A saucerful of secrets

As long-time blog readers may know, I shifted my focus to North American threats some three years ago. Ever since, I’ve noticed major cultural differences in how security issues get tackled.

One way in which the difference is very clear is the use of secret questions as an added security measure.
While secret questions are not overly common in Europe, they’re very popular in the USA.

It goes without saying that out-of-band authentication used by many European banks is a much more secure approach than asking a secret qeustion next to a regular password. And banks are just one of many examples. Secret questions are everywhere now.

Enter the Facebook era. Rarely do I encounter a secret question that people wouldn’t likely have posted the answer to on Facebook. It’s worse with the services that allow users to reset their password based on answering the secret question(s) correctly.

This Friday,Valve announced Steam Guard, based on Intel’s Identity Protection Technology.
IPT provides an additional layer of authentication which previously would have required a seperate hardware device, a security token. This new technology can definitely mitigate the negative impact that secret questions may pose. Additionally this mechanism should be less of hassle for users.

The feature requires hardware CPU support, which is currently limited to the latest generation Intel Core and Intel Core vPro processors. This means that general adoption is still quite some years away. IPT won’t solve all our problems. One example would be sophisticated Banker malware which makes fraudulent transactions on the infected endpoint.

However, for the problems that IPT is looking to address it’s a much better solution than what’s currently out there, especially in North America.

I, for one, will be happy when I can tell the boss I need a new CPU for security purposes. 🙂

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.