WHO = World Hackers Organization?

Hackers jack thousands of sites, including U.N. domains

by Gregg Keizer


April 23, 2008 (Computerworld) Large numbers of legitimate Web sites, including government sites in the U.K. and some operated by the United Nations, have been hacked and are serving up malware, a security researcher said today as massive JavaScript attacks last detected in March resume.

"They're using the same techniques as last month, of an SQL injection of some sort," said Dan Hubbard, vice president of security research at Websense Inc., referring to large-scale attacks that have plagued the Internet since January.

Among the sites hacked were several affiliated with either the U.N. or U.K. government agencies, said Websense.

The exact number of sites that have been compromised is unknown, said Hubbard. He estimated that it's similar to the March attacks, which at their height infected more than 100,000 URLs, including prominent domains such as MSNBC.com.

"The attackers have now switched over to a new domain as their hub for hosting the malicious payload in this attack," Websense said in an alert posted yesterday to its Web site. "We have no doubt that the two attacks are related."

Although the malware-hosting domain has changed, it's located at a Chinese IP address, just like the one used in March, Hubbard said. "It also looks like they're using just the one [hosting] site, but changing the link within the JavaScript," he added, talking about an obfuscation tactic that the attackers have used before.

When a visitor reaches one of the hacked sites, the malicious JavaScript loads a file from the malware-hosting server, then redirects the browser to a different page, also hosted on the Chinese server.

"Once loaded, the file attempts eight different exploits," noted the Websense warning, including one that hits a vulnerability in Internet Explorer's handling of Vector Markup Language (VML) that was patched in January 2007.

Another security researcher, Giorgio Maone, who also develops the NoScript Firefox add-on, said late Wednesday that although the U.K.-based sites appeared to have been cleansed of the malicious JavaScript, the U.N. sites had not.

Maone also said "I told you so" in his blog post yesterday. In an August 2007 entry, he had said that rather than fixing the underlying security problems on the U.N. site, the agency had simply deployed a "pretty useless" firewall that masked the most obvious attack surface.

However, even the disinfected sites could fall victim again, Maone maintained. "The sad truth, though, is that even those 'clean' sites are still vulnerable, hence they could be reinfected at any time," he said.

"Web site owners have to start securing their code," Hubbard noted.

Source: Computer World

Websense recognizes 22by7's expertise

Websense Awards Indian Partners at February Channel Meets
By : ChannelsTech2.0 Staff | Feb 27,2008

Websense Inc, from mid-February this year rolled out channel meets and roadshows in Chennai, Delhi, Mumbai and Bangalore, one after the other to lay off the roadmap of the company post acquisition of SurfControl. The security solutions provider also awarded good performing partners at these gatherings.

The list partners who bagged the awards in Northern India are- Best Sales Manager, Vishal Bhadani, Wipro Infotech, Best Pre-Sales Consultant, Harsh Bhasin, Taarak India, Best Pre-Sales Consultant, Sukhpal Singh Sandhu, ACPL Systems, Best Marketing Support, Select Technologies, Best Partner, Wipro Infotech and Futuresoft Solutions, Special Recognition Award, Rohit Sobti, Select Technologies, and the Best Emerging Partner, ACPL Systems.

All categories of The Best Sales Manager, Best Pre-Sales Consultant, Best Marketing Support and Best Partner in Western India went to MIEL e-Security. The Chennai and Hyderabad winners include- Best Sales Manager, Rupa Parekh, Wipro Infotech, Best Pre-Sales Consultant, Prasad Raghuram, Wipro Infotech, Best Pre-Sales Consultant, Srikkantan Venkatesh, Digital Track Solutions, Best Marketing Support, Veeras Infotek, Best Partner, Wipro Infotech, Best Emerging Partner, Raksha Technologies, Special Recognition Award, Secure Network Solutions India.

The southern India winners include Best Sales Manager, Ashutosh, Gemini Communication, Best Pre-Sales Consultant, Jeevan Shetty, Wipro Infotech, Best Pre-Sales Consultant, Vinay, 22by7 Solutions, Best Partner, Wipro Infotech and Kinfotech, Special Recognition Award, Avanti Shirur, Select Technologies.

There were National awards also handed over to partners that included Best National Sales Manager, Vikramjeet Bhatti, MIEL e-Security, Best Pre-Sales Consultant, Srikanth N V, Select Technologies, Best Pre-Sales Consultant, Sajith Rahman, Inflow Technologies, Best Marketing support, Najeeba, Inflow Technologies, Special Recognition Award, Ajit Zanjad, MIEL e-Security, Best Partner, MIEL e-Security, Best Partner, Softcell Technologies, Valued Distributor, Select Technologies, Inflow Technologies and Foresight Software Solutions.

Source:

http://www.tech2.com/channels/story.php?id=5443

Unmonitored Surfing is not Safe!!!

Websense reveals findings of `State of Security’ survey

India Infoline News Service / Mumbai Feb 12, 2008 15:19

The survey findings highlight that a majority of employees today spend a significant time on the Internet when at work. However, the majority of these employees are not aware of and hence not worried about the security threats arising from the Internet

Websense, Inc. a global leader in Web security and content protection announced the findings of the SOS ‘State of Security’ survey conducted in India. The survey commissioned by Websense and undertaken by The Nielsen Company, India, assesses the impact of the Internet at work and gauges awareness of Internet security risks among employees.

The study of employees working in 450 organisations across Delhi, Bangalore, Chennai, Mumbai and Hyderabad, surveyed employees with Internet access at work in large businesses and small and medium enterprises.

“The survey findings highlight that a majority of employees today spend a significant time on the Internet when at work. However, the majority of these employees are not aware of and hence not worried about the security threats arising from the Internet,” said Surendra Singh, Regional Director, SAARC, Websense Inc.

Key findings of 2007 State of Security India, employees survey:

1.Unsafe IT behaviour leads to unintentional loss of confidential information:

63% of respondents from Delhi use their personal email ID for work purposes against the average of 36%. Delhi and Bangalore also have the highest proportion of respondents (32%) who send work documents to personal e-mail accounts versus the average of 23%. Given the nature of data that BFSI deals with, 42% of employees in this vertical use personal e-mail for work-related activities. In Bangalore, an average of 17% of respondents admitted to clicking on links in e-mail sent from unknown sources and 22% on pop-up ads highlighting a significant section of Internet users who are ignorant of online threats.

2.Leaking information a job threat:

57% employees feel leaking sensitive company information or infecting their company with malicious spyware or viruses (38%) puts them at greater risk of losing their job than not adhering to their organisation’s Internet policy (20%). Almost one-third employees (31%) believe they will lose their job on viewing adult content at the workplace and 22% said they would lose their job if found downloading unauthorised software.

3.Employees surfing behaviour:

64% of respondents admitted they are bit fearful of the security dangers of the Web and hence surf only safe Web sites. However, 39% of all respondents agreed that they download movies, music, software etc. while at work. Significantly, 30% said they surf aimlessly with no particular destination in mind and about the same proportion of respondents said they surf without bothering about online security.

4.Internet — A critical work enabler:

All employees surveyed spend an average of 4.25 hrs per day on the Internet. Employees spend 45% of their time (3.5 hours) per day surfing work-related Web sites, the highest being in Chennai, 50% (4.25 hours) and Hyderabad, 65% (5.5 hours). The average time spent on non work-related Web sites is 5 hours per week. Enterprises incur a productivity loss of approximately Rs. 160,000 per employee per annum due to non work-related surfing.

5.Organisation’s Internet security:

Almost 70% of employees in India appeared confident of their IT department’s capabilities to protect them against every Internet security threat.

6.Web is biggest source of infection:

52% of all employees surveyed believe that the Web is a key source of infection followed by e-mail (39%) and instant messaging (4%). In similar findings, IT managers also believe the Web (48%) to be a key source of network infection followed by e-mail (46%).

7.Data leakage:

35% of employees feel most worried about losing both personal as well as work-related information. However, 28% of employees do not feel worried at all about any personal or private information being stolen or accessed from their work PC.

Source :

http://indiainfoline.com/news/innernews.asp?storyId=58837&lmn=1