Click here to receive your FREE subscription to Campus Technology
Featured News
Trojans 2 Crimeware Exploits Web 2.0 Technologies
1/2/2008
Just when you thought life couldn't get any riskier for Web app developers, a new species of malicious code is poised to begin oozing onto our networks. Dubbed "Trojans 2.0" by Web security vendor Finjan, this new Web-borne threat leverages Web 2.0 technology -- RSS feeds, social networks, blogs and mashups -- to provide crackers with easy and scalable command-and-control schemes.
The Trojans 2.0 scheme exploits the trust that legitimate Web services have earned through reputation-based security services. The attackers use the malicious code for a wide range of bad behaviors, the company says, including:
- Botnet delivery of spam;
- Identity theft through keylogging; and
- Highly sophisticated financial fraud, corporate espionage and business intelligence gathering.
"Until recently, the Trojans out there needed to phone home to the hacker to get these commands," Finjan's CTO, Yuval Ben-Itzhak, said. "So, if you could find the hacker's server and block it, either by IP or URL, you could avoid the attack of the data on your machine. But what we've found recently is that hackers are beginning to take advantage of Web 2.0 sites. Instead of the Trojan phoning home to the hacker's server, it's connecting to a blog or an RSS feed, where the Trojan is not communicating directly to the hacker's server, but sending the data to relatively trusted servers. Essentially, the hacker is using the Web 2.0 platform as an intermediate storage area."
Israel-based Finjan is a global provider of real-time, appliance-based Web security solutions. Its solutions utilize behavior-based technology to repel all types of Web-based threats from spyware to phishing, Trojans to obfuscated malicious code.
The company identified the new threat (which it calls "crimeware") in the latest report from its Malicious Code Research Center.
In its report, the company cites "financial reward" as the key driver for malicious code evolution in the coming year. The attacks will become more sophisticated, leveraging advanced Web 2.0 techniques and services to "heighten infection ratios and decrease detection rates." Ironically, Web 2.0 seems to be providing the black hats with more robust and scalable attack frameworks, Ben-Itzhak said, enabling them to hide malicious code within "legitimate" Web traffic.
"Using Web 2.0, these hackers can go undetected," Ben-Itzhak said, "because now there's an intermediary."
How do we protect ourselves from this new threat?
Not surprisingly, Ben-Itzhak recommends that enterprises embark on a strict regimen of infection prevention using real-time malware scanning technology.
"You need security technology that doesn't rely on signatures or URLs," he said, "but that scans the actual code of the Web site, trying to find out what the code is about to do. Is it about to delete a file, change settings -- and then it decides if this page includes malicious code, and blocks it based on that."
What do you do if your site is infected? Monitor the outgoing traffic for suspicious behavior.
"You scan the code to make sure that confidential data isn't going out," he said. "The combination of the two is necessary to secure a corporate network."
Finjan's Web security trend report includes examples of this type of attack, along with details and step-by-step diagrams. The report is available here for download, without registration.
John K. Waters is a freelance journalist and author based in Palo Alto, CA.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Sun, Stanford Working To Archive History
In May in San Francisco, experts from leading universities, libraries, and research institutions around the world met as part of an ongoing effort to address a pressing issue: archiving the world's history, right up to today.
- The Quilt Coalition Rolls Out XO Communications for High-Capacity Network Services
The Quilt, a coalition of 28 regional network organizations, has added XO Communications Services to its authorized vendor list. The Quilt represents 200 universities and thousands of other educational institutions across the United States. With this new relationship, Quilt members can purchase XO's high-speed IP transit and network transport services at competitive rates.
- Wimba Classroom 5.2 Expands Classroom Capture Support, Adds MP3 Downloads
At the NECC 2008 conference in Texas this week, Wimba launched a new version of Wimba Classroom, the virtual classroom component of the company's Collaboration Suite. The new 5.2 release expands options for classroom capture and adds a variety of other functional and ease of use features.
- Automation Chimera: Education Is Not Management
The lure of automating workflow online so human intervention is minimized is continually reinforced in the minds of higher education administrators by examples of automated campus systems such as financials, student information systems, and other enterprise systems. But what's good for management is not always good for learning.
- Cognos Releases BI Software for Linux-based IBM System z Mainframe
Cognos, which IBM acquired in January, has released an update to its business intelligence software that will run on the Linux operating system on IBM System z mainframes. IBM Cognos 8 BI was being developed by the two companies prior to the acquisition, but assimilation of Cognos into IBM accelerated development.
- Facebook and Collegiality: A Serendipitous Social Niche
Facebook is a way to greet a colleague as if she or he is on your own campus: a wave at a distance, a hello at the corner burrito place, a honk as you both leave the campus parking lot. Informal collegiality has been extended over the miles.
