The week in security: Hackers targeting cloud as vendors fund OpenSSL fixes

A study found that so-called 'zero-knowledge' security efforts may not be as secure as they're held up to be. This may prove particularly problematic given reports that cloud targets – a core market for zero-knowledge encryption – are in hackers' sights. Cloud adoption is also increasing the complexity of security-log centralisation and analytics efforts, forcing companies to develop robust strategies for security data management.

Amazon came under fire after a security vendor alleged Amazon had provided customers with an unpatched version of Windows. This reflects a growing trend for attacks on cloud infrastructure, with one vendor's figures suggesting attacks on cloud providers are on the rise. Yet cloud isn't the only target for baddies, with social-sharing site We Heart It forced to turn off its Twitter capabilities after it was mentioned in a large run of spam.

As some security managers deal with some unexpected problems with virtual machines affecting the business, CloudFlare jumped on the bug bounty bandwagon with a program to pay researchers to find bugs in its network. Yet other researchers were doing it for free: one researcher found that a supposedly patched router would still respond to a 'secret knock' after being patched poorly.

The latest instalment of Verizon's Data Breach Investigations Report (DBIR) dropped, warning that Web apps are the Internet's security punching bag and point-of-sale devices had become a leading hacker target during 2013. The report also made a case for behavioural analytics, found that espionage was becoming more common] than financial crime, and found that most data breaches [[xref:http://www.cso.com.au/article/543518/data_breaches_can_traced_back_nine_attack_patterns_says_verizon_report/ to nine specific attack 'patterns'.

Jailbroken iOS devices became another hacker target, copping the wrath of a malware campaign of unknown origins. AOL also copped the wrath of hackers, who launched a spoofing attack using old AOL email addresses.

Yet, even as Apple pushed out a range of fixes for its iOS operating system, figures suggested Android devices had leapfrogged iThings when it comes to mobile advertising traffic. Ironically, Android – which has been repeatedly slammed for its security because of bugs such as a Russian SMS Trojan that sends SMS messages to premium-rate numbers – was found to be protected from Heartbleed in some cases because of mistakes in the way OpenSSL was implemented.

Heartbleed may have motivated many vendors to join an effort to improve OpenSSL through a jointly funded initiative, but Apple wasn't naming the attack as it updated OS X even as researchers warned that the company's three-week delay in patching its OS X and iOS platforms was putting users at risk. Meanwhile, BlackBerry updated its mobile software to fix a Heartbleed-related flaw, while Mozilla said it would strengthen the verification of SSL certificates in Firefox.

Straight from the bringing-order-to-chaos department, proponents of the so-called 'dark web' were given access to a search engine providing hacking tools and services. Chinese equipment maker Huawei was also searching – in its case, for a refocusing of its public-relations efforts after becoming exhausted fighting claims its security has been compromised due to Chinese government links. The company is still selling products in the US and is redoubling its efforts to move past the controversy about its provenance.

Join the CSO newsletter!

Error: Please check your email address.

Tags security

More about Amazon Web ServicesAOLAppleBlackBerryHuaweiMozillaVerizonVerizon

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place