Man in the Browser Attacks Online Banking Customers

Last week you may remember that Symantec notified pcAnywhere customers of the potential for "Man in the Middle" attacks as a result of their leaked source code. This week a malware testing lab out of Britain,  S21sec, is warning online banking users of "Man in the Browser" or MitB threats. 


The idea behind these two threats, despite the different name, is the same. The user downloads malware accidentally and the application lives in their browser and alters what is seen on the site and where the entered data goes. Some more sophisticated versions will change payment details and amounts to try and cover the malicious activity.

Fortunately, many banks use software that understands a user's patterns and when something out of the norm occurs, the bank will alert the account holder of the activity. 

Read more: UPI.com

Anonymous Strikes Again - Texas Police Officer Edition

A hacker affiliated with Anonymous has gained access to the Texas Police Association website and obtained names, addresses and police departments of more than 700 officers across the state. These records were then published along with a link to a news story about a Texas police officer being placed on administrative leave while being investigated for child pornography charges.


This is not the first time the Texas Police Association's website has been hacked, but it is the first time personal data has been revealed. Erwin Ballarta, Executive Director of the Texas Police Association has contacted the FBI.

pcAnywhere is Safe Again

Symantec issued a statement updating their pcAnywhere customers with the news that they were able to patch all breach-exposed vulnerabilities that had previously caused the company to advise users to disable the product.

"On Friday, January 27, 2012, Symantec released a patch that eliminates known

vulnerabilities affecting customers using pcAnywhere 12.0 and pcAnywhere 12.1."

Symantec is also offering a free-upon-request upgrade to the latest version of pcAnywhere, version 12.5. Users should send the company an email to their pcanywhere@symantec.com address.

Symantec Urges Customers to Disable pcAnywhere

The breach of Symantec source code by an Indian hacking group a few weeks ago was all but brushed off by the security giant. Symantec went on the record saying that the leaked code is, "so old that current out-of-the-box security settings will suffice against any possible threats that might materialise as a result of this incident." 

However, in a posting on their website yesterday and an accompanying technical white paper, Symantec suggests that pcAnywhere customers are at a heightened risk and advises users to "disable the product until Symantec releases a final set of software updates that resolve currently known vulnerability risks." Customers could be at risk for "man in the middle" attacks where an unauthorized person accesses pcAnywhere transactions and intercepts data as it travels from its source to its destination. These attacks are more likely because the blueprints for Norton Antivirus Corporate Edition, Norton Internet Security, Norton SystemWorks (Norton Utilities and Norton GoBack) and pcAnywhere were accessed in the breach. The information contained in these blueprints makes it easier to identify and exploit software vulnerabilities. 

Symantec reps say that there are 50,000 people using the standalone version of pcAnywhere along with an unknown number of users who received the product bundled within other security packages.

Almost 1/3 of Americans Own an E-Reader or a Tablet

According to new research released by the good people at The Pew Internet Project,  "the share of adults in the United States who own tablet computers nearly doubled from 10% to 19% between mid-December and early January and the same surge in growth also applied to e-book readers, which also jumped from 10% to 19% over the same time period." This brings the total number of Americans who own at least one tablet or e-reader to 29%.

This study puts solid numbers on the tablet and e-reader market growth speculations. It is becoming more and more important for organizations to look into how they are going to integrate tablet and, more broadly,  mobile security into their enterprise DLP strategy. 

Two of the largest enterprise DLP vendors,Symantec and Websense, are introducing a DLP plug-in for tablets this year. The concept for tablets is pretty basic and shared for the most part across vendors. It works like an endpoint monitor that views and classifies information as it flows from a tablet to a web or cloud application. If the content is deemed appropriate it is allowed to reach its destination, and if the content is sensitive it will either notify DLP administrators, block the content or a combination of both.

Unsecured Video Conferencing Systems May be Exposing Your Meetings

In a New York Times Article by Nicole Perlroth published on January 22nd. Perlroth describes one of the latest organizational vulnerabilities found and exploited by Rapid7, a Boston based company that looks for security holes in computer systems. 

"SAN FRANCISCO — One afternoon this month, a hacker took a tour of a dozen conference rooms around the globe via equipment that most every company has in those rooms; videoconferencing equipment.

With the move of a mouse, he steered a camera around each room, occasionally zooming in with such precision that he could discern grooves in the wood and paint flecks on the wall. In one room, he zoomed out through a window, across a parking lot and into shrubbery some 50 yards away where a small animal could be seen burrowing underneath a bush. With such equipment, the hacker could have easily eavesdropped on privileged attorney-client conversations or read trade secrets on a report lying on the conference room table.

In this case, the hacker was HD Moore, a chief security officer at Rapid7, a Boston based company that looks for security holes in computer systems that are used in devices like toaster ovens and Mars landing equipment. His latest find: videoconferencing equipment is often left vulnerable to hackers."

Read the rest of this article here: Flaws in videoconferencing systems put boardrooms at risk

Symantec confirms source code leak in two enterprise security products

Computer world has a great article on Symantec's recent source code leak in India. It was supposedly taken from a government database in India where it is not uncommon for tech companies to have to submit their source code to prove they are not using their software to spy on the government. I think many organizations will take notice of this breach and begin to push back more on the requirements to submit source code.

Computerworld - Symantec late Thursday confirmed that source code used in two of its older enterprise security products was publicly exposed by hackers this week.In a statement, the company said that the compromised code is between four and five years old and does not affect Symantec's consumer-oriented Norton products as had been previously speculated."Our own network was not breached, but rather that of a third party entity," the company said in the statement. "We are still gathering information on the details and are not in a position to provide specifics on the third party involved. Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec's solutions," the statement said.Symantec spokesman Cris Paden identified the two affected products as Symantec Endpoint Protection 11.0 and Symantec Antivirus 10.2. Both products are targeted at enterprise customers and are more than five years old, Paden said."We're taking this extremely seriously, but in terms of a threat, a lot has changed since these codes were developed," Paden said. "We distributed 10 million new signatures in 2010 alone. That gives you an idea of how much these products have morphed since then, when you're talking four and five years."Symantec is developing a remediation process for enterprise customers who are still using the affected products, Paden noted. Details of the remediation process will be made available in due course, he added.

To read more of this article follow this link: http://www.computerworld.com/s/article/9223198/Symantec_confirms_source_code_leak_in_two_enterprise_security_products