Papers archive at Security Samizdat

Archive for the 'Papers' Category

Mar

Malware and its geographical distribution

By alfredo reino 0 Comments

Categories: Papers and Security

Very interesting article from McAfee: “Mapping the mal web“. It contains statistics on the chances to find malware on the web depending on the country of origin (according to the TLD) It’s worth it to take a look at it. The main conclusions are:

The most risky large countries are Romania (.ro, 5.6% risky sites) and Russia (.ru, 4.5% risky sites). These country TLDs are also the most likely to host exploit sites.
.info is the riskiest generic TLD, with 7.5% of its sites rated as risky. .com is the second most risky generic TLD, with 5.5% of sites rated as risky.
Four of the five least risky country TLDs are Nordic countries - Finland (0.10%), Norway (.no, 0.16%), Sweden (.se, 0.21%) and Iceland (.is, 0.19%). Ireland (.ie, 0.11%) rounds out the top five least risky country TLDs.
.gov is the only frequently tested TLD for which SiteAdvisor has found no risky sites. .gov is only available to United States government agencies.
Even though the .com TLD is only the 5th most risky TLD by rank, its huge popularity magnifies its impact on search and browsing risk dramatically. 86.6% of clicks to red and yellow rated sites go to .com sites.
Even though the Netherlands (.nl), Germany (.de) and the United Kingdom (.uk) are all relatively safe TLDs, ranking 31st, 33rd and 51st most risky, each of their TLDs account for more than 2 million clicks to red and yellow sites every month. Likewise Japan (.jp) is ranked 57th most risky and yet red and yellow rated .jp sites receive an estimated 1.6 million clicks each month.

The authors offer an interactive map to graphically show the different rates of malware occurrence per country.

The information is gathered from SiteAdvisor, which is a free tool available for Internet Explorer and Firefox which tests the websites the user visits, and checks for spyware, spam, viruses and scams.

Feb

Open Source Information Security Management

By alfredo reino 2 Comments

Categories: Papers and Security

These are several documents and frameworks that I find very useful in the area of Information Security management and consulting. The nice thing about these is their Open Source nature and their comprehensiveness.

Information Security Management Maturity Model v1.20 (PDF) by the ISM3 Consortium

ISM3 offers a practical approach to design, implement and evaluate process-oriented Information Security Management systems. It takes into account different levels of maturity and focuses on the level of security required to fulfill the organizational and business objectives.

Open Information Security Risk Management Handbook v1.0 (PDF) by SOMAP

It describes how to plan, implement and manage an Information Security Risk strategy, including Risk Assessment and Risk Management.

Open Information Security Risk Assessment Guide v1.0 (PDF) by SOMAP

SOBF (Security Officer’s Best Friend)

Open Source Security Testing Methodology Manual v2.2 (PDF) by ISECOM

information and data controls, personnel security awareness levels, fraud and social engineering control levels, computer and telecommunications networks, wireless devices, mobile devices, physical security access controls, security processes, and physical locations

Feb

The profits of spam and pump-and-dump scams

By alfredo reino 2 Comments

Categories: Papers and Security

Rustock spam I’m sure everyone assumes spam is worth it for spammers. They wouldn’t do it otherwise, right? Of course, the same could be said of the traditional “pyramid scams” and Multi-Level Marketing. They produce benefits. However, the benefits fall on few hands, usually those at the top.

Whether it’s selling Rolexes, Viagra, penis-enlargement pumps, dialer porn, or pump-and-dump stocks, the economic incentive is there.

And all that, not taking into account identity theft, credit card theft or phishing.

I’ve found an interesting post by Joe Stewart with an analysis of a particular pump-and-dump scheme related to the Rustock trojan. It shows how this particular spammer or organization can net a nice $20K over one single weekend just by deploying this spamming-trojan and some stock market knowledge (plus human greed, an important part of this, let’s not forget). Joe comments:

So, at close on Friday Dec 15, the stock is at $0.0011. Suddenly, the Rustock botnet begins spewing out the spam shown above. All weekend it churns away, sending millions of emails. Monday morning, Dec 18, sees the stock immediately rise to $0.0019 a share, then all the way to $0.0025 a share, as some recipients of the spam begin to purchase the stock. A far cry from the spammer′s target of $0.02 a share, but lets see how much that adds up to. If the spammer sells his shares early on Monday, when the stock has peaked, those 11,532,726 shares could be worth nearly $29,000, leaving the spammer with a cool $20K profit for one weekend. I wonder if the spams touting Viagra and Rolexes have ever made that much profit so quickly for the spammers with so little effort and almost zero overhead. It’s little wonder why stock spam is taking over.

Feb

Drive-by Pharming

By alfredo reino 2 Comments

Categories: Papers

The Symantec Security Response blog has published a post by Zulfikar Ramzan about a new type of emerging threat: the “drive-by pharming” attack.

It’s really a combination of different things: getting the victim to browse a malicious webpage, which uses “Cross-Site Request Forgery” to logon to the broadband router using default passwords, and changing the DNS configuration to hijack the user’s sessions, redirecting subsequent browsing to malicious sites.

It seems convoluted, but apparently it works. Proof-of-Concept code has been developed by Mr. Ramzan together with researches from the University of Indiana (Sid Stamm and Markus Jakobsson)

In the author’s own words:

Now, let’s go into a slightly more technical description. The attackers create a Web page that includes malicious JavaScript code. When the Web page is viewed, this code, running in the context of your Web browser, uses a technique known as ‘Cross Site Request Forgery’ and logs into your local home broadband router. Now, most such routers require a password for logging in. However, most people never change this password from the original factory default. Upon successful login, the JavaScript code changes the router’s settings. One simple, but devastating, change is to the user’s DNS server settings.

In our attack, the attackers can actually modify the settings on your home wireless router to dictate which DNS server you use. Even worse, they can get you to use a server that they created themselves. This server could have bogus records that tell your computer to go to the wrong IP address when you type in www.my-bank.com. The attackers can set up a fake Web site that looks just like your bank. Then, they can associate this fake Web site’s IP address with the address www.my-bank.com. Now whenever you think you’re going to your bank’s Web site, you’ll actually wind up at the attackers’ site. You may never know the difference. In the meantime, the attackers have stolen your bank account information.