McAfee: Data-theft attack hits oil industry

McAfee: data-theft attack hits oil industry

by Stephen Shankland (CNET News)

For years, companies in the oil and energy industry have been the victims of attempts to steal e-mail and other sensitive information from hackers believed to be in China, McAfee said yesterday.
The attacks, to which McAfee gave the sinister name "Night Dragon," penetrated company networks through Web servers, compromised desktop computers, bypassed safeguards by misusing administrative credentials, and used remote administration tools to obtain the information, the security firm said. McAfee and other security companies now have identified the method and can provide a defense,

DHS Best Practice for Remote Access Falls Short

DHS's Control Systems Security Program (CSSP) group recently released their best practice on securing remote access to trusted networks like control systems and their semi-trusted demilitarized zones (DMZ).  The best practice can be viewed by clicking here.  Unfortunately, if we maintain the "think like a hacker" mentality, this document still falls very short of expectations, and is not far off of the NIST guidance document produced in September 2010.

In order to provide a comprehensive defense-in-depth strategy for remote access that addresses both internal (company) and external (non-company or contract) personnel, the focus has to be expanded from just providing basic authentication and confidentiality.  The solution needs to address the health of the endpoint, as well as provide a mechanism to restrict access to the trusted system once access is granted.

February Issue of Hakin9: Network Security

Click here to view the February issue.

Hakin9 has released their February Free Issue of Hakin9 Magazine. This month the magazine has articles focused in Network Security.

Stuxnet Demonstration Videos now available on YouTube

Due to the success of the demonstration videos that I produced on the Stuxnet worm, I have posted them on YouTube for the general public to view including relevant keywords. The links for the videos that have been produced to date are as follows:

Part 1: Stuxnet Introduction, Installation and Infection
http://www.youtube.com/watch?v=sEfqtET13SY

Part 2: Stuxnet Mitigation: Using Software Restriction Policies
http://www.youtube.com/watch?v=YjlShzQEWOo

Immunity Releases CANVAS 6.66

This release should be promising, as it provides updates to my personal favorite exploits that revolve around the SMB services on Windows hosts using port 445.

Bandolier Baselines: Windows 7 and 2008 Server

The use of a vulnerability scanner in assessing the overall security posture of an integrated ICS is critical no more than ever. A common misconception is that these scanners will not detect ICS-related vulnerabilities like those used on the recent Stuxnet attack, and that these scans can often cause ICS equipment to fail. These misconceptions are in fact, quite false. Digital Bond has provided some very good guidance on the "proper" use of the Nessus vulnerability scanner within ICS environment. As for the comment on vulnerabilities ... well this is just because those individuals do not realize the power and flexiblity of perform ICS scans and audits using the authenticated scan features of Nessus, coupled with the use of specialized Nessus audit files.

New York Times: Stuxnet Worm Used Against Iran Was Tested in Israel

Normally, I would not copy-and-paste an entire article in this blog, but this article provides views and references on Stuxnet that is worthy or retaining. Enjoy!

(Click here to download the referenced presentation given by Siemens and Idaho National Lab (INL) during the Siemens Automation Summit Users Conference at Chicago's Navy Pier in 2008.)