Symantec's Internet Security Threat Report

Symantec has just released its twice-yearly Internet Security Threat Report. This contains plenty of interesting data from the perspective of Symantec's Security Response team. Well, "interesting" if you're interested in that sort of thing...

Here are some highlights (percentage changes are over a six month period):

• About half of identity thefts are caused by loss or theft of laptops and other hardware containing personal data
• Denial of Service attacks are down about 20%
• Botnet activity is up by about 10% (in terms of number of active zombies)
  • China hosted about one quarter of these zombies -- more than any other single country
  • The U.S. hosted about 40% of the botnet command-and-control nodes
• New vulnerabilities (e.g. in Windows or Web applications) were up about 10%
  • Operating system vendors are taking "longer" to patch vulnerabilities (no quantitative data disclosed)
• The Stration family of worms was the most widely-reported
• Email is still the most-used vector for propagating viruses and other malware -- at about 75%
• Phishing is up 5% in terms of numbers of campaigns, and about 20% in terms of volume
  • Phishing attacks are more likely to be sent on a weekday than at the weekend
• Stock kiting and other financial services spam represented about a third of all spam

Drop Everything and Patch Symantec Mail Security for SMTP

Running Symantec Mail Security for SMTP? Stop what you're doing and download the patch (patch 176 at the time or writing).

Seems like a craftily-crafted incoming message can cause a buffer overrun. This may lead to code execution. [Update: Symantec now confirms that they see no chance of arbitrary code execution, merely denial of service.]

Currently being exploited. The code in question tries to infiltrate a Microsoft SQL Server, presumably in order to steal passwords. Another good reason to segment your servers so that they each have a single role; perhaps using virtualization.

Of course, a patch for this bug has been available for eight months, but that doesn't seem to have stopped exploits causing some trouble over at Turner Broadcasting System.

So run: don't walk. More at US-CERT.

Why You Shouldn't Buy from Spammers

Aside from the obvious ("because it only encourages them"), the U.S. Food And Drug Administration offers another, more worrying reason:

A number of Americans who placed orders for specific drug products over the Internet (Ambien, Xanax, Lexapro, and Ativan), instead received a product that ... can cause muscle stiffness and spasms, agitation, and sedation ... Preliminary analysis indicates they contain haloperidol, the active ingredient in a prescription drug used primarily to treat schizophrenia.

Ouch. No surprise here: spammers are Bad People. Lest we forget, spam isn't merely an productivity-sucking irritant.

I'm indebted to the FDA for providing the following photos and captions. More at the FDA site.

Back photo of yellow Haloperidol with “H 2” imprinted on the tablet.

Front photo of yellow Haloperidol with “Janssen” imprinted on the tablet

Plastic bag containing yellow Haloperidol tablets as received by consumers

Mailing envelope in which tablets were shipped to consumers

Mailing envelope in which tablets were shipped; yellow tablets, and the clear plastic bag in which they were contained. The ruler was placed for size comparison purposes

Mailing envelope in which the tablets were shipped to consumers. The ruler was placed for size comparison purposes.

White Haloperidol in blister pack

Yellow Haloperidol in blister pack

Normal Service Will Be Resumed ASAP

So a big sarcastic thanks to my now-ex-hosting company, who decided I was about to run out of bandwidth, but didn't bother to, you know, tell me or anything. If you noticed an odd "free host" banner recently, that's why.

Anyway, panic over. I've now moved to Surpass Hosting. If you're quick, you can get the same deal I did: $1 hosting for a year. There's also deals on reseller plans and dedicated plans.

The RSA Show Floor is Awful

I was going to rant about how boring/racist/sexist/infuriating the RSA expo floor is, but Ross Brown already did it for me. So... what he said:

'Dancing baloney' marketing ... demeaning use of booth babes, vaguely jingoistic references to fictional eastern European countries like Hackistan ... the vast majority of messages were identical. Differentiation is hard in security ... but wow, some of these booths were phoning it in from a content standpoint.