SecurityOrb Blog Station

On June 4, 2010, Adobe announced a critical vulnerability with Adobe Flash Player, Adobe Reader and Acrobat that could allow attackers to take control of the affected system. While Adobe is working to release a fix, the vulnerability is being actively exploited in what are known as Zero-Day attacks.

Since then, a series of Advanced Persistent Threat (APT) attacks have been launched against corporate employees in the form of emails that contain malicious links to sites that use this vulnerability. As of last night, SecurityOrb.com a Washington DC Based Information Security media company has obtained information that a number of corporate employees had received such emails and many of them had clicked on the links causing their machines to be compromised.

SecurityOrb, LLC is asking everyone to take extra caution and validate the sender on all emails before opening them. All externals emails should be scrutinized closely before opening any attachment or clicking any links.

SecurityOrb.com has also obtain information many of these organizations are blocking all Flash downloads from the Internet. This means that users will not be able to view Flash videos/animation in certain web sites they visit. Adrian Williams of SecurityOrb.com stated, “We do not know how long it will take Adobe to come up with a fix, but it is very important for organizations to implement the proper security controls until the matter has been resolved.”

If you have a business critical need to access Flash video in a specific business-related web site, please contact our Service Desk or Internet Service Provider with the site information and business justification and they may be willing to have it white-listed (allowed) for you to access it.

Please continue to be vigilant and never assume you are protected. Visit SecurityOrb.com for additional tips on how you can be secure.

Network Printers and the Threat they pose to your Network…

Posted using ShareThis

Mac OS X: A Threat is growing…

Posted using ShareThis

Facebook Urged to Add “Panic Buttons” in Meeting at Washington DC

Posted using ShareThis

Washington D.C. Carries the Most Cyber-Criminals Per Capita

Posted using ShareThis

Apple’s iPad Security Concerns Consumers should be Aware of…

Posted using ShareThis

Cyber ShockWave Aftermath: Is the U.S. Ready for a Cyber-Attack?

Posted using ShareThis

Cyber ShockWave: Simulated Cyber-Attack on the U.S. Government being conducted in Washington, D.C.

Posted using ShareThis

The Bipartisan Policy Center (BPC) will host Cyber ShockWave, a simulated cyber attack on the United States government February 16, 2010.  This should not be a surprise and is very necessary at this time especially with all the recent sophisticated cyber-attacks that has been in the news lately.

We at SecurityOrb.com feel exercises such as these simulated cyber-attacks should be conducted more often and if possible with the assistance of other countries as well.  The federal government has staged fake cyber-attacks before and many organizations do so as part of their incident response preparedness.  In fact, Booz Allen Hamilton ran a cyber warfare simulation in 2008, with representatives from both the government and private sector.

PRNEWSWIRE.com stated in there website, “Following the simulation, there will be a post-event discussion with the participants and partners to discuss what the U.S. government can do to avoid a real-world cyber attack of this magnitude and what can be learned from the exercise”.

We think the results should provide real world viable information about how to handle an actual event and some usable lessons to aid in future policy and defense of a real attack.

Black Hat DC was another success this year, with many interesting topics and speakers. The turnout, while still not at the Las Vegas levels, appeared to have grown over last years’ conference. I’m not one to build my own hardware equipment, other than my own PCs and The Big Picture track was a little too broad for my taste, so I spent the bulk of my time on Day 1 attending lectures under the Application Security track. Of all the presentations, I found the “Neat, New, and Ridiculous Flash Hacks” to be the most current and interesting topic. With the use of Flash becoming more and more popular and the recent issues that Adobe has had, it seems to be the target of several attacks. The demonstration of working attacks on popular websites was scary to say the least.

Day 2 found me staying mainly with Application Security; I did make a few stops in the Forensics and Privacy track, not venturing to attend any of the Metasploit briefings. Litchfield, as usual, didn’t disappoint. His presentation on penetration testing techniques and a new Oracle bug was very informative. Since I’m a big fan of my iPhone; I also found the iPhone Privacy presentation to worry me a great deal, including his proof of concept for spyware applications on the iPhone. Lastly, the section on “Why Black Hats Always Win” was right on point, the observations on “White Hats” versus “Black Hats” hit many key errors that separate the two. The debates here are endless and probably could have a whole conference dedicated to the subject. As for me, I think it will be an endless battle, just like good and evil, you can’t have one without the other.

Finally, the location was ok this year and the Hyatt Regency supported the event well, but I would have been happier if the event was in DC and not Crystal City. All in all, Black Hat 2010 was another great success.