Here's my latest article in Search Security Magazine

Over the past few years, information security has become a top-level concern to enterprise senior management. Many organizations by now have created information security departments to secure themselves from the threats they’re facing, but in today’s environment, it’s no longer enough. Hence the reasons why a paradigm shift is needed regarding the ways security departments are being structured. No longer should one department manage security from cradle to grave.

Take a look here for the rest.

http://searchsecurity.techtarget.com/tip/Modern-security-management-strategy-requires-security-separation-of-duties

Testing the Waters (Illinois Water System Hacked!!)

There is reason to believe that an Illinois water system has been compromised, and the source of the attack has been traced back to a computer in Russia (no surprise). Supposedly, the intruders burned out a pump by utilizing access to stolen credentials that gave them access to there SCADA software.

Its widely known that critical infrastructure in America is severely insecure. There's been a call from many security professionals over the past decade to tighten security on these systems, and protect our infrastructure. With highly sophisticated malware being created to attack SCADA equipment, like Stuxnet and Duqu, its only a matter of time before these hacks start taking place more frequently.

Its seems like the hackers were only "testing the water", sorry about the pun, with what they could do with their access. What if they wanted to do something more malicious to these systems besides breaking them? The water supply would reach thousands if not millions of people. What if they hit the power grid, and turned off power to parts of the country? These things, as unbelievable as they may seem, are what we're facing now.

The government is downplaying what happened here in Illinois, but they need to start securing their systems before innocent people die. This isn't a trojan thats going to steal your banking credentials. These hacks have the capability to stop a town and or state, and potentially harm the citizens living in them.

The time to act it now.

Anonymous vs. Mexico's Zetas Cartel: This One's Real

Anonymous seems to have met their match: The Zeta Cartel, or have they?

Over the past week anonymous has been threatening to release a list of "servants",(journalists, taxi drivers, government workers, etc.) that are on the payroll for the Zeta cartel. This is in response to the Mexican's kidnapping an anonymous member earlier in the week. The Zeta cartel is one of the most infamous and powerful cartels in Mexico, are extremely violent, and not shy about bloodshed.

Anonymous has demanded the kidnapped member be released, or they'd dump the classified information they have on the cartels "servants". As of this morning its been noted that the kidnapped member has been freed, but they threatened if anonymous leaked any information on their "servants" they'll kill the members family and 10 people for every name released.

This is where it gets real. Anonymous is an internet group and debated heavily on on the release of this data. This isn't law enforcement or governments getting involved, its random people in a chat forum. If they were to dump a couple hundred names on the internet thousands of people could have died. Its one thing to setup a sit-in at parks (#occupy), but getting started in a gang war is over their heads.

Both of these groups don't like being told what to do, but its evident the cartel dosen't want their servants exposed, and anonymous were slightly concerned with a real backlash. Their response to this event was much more real than a DDOS or web attack, and I think they eventually realized that.

Anonymous, for the sake of human life drop this one.

My Latest Publication in Infosecurity-Magazine.com

http://www.infosecurity-magazine.com/view/21643/comment-encryption-vendors-may-be-the-weakest-link/

Here's my latest article in Infosecurity-Magazine.com regarding how encryption vendors are becoming a weak link in your security posture.

Does Anonymous Want to Cripple Critical Infrastructure?

Good interview, Dan!!

Stuxnet's Little Brother

Researchers at F-Secure and Symantec have reportedly found a Stuxnetesque Trojan affecting industrial and manufacturing systems in Europe. The trojan uses similar methods of stealth by using a legitimate driver signed with a valid digital certificate from Taiwan. Again.

They’re calling this Trojan “Duqu” and from what we’re hearing, it’s the precursor to future Stuxnetesque attacks. This particular Trojan seems to only watch what’s occurring on the infected systems. It doesn’t seem to change anything on the devices or send commands to destroy the industrial equipment like Stuxnet. Duqu seems to be the part of Stuxnet that was missing; the data gathering piece. It’s still early, but Duqu seems to be the intelligence gathering module for future attacks. Using data that’s siphoned out of these companies on potentially how systems work, and who’s using what, is a valuable part of creating the next Stuxnet version. The trojan also supposedly uses custom protocols to communicate to its command-and-control server. Duqu doesn’t have had a payload and doesn't seem to have a way of replicating itself. I’m very interested in seeing how it was initially installed; I’m guessing spear phishing here.

Despite this trojan opening a window into how Stuxnext might have been developed, it opens up a few others?

First, the authors of Stuxnet haven’t been dormant. This software was created after Stuxnet was initially found and they’ve obviously been busy. They don’t seemed phased by the celebrity of Stuxnet and rightfully so. People still don’t know who created it so why be concerned with continuing. If this is a nation-state, which I’m pretty sure it is, the funding and the mission are still there. I think by the mere exception of it not being installed in America is a good factor that the USA has something to do with it.

Secondly, the authors are getting ready for another strike. If this is an information gathering tool that’s used to create Stuxnet 2.0, than it’s only a matter of time before they attack again. The industrial sector needs to be aware of what’s going on and ways to protect themselves from these types of attacks.

Thirdly, why is this being focused only in Europe? I think we all know why Iran was targeted, but what's so special about these locations in Europe? What's the motive here?

Lastly, it was reported that the trojan was using custom protocols to communicate to the CC server. This is something we’re starting to see a lot of now. The authors of their code are not only creating custom malware, but they’re communicating the data back over custom protocols that they've created. This adds yet another layer of obfuscation to an already mysterious trojan.

Here's my latest article in SCMagazine on Hacktivism

Here's my latest article on Hacktivism, and if we'll able to stop it.

You can read the article to find my opinion, but leave me some comments to let me know yours.

http://www.scmagazineus.com/can-we-stop-hacktivism/article/213559/