Intel Introduced Doubtful Security Plan

After Chipzilla had bought the worldwide-known insecurity company McAfee, lots of industry experts wondered why, and recently Intel finally released the results of its collaboration.

Intel has developed a security system called Deepsafe. According to the giant, this system will work outside the operating system at the chip level, watching the hardware for signs of malware being active. The system in question is expected to be quite good at tackling rootkit malware attacks, because they also happen outside the operating system. For example, McAfee’s own threat report quoted the statistics which mentioned the number of rootkit infections discovered in the 6 months of this year being up 32% year-on-year.

At the same time, media reports revealed that the industry observers aren’t quite sure that the new idea of the company will make much difference in this field. For instance, Wendy Nather, which works as a security analyst from the 451 Group and is also known as a former IT security director at UBS, explained that Intel has actually had the security modules the new system is based on in their chipset for a while now. The only problem is that venders could not be even bothered to use them, as this demands development where they thought there was not much market interest.

The security system updates would be a bit more disruptive than the current security software patches – in fact, it would be more about changing the foundations of a building from underneath it. As for the first McAfee product based on this security system, it is Deep Defender, and it’ll be out there in the stores in the beginning of 2012. Wendy Nather pointed out that Intel is simply doing the same things as McAfee has already been doing now and moving them into the chipset. As you can understand, this doesn’t sound too exciting.

Meanwhile, the real area in which chip-level security would be very interesting is embedded systems. This is because they are being used virtually everywhere – from smart meters to mobile devices, in which, as you know, a lot of money are being invested in order to secure them. In short words, Deepsafe is a system which softly hints that the technology isn’t actually being targeted at personal computers at all. Instead, it can mean Intel’s move into the mobile market.

Microsoft Uses Law To Cripple Hacker Spam Network

SAN FRANCISCO—Microsoft on Thursday said it combined technology with an "extraordinary" legal maneuver to cripple a massive network of hacked computers that had been flooding the Internet with spam.

The software titan's Digital Crime Unit got clearance from a US judge to virtually sever the cyber criminals' command computers from hundreds of thousands of machines worldwide infected with a Waledac virus.

"We decided the best tactic would be to literally build a wall between the bot-herder, the command computer, and all of the other computers -- effectively cutting the umbilical cord," said Microsoft attorney Richard Boscovich.

Microsoft got a US judge to grant an ex parte temporary restraining order that let the firm erect the cyber blockade without warning bot-herders, masters of the "botnet."

"It was of crucial importance that when we went out to sever the connection between the bot herder and the bots, that severing had to be done without him knowing," said Boscovich, who works in the digital crime unit.

Microsoft drafted a complaint that made a case to the court that the damage to computer owners worldwide, and to the software firm, was major enough to warrant "this rather extraordinary order," Boscovich said.

The mission to take down one of the ten largest botnets in the United States was referred to internally at Microsoft as "Operation b49."

Waledac is estimated to have infected hundreds of thousands of computers worldwide, letting its masters mine machines for information or secretly use them to fire off spam email.

Hackers typically infect computers with malicious codes by tricking owners into clicking on booby-trapped email messages or Internet links that plant viruses.

Bot-herders are then free to hire out botnets for nefarious tasks such as spewing spam or overwhelming legitimate websites with myriad simultaneously requests in what are known as distributed-denial-of-service attacks.

The Waledac botnet was believed to be capable of sending more than 1.5 billion spam email messages daily.

During a three week period in December, Waledac-infected machines sent approximately 651 million spam email messages to users of Microsoft's free Hotmail service, according to the software firm.

The spam included messages pitching online pharmacies, knock-off goods, and penny stocks.

"Three days into the effort, Operation b49 has effectively shut down connections to the vast majority of Waledac-infected computers, and our goal is to make that disruption permanent," a Microsoft lawyer said in a release.

"But the operation hasn't cleaned the infected computers and is not a silver bullet for undoing all the damage we believe Waledac has caused."

Computer users are advised to purge their machines of viruses and make sure their programs and security software are up to date.

US courts allow for hearings to decide whether temporary restraining orders should be made permanent, setting up an unlikely scenario in which bot-herders would argue for their right to reconnect with their machine minions.

House Passes Cybercrime Bill

MANILA, Philippines—The House of Representatives has passed on third and final reading the cybercrime prevention bill, which intends to punish people who commit computer fraud and other cyber-related abuses.

There was hardly any opposition to the measure, except from Kabataan party-list Rep. Raymond Palatino, who explained during the voting Monday night that passing the measure would give the government a dangerous weapon.

“We are dangerously granting the government the legal basis to invade the privacy of individuals,” Palatino said.

The bill, co-authored by 21 lawmakers, lists the prohibited acts relating to the use of computers and other electronic devices. These include illegal access, illegal interception, system and data interference, computer fraud, cybersex activities and child pornography.

But according to Palatino, the bill contains provisions that affect people's civil liberties.

For one thing, cybercrime is defined vaguely, he contended. The measure encompasses the recording and distribution of recorded private acts not limited to sexual acts. But he said this will have an impact on media exposes where they use hidden cameras to catch acts of corruption.

He added that even the “Hello Garci” phone call that snagged President Macapagal Arroyo, who was caught in a wiretapped conversation with an unidentified election official during the counting of votes during the 2004 polls, would be considered a private act.

He also warned that the proposed law would allow government authorities to monitor people's personal accounts on various sites, including e-mail. If a person is suspected of engaging in cybercrime the authorities could open his accounts for surveillance on his actions, he said.

In such instances, the government could access activities and files not related to the suspicious activities.

“This is dangerous because it gives the government an excuse to justify illegal fishing expeditions against ordinary citizens and allows the wanton violation of the strict requirements in criminal procedure,” he said.

Palatino said the measure should be revised to remedy the vague provisions on the definition of cybercrime, and to make the bill more technical.

By Leila Salaverria

Cyber crooks targets banks, social networks

SAN FRANCISCO—An annual security report released Tuesday by technology titan Cisco warns that banks and online social networks are prime targets for increasingly sophisticated cyber crooks.

"Criminals have been taking note of the large crowds in social-networking sites. They steal them with various techniques," said Cisco security researcher Scott Olechowski.

Tactics used to get into social-networking profiles include hacking password databases at vulnerable online services and then exploiting the fact that many people use one password for multiple accounts.

Cisco estimates that a Koobface computer worm, named as a play on social networking hot spot "Facebook," has infected more than three million computers since it first appeared in 2008.

Koobface is malicious code that steals social networking account credentials, logs into profiles and sends "friends" messages along the lines of wanting to share scintillating online videos.

Links enclosed in the messages lead to bobby-trapped Web pages that trick visitors into infecting their machines with copies of the worm.

Crooks sometimes set up fake profiles and then finagle their ways into people's online social circles and entice them to opening computer files tainted with malicious code.

Money-making tricks can be as simple as hackers using social-networking profiles to pretend to be friends in desperate straits that ask to be wired money to get out of trouble in a far-away places.

Social networks are also targeted by hackers out to control or disrupt political discourse.

Business computers can wind up infected because one of every 50 "clicks" in the workplace is to social-networking websites, according to Cisco.

"The blending of social media for business and pleasure increases the potential for network security troubles, and people, not technology, can often be the source," said Cisco fellow Patrick Peterson.

"Without proper cognizance of security threats, our natural inclination to trust our 'friends' can result in exposing ourselves, home computers and corporate networks to malware," he said.

Cyber criminals can mine profiles for names and email addresses of business executives or accounting department members to "spear phish," target strategically placed workers with scams.

The potential for workplace computers to be infected through a social-networking attack is all the more disturbing given the rise of a computer Trojan named Zeus crafted to digitally loot money from banks.

Once in computers, Zeus can swipe information and alter what is seen in Web browsers so that people tending to online banking see correct balances on screen while accounts are actually being emptied by cyber thieves.

"Zeus is sold on a retail basis by criminals to criminals," Olechowski said, putting the price at $700.

Gangs have used Zeus to steal "$400,000 to $1.5 million a shot," he added. Cisco predicts Zeus will be a growing bane in 2010.

Spam remains a tried-and-true method for tricking people into downloading malware or buying specious products, such as fake medicine.

Cisco's report estimates that the amount of spam worldwide next year will rise 30 to 40 percent above 2009 levels.

While US and European countries shut down spam-spewing networks of "zombie" computers infected with malicious code and commandeered by criminals, more are being created in developing countries, according to the California-based firm.

Brazil this year dethroned the United States as the country producing the most spam, according to Cisco. The amount of spam coming from Vietnam and India has also soared.

"In the World Cup of spam, Brazil beat the US for the first time. We are starting to see emerging economies represent the bulk of spam globally," Olechowski said.

Cyber criminals are taking advantage of improved broadband Internet and computer access in developing countries where people may still have lessons to learn about Internet security.

Increasing spam in developing countries is a symptom of a greater problem, according to Cisco senior security researcher Henry Stern.

"This means that there is a greater rate of compromised machines, which means there will be more banking Trojans and other malware," Stern said.

Cisco created a Global Adversary Resource Market Share (ARMS) Race index, which estimates that between five and ten percent of the world's personal computers are "compromised" by malicious software.