RIPE NCC Responds to the Rove Digital/DNS Changer Re-allocations

RIPE has publicly responded to the surprise felt by members of the DCWG and others involved with the Rove Digital/DNS Changer clean up community. The statement on their web page is as follows: 15 Aug 2012 — ripe ncc As reported in previous announcements, the RIPE NCC will go to court in the Netherlands on

Beware! DNS Changer IP Blocks are re-allocated and advertised!

DNS Changer Update As of Friday morning (August 10, 2012), the IP address blocks used by the DNS Changer –  Rove Digital criminal operations have been re-allocated by RIPE-NCC and advertised to the Internet: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=1&arg=85.255.112.0%2F20 http://www.ris.ripe.net/dashboard/85.255.112.0/20 As a reminder, the Rove Digital/DNS Changer Crew used the following IP address blocks for their nefarious activities: 85.255.112.0/20

Huawei’s Customers Share Accountability

Vendors have a responsibility to deliver products to the best of their “security” capacity. At the same time the vendor’s customer have a responsibility to push for security accountability. Huawei’s Customers share accountability for the lack of security capabilities and capacity.  Huawei responds to the DEFCON presentation ….  “We are aware of the media reports

Huawei Vulnerabilities – the Real Risk & what you should do now

The Facts: Two researchers from Recurity Labs – Felix Lindner (also known as “FX”) and Gregor Kopf – presented a talk at DEFCON titled:  Hacking [Redacted] Routers. (see https://www.defcon.org/html/defcon-20/dc-20-speakers.html#FX). Their work examined the Huawei AR18 and AR28 routers. Exploitable vulnerabilities were discovered. Questions to the quality of the code were raised. A general concern in

Everyone should be deploying BCP 38! Wait, they are ….

Have you deployed BCP 38 in your network? For most networks, the answer is yes. During last week’s FCC CSRIC III meeting, several people called on operators to deploy “BCP 38.” This IETF best common practice (BCP) is packet filter placed on the edge of networks to insure that the IP source cannot pretend to

Flashback Malware – Check your MAC Now! Are you one of the 500,000?

Dr Web has released a tool to check to see if your MAC is showing up in their list of +500K infected computers. The Flashback.k malware uses the MAC’s UUID to identify the computer. UUID is Universally Unique IDentifier, defined in RFC 4122, ITU-T Rec. X.667 and ISO/IEC 11578:1996, used by Apple to identify the

An interesting 0-Day Comparing Anti-Virus Solutions

Comparing Anti-Virus Solutions is something many organizations will (should) do to ensure their security choices sill work. While researching DrWeb’s work on the Flashback.K malware, I stumbled on this chart (see below). It uses data from Shadowserver.org (http://www.shadowserver.org/wiki/pmwiki.php/Stats/VirusDailyStats) to compare malware packages. Interesting POV that is worth watching over time to see if it is

U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs) is now posted

The FCC’s Communications Security, Reliability and Interoperability Council’s (CSRIC) has now posted the U.S. Anti-Bot Code of Conduct (ABCs) for Internet Service Providers (ISPs). This voluntary code of conduct is a milestone for the industry – placing new expectations on the eco-system required to safe guard our telecommunications system. The core of the code is

DNSChanger – New tool to clean up the infection

DNS Changer (see http://www.dcwg.org/) has been a “thick” piece of malware to remediate. At the start of the take down we have ~600K violated computers. Today we’re at ~400K computers. Not an impressive clean-up record. Why? The operational security community has no effective tools that an average user can use to start cleaning up their

Private-to-Private Collaboration with Public Participation

The Cybersecurity Act of 2012 has now been posted. The dialog of representative government as started with enlightenment on what is important to a different interest. Coincidentally, this act is directly applicable to the principle of aggressive private-to-private collaboration with public participation. The act ‘could’ significantly help our cyber-security capabilities OR it could dramatically hurt