Actus de la semaine [41/10]
Bonjour à tous 
La sélection des liens de la semaine. Pour ceux qui découvrent, et afin de repréciser l'intérêt de la démarche, il s'agit de recenser, via un filtre-Gof, arbitraire certes, l'actualité sécu grand public de la semaine, et les sujets généralistes du moment. Un petit peu en retard cette semaine 
Actus Sécurité Grand public
=> Stuxnet, révélations. Quand Zeus donne un coup de pouce à Deus. 11/10/2010. «Tandis que les medias fument le myrte et que s’opacifie le mystère Stuxnet, les experts prennent de la hauteur. Et que voit-t-on sur les cimes de l’Olympe informatique loin au dessus de la myrtologie et ses cultes impies ? Zeus bien sûr. Le dieu des botnets. Des millions d’ordinateurs infectés dans 196 pays, mais surtout aux USA où les grandes sociétés ont été visées. Quel rapport entre Zeus et Stuxnet ? (...).» Encore du Stuxnet. On n'a pas fini d'en entendre parler, avec tout ce que cela peut comporter d'infos pertinentes et de désinformations. Difficile pour le quidam comme nous de démêler le vrai du faux.
Source : http://nanojv.wordpress.com/2010/10/11/stuxnet-botnets-zeus-deus/
Billets en relation :
11/10/2010. SCADA, salades et escalades : http://owni.fr/2010/10/11/scada-salades-et-escalades/
14/10/2010. Stuxnet change de rive ? : http://si-vis.blogspot.com/2010/10/stuxnet-change-de-rive.html
=> Les sites de médias français, cible d'attaques DDoS. 11/10/2010. «Le désir de « tirer sur le messager » porteur de mauvaises nouvelles est bien connu. Dans le monde des médias en ligne, les sites d'actualités se font tirer dessus massivement au moyen d'attaques par déni de service (DDoS) destinées à de les faire tomber. C'est ainsi que la moitié des grands sites d'actualités présents sur le Net sont victimes de cyberattaques « politiquement » ciblées (...).»
=> Bilan 10èmes Assises à Monaco : un triomphe total. 12/10/2010. «Pour cette dixième édition, les Assises avaient mis les petits plats dans les grands avec l'intervention de grands patrons du secteur, Eugene Kaspersky, CEO de Kaspersky Lab, Enrique Salem, CEO de Symantec, ou encore Eva Chen, la passionnée PDG de Trend Micro. Cette 10ème édition a réuni plus de 1700 personnes dont des personnalités de la société civile comme Alex Türk (Président de la Cnil), le député Pierre Lasbordes, ou bien encore l’astronome Jean-François Clervoy, pour la SSI en environnement spatial (...).»
Billets en relation :
06/10/2010. Assises de la Sécurité 2010 : Après Stuxnet : http://www.cnis-mag.com/assises-de-la-securite-2010-apres-stuxnet.html
07/10/2010. Les gardiens de la sécurité face à l'éclatement du système d'information : http://www.journaldunet.com/solutions/securite/reportage-assises-de-la-securite-2010/
=> MSRT on Zbot, the botnet in a box. 12/10/2010. «This month, the MSRT team has added detection and removal for Zbot, one of the most widely known active botnets today. Although the malware itself is quite complex and varied, the technical acumen required to use and distribute it is actually quite low. Toolkits to create the malware are easily attainable and quite simple to use as the following screenshot shows (...).»
Source : http://blogs.technet.com/b/mmpc/archive/2010/10/12/msrt-on-zbot-the-botnet-in-a-box.aspx
=> Cybercrime Raiders. 12/10/2010. «He security was tight enough, but the raider knew exactly where the weak point in the system was. He had undergone special training to help him slip unnoticed through loopholes like these and infiltrate the network. The raider creates the loophole that lets others in — spies, thieves or secret agents, who then force the system to operate according to their bosses’ wishes. As long as the loophole stays open… (...).»
Source : http://www.securelist.com/en/analysis/204792142/Cybercrime_Raiders
=> HacKid - An Amazing Conference . 12/10/2010. «I’ve just returned home from Boston, having taken part in one of the most interesting, original and awesome conferences I’ve ever seen. Step up HacKid, a conference geared towards “providing an interactive, hands-on experience for kids and their parents which includes things like staying safe online, how the internet works, manipulating hardware / software for fun, meeting law enforcement, low impact martial arts, podcast creation, Makerbot building” and an awful lot more to boot
(...).»
Source : http://sunbeltblog.blogspot.com/2010/10/hackidcon-amazing-conference.html
Billets en relation :
12/10/2010. HacKid : http://www.hackid.org/content/
=> La Revue Défense n°147 consacre son grand dossier à la cybercriminalité. 12/10/2010. «Le numéro 147 de la revue bimestrielle Défense , publiée par l’Union des associations des auditeurs de l’Institut des hautes études de la Défense nationale, vient de paraître, avec la cybercriminalité pour thème central. Le rôle de la gendarmerie est en particulier abordé. Un article est également dédié à l’implication de la Direction centrale du renseignement intérieur (DCRI), dans la lutte contre la cybercriminalité. L’invité du grand entretien est le général Marc Watin-Augouard, Inspecteur général des armées-gendarmerie. Interrogé sur ce même thème, il défend notamment la nécessité de faire participer « tous les acteurs public et privés à la sécurité du cyberespace », pour permettre aux politiques publiques d’être efficaces dans ce domaine (...).»
Source : http://www.defense.gouv.fr/content/view/full/89948
=> Londres prend conscience des risques de cyberattaques. 13/10/2010. «Les services secrets britanniques envisagent de se doter d'une «capacité de dissuasion» sur Internet (...).» Actualité toujours à l'honneur cette semaine.
Billets en relation :
30/09/2010. Bruxelles doit se préparer : http://www.lefigaro.fr/flash-actu/2010/09/30/97001-20100930FILWWW00553-cyberattaque-bruxelles-doit-se-preparer.php
08/10/2010. La sécurité dans le cyberespace, un enjeu stratégique : http://www.sgdsn.gouv.fr/site_article106.html
13/10/2010. Vidéo sur la stratégie américaine en termes de cyberguerre : http://defense-jgp.blogspot.com/2010/10/une-petite-video-sur-la-strategie.html
14/10/2010. Les Etats-Unis renforcent leurs dispositifs contre les cyberattaques : http://www.lemonde.fr/technologies/article/2010/10/14/les-etats-unis-renforcent-leurs-dispositifs-contre-les-cyberattaques_1425914_651865.html
15/10/2010. Informations en vrac... : http://cidris-news.blogspot.com/2010/10/informations-en-vrac.html
16/10/2010. John Arquilla sur la cyberguerre : http://defense-jgp.blogspot.com/2010/10/john-arquilla-sur-la-cyberguerre.html
=> Un voleur de mot de passe pour Firefox. 13/10/2010. «C'est l'éditeur Webroot qui a annoncé avoir découvert ce logiciel espion qui, une fois avoir mis son nez dans le fichier nsLoginManagerPrompter.js de Firefox, communique les données sensibles et privées à un serveur extérieur (...).»
Source : http://www.zataz.com/reportage-virus/20732/Un-voleur-de-mot-de-passe-pour-Firefox.html
=> Announcing Microsoft Security Intelligence Report version 9. 13/10/2010. «Today, the 9th edition of the Microsoft Security Intelligence Report was released as Adrienne Hall, General Manager of Microsoft Trustworthy Computing Communications, gave her keynote at RSA Europe. This time around, we've done a few things differently. First off - we've dedicated this particular volume to the study of botnets and the role that they play in the malware world. You'll find a historical anthology of how botnets came to be along with modern-day examples, including the most prevalent families and differences in their geographical distribution (...).»
Billets en relation :
13/10/2010. Rapport sur les données de sécurité V9, en français [pdf] : http://download.microsoft.com/download/5/E/C/5ECE5EB1-50D0-45BB-B43C-273D626AB317/Microsoft_Security_Intelligence_Report_volume_9_Key_Findings_Summary_French.pdf
13/10/2010. Security Intelligence Report : http://www.microsoft.com/security/sir/default.aspx
13/10/2010. Les PC Zombies au cœur du cybercrime : http://www.globalsecuritymag.fr/Les-PC-Zombies-au-coeur-du,20101013,20067.html
=> La faille CSRF. 14/10/2010. «Voilà quelques temps que je n’ai pas posté d’article, j’ai donc décidé de revenir en force avec un lot d’article, expliquant diverses failles Web. Qu’est ce que le CSRF ? (...).»
Source : http://info2aaz.blogspot.com/2010/10/la-faille-csrf.html
Billets en relation :
13/10/2010. [POC] CSRF dans un BBcode : http://art.hackbbs.org/?p=261
=> Black Hat SE . 14/10/2010. «This Google TechTalk features Julien Sobrier of Zscaler discussing the tactics and techniques that spam gangs use in constructing their black hat SEO campaigns (...).»
Source : http://threatpost.com/en_us/blogs/black-hat-seo-101410
=> Adobe Flash, The Spy in Your Computer – Part 3. 15/10/2010. «In the first two parts (Part 1, Part 2) of this series I discussed some of the privacy issues associated with Flash and also explained the configuration options that Adobe offers. If you are willing to go through the hassle of creating an mms.cfg file and maintaining it then you really do have the ability to still use Flash and maintain some control, but it is not realistic to think that many people will do this (...).» Poursuite de la série initiée la semaine dernière.
Source : http://blog.eset.com/2010/10/14/adobe-flash-the-spy-in-your-computer-%E2%80%93-part-3
Billets en relation :
07/10/2010. Rappel Part 2 : http://blog.eset.com/2010/10/06/adobe-flash-the-spy-in-your-computer-%E2%80%93-part-2
07/10/2010. Rappel Part 1 : http://blog.eset.com/2010/10/06/adobe-flash-the-spy-in-your-computer-%E2%80%93-part-1
=> Don’t Get Infected By Zombies. 15/10/2010. «Today we had a peek inside an exploit kit known as the Zombie Infection Kit. This kit is not as widely used as some of the more popular kits such as Eleonore and Phoenix and compared to these other kits, Zombie is not really that sophisticated. However it does carry the usual range of exploits that have been effectively used in many other exploit tool kits. Potential victims are forced to visit Zombie’s exploit page when their browser loads an IFrame placed on a compromised websit (...).»
Source : http://labs.m86security.com/2010/10/don%E2%80%99t-get-infected-by-zombies/
=> La France : premier pays émetteur de spam en Europe, selon Sophos. 15/10/2010. «Sophos publie son enquête sur les douze principaux pays à partir desquels des campagnes de spam ont été émises au cours du troisième trimestre 2010. Avec 18,6% du spam émis dans le monde (contre 15,2% au trimestre précédent), les Etats-Unis poursuivent leur progression et sont désormais responsables d’un message indésirable sur cinq, presque 2,5 fois plus que l’Inde qui leur succède immédiatement (...).»
Source : http://www.globalsecuritymag.fr/La-France-premier-pays-emetteur-de,20101015,20107.html
Billets en relation :
14/10/2010. USA, your poorly protected PCs are polluting the world with spam : http://www.sophos.com/blogs/gc/g/2010/10/14/usa-poorly-protected-pcs
=> Les accès Wifi anglais insuffisament sécurisés. 16/10/2010. «Une société d'assurance a fait réaliser par un "hacker étique" des tests de sécurité sur environ 40.000 accès wifi présents dans les domiciles de nos amis d'outre-manche (...).»
Billets en relation :
13/10/2010. UK's wireless networks open to attack : http://www.cpp.co.uk/news/wireless-networks-open-to-attack/
14/10/2010. Ethical hacking : http://blog.cpp.co.uk/index.php/articles/view/ethical-hacking
=> Why is called... About malware naming. 17/10/2010. «About malware naming... (...).» Chae Jong Bin explique simplement par des bouts de code l'origine des noms attribués par les éditeurs sécu aux menaces.
Source : http://my.opera.com/cjbi/blog/
Actus Sécurité Confirmé(s)
=> Mapping a web browser to GPS coordinates via router XSS + Google Location Services without prompting the user. « Welcome. Here is a proof of concept on obtaining *accurate* GPS coordinates of a user sitting behind a web browser via router XSS. The router and web browser themselves contain NO geolocation/GPS data. This is also *not* IP based geolocation (...). »
Source : http://www.samy.pl/mapxss/
Billets en relation :
Source tweet sbz : http://www.twitter.com/sbrabez
=> EU Agency analysis of ‘Stuxnet’ malware: a paradigm shift in threats and Critical Information Infrastructure Protection. 07/10/2010. «The EU ‘cyber security’ Agency ENISA, i.e. the European Network and Information Security Agency, has produced an initial comment and brief, high level analysis of the recent ‘Stuxnet’ attacks; on its importance, and its technical implications for Europe. The Agency considers ‘Stuxnet’ a paradigm shift, and warns that similar attacks may occur. It argues that Europe should reconsider its protection measures for Critical Information Infrastructure Protection (CIIP) (...).»
=> MAEC Language Version 1.01 Now Available. 08/10/2010. «Version 1.01 of the MAEC Language is now available on the Releases page on the MAEC Web site. This is the initial release of the MAEC Language, and is focused on standardizing results of dynamic malware analysis engines (...).»
Source : http://maec.mitre.org/news/
Billets en relation :
10/10/2010. Source Tweet ToolsWatch : http://twitter.com/ToolsWatch/status/26929745919
=> Windows kernel2user transitions one more time. 10/10/2010. «Before I start talking (writing?) over the real subject of this short post, I would like to make some interesting announcements (...).»
Source : http://j00ru.vexillium.org/?p=641
Billets en relation :
10/10/2010. Source Tweet Malwarescene : http://twitter.com/MalwareScene/statuses/26940076821
=> New threat set to dethrone Zeus. 11/10/2010. «The position of the infamous Zeus trojan may be usurped by a new upstart that is unknown to four of the six largest antivirus companies and has already been used by a criminal group to empty bank accounts across Europe and America (...).»
Source : http://www.zdnet.com.au/new-threat-set-to-dethrone-zeus-339306495.htm
Billets en relation :
06/10/2010. Rappel : Carberp – a new Trojan in the making : http://www.trustdefender.com/blog/2010/10/06/carberp-%E2%80%93-a-new-trojan-in-the-making/
11/10/2010. Trojan Carberp : http://www.pornosecurity.org/blog/trojan_carberp
11/10/2010. Source tweet GadixCRK : http://twitter.com/GadixCRK/status/27033103764
14/10/2010. CARBERP Trojan Steals Information : http://blog.trendmicro.com/carberp-trojan-steals-information/
=> Password Patterns . 11/10/2010. «In December 2009, a critical data breach in the Internet has been experienced. Around 32 million user passwords of rockyou.com web portal were stolen by a hacker which had used SQL injection for his attack. He got all passwords and made them anonymously (i.e. without usernames) available in the Internet to download (...).»
Source : http://www.architectingsecurity.com/2010/09/11/password-patterns/
Billets en relation :
17/10/2010. Source tweet petrucci_2005 : http://twitter.com/petrucci_2005/status/27587515147
=> Eleonore Exploits Pack's Unescape Cipher . 13/10/2010. «In this blog post, we will cover Eleonore Exploits Pack's obfuscation, which is meant to conceal the true intent of the source code that the exploit page serves up. Obfuscation is one of a few ways that attack kits try to protect themselves and their malicious intent. The obfuscation of their code discourages analysis because it looks too difficult to handle. With a little bit of patience and time, we can learn to deobfuscate the content and fully understand the intent of the attack code. The kit also protects itself by only serving the exploit page once per visitor, identifying visitors by IP address. This may seem counterintuitive, since it does limit the exposure of the attack, but it also protects the kit from analysis because researchers only have one shot at obtaining the payload (...).»
=> My smashing improved . 13/10/2010. «In this brief post I will show you the improvements I have made on “Smashing the stack in 2010?. First of all I have improved the bibliography in order to help the readers to learn and delve into as well as to give the credits to others researchers for their works. Then I have rewritten the section “write an exploit” in my Windows part because of lack of clarity in the previous version, now I hope it is suitable to a newbie. Last but not least I have added a new part called “Real Scenario” in which we are going to analyze real exploits, in fact it is important – to gain a real and useful knowledge – to be able to analyze a real attack even it can be complex and sophisticated (...).»
Source : http://5d4a.wordpress.com/2010/10/13/my-smashing-improved/
Billets en relation :
14/10/2010. Source tweet emd3l : http://twitter.com/emd3l/status/27276622971
17/10/2010. Smashing the stack in 2010 [pdf] : http://mariano-graziano.llab.it/docs/stsi2010.pdf
=> RSACE2010 Podcast: AND-201: When A Billion Laughs Are Not So Funny: Application-Level Denial of Service. 13/10/2010. «Bryan Sullivan, Senior Security Program Manager, Microsoft Corporation. Everyone understands the danger of Denial of Service attacks, but proper defence must go beyond the network layer into the applications themselves. Unless performed correctly, simple tasks such as parsing XML or validating input with regular expressions can open applications to dangerous asymmetric DoS vulnerabilities. This session will describe how to find and fix these common errors (...).»
Billets en relation :
13/10/2010. Source tweet malwarescene : http://twitter.com/MalwareScene/statuses/27221864563
=> Hacking a Fix. 13/10/2010. «There have been many discussions, rants, and commentary on what it means to be a hacker. Many of us in the security community use the term in its original intended use and despise the way the media and popular culture portrays it. Hacking to many of us is about learning and using that knowledge to make improvements upon software and hardware. I have previously posted about the resourcefulness of people that define themselves as hackers. My coding skills are certainly not L337 and I am certainly not dropping 0-day but what I am very skilled at is understanding technical issues and finding unique solutions to them. This post is on one such issue and my obsession to fix it (...).»
Source : http://securitybraindump.blogspot.com/2010/10/hacking-fix.html
Billets en relation :
13/10/2010. Source tweet malwarescene : http://twitter.com/MalwareScene/statuses/27239442628
=> ZeuS Busts Bring Botnet Beatdown?. 14/10/2010. «Authorities in the United States, United Kingdom and Ukraine launched a series of law enforcement sweeps beginning late last month against some of the world’s most notorious gangs running botnets powered by ZeuS, a powerful password-stealing Trojan horse program. ZeuS botnet activity worldwide took a major hit almost immediately thereafter, but it appears to be already on the rebound, according to one prominent ZeuS-watching site (...).»
Source : http://krebsonsecurity.com/2010/10/zeus-busts-bring-botnet-beatdown/
Billets en relation :
13/10/2010. Underground Ripples : http://blogs.rsa.com/rivner/underground-ripples/
=> Murofet: Domain Generation ala Conficker . 14/10/2010. «Recently a new piece of malware has emerged that operates similarly to Conficker. This malware, named Murofet, is similar to Conficker in that it generates thousands of domains daily that it then contacts for updates (...).»
Billets en relation :
14/10/2010. Domain Name Generator for Murofet : http://blog.threatexpert.com/2010/10/domain-name-generator-for-murofet.html
15/10/2010. New Malware Murofet Following Conficker's Lead : http://threatpost.com/en_us/blogs/new-malware-murofet-following-confickers-lead-101510
15/10/2010. Murofet, Zeus++ or just Zeus 2.1? : http://www.honeynet.org/node/579
=> Security Landscape: Do-it-yourself crimeware botnet kits Podcast. 14/10/2010. «On this episode of Security Landscape, Derek Manky from Fortinet and Keith Shaw discuss the latest security threats seen worldwide. This includes the rise of do-it-yourself crimeware botnet kits, as well as the possibility of another iPhone jailbreak vulnerability on Oct. 10, 2010 (...).»
Source : http://www.networkworld.com/podcasts/panorama/2010/100810-securitylandscape-sept2010.html
Billets en relation :
14/10/2010. Source tweet malwarescene : http://twitter.com/MalwareScene/statuses/27364811200
=> Stuxnet Paper Revision. 15/10/2010. «The Stuxnet analysis “Stuxnet under the Microscope” we published a few weeks ago has been updated, as promised, to include some information about the recently-patched win32k.sys vulnerability (MS10-073, or CVE-2010-2743), and just a little about the Task Scheduler issue that hasn't been patched yet (...).»
Source : http://blog.eset.com/2010/10/15/stuxnet-paper-revision
Billets en relation :
15/10/2010. Win32k.sys: A Patched Stuxnet Exploit : http://blog.eset.com/2010/10/15/win32k-sys-about-the-patched-stuxnet-exploit
15/10/2010. Stuxnet Under the Microscope - Revision 1.1 : http://www.eset.com/resources/white-papers/Stuxnet_Under_the_Microscope.pdf
16/10/2010. Symantec’s Virus Bulletin presentation : http://www.slideshare.net/symantec/stuxnet
La suite en commentaires.
2 Commentaires
Commentaires recommandés
Rejoindre la conversation
Vous publiez en tant qu’invité. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.