Bob Gourley

Verizon in the News for Breach Report 2012 and Assisting FCC with Botnet Control

Much of the security news this week revolved around sets of computer security reports and figures released about 2011 — the year best known for the rise of hacktivism into the public eye with such high-profile attacks as Sony’s PSN and the other myriad targets breached by LulzSec and its brethren.  The statistics show some interesting facts which are worthy of attention.  The potential resurgence of Lulzsec, and security posturing of ISP’s also make this week’s list of notable security news as well, due to their effects in shaping the security landscape (minefield?).

Exploit Code Down, Hacktivism Up:

Out of 855 breaches investigated by Verizon, it was reported that hacktivism was responsible for the disclosure of 58% of the confidential information.  This information is typically posted publicly in order to embarrass companies and is quickly scraped and used by online criminals (typically involved in organized crime) and abused.
While hacktivism is on the rise, publicly posted exploits are reportedly on the fall — The total number of exploits in 2011 fell to 778 from 1280 (though it has been noted that this could signal a corresponding upswing this year).  This contrasts with the number of large breaches that were occurring on a regular basis in the latter half of 2011 and the beginning of this year.  Verizon warns that hacktivism is still a very powerful force and that it continues to endanger many organizations.
Read the 2012 Breach Report Here:http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf

Read More about breaches, Exploits: http://www.computerworlduk.com/news/security/3346538/software-exploits-fell-new-low-in-2011-says-trend-risk-report/

LulzSec Returns For Another Round:

A new video claiming to herald the return of LulzSec on the 1st of April has surfaced on the internet.  While several of LulzSec’s high-ranking members remain in custody, it may be that the collective has re-grouped its lower-ranking members into another stand.  According to the video, the arrested members were only the “Active Faction” of the group and their hackers are currently planning attacks.  Anyonymous members don’t seem to know if the video is legitimate or not, but (as always) it might pay off to start hardening your web applications now.
Link to The Video: http://www.youtube.com/watch?v=rX6Z9x-W5wI&feature=player_embedded

SQL Injections Perhaps No Longer The Flavour-Of-The-Month:

According to the IBM X-Force Trend and Risk Report, there has been a “2 to 3-fold increase” in shell injection attacks on web applications as the number of SQL injection attacks decreased, likely due to security improvements and programming technique adjustments.  Shell injection and SQL injection attacks require similar conditions to exist, mostly the absence of user-controlled variable sanitization.  Whereas SQL injections attack the interface between the application and the SQL database, command injection attacks the application interfaces with the underlying system or the application itself.

Read More Here:http://business.newsfactor.com/news/IBM-Report-Finds-Progress-on-Security/story.xhtml?story_id=11200AG5XV28

Read The X-Force Report: http://www-935.ibm.com/services/us/iss/xforce/trendreports/

ISPs Agree to Police Users for Botnets:

Many large US internet service providers recently agreed to a code of conduct in order to notify and help users infected by botnet code with the goal of reducing the infections that assist hackers with the production of spam and denial of service attacks.  AT&T, CenturyLink, Comcast, Cox, Sprint, Time Warner and Verizon have agreed to the code of conduct, and some already are providing similar services to their users.  This is good news for infected victims, most of whom have no idea that they are being used in attacks or having their personal information stolen unless their computer is showing overt symptoms of infection.
Read more: http://www.huffingtonpost.com/2012/03/22/internet-providers-botnets_n_1372837.html