Research Highlights Top 25 Programming Errors

A group of renowned security researchers led by the MITRE Corporation, also including the National Cyber Security Division (US Department of Homeland Security) and the SANS Institute, have updated their one-year-old findings, and republished the list of the top 25 most dangerous programming errors.

The list is broken down into three major categories as follows: Insecure interaction between components, Risky resource management and Porous Defenses. The entire list of programming errors is comprised of:

1. Failure to Preserve Web Page Structure ('Cross-site Scripting')
2. Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection')
3. Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
4. Cross-Site Request Forgery (CSRF)
5. Improper Access Control (Authorization)
6. Reliance on Untrusted Inputs in a Security Decision
7. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
8. Unrestricted Upload of File with Dangerous Type
9. Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection')
10. Missing Encryption of Sensitive Data
11. Use of Hard-coded Credentials
12. Buffer Access with Incorrect Length Value
13. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion')
14. Improper Validation of Array Index
15. Improper Check for Unusual or Exceptional Conditions
16. Information Exposure Through an Error Message
17. Integer Overflow or Wraparound
18. Incorrect Calculation of Buffer Size
19. Missing Authentication for Critical Function
20. Download of Code Without Integrity Check
21. Incorrect Permission Assignment for Critical Resource
22. Allocation of Resources Without Limits or Throttling
23. URL Redirection to Untrusted Site ('Open Redirect')
24. Use of a Broken or Risky Cryptographic Algorithm
25. Race Condition.

The list was voted during a period of ten days by representatives of various organizations, the votes being cast for a vast category of metrics, the most important being critical importance and widespread prevalence. To avoid organizations being biased to one or more errors, only one vote per organization was allowed. The nominees list was then sorted based on the aggregate scores received by each error.

The authors didn't limit themselves to only listing these errors but went on record and encouraged customers to insert special security and application anti-hacking protection clauses in future contracts, providing a draft for those interested. The researchers' conclusions tend to blame in equal part the developers and IT educational institutes.

While few IT and programming courses really tackle the subject of product and code security, the main problem to the recent recorded hacks remains the programmer's reduced security knowledge base. The MITRE report tries to offer a solution by encouraging customers to contractually force either employees and freelancers into foul-proofing their code.

“As a customer, you have the power to influence vendors to provide more secure products by letting them know that security is important to you,” says the MITRE report. “Use the Top 25 to help set minimum expectations for due care by software vendors. Consider using the Top 25 as part of contract language during the software acquisition process.”

The complete report, with technical details, code samples, detection methods, references and interpretation guidance can be found on the MITRE page or the SANS Institute page.

New Banking Trojan Discovered in the Wild

New Banking Trojan Discovered in the Wild - Used to perform ACH and wire fraud - Softpedia

Researchers from Atlanta-based security vendor SecureWorks have discovered a new information-stealing trojan facilitating ACH and wire fraud. The trojan has all the capabilities of malware commonly used to steal money from SMBs and non-profits.

An unprecedented wave of Automated Clearing House (ACH) and wire fraud started in 2009, resulting in small and medium-sized companies, public institutions and non-profit organizations losing millions of dollars to cyber-criminals. The problem prompted the FBI and the American Bankers Association torecommend that online banking operations be performed from dedicated computers only.

These attacks start by infecting computers on an organization's network with the purpose of stealing online banking credentials. The Clampi and Zeus (Zbot) families of trojans have so far dominated this aspect of cyber-crime and positioned themselves as the leading information-stealing computer trojans.

However, it seems other groups are willing to challenge that supremacy, especially since antivirus products are getting better at generically detecting modified Clampi and Zeus variants, which significantly reduces their success rate. The trojan discovered by SecureWorks back in January, which was dubbed Bugat, appears to be one of these new competitors.

"In mid-January, the installer for Bugat had moderate coverage (20/40), according to VirusTotal. The most commonly identified name (Bredolab) corresponds to a family of trojan downloaders. However, its runtime behavior did not match what one would expect from Bredolab. The installed mspdb30.dll file had almost no AV recognition (2/41)," Jason Milletary, SecureWorks' technical director for malware analysis, explains on the company's research blog.

Bugat is capable of capturing information entered in Web forms, altering the content of targeted websites or stealing browser cookies, as well as FTP and POP3 credentials. Additionally, the malware can function as a SOCKS proxy server, upload files from the infected computer to a remote server or download and execute programs.

The trojan communicates with a command and control (C&C) server from where it receives instructions and updates to the list of financial websites it targets. This communication can be encrypted in order to thwart traffic inspection tools.

"The emergence of Bugat reinforces that there is a strong demand for new malware to commit financial credential theft and that ACH and wire fraud remains a profitable venture for criminals," Mr. Milletary concludes. Indeed, just last week, Symantec warned of a new Zeus-like crimeware toolkit called SpyEye.

Taiwan man dies after watching 'Avatar'

AFP: Taiwan man dies after watching 'Avatar':

"TAIPEI — A 42-year-old Taiwanese man with a history of high blood pressure has died of a stroke likely triggered by over-excitement from watching the blockbuster 'Avatar' in 3D, a doctor said Tuesday.

The man, identified only by his surname Kuo, started to feel unwell during the screening earlier this month in the northern city of Hsinchu and was taken to hospital.

Kuo, who suffered from hypertension, was unconscious when he arrived at the Nan Men General Hospital and a scan showed that his brain was haemorrhaging, emergency room doctor Peng Chin-chih said.

'It's likely that the over-excitement from watching the movie triggered his symptoms,' he told AFP.

Kuo died 11 days later from the brain haemorrhage, and the China Times newspaper said it was the first death linked to watching James Cameron's science-fiction epic 'Avatar'.

Film blogging sites have reported complaints of headaches, dizziness, nausea and blurry eyesight from viewers of 'Avatar' and other movies rich in 3D imagery."

McAfee Will Offer Free Six-Month Subscriptions to Facebook Users - McAfee becomes Facebook's main security service provider - Softpedia

McAfee Will Offer Free Six-Month Subscriptions to Facebook Users - McAfee becomes Facebook's main security service provider - Softpedia:

"Facebook and McAfee announced on January 13, 2009 a partnership through which over 350 million Facebook users will benefit at no cost of a free six-month subscription to McAfee's Internet Security Suite security software. After this six-month period, Facebook users will have the possibility to extend their license at a special discount price.


Besides the free software, Facebook users will benefit from a whole range of new tools built to enhance their and Facebook's security at the same time providing a safer and virus-free environment on the social networking platform.

Users who had their account infected or compromised now have the possibility to employ a new and innovative tool developed by Facebook and McAfee, which will help them re-secure their account. Custom McAfee technology will scan and clean the user's computer before allowing them to log on Facebook again. This tool incorporates McAfee technology and will be provided at no costs for the user.

Facebook has declined to financially capitalize on its users and will provide (alongside McAfee) a series of tutorials and educational materials to help them raise their security knowledge.

McAfee was chosen as the premiere software security provider after Facebook spent serious time on a review process of major security companies. Products like McAfee SiteAdvisor (website rating technology) and McAfee Active Protection (technology for almost instantly blocking known and unknown online threats) have been critical in the reviewing process.

It is unsure whether these products will be included in Facebook's new security measures aimed at detecting and blocking suspicious activities in real-time.

Regarding this topic, Jake Brill, Facebook representative and Project Manager in Facebook's Integrity Team, had this to say, “We invest in dedicated teams and advanced technical systems that detect and block suspicious behavior. When we find a message with a link to a fake login page or other malicious website, we prevent it from being sent and delete all instances of it from the site.” He added that “We also work with third parties to get malicious sites added to browser blacklists or removed completely.”

Users can learn more on this offer by visiting McAfee's Facebook page and clicking on the “Protect Your PC” tab.

Facebook has set up a Security Page for updates and tutorials on issues and topics concerning the site's security."

Aayirathil Oruvan - Review

Aayirathil oruvan (ஆயிரத்தில் ஒருவன்)

An another extra-ordinary movie by Selvaraghavan, The story starts with the Chola Dynasty… Last prince of Chola is taken away from the kingdom to save him from the Pandiya’s. Also with him they take the God Statue of the Pandiya’s.

The place where the Chola Prince is taken is a secret and also there are 7 major traps in the way. Andrea’s father Prathap pothan goes over and finds the Place but he gets disappeared. Then Reema Sen, Andrea, with military people and some porters, in which the Karthik is person who leads the porter’s gang, goes over to the place to find Prathap Pothan and the lost prince city. How they find the chola prince and Prathap pothan is the story & what happens to the Pandiyas Statue.

I was very much excited in watching the movie…. The first half goes on with lots of fun and excitement, the song ‘Oh Easa’ and ‘Un mela Asai’ are awesome and the picturing was excellent.

Second half totally changes the pace of the movie and there are lots of pure tamil conversations, which I very hard for us to understand. Performance of Parthiban, Reema Sen was excellent in the second half. Karthi rocks in the first half.

This movie is really a 1 in 1000 movie. No one can think like this… Must to watch... Also to be noted the movie contains all bad words in Tamil and English, also the movie can’t be enjoyed by all type of audience, mainly you can’t watch the movie with family for sure.

I liked the movie a lot… Except the last 20 mins which was little odd for the pace of the movie.

Pakistani National Response Center for Cyber Crimes Website Defaced

Pakistani National Response Center for Cyber Crimes Website Defaced - Hackers claim they downloaded the e-mail database too - Softpedia:

"The website of the Pakistani National Response Center for Cyber Crimes was defaced yesterday and hackers mocked the institution through a message on the first page. Furthermore, the attackers claim to have downloaded the database and emails stored on the server.

The National Response Center for Cyber Crimes (NR3C) is operated by the Federal Investigation Agency (FIA), Pakistan's equivalent of the FBI. The NR3C is similar to the FBI's Internet Crime Complain Center (IC3) as it provides a single point of contact for organizations to report matters related to cyber-crime. It also offers information security training to government, as well as private sector organizations.

The attack was claimed by someone associated with a hacking group called 'PAKbugs.' According to Web defacement archive Zone-H, during 2009, this group was responsible for similar attacks against 1,720 websites, some of them belonging to the Pakistani government.

'Your whole database and e-mails are leaked .... i was really excited to read, see what the [expletive] is private in here lOl,' part of the message left on the NR3C reads. 'I Guess, Federal Investigation Dept of Pakistan is in Wrong, Untalented Hands !!' the hacker says.

In a post on the pakbugs.com forum, a user named ZombiE_KsA, who identifies himself as one of the founders of the PAKbugs-Crew, has posted some screenshots to substantiate his claims. One of the pictures shows him logged into the cPanel Webmail administration interface on nr3c.gov.pk. Zone-H attributes a total of 168 defacements to ZombiE_KsA, out of which 62 are on high-profile websites.

'It seems that from an amateur penetration test a hacker has access at least to the full email database and possibly the backups, of a National Response Center for Cyber Crimes in a highly politically sensitive country. […] To say this hack has national security implications would not be overstating the matter,' writes Rik Ferguson, solutions architect at antivirus vendor Trend Micro.

It is worth pointing out that pakbugs.com was hacked too, back in September 2009. At the time, an unknown hacker made public a list containing the usernames, e-mail addresses and hashed passwords of all forum members. The PAKbugs forum is a well known cyber-crime hub where people exchange illegal information and programs."