Re: A change

[Matthew Wollenweber <mjw () cyberwart com>]

I agree, to me these attacks don't appear overly sophisticated. I've heard
it argued that a nation state wouldn't use an extremely sophisticated attack
for deniability. However, I think that gets into a circular argument of who
is smarter. Personally, I think China just has a lot of unlicensed and
unpatched machines that are easy to exploit and therefore easy to use for
further attacks. Some activists were targeted, but also a lot of high-tech
companies. To me that sounds like greed which aligns with most every day
attacks.

What strikes me is the ready attribution to China. What's the evidence for
it?

Symantec gave some details here:
http://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99&tabid=2
but there was no confirmation it was the same event until I saw the Avert
Labs blog today. So I looked at some network information I got from
centralops and robtex the other day. I wrote it up here:
http://www.cyberwart.com/blog/2010/01/19/idle-speculation-on-auroras/ but
I'm even more confused as to why everyone thinks it's China.



On Mon, Jan 18, 2010 at 6:47 AM, Nelson Brito <nbrito () sekure org> wrote:

> Well... A really sophisticated attack can use "one year old" vulnerability
> targeting new exploit "triggers" inside vulnerabilities. I have
> demonstrated
> this in H2HC - how to play a little bit deeper to really know "almost all"
> the
> aspects behind a vulnerability.
>
> I can tell you that some of "Protection Solutions" doesn't really protects
> and
> just let the "new exploit" pass thru the protection layers. I call this
> "Z-Day":
> An "one-year-old" vulnerability's new approach, that could be compared to
> new
> "0-day"... Hopefully I will submit this to BH-USA and will demonstrate my
> approach.
>
> /*
>  * $Id: .siganture,v 1.3 2009-12-11 09:22:54-02 nbrito Exp $
>  *
>  * Author: Nelson Brito <nbrito [at] sekure [dot] org>
>
>   Copyright(c) 2004-2009 Nelson Brito. All rights reserved worldwide.
>   http://fnstenv.blogspot.com */
>
>
> > -----Original Message-----
> > From: dailydave-bounces () lists immunitysec com [mailto:dailydave-
> > bounces () lists immunitysec com] On Behalf Of dave
> > Sent: Friday, January 15, 2010 4:39 PM
> > To: dailydave () lists immunityinc com
> > Subject: [Dailydave] A change
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > I think we're seeing a sudden change in how large companies (or simply
> > companies with a high level of perceived threat[1]) deal with software
> > security. Perhaps the era of IDS and AV and scanners has come to an
> > abrupt end? We can only hope.
> >
> > Everyone says an attack is "sophisticated" whenever any 0day is
> > involved. But that should be the baseline. Or rather, it IS the baseline
> > and everyone seems to just be finding out.
> >
> > One of the things Immunity has been including in our services but is now
> > offering seperately is a client-side 0day penetration test against a
> > single host using CANVAS technology. You get your penetration verified
> > during phone consultation. And you receive real-time analyst
> > interpretation of results, plus delivery of log data at the end. For
> > more information you can contact mark () immunityinc com.
> >
> >
> >
> > Thanks,
> > Dave Aitel
> > Immunity, Inc.
> >
> > [1]http://news.cnet.com/8301-27080_3-10434551-245.html
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.9 (GNU/Linux)
> > Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
> >
> > iEYEARECAAYFAktQtl4ACgkQtehAhL0gherpYgCfcmGb9odb00W5XC9GgXbHHzXf
> > KjUAn32K/UblyoI4dA9iIC6ktbqNfa+i
> > =EWHt
> > -----END PGP SIGNATURE-----
> > _______________________________________________
> > Dailydave mailing list
> > Dailydave () lists immunitysec com
> > http://lists.immunitysec.com/mailman/listinfo/dailydave
>
> _______________________________________________
> Dailydave mailing list
> Dailydave () lists immunitysec com
> http://lists.immunitysec.com/mailman/listinfo/dailydave
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave