Source: Comuting.co.uk
Finding technology systems to beat the hackers can be a challenging job. Every time you secure your systems, they find another loophole to crack your processes and procedures.
A significant advance in encryption is at hand, however - one that mixes traditional defence methods with sophisticated quantum cryptography techniques.
Such developments are being made possible by German physicist Werner Heisenberg's uncertainty principle, which states it is impossible to make a perfectly accurate measurement of the position and velocity of an object because the act of measurement will to some extent distort what you are calculating.
In nuclear physics and quantum mechanics - both of which deal with sub-atomic particles - the uncertainty principle is crucial, as the uncertainties it implies are large in relation to the things being measured.
But where large objects are concerned, the uncertainty principle is not generally significant because the things that are being calculated are too big for the uncertainties to matter.
For example, it is easy to measure the position and speed of a car because the uncertainties are so small in relation to the size of the car that they are negligible.
But the days when Heisenberg's uncertainty principle had no useful applications in everyday life are now coming to an end.
At a time when information technology security is more vitally important than it has ever been, a new IT security technique is rising to prominence that could stack the odds against the eavesdropper: quantum cryptography, which uses quantum mechanics to help make communications secure.
Using the technique, communications information is encoded into individual photons of light that then become subject to the uncertainty principle.
Messages are encoded by giving each photon a different polarisation, rather like passing it through a different pair of Polaroid sunglasses - depending on the state you want it to have.
Quantum cryptography will be adopted alongside many other powerful encryption methods that are available to guard errant computer communications, most of which rely on a key being passed between sender and recipient.
But the problem with passing a key is that they can be read or changed illicitly - making keys the main vulnerable point in strong encryption techniques.
But the problem of vulnerability does not apply if keys are sent from the provider of the encryption system to the authorised recipient using quantum cryptography.
Traditional cryptography relies on the computational complexity of certain mathematical techniques - such as extracting the factors of very large numbers - to restrict the likelihood of eavesdroppers learning the contents of encrypted messages.
Quantum cryptography, on the other hand, relies on the fact that any unauthorised attempt to read the key - and its photons - will be detectable.
The technology is configured so that the receiving party will instantly see the disturbance and will consequently know it cannot rely upon that portion of the key because it is no longer secure. The recipient will then alert the sender to change the key.
In practice, the change happens automatically - indeed, the detection and key change process itself takes place almost instantaneously, meaning the eavesdropper's possession of it is pointless.
For the authorised participants in the message exchange, a combination of quantum and classical techniques is used to produce a key that can be proven to be secure.
And because the message has been sent using quantum cryptography, the participants can be confident that the hidden key cannot have been read by anyone other than the intended participants.
Such techniques mean quantum cryptography represents a significant advance in terms of security compared with conventional encryption techniques.
Indeed, the advance is so massive that the day may come, and sooner rather than later, when not using quantum cryptography for sending encryption keys may be unthinkable.
Why, if Heisenberg's uncertainty principle and his related quantum theory are not new, has quantum cryptography only now become viable?
For the first time, we have the ability to measure the state of individual photons using equipment that will fit into a normal office, rather than requiring the facilities of a nuclear physics laboratory.
The benefits of quantum cryptography are still only available across fibre optic cables that are no longer than approximately 100km.
And while the technology is already potentially available for use across networks within big cities, inter-city and international applications are limited by the 100km rule.
There is, however, every indication that the technological barrier will soon be overcome.
And with quantum cryptography at the point where it might soon achieve breakout into the mass market, IT managers might want to consider exploring the potential for business communications.
Thursday, August 9, 2007
Spam levels creep up again
Source: VNUNET.COM
Spam levels crept up again in July, accounting for 91.52 per cent of all email, according to messages scanned by SoftScan.
Despite the recently highlighted change in tactics by spammers to use PDF and Excel files to hide their messages, SoftScan attributes the rise to the fact that there is less legitimate business email around during July because many people are on holiday.
"Around this time of year we always see an increase in spam. However, further investigation of the data shows that it has not increased in real terms, but that legitimate email has decreased," said Diego d'Ambra, CTO of SoftScan.
"But spammers changing tactics around this time of year is bad news for businesses that don't have adequate protection. Spam that was once stopped before it reached those users' inbox is now getting through, leaving the holidaymaker returning to not just a full work load, but an inbox full of junk mail too."
Virus levels dropped again during July, from 0.61 per cent to 0.39 per cent of all email scanned. Phishing style viruses are also down from last month. However, since many viruses are distributed in waves of attacks, this lower figure is probably due to a dip in activity, not that the overall tactic of phishing has decreased, SoftScan said.
Spam levels crept up again in July, accounting for 91.52 per cent of all email, according to messages scanned by SoftScan.
Despite the recently highlighted change in tactics by spammers to use PDF and Excel files to hide their messages, SoftScan attributes the rise to the fact that there is less legitimate business email around during July because many people are on holiday.
"Around this time of year we always see an increase in spam. However, further investigation of the data shows that it has not increased in real terms, but that legitimate email has decreased," said Diego d'Ambra, CTO of SoftScan.
"But spammers changing tactics around this time of year is bad news for businesses that don't have adequate protection. Spam that was once stopped before it reached those users' inbox is now getting through, leaving the holidaymaker returning to not just a full work load, but an inbox full of junk mail too."
Virus levels dropped again during July, from 0.61 per cent to 0.39 per cent of all email scanned. Phishing style viruses are also down from last month. However, since many viruses are distributed in waves of attacks, this lower figure is probably due to a dip in activity, not that the overall tactic of phishing has decreased, SoftScan said.
Boffins find way to fight spam scams
Source: VNUNET.COM
US computer scientists today published research that reveals "striking differences" between the infrastructure used to distribute spam and the infrastructure used to host the online scams advertised in these unwanted email messages.
The boffins from University of California, San Diego (UCSD) Jacobs School of Engineering reported that, while hundreds or thousands of compromised computers may be used to relay spam to users, most scams are hosted by individual web servers.
The computer scientists studied a spam feed over the course of a week. They analysed spam-advertised web servers hosting online scams that either offer merchandise and services (including pharmaceuticals, luxury watches, mortgages) or use malicious means to defraud users (including phishing, spyware, rootkits). The researchers followed the URLs embedded in spam back to the hosting servers, probed the servers and analysed the web pages advertised in the spam.
Based on the analysis of over one million spam emails, 94 per cent of the scams advertised via embedded links are hosted on individual web servers, according to new peer-reviewed research to be presented at the USENIX Security 2007 conference in Boston on August 09, 2007.
“A given spam campaign may use thousands of mail relay agents to deliver its millions of messages, but only use a single server to handle requests from recipients who respond. A single takedown of a scam server or a spammer redirect can curtail the earning potential of an entire spam campaign,” wrote the UCSD computer scientists.
“The availability of scam infrastructure is critical to spam profitability. Our findings suggest that the current scam infrastructure is particularly vulnerable to common blocking techniques such as blacklisting,” said Geoff Voelker, a computer science and engineering professor at the UCSD Jacobs School involved in the study.
The computer scientists recorded the server locations and captured screenshots of the spam URL destination web pages. From these screen shots, they grouped the scams using a technique called “image shingling”.
This approach matches visually similar web pages based upon images rendered in a web browser rather than on HTML source, URL text, or spam email contents. Image shingling enables spamscatter to foil common scammer techniques for avoiding detection in which, for example, the scammers compose their websites entirely with images.
Using this approach, the computer scientists identified scams across servers and domains and reported on distributed and shared infrastructure, lifetime, stability, and location.
By clustering the web pages that were visually equivalent and integrating this information into the other data collected from the spam feed, the computer scientists determined that about 94 per cent of the scams advertised in spam emails with embedded URLs were hosted only a single web server.
Of the six per cent of scam servers that were distributed across multiple servers, a few used more than 10 IP addresses, and one scam used 45 servers.
“Scams might use multiple hosts for fault-tolerance, for resilience in anticipation of administrative takedown or blacklisting, for geographic distribution, or even for load balancing,” the authors wrote, noting that most scammers are not currently taking this precaution.
US computer scientists today published research that reveals "striking differences" between the infrastructure used to distribute spam and the infrastructure used to host the online scams advertised in these unwanted email messages.
The boffins from University of California, San Diego (UCSD) Jacobs School of Engineering reported that, while hundreds or thousands of compromised computers may be used to relay spam to users, most scams are hosted by individual web servers.
The computer scientists studied a spam feed over the course of a week. They analysed spam-advertised web servers hosting online scams that either offer merchandise and services (including pharmaceuticals, luxury watches, mortgages) or use malicious means to defraud users (including phishing, spyware, rootkits). The researchers followed the URLs embedded in spam back to the hosting servers, probed the servers and analysed the web pages advertised in the spam.
Based on the analysis of over one million spam emails, 94 per cent of the scams advertised via embedded links are hosted on individual web servers, according to new peer-reviewed research to be presented at the USENIX Security 2007 conference in Boston on August 09, 2007.
“A given spam campaign may use thousands of mail relay agents to deliver its millions of messages, but only use a single server to handle requests from recipients who respond. A single takedown of a scam server or a spammer redirect can curtail the earning potential of an entire spam campaign,” wrote the UCSD computer scientists.
“The availability of scam infrastructure is critical to spam profitability. Our findings suggest that the current scam infrastructure is particularly vulnerable to common blocking techniques such as blacklisting,” said Geoff Voelker, a computer science and engineering professor at the UCSD Jacobs School involved in the study.
The computer scientists recorded the server locations and captured screenshots of the spam URL destination web pages. From these screen shots, they grouped the scams using a technique called “image shingling”.
This approach matches visually similar web pages based upon images rendered in a web browser rather than on HTML source, URL text, or spam email contents. Image shingling enables spamscatter to foil common scammer techniques for avoiding detection in which, for example, the scammers compose their websites entirely with images.
Using this approach, the computer scientists identified scams across servers and domains and reported on distributed and shared infrastructure, lifetime, stability, and location.
By clustering the web pages that were visually equivalent and integrating this information into the other data collected from the spam feed, the computer scientists determined that about 94 per cent of the scams advertised in spam emails with embedded URLs were hosted only a single web server.
Of the six per cent of scam servers that were distributed across multiple servers, a few used more than 10 IP addresses, and one scam used 45 servers.
“Scams might use multiple hosts for fault-tolerance, for resilience in anticipation of administrative takedown or blacklisting, for geographic distribution, or even for load balancing,” the authors wrote, noting that most scammers are not currently taking this precaution.
ISPs suspected of massive identity theft in Korea
Source: VNUNET.COM
Police are investigating South Korea's two biggest ISPs on suspicion that they broke identity theft laws on more than seven million occasions. The two companies, KT and Hanaro Telecom Inc, are suspected of signing up more than seven million customers for services without their permission, according to police sources cited by local media today.
Many of the company's internet service customers were apparently illegally signed up for additional services by telephone sales agents, who did not obtain the written consent required under law, police say. Reports say the two ISPs may have illegally signed up 7.3 million of the 10 million households and businesses in the country that rely on them for internet service.
More than 60 employees and agents working for the two firms are now being questioned by police. KT has announced that it is cooperating with authorities and that it will improve internal data security procedures. Hanaro Telecom CEO Park Byung-Moo made an apparent apology at a press conference today, saying "he feels sorry to customers for causing such trouble," according to the Korea Herald.
The two companies provide a wide variety of services through their web portals, including email, auctions and games. Many of these services are free or advertising funded, although some require payment. It is not yet clear if any customers were illegally signed up for paid services.
"Even though subscribers are not aware they are internet site members and do not visit them, the high number of members itself can give website operators sales and marketing power in pushing for contracts with other businesses, for example, in advertising," detective Jeong Hyung-Won of Seoul's cyber crime investigation team told the Korea Herald.
Hanaro Telecom has also been accused of illegally sharing subscriber contact information with outside firms, which then contacted the customers in an attempt to sell products to them.
Police are investigating South Korea's two biggest ISPs on suspicion that they broke identity theft laws on more than seven million occasions. The two companies, KT and Hanaro Telecom Inc, are suspected of signing up more than seven million customers for services without their permission, according to police sources cited by local media today.
Many of the company's internet service customers were apparently illegally signed up for additional services by telephone sales agents, who did not obtain the written consent required under law, police say. Reports say the two ISPs may have illegally signed up 7.3 million of the 10 million households and businesses in the country that rely on them for internet service.
More than 60 employees and agents working for the two firms are now being questioned by police. KT has announced that it is cooperating with authorities and that it will improve internal data security procedures. Hanaro Telecom CEO Park Byung-Moo made an apparent apology at a press conference today, saying "he feels sorry to customers for causing such trouble," according to the Korea Herald.
The two companies provide a wide variety of services through their web portals, including email, auctions and games. Many of these services are free or advertising funded, although some require payment. It is not yet clear if any customers were illegally signed up for paid services.
"Even though subscribers are not aware they are internet site members and do not visit them, the high number of members itself can give website operators sales and marketing power in pushing for contracts with other businesses, for example, in advertising," detective Jeong Hyung-Won of Seoul's cyber crime investigation team told the Korea Herald.
Hanaro Telecom has also been accused of illegally sharing subscriber contact information with outside firms, which then contacted the customers in an attempt to sell products to them.
Giant 'pump-and-dump' spam scam hits computers
Source: AFP
Spammers have unleashed one of the biggest online stock manipulation campaigns in history in the last 24 hours, increasing global spam levels by 30 percent, a leading IT security company claimed Wednesday.
Experts at SophosLabs have detected about 500 million emails containing advice to invest in Prime Time Stores Inc. -- an obscure US-listed group -- in a record-breaking example of the "pump-and-dump" spamming technique.
"Pump-and-dump" is when spammers buy shares, orchestrate a spam campaign promoting the company, then wait for a share price to rise before selling their stock for a profit.
"This particular campaign was first detected 24 hours ago in Germany and has caused a 30-percent rise in spam worldwide compared to typical levels," said Graham Cluley, senior technology consultant for Britain-based Sophos.
"This is staggering. It's one of the biggest spam campaigns we've ever seen," he told AFP in a telephone interview.
The US stock market regulator, the Securities and Exchange Commission, estimated in March that 100 million share-ramping emails were sent every week on average -- a fraction of the number Sophos says it has picked up in the last 24 hours.
The email cites a company press release announcing the opening of shops by Prime Time Stores in Puerto Rico and goes on to say: "Imagine if you had the chance to buy a Wal-Mart franchise in Mexico right when it first opened its doors there and all you needed was a small stake to get in (sic)."
"Hurry, we see this stock starting to make the turn NOW. Big watch in effect for August 8, 2007!".
Prime Time Stores, which is the exclusive licensee for 7-Eleven convenience stores in Puerto Rico and the Caribbean, did not return calls when contacted by AFP.
The diversified company also has oil and gas, automotive, and mobile phone activities, according to its website.
The stock rose 2.35 percent in morning trade in the United States on Wednesday to 0.087 dollars, but gained 30 percent on Monday and 14.8 percent on Tuesday in the days running up to the detection of the campaign.
"It turns out that it's one of the kinds of spam that actually works," said John Levine, chair of US-based Anti-Spam Research Group.
"There are at least two academic studies that show that the share does go up and the bad guys make money."
Sophos estimates that "pump-and-dump" stock campaigns, which entice consumers with headlines such as "Ready to Explode," "Ride the Bull," and "Fast Money," account for about 25 percent of all spam nowadays, up from less than 1.0 percent in January 2005.
Levine, who is also the author of hit book "Internet for Dummies," says the perpetrators are extremely difficult to catch despite efforts by stock market regulators and police.
"Spamming used to be about guys selling fake viagra from their basements," he said. "Now it's likely to be international crime gangs."
Cluley from Sophos said the share-ramping scams target small stocks, often worth a fraction of a cent, which require only a small increase to deliver big gains.
"They send out fake news about a tiny stock and there are so many day-traders out there that are ready to jump on the bandwagon," he said, referring to amateur investors who play the stock market from home.
The emails promoting Prime Time Stores stock, which are being propagated by thousands of virus-infected home computers whose owners are unaware, has a PDF attachment that contains the investment advice.
The use of a PDF file, a special document-friendly format, makes it easier for the email to slip through spam filters, Cluley said.
Levine has clear advice for anyone tempted to act on unsolicited investment advice sent via email.
"No stranger would ever give you a stock tip for your own good. It was true in the 1920s and it's just as true now," he said.
In March this year, the Securities and Exchange Commission decided to suspend trading in the shares of 35 companies that had been targeted by spam in the first such action of its kind.
The regulator has launched an initiative called "Operation Spamalot" to combat what SEC chairman Christopher Cox has called an "illegal and destructive" practice.
Spammers have unleashed one of the biggest online stock manipulation campaigns in history in the last 24 hours, increasing global spam levels by 30 percent, a leading IT security company claimed Wednesday.
Experts at SophosLabs have detected about 500 million emails containing advice to invest in Prime Time Stores Inc. -- an obscure US-listed group -- in a record-breaking example of the "pump-and-dump" spamming technique.
"Pump-and-dump" is when spammers buy shares, orchestrate a spam campaign promoting the company, then wait for a share price to rise before selling their stock for a profit.
"This particular campaign was first detected 24 hours ago in Germany and has caused a 30-percent rise in spam worldwide compared to typical levels," said Graham Cluley, senior technology consultant for Britain-based Sophos.
"This is staggering. It's one of the biggest spam campaigns we've ever seen," he told AFP in a telephone interview.
The US stock market regulator, the Securities and Exchange Commission, estimated in March that 100 million share-ramping emails were sent every week on average -- a fraction of the number Sophos says it has picked up in the last 24 hours.
The email cites a company press release announcing the opening of shops by Prime Time Stores in Puerto Rico and goes on to say: "Imagine if you had the chance to buy a Wal-Mart franchise in Mexico right when it first opened its doors there and all you needed was a small stake to get in (sic)."
"Hurry, we see this stock starting to make the turn NOW. Big watch in effect for August 8, 2007!".
Prime Time Stores, which is the exclusive licensee for 7-Eleven convenience stores in Puerto Rico and the Caribbean, did not return calls when contacted by AFP.
The diversified company also has oil and gas, automotive, and mobile phone activities, according to its website.
The stock rose 2.35 percent in morning trade in the United States on Wednesday to 0.087 dollars, but gained 30 percent on Monday and 14.8 percent on Tuesday in the days running up to the detection of the campaign.
"It turns out that it's one of the kinds of spam that actually works," said John Levine, chair of US-based Anti-Spam Research Group.
"There are at least two academic studies that show that the share does go up and the bad guys make money."
Sophos estimates that "pump-and-dump" stock campaigns, which entice consumers with headlines such as "Ready to Explode," "Ride the Bull," and "Fast Money," account for about 25 percent of all spam nowadays, up from less than 1.0 percent in January 2005.
Levine, who is also the author of hit book "Internet for Dummies," says the perpetrators are extremely difficult to catch despite efforts by stock market regulators and police.
"Spamming used to be about guys selling fake viagra from their basements," he said. "Now it's likely to be international crime gangs."
Cluley from Sophos said the share-ramping scams target small stocks, often worth a fraction of a cent, which require only a small increase to deliver big gains.
"They send out fake news about a tiny stock and there are so many day-traders out there that are ready to jump on the bandwagon," he said, referring to amateur investors who play the stock market from home.
The emails promoting Prime Time Stores stock, which are being propagated by thousands of virus-infected home computers whose owners are unaware, has a PDF attachment that contains the investment advice.
The use of a PDF file, a special document-friendly format, makes it easier for the email to slip through spam filters, Cluley said.
Levine has clear advice for anyone tempted to act on unsolicited investment advice sent via email.
"No stranger would ever give you a stock tip for your own good. It was true in the 1920s and it's just as true now," he said.
In March this year, the Securities and Exchange Commission decided to suspend trading in the shares of 35 companies that had been targeted by spam in the first such action of its kind.
The regulator has launched an initiative called "Operation Spamalot" to combat what SEC chairman Christopher Cox has called an "illegal and destructive" practice.
SpyProxy takes Web apps security fight to "virtual Sandbox"
Source: PC WORLD.COM
San Francisco (InfoWorld) - Faced with volumes of browser vulnerabilities and Web-based exploits designed to take advantage of the flaws, security researchers presented a new process for protecting users with execution-based malware detection at the ongoing Usenix Security Symposium in Boston on Wednesday.
In a demonstration led by Alexander Moshchuk, a University of Washington graduate student who is part of a research team that has developed a tool that uses the technique for filtering out malicious programs, the expert pitched the use of "virtual sandboxing" as an effective means for testing Web applications for suspicious behavior before they reach end-users' browsers.
With the threat of drive-by attacks and zero day exploits expanding on a daily basis as malware authors advance their sophistication, security experts have increasingly downplayed the efficacy of traditional signature-based anti-virus technologies for stopping many online attacks.
As a result, several new techniques have emerged for protecting end-users before vulnerabilities can be identified and patched. Virtualization is one of the technological means being adopted by many researchers attempting to address the problem, and Moshchuk highlighted the use of the technique in a tool created at UW and named SpyProxy.
Injected as a virtual machine that sits between an end-users' browser and a Web site, SpyProxy promises to download and test any application that the browser is directed toward in order to weed-out potential attacks.
In a matter of seconds, the security program can effectively run and analyze any type of Web page or application to determine whether it contains the hallmarks of many threats, the researcher said.
"SpyProxy has limitations, but nonetheless we feel that it can be an effective new weapon in the Internet security arsenal, as a low-cost way to block real zero days that is complimentary to existing techniques and actively makes the Web browsing experience more secure," Moshchuk said.
If you add up the number of days that Microsoft's Internet Explorer was vulnerable to published attacks during 2006, the total equates to roughly nine months of opportunities for malware authors to deliver their threats to end-users, said Moshchuk, who observed that business users in particular can ill afford to remain exposed to viruses and other threats on such a regular basis.
Execution-based malware detection cannot identify some advanced forms of threat such as so-called cross-site scripting (XSS) scams based on their latent nature, but most active attacks can be unearthed with relative ease, Moshchuk said.
SpyProxy works by creating a virtual machine that mirrors the same browser as that being used by someone running the tool and fully renders any page or application that is accessed to determine whether the URL contains an attack.
While the process does lead to delays in Web page delivery, on the order of roughly three seconds per URL in an unmodified state, the tradeoff of eliminating many zero days and drive-bys will make the technology acceptable to some end-users, the researcher maintains.
In a test of roughly 2,000 Web site requests carried out by the UW team over 124 individual URLs, the researchers found some 27 active browser exploits and 73 spontaneous downloads that could represent malware, adware, or other unwanted programs. The group maintains that SpyProxy identified and blocked all of the threats.
In terms of scalability, SpyProxy -- which the group plans to distribute free of charge -- was designed to handle multiple users on clusters of workstations. According to Moshchuk, a single-CPU device can process roughly 82,000 page requests in one day, which he estimated as sufficient coverage for approximately 800 users per machine. A quad-core machine could reasonably be expected to protect several thousand users in a single organization, he said.
One limitation of SpyProxy: it works more effectively on sites that contain larger volumes of static content such as text, although it is taxed to scan applications that behave similarly to general purpose software programs, the researcher said.
Another problem is that the tool sometimes struggles to determine when a page or application has completely finished loading, and when to pass content along to the end-user, which could lead to additional latency concerns.
However, in a modified state where the tool is set to eliminate unnecessary scanning by allowing sites that have already been tested -- but which have not been changed since a previous download -- to flow through without constraint, or to allow pages with only static content to flow to the user unabated, the amount of time needed to allow SpyProxy to run its course drops to only 600 milliseconds, according to Moshchuk.
Another manner to speed the downloading process and overall performance of the tool could be to deliver different portions of sites that are being tested as individual scans are being completed.
Moshchuk said that the UW team hopes that other security researchers will apply similar techniques in addressing malware with active detection, and promised that it will also continue to expand and improve SpyProxy.
"This isn't about building a perfect security tool. We really care about exploring the technique further," Moshchuk said. "But we think that people can already begin using the tool without affecting the end-user experience too much."
San Francisco (InfoWorld) - Faced with volumes of browser vulnerabilities and Web-based exploits designed to take advantage of the flaws, security researchers presented a new process for protecting users with execution-based malware detection at the ongoing Usenix Security Symposium in Boston on Wednesday.
In a demonstration led by Alexander Moshchuk, a University of Washington graduate student who is part of a research team that has developed a tool that uses the technique for filtering out malicious programs, the expert pitched the use of "virtual sandboxing" as an effective means for testing Web applications for suspicious behavior before they reach end-users' browsers.
With the threat of drive-by attacks and zero day exploits expanding on a daily basis as malware authors advance their sophistication, security experts have increasingly downplayed the efficacy of traditional signature-based anti-virus technologies for stopping many online attacks.
As a result, several new techniques have emerged for protecting end-users before vulnerabilities can be identified and patched. Virtualization is one of the technological means being adopted by many researchers attempting to address the problem, and Moshchuk highlighted the use of the technique in a tool created at UW and named SpyProxy.
Injected as a virtual machine that sits between an end-users' browser and a Web site, SpyProxy promises to download and test any application that the browser is directed toward in order to weed-out potential attacks.
In a matter of seconds, the security program can effectively run and analyze any type of Web page or application to determine whether it contains the hallmarks of many threats, the researcher said.
"SpyProxy has limitations, but nonetheless we feel that it can be an effective new weapon in the Internet security arsenal, as a low-cost way to block real zero days that is complimentary to existing techniques and actively makes the Web browsing experience more secure," Moshchuk said.
If you add up the number of days that Microsoft's Internet Explorer was vulnerable to published attacks during 2006, the total equates to roughly nine months of opportunities for malware authors to deliver their threats to end-users, said Moshchuk, who observed that business users in particular can ill afford to remain exposed to viruses and other threats on such a regular basis.
Execution-based malware detection cannot identify some advanced forms of threat such as so-called cross-site scripting (XSS) scams based on their latent nature, but most active attacks can be unearthed with relative ease, Moshchuk said.
SpyProxy works by creating a virtual machine that mirrors the same browser as that being used by someone running the tool and fully renders any page or application that is accessed to determine whether the URL contains an attack.
While the process does lead to delays in Web page delivery, on the order of roughly three seconds per URL in an unmodified state, the tradeoff of eliminating many zero days and drive-bys will make the technology acceptable to some end-users, the researcher maintains.
In a test of roughly 2,000 Web site requests carried out by the UW team over 124 individual URLs, the researchers found some 27 active browser exploits and 73 spontaneous downloads that could represent malware, adware, or other unwanted programs. The group maintains that SpyProxy identified and blocked all of the threats.
In terms of scalability, SpyProxy -- which the group plans to distribute free of charge -- was designed to handle multiple users on clusters of workstations. According to Moshchuk, a single-CPU device can process roughly 82,000 page requests in one day, which he estimated as sufficient coverage for approximately 800 users per machine. A quad-core machine could reasonably be expected to protect several thousand users in a single organization, he said.
One limitation of SpyProxy: it works more effectively on sites that contain larger volumes of static content such as text, although it is taxed to scan applications that behave similarly to general purpose software programs, the researcher said.
Another problem is that the tool sometimes struggles to determine when a page or application has completely finished loading, and when to pass content along to the end-user, which could lead to additional latency concerns.
However, in a modified state where the tool is set to eliminate unnecessary scanning by allowing sites that have already been tested -- but which have not been changed since a previous download -- to flow through without constraint, or to allow pages with only static content to flow to the user unabated, the amount of time needed to allow SpyProxy to run its course drops to only 600 milliseconds, according to Moshchuk.
Another manner to speed the downloading process and overall performance of the tool could be to deliver different portions of sites that are being tested as individual scans are being completed.
Moshchuk said that the UW team hopes that other security researchers will apply similar techniques in addressing malware with active detection, and promised that it will also continue to expand and improve SpyProxy.
"This isn't about building a perfect security tool. We really care about exploring the technique further," Moshchuk said. "But we think that people can already begin using the tool without affecting the end-user experience too much."
Fighting Spam
Source: PC WORLD.COM
Spammers may have an Achilles Heel.
According to researchers at the University of California, San Diego, antispam fighters could really hurt the spammers bottom line, if they target the Web sites used to host their scams rather than simply trying to block the mail server used to send out unsolicited commercial e-mail.
"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach, a research assistant with U.C. San Diego. "A lot of people using spam to advertise their sites aren't well provisioned," he explained, "so focusing on these bottlenecks would have a deleterious effect on the spam campaign."
Fleizach is part of a research team that recently took a close look at the network infrastructure used by spammers. They concluded that while spammers may use many different servers to send out their e-mail, it's a different story when it comes to hosting the Web page that sells the watches or male enhancement products featured in the spam.
In fact, 94 percent of the time, the scam could be traced back to a single Web server. "Most scams are hosted on a single IP address, providing a potentially convenient single point for network-based interdiction either via IP blacklisting or network filtering," the researcher wrote in a paper to be delivered Thursday at the Usenix Security 2007 conference in Boston.
That's because these Web sites are often run by gray market vendors who need to set up complex e-commerce sites, said Stephen Pao, vice president of product management with antispam vendor Barracuda Networks Inc. "Folks who sell diet pills, folks who sell fake watches, they all need to take credit-card numbers," he said. "And they all need to have central data centers."
The U.C. researchers monitored over 1 million spam messages over a one-week period late last year, tracing them back to more than 36,000 URLs (uniform resource locators). Using a data analysis technique called image shingling, they were able to identify 2,334 distinct spam campaigns, hosted on 7,029 computers.
Previously used by search engines, image shingling can break down a screen shot of a Web page and analyze its graphical elements.
Researchers found that nearly 40 percent of the time the spammer's Web site was also being used by another spam campaign, suggesting that these machines are often rented out to more than one spammer.
Although browser makers like Microsoft Corp. and Mozilla Corp. have spent a lot of effort beefing up their antiphishing filters this past year, there hasn't been a similar effort to warn people when they're visiting a spam-related site, Fleizach said. "There's no broad community effort to go block sites that are linked to spam, and that may be an important effect that comes out of this [research]."
Enterprise users can block spammer's sites by purchasing Web-filtering products such as those that do "intent analysis" of Web sites, said Barracuda's Pao. But "in general the consumers don't have the tools available for them to do it," he added.
Spammers may have an Achilles Heel.
According to researchers at the University of California, San Diego, antispam fighters could really hurt the spammers bottom line, if they target the Web sites used to host their scams rather than simply trying to block the mail server used to send out unsolicited commercial e-mail.
"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach, a research assistant with U.C. San Diego. "A lot of people using spam to advertise their sites aren't well provisioned," he explained, "so focusing on these bottlenecks would have a deleterious effect on the spam campaign."
Fleizach is part of a research team that recently took a close look at the network infrastructure used by spammers. They concluded that while spammers may use many different servers to send out their e-mail, it's a different story when it comes to hosting the Web page that sells the watches or male enhancement products featured in the spam.
In fact, 94 percent of the time, the scam could be traced back to a single Web server. "Most scams are hosted on a single IP address, providing a potentially convenient single point for network-based interdiction either via IP blacklisting or network filtering," the researcher wrote in a paper to be delivered Thursday at the Usenix Security 2007 conference in Boston.
That's because these Web sites are often run by gray market vendors who need to set up complex e-commerce sites, said Stephen Pao, vice president of product management with antispam vendor Barracuda Networks Inc. "Folks who sell diet pills, folks who sell fake watches, they all need to take credit-card numbers," he said. "And they all need to have central data centers."
The U.C. researchers monitored over 1 million spam messages over a one-week period late last year, tracing them back to more than 36,000 URLs (uniform resource locators). Using a data analysis technique called image shingling, they were able to identify 2,334 distinct spam campaigns, hosted on 7,029 computers.
Previously used by search engines, image shingling can break down a screen shot of a Web page and analyze its graphical elements.
Researchers found that nearly 40 percent of the time the spammer's Web site was also being used by another spam campaign, suggesting that these machines are often rented out to more than one spammer.
Although browser makers like Microsoft Corp. and Mozilla Corp. have spent a lot of effort beefing up their antiphishing filters this past year, there hasn't been a similar effort to warn people when they're visiting a spam-related site, Fleizach said. "There's no broad community effort to go block sites that are linked to spam, and that may be an important effect that comes out of this [research]."
Enterprise users can block spammer's sites by purchasing Web-filtering products such as those that do "intent analysis" of Web sites, said Barracuda's Pao. But "in general the consumers don't have the tools available for them to do it," he added.
Subscribe to:
Posts (Atom)