CanSecWest: Let’s talk about non

Today is the last day of CanSecWest – a security conference taking place in Vancouver, Canada.
On Wednesday I filled in for Costin Raiu and talked about our forensics work into Duqu’s C&C servers.

As I’m writing this, Google Chrome just got popped. Again. The general feeling is that $60k, even with a sandbox escape, isn’t a whole lot of money for a Chrome zero-day.
So, to see multiple zero-days against Chrome is quite the surprise, especially when considering the browser’s Pwn2Own track record.

Separately, I found the Q&A session following Facebook’s Alex Rice’s presentation immensely intriguing.

Alex presented on Facebook’s social CAPTCHA, a secondary authentication step that uses friends’ photographs that kicks in when Facebook suspects a compromised/phished account.

The introduction of this system has meant that mass Facebook phishing attacks have gone away. They’ve become ineffective.

However, during the Q&A, there were a lot of comments about how this system can be circumvented in a targeted attack.

Clearly, any system which simply eradicates an entire ‘class’ of attack, while not really impacting user experience, should be considered a huge success.

Facebook should be applauded for their solution, but instead they mostly got criticism from the audience.

Seeing so much criticism is extremely worrisome. We shouldn’t be dismissing ideas or systems simply because they’re not particularly effective against targeted attacks. It’s not always black or white.

After all, the vast majority of (cyber-)crime is not targeted. Let’s not forget that.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.