Microsoft comes to aid of SMBs reliant on Windows XP

May 4th, 2014


By Byron Acohido, Last Watchdog

KINGSTON, Wash. –  Microsoft should be applauded for reversing its policy , and broadly issuing a  security patch for a profound new security hold recently discovered in  Windows XP.  This is a major benefit to thousands of small and medium sized businesses reliant on XP.

SMBs already have their hands full dealing with intensifying attacks and the high likelihood that their networks have been  breached. This SANS Institute survey of 948 IT pros found the majority of respondents operate on the assumption that their respective company’s networks are compromised, or soon will be. The survey was sponsored by Guidance Software.

So when Microsoft came along last April and stopped all support for XP, including issuing security patches, things got dicier. And the discovery of this latest flaw in IE browsers underscored how that move makes XP machines ripe targets. (more…)

 

LastWatchdog moves to ThirdCertainty.com

black-hat2

(Editor’s note: Last Watchdog is on the move. On this site you may continue to access my body of work on security and privacy topics since 2008. I’m not done yet. Going forward, I will continue delivering smart content as Editor-In-Chief for ThirdCertainty, a  new cybersecurity and privacy online publication sponsored by  IDT911. Full disclosure: ThirdCertainty’s parent company, IDT911,  is an identity theft and data loss assistance firm owned …more

Why $3.6 million to prevent next Heartbleed isn’t enough

By Byron Acohido, Last Watchdog

A dozen tech behemoths — led by Microsoft, IBM, Google, Intel and Cisco — have stepped forward with cold, hard cash to prevent the next Heartbleed.

Each has pledged $100,000 annually for the next three years to a war chest earmarked to fund improvements of open source technology.

That’s a collective pledge of $3.6 million, through 2016, set aside in something called the Core Infrastructure Initiative, administered by The Linux Foundation. …more

Why certain Heatbleed exposures won’t be so easy for bad guys to exploit

Heartbleed + Android: A Not-So Love Story from Lookout
By Byron Acohido, Last Watchdog

KINGSTON, Wash. – The security headaches raised by the Heartbleed coding flaw keep expanding.

sh_heartbleed_450pxArs Technica reporter Dan Goodin has broken stories about how the Canadian government and Yahoo Mail have been bitten by Heartbleed exploits in the wild. And there are numerous vendors and experts stepping forward with information on how Heartbleed could be exploited in pervasively used technologies. However, despite the high-alarm conveyed in media reporting and by security products marketers, it’s not trivial for individuals or even hacking collectives with ill-intent to capitalize.

Google, for instance,  last week warned that Android smartphones running version 4.1.1 of Google’s mobile operating system are vulnerable to Heartbleed attacks in which a bad guy might access  passwords, personal messages and other private information from the device. Last Watchdog asked Mojave Networks threat engineer Ryan Smith …more

Heartbleed threatens financial channels

(Editor’s note: In this guest essay, Scott Borg, CEO and chief economist at the U.S. Cyber Consequences Unit, outlines why online financial accounts are most exposed to the Heartbleed coding flaw – and why few criminal hackers are in a position to take advantage. The accompanying video conveys an overview of the state of the cyber underground; it comes from  a talk delivered by Borg at the RSA Conference in San Francisco earlier this year. US-CCU is an independent, non-profit research institute that investigates the strategic and economic consequences of cyber-attacks.)

By Scott Borg, Special to Last Watchdog

There seems to be some confusion about what Heartbleed is good for. Heartbleed is primarily useful for retrieving information from webservers that reveals the details of those servers’ recent interactions with clients. …more

Heartbleed remediated on thousands of enterprise apps, dozens still vunerable

140415_Heartbleed_fixed appsBy Byron Acohido, Last Watchdog

KINGSTON, Wash. – Netskope, a new cloud app analytics company, has come up with a unique metric illustrating the scramble to patch Heartbleed vulnerabilities in widely deployed business apps. Netskope’s technology enables granular scoping for specific behaviors within the most popular apps used by companies and workers. It currently tracks some 4,500 enterprise cloud apps.

Last week, Netskope sorted this index of apps to see which were susceptible to Heartbleed and found that after an initial burst of patching at least 100 enterprise cloud apps remained vulnerable to the OpenSSL vulnerability. Netskope then posted this countdown timer to show how many apps remain vulnerable. …more

A roadmap for triaging Heartbleed exposures

By Byron Acohido, Last Watchdog

The acute notoriety of Heartbleed is a good thing in this sense: it ought to compel CIOs and CISOs to drill down on developing a roadmap for dealing with exposures that could run very deep.

The most worrisome aspect of Heartbleed arguably is the fact that  this gaping security hole is so pervasively embedded in the fabric of the  commercial Internet.  “There are a few protocols that dominate when it comes to the security and operation of the Internet as a whole, SSL/TLS is one of them.” says TK Keanini, CTO at Lancope.   “Everyone should have seen this coming.”

Companies and organizations ought to be scrambling over the next several days and weeks to triangulate and mitigate potential exposures relating to the wide use of the  OpenSSL encryption protocal recently shown to be dangerously squishy, from a security standpoint, observes  Dr. Mike Lloyd, CTO of RedSeal .  Top of mind should be the spectre of data thieves and cyber spies  hustling to exploit  the Heartbleed flaw in order to exfiltrate sensitive data, especially  private encryption keys, Lloyd says. …more