. I'm willing to bet they didn't get permission to do that.)

Anyway, how effective can propaganda be when its laughable on so many levels?

IPv6 and Telecom IPv4 Is Finally Running Out. Now What?

As this  recent article explains, it's the 11th hours for IPv4 address. If you haven't taken this threat seriously yet, maybe it's time.

The Handbook of IPv4 to IPv6 Transition: Methodologies for Institutional and Corporate Networks by John J. Amoss and Daniel Minoli

• Addresses the migration and macro-level scalability requirements
• Discusses IPv6 network constructs, AutoConfiguration techniques, and the suite of IPv6 and related protocols
• Describes IPv6 enterprise/institutional network migration scenarios and coexistence issues
• Examines scenarios and techniques for introducing IPv6 into carrier networks
• Explores application aspects of IPv6 transition, issues related to mobile environments, and security in IPv6 networks

Is Infosec Getting More Stressful?

Is Infosec Getting More Stressful? 

Frankly, I think everything is getting more stressful, and not just at work.

But specifically regarding InfoSec, external threats and pressure are increasing, helped by wide media coverage of intrusions. And, internal pressure must be building, too. Just think about the Target CIO falling on his sword because of the data theft. Now there are real costs to personnel as well as the enterprise.

What do think?

Internet of Things to Redefine Scope of IT Security

A recent report from Gartner is sounding the alarm about the burgeoning threat from IoT.
I've been riding this horse for a long time now. But recently, attacks on these systems are headlining the mainstream media: hijacked baby monitors, hijacked cars and drones, hacked medical devices, ...  Attacks are limited only by the imaginations of the hackers, which seems endless.

If you haven't investigated for yourself what IoT means for your enterprise and yourself, it's not too late to start.

We have some articles on IoT, M2M, NFC, RIFD, sensors, CPS, etc.

The Internet of Things

Internet of Things: A Context-Awareness Perspective

Internet of Things (IoT) Reaching Tipping Point

MTC/M2M Middleware

And, we also have a slew of books on the subject:

Unit and Ubiquitous Internet of Things

The Internet of Things: From RFID to the Next-Generation Pervasive Networked Systems

Cyber-Physical Systems: Integrated Computing and Engineering Design

Machine-to-Machine Communications: Architectures, Technology, Standards, and Applications

The Internet of Things in the Cloud: A Middleware Perspective