Leverage Vulnerability Assessments within Symantec Website Security SSL Certificates

Our online world is rife with shadowy creatures; it’s riddled with crime organizations, activist groups, government entities, and lone hackers. Why they breach our data can boil down to a few things; greed, ideological dissent, and their desire to publicly embarrass their targets. In 2011, high-profile attacks on various Certificate Authorities threatened the systems that sustain trust in the internet itself.  These attacks highlighted the need for Symantec to continue to harden their defenses and develop even stronger security procedures and policies.

The Website Security Internet Threat Report, published in May 2012, reported that in 2011 the Symantec website security malware scanning service scanned over 8.2 Billion URLs for malware infection. Approximately 1 in 156 unique websites were found to contain malware. The struggle to preserve IT security for your client accounts is a 24/7 job, and your strategy needs to be comprehensive and focused. Where website malware scanning finds malware infection fast and helps you eliminate it, website vulnerability assessments are a proactive measure to prevent hacks in the first place. They enable you to proactively identify weaknesses in your website that bad actors are most likely to use to attack you. Vulnerability assessment services identify and guide resolutions to the most common and highest risk exposure points like SQL Injection and Cross Site Scripting (XSS). Symantec's vulnerability assessment identified critical vulnerabilities on 50% of websites scanned in a Symantec Assessment Preview Program conducted in August 2011.

In the 2012 Verizon Data Breach Investigation Report, 79% of victims were targets of opportunity. Of these, 96% of the attacks were simple, well known or published vulnerabilities. Meaning most of these businesses were attacked because they possessed easily exploitable weaknesses. Don’t leave your clients’ front door open.

Symantec Secure Site Pro with Extended Validation (EV), Secure Site with EV, and Secure Site Pro SSL Certificates carry the Norton™ Secured Seal, the most recognized trust mark on the Internet** and include vulnerability assessment at no cost for your clients. The targeted scan helps quickly identify and take action against the most common exploitable weaknesses that create the biggest risk to your customer’s business operations. Scans done automatically on a weekly basis can check for vulnerabilities on public-facing Web pages, Web-based applications, server software and network ports. Actionable reports identify both critical vulnerabilities that should be investigated immediately as well as informational items that pose a lower risk. You and your clients then have an option to rescan the websites to confirm that the vulnerabilities have been fixed. In addition, Symantec maintains one of the world’s most comprehensive vulnerability databases, currently consisting of more than 47,662 recorded vulnerabilities (spanning more than two decades) from over 15,967 vendors representing over 40,006 products.

Neglecting to perform frequent vulnerability checks puts your customers’ websites, their clients, and their business at risk by leaving the door open to hackers. Studies show that the average cost per incident of a data breach in the United States is $7.2 million, with one of the largest breaches costing $35.3 million to resolve.*

The shadowy creatures that infiltrate security vulnerabilities are not going away; they will continue to refine their attacks against your customers. Your clients need tools that allow them to continue to do business safely online. They want answers and look to you, their trusted advisor, for the right solution. Symantec Secure Site Pro with Extended Validation (EV), Secure Site with EV, and Secure Site Pro SSL Certificates are the tools they need to stay protected. Symantec vulnerability assessment help reduces the cost and complexity of vulnerability management, and it’s a solid starting point for your clients’ organizations that want to quickly assess their security standing. Symantec SSL certificates vulnerability assessments are also ideal for your clients' organizations that already use a compliance vulnerability scanning solution such as those for PCI, and need a complementary solution to cross-check the results of their scan for an added layer of security. When used in combination with Symantec SSL Certificates and daily website malware scan, vulnerability assessments help you to secure your clients' websites and protect their consumers.

Source : Symantec.com

SSL for Apps

SSL/TLS is technology that is critical for securing communications. The challenge facing the SSL ecosystem today is how it is being implemented and used. Several University researchers have recently published reports indicating errors and shortcomings in non-browser applications that act as the client of an SSL/TLS connection. These issues result from flawed implementations of SSL in the applications or in SDKs or APIs used by them. SSL Client non-browser applications should follow these best practices to ensure the high level of authentication, confidentiality and integrity promised by SSL remain intact.

A Developer must perform a number of checks, and the most important is to cryptographically validate that the end-entity certificate presented by the server is the expected certificate, or was signed by an expected certificate. In other words, the Developer must create a trusted and validated chain of certificates starting with the end-entity certificate and linking up to a trusted root or intermediate certificate. Certificates in the chain can be returned in random order, with instances of more or even fewer certificates necessary to build a chain. If a self-signed root certificate is returned by the server, it should be ignored. By building a certificate chain, the developer cryptographically verifies that the chain from end-entity certificate through intermediates to root certificate are valid and can be trusted.

Think carefully about which certificates you will trust. It is good to require the server to return a particular end-entity SSL certificate, however your application can break when the certificate is renewed or replaced. Alternatively, require that the end-entity SSL certificate chains up to a particular trusted root, and is signed by an intermediate certificate with a specific Common Name.

The SSL/TLS protocol, when properly implemented, provides strong confidentiality and integrity for communications, as well as authentication of one or both endpoint identities. But it must be used according to standards and best practices. SSL Certificate has been the key to trust on the Internet for more than a decade, and it will continue to provide excellent protection against evolving cyber security threats.

Some Android apps have serious SSL vulnerabilities, researchers say

A team of researchers from two German universities has released a study asserting that many of the most popular free apps available through the Google Play store may be vulnerable to man-in-the-middle attacks -- seriously threatening user privacy.

RELATED: The 10 most common mobile security problems and how you can fight them

The researchers, from the Universities of Hannover and Marburg, studied the 13,500 most popular free apps on the Play store for SSL and TLS vulnerabilities. They found that 1,074 of the applications "contain SSL specific code that either accepts all certificates or all hostnames for a certificate and thus are potentially vulnerable to MITM attacks," according to a summary posted online.

Additionally, the scientists performed a manual audit of 100 apps for a more definitive look at potential security issues, finding that 41 were open to man-in-the-middle attacks because of SSL vulnerabilities. They said that the vulnerable apps could be exploited, allowing an attacker to steal highly sensitive usernames and passwords for Facebook, WordPress, Twitter, Google, Yahoo and even online banking accounts, among others.

Similar vulnerabilities, the team added, could be used to manipulate antivirus software on the phone, changing definitions to include benign apps or ensure that malicious ones are ignored.

"The cumulative install base of the apps with confirmed vulnerabilities against MITM attacks lies between 39.5 million and 185 million users, according to Google's Play Market. Actually Google's Play Market does not give a precise number of installs, instead giving a range. The actual number is likely to be larger, since alternative app markets for Android also contribute to the install base," the researchers wrote.

According to the H-Online, the team plans to make the code analysis tool it developed for the research public "in the near future."

Source:networkworld.com

Adobe Revokes Certificates Following Server Compromise

Adobe is in the process of revoking certain digital certificates after discovering two malicious utilities signed by valid Adobe certs. 

Adobe's senior director of security Brad Arkin, wrote in a blog post that attackers had compromised an Adobe build server (and not the certificates themselves) that was able to make code signing requests to Adobe's actual code signing service.

The breach occurred on July 10, so any certs signed with the impacted key from then until October 4 will be revoked, Arkin wrote.  

Adobe Downplays Impact
"This only affects the Adobe software signed with the impacted certificate that runs on the Windows platform and three Adobe AIR applications [Adobe Muse, Adobe Story AIR, and Acrobat.com] that run on both Windows and Macintosh. The revocation does not impact any other Adobe software for Macintosh or other platforms," he said. 

So far, Adobe has found only two malicious utilities, pwdump7 v7.1 and myGeeksmail.dll, bearing the certificates. Adobe told Securityweek that "the evidence indicates that the certificate was not used to sign widespread malware." 

The Story's Not Over, Security Experts Say
But although the current scope is small, some security experts warn that the impact could be huge.

Kaspersky's Roel Schouwenberg questioned why Adobe had backdated the cert revocation to July 10, when the two malicious files were signed two weeks later.

"Is Adobe 100 percent confident no other malicious files were signed?" he asked. "We should view this as along the same lines as the RSA attack."

Furthermore, he said, no one knows who the attackers are really targetting. "So far nothing suggests that Adobe was the real target."

F-Secure's Sean Sullivan agreed that although "there's definitely no need to panic at this point" about getting infected by a stolen Adobe signature, we shouldn't move on too quickly.

"Being the build server, it makes one wonder if any developer computers have been compromised to allow code to be injected into Adobe's apps. Injecting a backdoor into Adobe's apps would be so much more valuable than spoofing its cert," he said.

In a statement, Paul Zimski of Lumension said that with the right certificates an attacker "could theoretically impersonate a legitimate software update, and spread malware payloads through these mechanisms."

"The installed software is going to think its downloading a valid update, but it’s actually a false update signed with a fraudulent, but real certificate. I’m not saying that’s what was done here, but this is the Holy Grail of what could happen."

The issue now, Zimski said, is where the attackers are going next.

Similarly Wes Miller, research VP at Directions on Microsoft, said the fact that attackers now have code signing certificate for code "from one of the most pervasive companies on the planet, and one that is constantly patching" means it will take quite a bit of time for Adobe to revoke the certificates on a global level. And in the meantime, "how large of a threat vector does this pose"

Adobe posted the malicious utilities on the Microsoft Active Protection Program (MAPP) so security vendors could detect and block them. At the moment, using an up-to-date anti-virus is your best bet, Schouwenberg said. 

Source : securitywatch.pcmag.com

PRESIDENT OBAMA URGED TO ISSUE CYBERSECURITY ORDER

U.S. president Barack Obama has been called upon to issue an executive order to improve the nation's computer and website security practices. Senate Intelligence Chairwoman Dianne Feinstein of California wrote an open letter to the president that expressed concerns over cybersecurity legislation efforts, predicting that effective legislation is not likely to pass within the next year.

"Therefore, I believe the time has come for you to use your full authority to protect the U.S. economy and the networks we depend on from future cyber attack," Feinstein wrote. "While an Executive Order cannot convey protection from liability that private sector companies may face, your administration can issue cybersecurity standards and provide technical assistance to companies willing to take voluntary steps to improve their security. You can also direct the Intelligence Community and the Department of Homeland Security to provide as much information as possible to the private sector about cyber threats, including classified information."

A recent article from The New American pointed out this isn't the only time the Obama administration has been called to action. Senator Jay Rockefeller of West Virginia wrote a similar letter to the president earlier this month. White House representatives said that the administration considered issuing an executive order after the Cybersecurity Act of 2012 failed to pass in the Senate.

Although the U.S. government has made several attempts to pass legislation enhancing communication between the private and public sector, those efforts have come under heavy criticism from security experts. According to a CIO blog post written earlier this month, experts said previous cybersecurity bills did not address core issues.

The article highlighted comments from Jason Lewis, chief scientist at Lookingglass Cyber Solutions, who said the problem with the bill was accountability. Voluntary guidelines such as those outlined by CISPA are not enough to protect critical infrastructure, according to Lewis. An effective cybersecurity solution would be painful for everyone, legislators and businesses included.

"If the law stated that companies involved in security incidents had to shut down their business until they could prove they had addressed the issues, the number of breaches would be low and the level of security across all sectors would improve dramatically," Lewis said.

Lewis added that organizations responsible for managing critical infrastructure would need help upgrading their technology infrastructures and implementing best-practice solutions. Making improvements to these systems without hindering operations can be costly, but the first step would be to hold organizations accountable for security.

Source: thawte.com

New Ways to Force Browsers to be Safe

HTTPS is old (it was devised in 1994 by Netscape for Navigator), but it has always been seen as optional for most sites. That is changing, as the number of real-world abuses of users on the web increases. Using HTTPS makes safe browsing much easier. 2 developments in web technology make it easier to use HTTPS more often. One is a client-side technology, the other a new server-client standard.

Many sites support HTTPS but don't default to it. In order to help users invoke HTTPS on the site, the EFF (Electronic Frontier Foundation) and the Tor Project created HTTPS Everywhere, a Firefox add-on which reviews all HTTP requests from the browser to sites on a whitelist and changes them to appropriate HTTPS requests. HTTPS Everywhere maintains rules for over 1000 sites on the whitelist.

There are some downsides to HTTPS Everywhere, starting with the fact that it only works with Firefox. Other browsers, such as Google Chrome, don't support the features (mainly request rewriting) that HTTPS Everywhere needs. This may change in the future. The other problem with the HTTPS Everywhere approach is that the maintainers of it need to keep up with the zillions of sites on the Internet as opposed to having a generic solution.

HSTS (HTTP Strict Transport Security) goes at the problem in a different way. It is a standard through which web sites can tell clients (mainly browsers) that they will only support HTTPS communications.
If a client makes an HTTP request and HSTS is enabled on the server, the server responds with a special header 'Strict-Transport-Security' and a 'max-age' parameter specifying the number of seconds during which the client may only reconnect over HTTPS. While the initial HTTP request is unprotected, the client should know to use only secure communications thereafter.

HSTS has been supported in Google Chrome and Firefox since version 4 of each browser. Many web sites, including PayPal and a number of Google subdomains (chrome.google.com, checkout.google.com, etc.), support it.

In the long run, standards like HSTS are a better solution than hacks like HTTPS Everywhere. Currently Internet Explorer has no support for either and I see no indication that Microsoft plans to support them (or that the EFF is interested in supporting Internet Explorer for that matter).

Source: pcmag.com

Lessons Learnt From FinFisher Mobile Spyware

FinFisher, a controversial spyware toolkit being used by oppressive regimes to track activists, can also take over smartphones, researchers unveiled on Wednesday.  

Earlier this year, Bahraini activists sent U.S.-based researchers samples of computer spyware that was being delivered through spoofed emails. When downloaded onto Windows systems, the spyware would record Skype calls, copy emails, take screenshots, capture keystrokes, and send the data to remote servers (command and control centers, or C&C). So far, with the help of Rapid7, C&Cs have been found in 15 countries across five continents, including the United States, Australia, Singapore, and Bahrain. For most cases it's unclear if the governments of these countries are manning the servers or if they're just intermediaries. 

The researchers, led by Citizen Lab, identified the spyware as part of the FinFisher toolkit sold by UK-based Gamma International. Gamma markets the products as software to help governments and law enforcement agencies capture criminals, but advocates say it is being used by oppressive governments to clamp down on activists without criminal records. 

"You're Carrying a Potential Wire Tap"

Shortly after Bloomberg broke the story about the PC version of Finfisher, samples of Gamma's mobile spyware, called FinSpy Mobile, were sent to researchers.

FinSpy Mobile has even more functionality: it monitors calls, texts, WhatsApp messages, and emails, captures keystrokes, steals contact lists, turns on the device microphone to record ambient sounds, and tracks owners by GPS. Citizen Lab posted a pretty thorough overview of how the Trojan works on iPhones, Androids, BlackBerries, Windows Mobiles, and Symbian devices. 

Like the PC variant, FinSpy Mobile requires some sort of human interaction to infect devices. Although Citizen Lab hasn't confirmed seeing actual delivery methods, most likely they are being distributed through Trojanized, legitimate-looking apps attached to text messages and emails. 

Bill Marczak, a computer science doctoral candidate at the University of California Berkeley who has been co-leading the research into Finfisher, is more worried about the mobile than the PC spyware. 

"What scares me more is the possibility of mobile phone Trojans," Marczak told Security Watch. "Sure I've got my computer in my room, but my mobile phone follows me everywhere I go. It always knows my location, it has my contacts, email addresses, texts, Whatsapp conversations. It has a mic," he said. "You carry your phone everywhere and don’t even realize you're carrying a potential wire tap."

The Takeaway For You and Me

For now, FinSpy Mobile isn't your every day consumer security concern, as it only appears to be used in highly-targeted attacks on activists living in oppressive regimes.

In a blog post on Thursday, ESET researcher Cameron Camp wrote that Finfisher hasn't been seen in large-scale industrial attacks, but rather, in limited, highly targeted attacks. "Obviously, if your company is doing business in the Middle East you are already on high alert for attacks of this type," he wrote. Bigger picture repercussions, like the potential spread of FinSpy Mobile to the masses, or who Gamma International should be allowed to sell its products to, are another discussion altogether. 

That said, the research does present some useful lessons for consumers. 

The first one is dead obvious for most security-conscious smartphone owners: don't install apps from untrusted sources.

Will installing an antivirus app help? Sort of. According to Marczak, "As we saw with respect to the desktop version of Finfisher, antivirus alone isn't enough, as it bypassed antivirus scans." By now most leading antivirus providers have updated their signatures to include FinSpy, but that wouldn't have helped you, say, last week. 

That's why Marczak advises taking a few additional precautions:

1. Don't click on unknown links or download attachments if you aren't confident in the sender
2. Don't give your device to untrusted people who might secretly install the malware on yor device
3. For the same reason, password-protect your phone
4. Keep your OSes and apps patched (yes, that's a problem for Android) 
5. For Android owners, activate the built-in encryption, which requires a password to decrypt every time you turn on your device. 

Encrypted communication protocols are a good idea, but Marczak said they wouldn't protect you from this type of threat, since Finfisher infects devices before an encrypted call or text even leaves the device. "Skype likes to talk about how it encrypts communications, but Finspy intercepts calls before they even go out," he said.

Source:Pcmag.com