Showing posts with label intrusion. Show all posts
Showing posts with label intrusion. Show all posts
Tuesday, August 16, 2011
Thoughts on the Operation Shady Rat
Labels:
Anonymous,
antisec,
Cyber Espionage,
cyber terrorism,
hackers,
information insemination,
intrusion,
Lulzsec,
McAfee,
Operation Shady Rat,
rootcon philippines
Let it be known that the year 2011 is best described as the Year of the Hackers. And I know, one way or another you will agree or disagree with me. But hey! The media publicized these sophisticated security attacks targeting CIA, US Senate, Sony, PBS, Philippine Congress and the list continues. All of these attacks are attributed to hacker groups such as AntiSec, Anonymous and LulzSec.
What is very surprising from these groups is that most of their members are teens just like Topiary who recently posted on bail.
These attacks and media whoring already existed in the past but it’s only now that it has been the center of attention and worst it gained a lot of followers on what will be their next target as most of them have their own social network page on Facebook and Twitter.
In other news, Dmitri Alperovitch, Vice President of Threat Research at the Cyber-Security Firm of McAfee recently posted a blog entitled “Revealed: Operation Shady Rat” which demystified a five year hacking campaign which infiltrated the computer systems of national governments, global corporations, oil companies, and other profit and non-profit organizations. The campaign which took down 72 targets, making it perhaps the largest concerted hacking attempt in history, McAfee said. Government agencies in India, South Korea, Taiwan, and the U.S. were also attacked, plus high-profile targets like the International Olympic Committee.
I have been quiet for a couple of days because of constant research of this unprecedented cyber-espionage campaign which was discovered in the year 2006 because of the logs which was discovered by McAfee. In fact, some people blame China and Russia behind this espionage but it should be noted that McAfee disclaimed that China or Russia is responsible for this and that they also declined to reveal the source where the “Shady RAT” came from.
I’m not really sure who suggested that China should be blamed for this but I think they blamed some of the Chinese hackers because of the recent information gathering they made. It is said that in the past years, they have stolen highly confidential information that is kept secret in supercomputers in the US. But the Chinese government denied its involvement of the said campaign.
Some people may also say that it’s the Russian government because of the unforgotten Cold War between the US but then again it is really unfair to point our fingers to Russia and China because of insufficient evidence against them. All countries are innocent until proven guilty.
I guess McAfee has unleashed a new media storm because of their discovery since 2006. Their rival company, Symantec also posted its own analysis of the campaign and was skeptical of its impact. "Is the attack described in Operation Shady RAT a truly advanced persistent threat? I would contend that it isn’t, especially when you consider the errors made in configuring the servers and the relatively non-sophisticated malware and techniques used in this case," Symantec's Hon Lau wrote in a blog post.
"Sure the people behind it are persistent but no more than the myriad of other malware groups out there such as Zeus, Tidserv, and others like them," said Lau.
Although, it is highly controversial and questionable why McAfee discovered this campaign before any antivirus company or government agency; but could it be possibly an excuse to put blame on China? That I’m not sure of and I lay my hands off regarding this case.
To our valuable readers, I’ll give you a room for your opinions and views regarding this campaign. If you ask me, I have 60% trusts on this revelation. Whether this is true or not, there are questions that will cloud up our minds. So are we ready for this cyber espionage and cyber terrorism?
Philippines is not included in the list but who knows?
About the Contributor:
Shipcode is an InfoSec enthusiast from Cebu. During his high school days he was just an ordinary script kiddie. He loves to search for web exploits and other issues concerning network / wireless security.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved.Designated trademarks, brands and articles are the property of their respective owners.
Monday, August 15, 2011
Do You Need Snort for Intrusion Detection?
If you haven't heard of Snort, you may be surprised at how much this system has to offer for FREE!
Snort has a proven track record, excellent performance and accuracy that will surely be around for a long term.
There are many products out there and some of them are rather expensive. Snort is an open source IDS (intrusion detection system) which is just as powerful and popular as any commercial product.
However, the big down side is that you don't have a customer support to help you out and you have to teach yourself on how to install, configure and maintain your IDS.
I know a former colleague of mine who has a good experience in using Snort. I'm not sure if he's available for an invitation to give a talk.
Well, if you're one of the good guys out there who loves to share your knowledge, then by all means contact us at info[at]rootcon[dot]org. We can have an informal meet-ups. After all, we are here to share and be part of ROOTCON community.
Stay Safe!
About the Contributor:
A self-confessed blogger minus the coffee. He maximizes his skills in consultancy, project management, professional networking, social media campaigns and very active in conceptualizing things. To date he already conducted several IT / Information Security events as his passion since 2007. Currently he's working as a Technical Support Specialist in a local company.
ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Sunday, July 31, 2011
BackTrack 5 R1 to be released on August 10th
Labels:
BackTrack,
crackers,
filipino hackers,
information security summit,
intrusion,
Linux,
pentesting
The BackTrack Team has announced that Backtrack 5 R1 (Release One) is set to be released on the 10th of August 2011.
I’m sure many of our infosec friends out there are already excited to download its new release on the said date. The update includes 100 bug fixes, package updates, and the addition of over 30 new tools and scripts.
BackTrack 5 will surely rock your ninja skills because it’s the most favored penetration testing linux distro; and once again it’s back in action.
The crew will also have a pre-release event of BackTrack 5 R1 at the BlackHat / Defcon Conference a few days earlier. Cool isn't?
“May the sauce be strong with you.” – BackTrack Crew
Way to go BackTrack Team!
For more info, just visit the BackTrack Official Website.
P.S.
I attached a spoofed video about Backtrack 4 but its thoughts are true.
So anyone out there who wants to master this tool and show off your skills on our next meet up?
Perhaps on ROOTCON 2012? Any volunteers? Email us at info[at]rootcon[dot]org. Thanks.
About the Contributor:
Shipcode is an InfoSec enthusiast from Cebu. During his high school days he was just an ordinary script kiddie. He loves to search for web exploits and other issues concerning network / wireless security.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved.Designated trademarks, brands and articles are the property of their respective owners.
Sunday, June 12, 2011
Outsourced Security on the Rise?
Labels:
hackers,
ids,
intrusion,
outsourced,
outsourced security,
security services
ROOTCON Company Tour
Target Company:
- Providers of Managed Security Services
With the recent wave of cyber attacks, providers of managed security services are beefing up firewall, intrusion-detection, and risk-assessment offerings.
With limited IT resources, companies prompted to outsource security tasks such as firewalls and heightened the need for around-the-clock monitoring and analysis.
As the bad guys get more sophisticated, so do tools such as intrusion detection devices and other resources required to combat attacks will increase.
Just because an IT administrator can configure a firewall, it doesn’t mean he can do diagnosis of IDS (Intrusion Detection Systems) data.
This company tour will also interview your company’s representative if you have a range of services to offer to the public such as customized intrusion detection, incident responses, server hardening, system configuration, firewall reviews, vulnerability scanning to name a few.
If you know of any companies who offer these kinds of services, do contact us at info[at]rootcon[dot]org and we’ll be glad to feature them here.
Humbly speaking, the Banking sector / industry should also take this into consideration. Imagine if somebody is transferring your money electronically to undisclosed bank account? (Movie sequence starts….)
Standing by….
Related Blog:
Pinoy Hacker’s Confession 2004
About the Contributor:
A self-confessed blogger minus the coffee. He maximizes his skills in consultancy, project management, professional networking, social media campaigns and very active in conceptualizing things. To date he already conducted several IT / Information Security events as his passion since 2007. Currently he's working as a Technical Support Specialist in a local company.
ROOTCON is managed by like minded InfoSec professionals across the Philippines.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Subscribe to:
Posts (Atom)
