Bugtraq mailing list archives
RE: mac trojan in-the-wild
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Thu, 1 Nov 2007 22:18:55 -0700
That's an interesting figure (86% that is). Can you give us some insight into what you define as "user interaction"? If it is clicking a link or reading an HTML email, then OK. If it is opening an .exe from an email, I'd like to see what client you are talking about and what environment (meaning, what OS/email client and what did they have to do to get it to run). But specifically, how many were exploits where a user had to visit an untrusted site, download an executable, run it, and explicitly give it administrative credentials to run? Not just people running as administrator, but typing in the admin account credentials to run it as administrator as one has to do on OSX? My guess (and I'd really like to see details on your findings) is that most "interactive" issues are the more "trivial" interactive issues (like clicking a link and launching a vulnerable version of IE). But more importantly, let's look at things from the other side. Let's say I'm wrong, and that Gadi is right on target with his "hit hard" prediction and that we should be very concerned with this. Given the requirements here, that again being flagrant ignorance where all the above steps are executed (including the explicit admin part)-- what exactly are we supposed to do? If people are willing and able to go through the motions above what can we as security people do to prevent it? Far too many people in this industry are far too quick to point out how desperate the situation is at all turns, but I don't see many people offering real solutions. But you know, I have to say... If we are really going to consider this "serious," and we are really going to define part of our jobs as being responsible for stopping people who have absolutely no concerns for what they do and are willing to enter their admin credentials into any box that asks for it, then I'd say that there is a *serious* misunderstanding about what security is, and what can be done about it-- either that, or I'm just in the wrong business. t
-----Original Message----- From: Roger A. Grimes [mailto:roger () banneretcs com] Sent: Thursday, November 01, 2007 5:37 PM To: Alex Eckelberry; Thor (Hammer of God); Gadi Evron; bugtraq () securityfocus com; full-disclosure () lists grok org uk Subject: RE: mac trojan in-the-wild Actually, on that same note, I recently did an analysis of the last three years of published Windows vulnerabilities. 86% required local end-user interaction (i.e. social engineering) to
be
pulled off. http://www.infoworld.com/article/07/10/19/42OPsecadvise-insider- threats_ 1.html I didn't analyze Linux or BSD threats, but my gut feeling puts them at the same level or even higher. With 86% or more of the past threats requiring social engineering to pull off, we can safely say the "future" you state below is here now. Now, what is interesting is that any exploit requiring social engineering to work has so far been less of a problem than the vast majority of "remote buffer overflow" exploits like the Blaster and SQL worms. Social engineering-required malware still works, and works well, but not with the same success of remote buffer overflow malware. There is very little we in the security space can point to as a
success...but
the overall decrease in remote buffer overflows is one.
Unfortunately,
the social engineering malware is getting better day-by-day. We can no longer count on mispellings (sic) and bad grammar to be malware indicators. Our users, regardless of the OS, are ready as ever to
click
on interesting content, malicious or not. We've got to design our defenses to pay more attention to client-side attacks, but it is the weak point now, not in the future. Roger ***************************************************************** *Roger A. Grimes, InfoWorld, Security Columnist *CPA, CISSP, CISA, MCSE: Security (2000/2003), CEH, yada...yada... *email: roger_grimes () infoworld com or roger () banneretcs com *Author of Windows Vista Security: Securing Vista Against Malicious Attacks (Wiley) *http://www.amazon.com/Windows-Vista-Security-Securing- Malicious/dp/0470 101555 ***************************************************************** -----Original Message----- From: Alex Eckelberry [mailto:AlexE () sunbelt-software com] Sent: Thursday, November 01, 2007 5:49 PM To: Thor (Hammer of God); Gadi Evron; bugtraq () securityfocus com; full-disclosure () lists grok org uk Subject: RE: mac trojan in-the-wild The future of malware is going to be largely through social engineering. Does that mean we ignore every threat that comes out because it requires user interaction? Seems like whistling past the graveyard to me. Alex
Current thread:
- Re: mac trojan in-the-wild, (continued)
- Re: mac trojan in-the-wild Matthew Leeds (Nov 01)
- RE: mac trojan in-the-wild Alex Eckelberry (Nov 01)
- Re: mac trojan in-the-wild Nick FitzGerald (Nov 02)
- RE: mac trojan in-the-wild Thor (Hammer of God) (Nov 01)
- RE: mac trojan in-the-wild Alex Eckelberry (Nov 01)
- Re: mac trojan in-the-wild nnp (Nov 02)
- Re: [Full-disclosure] mac trojan in-the-wild Peter Besenbruch (Nov 02)
- Re: [Full-disclosure] mac trojan in-the-wild Paul Schmehl (Nov 02)
- Message not available
- Re: mac trojan in-the-wild Robert McArdle (Nov 02)
- RE: mac trojan in-the-wild Alex Eckelberry (Nov 01)
- RE: mac trojan in-the-wild Roger A. Grimes (Nov 02)
- RE: mac trojan in-the-wild Thor (Hammer of God) (Nov 02)
- RE: mac trojan in-the-wild Roger A. Grimes (Nov 02)
- the heart of the problem [was: RE: mac trojan in-the-wild] Gadi Evron (Nov 02)
- Re: mac trojan in-the-wild Matthew Leeds (Nov 01)
- RE: mac trojan in-the-wild Gadi Evron (Nov 02)