Random Accesses

Independent security researchers in California and researchers at the Centrum Wiskunde & Informatica (CWI) in the Netherlands, EPFL in Switzerland, and Eindhoven University of Technology (TU/e) in the Netherlands have found a weakness in the Internet digital certificate infrastructure that allows attackers to forge certificates that are fully trusted by all commonly used web browsers.

As a result of this weakness it is possible to impersonate secure websites and email servers and to perform virtually undetectable phishing attacks, implying that visiting secure websites is not as safe as it should be and is believed to be. By presenting their results at the 25C3 security congress in Berlin on the 30th of December, the experts hope to increase the adoption of more secure cryptographic standards on the Internet and therewith increase the safety of the internet,

Source: http://www.eurekalert.org/pub_releases/2008-12/epfd-euw123008.php

Dan Kaminsky, uncharacteristically, was not looking for bugs earlier this year when he happened upon a flaw at the core of the Internet. The security researcher was using his knowledge of Internet infrastructure to come up with a better way to stream videos to users.

Kaminsky's expertise is in the Internet's domain name system (DNS), the protocol responsible for matching websites' URLs with the numeric addresses of the servers that host them. The same content can be hosted by multiple servers with several addresses, and Kaminsky thought he had a great trick for directing users to the servers best able to handle their requests at any given moment.

It was only later, after talking casually about the idea with a friend, that Kaminsky realized his "trick" could completely break the security of the domain name system and, therefore, of the Internet itself..

Source: http://www.technologyreview.com/web/21537/page1/

Scientists may have found a new way to combat the most dangerous form of computer virus. The method automatically detects within minutes when an Internet worm has infected a computer network.
Network administrators can then isolate infected machines and hold them in quarantine for repairs.

Ness Shroff, Ohio Eminent Scholar in Networking and Communications at Ohio State University, and his colleagues describe their strategy in the current issue of IEEE Transactions on Dependable and Secure Computing.

They discovered how to contain the most virulent kind of worm: the kind that scans the Internet randomly, looking for vulnerable hosts to infect.

Source: http://www.sciencedaily.com/releases/2008/06/080604143419.htm

A team of academics from Princeton University has demonstrated a new class of computer attacks that compromise the contents of 'secure' memory systems, particularly in laptops.

The attacks overcome a broad set of security measures called 'disk encryption,' which are meant to secure information stored in a computer's permanent memory. The researchers cracked several widely used technologies, including Microsoft's BitLocker, Apple's FileVault and Linux's dm-crypt, and described the attacks in a paper and video published here.

The attacks are particularly effective against computers that are turned on but are locked, such as laptops that are in a 'sleep' or hibernation mode. One effective countermeasure is to turn a computer off entirely, though in some cases even this does not provide protection.

Source: http://www.theengineer.co.uk/Articles/304880/Computer+attack.htm

The battle fought in April and May this year employed not tanks or planes, but botnets and script kiddies. It nearly brought Estonia to its knees. We can learn a number of lessons from what Wired has referred to as “Web War One.” Could it happen here?

The triggering event happened on April 27. That's when the Estonian government moved a six-foot-tall statue named the Bronze Soldier from its prominent place in downtown Tallinn, the country’s capital, to a more remote cemetery. The statue commemorated the lives lost by the Soviet army when it drove the Nazis out of Estonia at the end of World War II.

The Estonians took great care when moving the statue; they even identified the unknown soldiers of the Red Army that made up part of the memorial. That didn’t prevent the Russian government (and only the Russian government) from protesting the relocation of the statue. It also didn’t prevent two days of rioting in Estonia that left 100 people injured and one person dead.

Those cleaning up after the real world riots found that the fight wasn’t over; it had merely shifted its front. Russian language chat rooms were enlisting script kiddies into a cyber army to punish Estonia for the intolerable affront of moving the memorial. After whipping readers to a fever pitch with words, many posts called them to action: “You do not agree with the policy of eSStonia??? May think you have no influence on the situation??? You CAN have it on the Internet!” read one post, according to Wired. These posts included precise instructions for launching ping attacks on specific Estonian sites.

Source: http://webhosting.devshed.com/c/a/Web-Hosting-News/Estonia-Survives-Internets-First-Cyberwar/