January 30– February 5, 2012The IntelliShield Cyber Risk Report is a strategic intelligence product that highlights current security activity and mid- to long-range perspectives. The report addresses seven major risk management categories: vulnerability, physical, legal, trust, identity, human, and geopolitical. The Cyber Risk Reports are a result of collaborative efforts, information sharing, and collective security expertise of senior analysts from Cisco security services that include the IntelliShield team (IntelliShield Alert Manager, Applied Intelligence, and IPS), ROS, PSIRT, the Corporate Security Programs Organization, and Legal Support. VulnerabilityVulnerability activity was significantly increased for the period, roughly doubling the normal amounts. The increase was primarily due to large security updates from Apple and VMware for multiple products. Other vulnerability activity included Symantec updates for pcAnywhere (reversing their previous recommendations), Mozilla Firefox 10 correcting multiple vulnerabilities, and updates for HP Diagnostics, IBM SPSS Oracle Hash Collisions, PHP, Python, Apache HTTP server, and a sudo local escalation of privilege vulnerability impacting most Linux and Unix based systems. In threat activity Cisco continues to see scanning and attacks on the Microsoft Media Player vulnerability, reported in IntelliShield alert 24880, and multiple sources are reporting phishing and spam campaigns targeting Facebook changes, Super Bowl XLVI events, and Tax and IRS activity during the current U.S. tax season. Microsoft is scheduled to release the Security Bulletins for February 2012 on February 14, 2012. The pre-release announcement of the February bulletins is scheduled to be released on February 9, 2012. In annual and monthly statistics, IntelliShield metrics show that 2011 closed with an increase in vulnerability activity for the year as expected. Throughout 2011, activity levels were running slightly above 2010 levels and finished the year with a total 3 percent increase. While this is a small increase, it does reverse a trend of declining annual vulnerability metrics since 2009. Another significant point of analysis of the 2011 metrics is that the new vulnerability metrics increased significantly over 2010 totals, while updated vulnerability activity showed a decrease. These metrics indicate that the number of vulnerabilities impacting multiple products was decreased, while new vulnerabilities impacting specific products increased. Ultimately for security teams, this means an increase in risk and patch management activity, further complicated by the growing number of virtual and cloud system management and providers. Despite the growing number of vulnerabilities reported, Cisco and other security organizations, continue to report that the major breaches, compromises, and attacks do not usually target or exploit most of these new vulnerabilities, but focus on exploiting users and user errors, and common widely known vulnerabilities such as SQL injection attacks, flooding type denial of service attacks, and cross site scripting vulnerabilities. The other area of significant threat activity is older vulnerabilities that are exploited using attack and exploit toolkits, such as Java vulnerabilities that have updates available. IntelliShield published 227 events last week: 56 new events and 171 updated events. Of the 227 events, 181 were Vulnerability Alerts, eight were Security Activity Bulletins, 10 were Security Issue Alerts, 27 were Threat Outbreak Alerts, and one was a Cyber Risk Report. The alert publication totals are as follows: Weekly Alert Totals
2012 Monthly Alert Totals
Previous Alerts That Still Represent Significant RiskMicrosoft Windows Media Player MIDI File Processing Arbitrary Code Execution Vulnerability Apache HTTP Server Reverse Proxy Rewrite URL Validation Vulnerability Multiple Products Hash Collisions Denial of Service Vulnerability OpenSSL Datagram Transport Layer Security Plaintext Recovery Issue Oracle Java Applet Rhino Script Engine Arbitrary Code Execution Vulnerability Oracle Java SE Critical Patch Update October 2011 Apache HTTP Server Overlapping Ranges Denial of Service Vulnerability Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability Oracle Critical Patch Update January 2012 ISC BIND Recursive Query Processing Denial of Service Vulnerability Microsoft Windows TrueType Font Parsing Remote Code Execution Vulnerability PhysicalSecuring The Super Bowl using 21st Century TechnologyIndianapolis, Indiana has gone to extreme financial and technical lengths in an effort to make the 2012 edition of the Super Bowl (Super Bowl XLVI) the most secure ever. In addition to the use of iPhones, iPads, Gamma ray scanners, and night vision cameras Indianapolis and Marion County has invested $18 million in publicly financed bonds to produce a Regional Operations Center (ROC) which will serve as the centerpiece of security for the Super Bowl. LegalTourists Refused Entry to United States Based on Twitter ContentTwo tourists were detained, questioned and subsequently deported by the U.S. Department of Homeland Security (DHS) as a result of comments posted on Twitter by one of the two. The tweets in question alleged that the two were going to "destroy America" and tamper with the grave of Marilyn Monroe. During questioning by the DHS, the pair stated that 'destroy' was British slang for having fun and that the other tweet referred to a quote from the American comedy show 'Family Guy.' DHS officials went so far as to search their belongs for spades and shovels before releasing them onto a return flight to Britain. IntelliShield Analysis: The desire to monitor social media feeds by national security agencies including the U.S. is well known. The incident with the two tourists highlights legal questions raised by data flagged as threatening by the monitoring agencies. Beyond the challenges of determining actual intent in the context of cultural nuance and language, there is also the larger issue of whose laws ultimately apply. In this specific instance, it would seem that both Britain and the U.S. would have an interest in the incident. With the issue of free speech additionally considered, resolving any situation of this nature will prove complex if not outright political. Absent of any established precedents upon which agencies can agree, persons using social media need to be mindful that their content could be considered threatening or offensive, particularly if they plan to travel to locations where the laws and cultural idioms differ from their own. TrustTwitter Censorship and TransparencyTwitter has become very transparent in its operations regarding DMCA and removal of content based on requests, posting that information and their responses publicly, and has now announced the country-by-country policy, to the ire of many activists and persons in more tightly censored countries. Twitter has clarified and explained its position on the policy, but many are countering it as censorship of the Internet. IntelliShield Analysis: Twitter has grown to a site which processes over a billion tweets per day. Twitter will continue to try and avoid legal risk and physical security risk to employees by selectively blocking tweets on a per-country basis. Freedom advocates are correctly pointing out the investment influence of Saudi billionaire Prince Alwaleed bin Talal; however, in the end Twitter's transparency should deflect criticism from freedom advocates. Universal Music Group and others who request the tweets be taken down should take the blame. DMCA Takedown requests have actually dropped since the Twitter policy change. Is this because of the transparency? Other entrants may fill the tweet void if there are wholesale changes. IdentityHow to Prevent Google from Tracking YouMany online users have communicated concerns regarding Google's new privacy policy set to go into effect on March 1, 2012. The concern is the potential misuse of personal information (including information sharing) by Google. This concern has many wondering how much information is being tracked by Google amongst other constituents (advertisers and marketers)? How much can they determine about a person? Who is tracking whom? Organizations such as the Electronic Frontier Foundation, in addition to programs and applications such as the Network Advertising Initiative's opt-out program, various browser extensions, add-ons, and apps including Google themselves, are available to aid in alleviating various facets of tracking. These techniques range vastly, from cookie deletion or non-storing to de-personalizing searches while also providing the ability to block (white list) or unblock individual sites. IntelliShield Analysis: The saga of convenience and meaningful concepts vs. security (specifically privacy in this case) continues. Years ago these very concepts were viewed as Web and Internet enhancements to the user experience. The continuing evolution of security and society's education on the matter continues to exacerbate the fear, uncertainty, and doubt (FUD) factor. There is always a proverbial flag to be raised in an attention grabbing fashion when one of the solutions offered is by the same company or organization that has a stake in the issue set forth. Does the organization truly mean well and simply want to provide the users the rightful experience and options they desire, or is there more at play? By the same token, the irony continues in that it only takes an instant (a seamless one at that) to gather such information and details on users (i.e. track them), yet the solutions are more inconvenient in that the users must download and install software and apps not to mention configure and specify options, requirements, and details for proper provisioning based on their needs. While the saga indeed continues, the fact that it is even a discussion and point of contention is proof positive that society's eyes and ears are open and the education curve in the security realm continues to grow. HumanThere was no significant activity in this category during the time period. GeopoliticalNew Censorship Policies by Social Media Sites Raise Hard QuestionsLast week, Google's Blogger service announced that it would block posts in countries where the content violates the laws of that country. According to a Q&A section on the Google website, the company is migrating to the use of country-code top-level domains (ccTLDs) in order to facilitate country-by-country management of content. The announcement is similar to a policy change late last month by Twitter. The microblogging site announced that it would reactively withhold content from users in a specific country, while keeping it available in the rest of the world. According to Twitter, followers will be informed when and where a tweet has been withheld. Twitter will also publicly record tweet removals, which will take place after company review. Activists and privacy advocates, including Amnesty International and the OpenNet Initiative were critical of the announcement. The policy was criticized in some articles as a turnabout from last spring, when activists in the Arab world used Twitter, among other communication methods, to organize protests, record the unfolding of events, and gather public and international support. IntelliShield Analysis: The announcements by Google and Twitter are probably less of a turnabout than an evolution, and one that information communications companies around the world may watch closely. Social media, propelled by globalization, has in its short lifespan clashed spectacularly with diverse cultures and government systems. Ultimately, multinational companies must abide by the laws of the countries in which they operate. These companies supporters argue that it may be preferable, both from a business perspective as well as a free-speech perspective, for a social media company to remain operational in a country and comply with censorship requests, than to be banned outright, as both Twitter and Google are in some countries. As these fundamental questions are debated, information specialists at multinational companies may want to prepare for possible vigilante attacks against corporate network infrastructure when new policies are announced, while brand protection specialists can expect to field head-on reputation challenges. Upcoming Security ActivityRSA Conference: February 27–March 2, 2012 Because of the potential for increased risk on multiple vectors, organizations' security teams should be aware of and consider making special preparations for the following, FreeBSD dates: Presidential Election in Russia: March 4, 2012 Additional InformationFor more information about the vulnerabilities contained in this report or the Cisco Security IntelliShield Alert Manager Service, please visit For information on obtaining a free trial of the Cisco Security IntelliShield Alert Manager Service, please visit This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
|||||||||||||||||||||||||||||||||||||||||||||||||
