Speaking at San Antonio Cyber Vision on December 1

Jeff Reich, our director of research operations, will be representing the Institute for Cyber Security at the  San Antonio Cyber Vision Hi-Tech Mixer. Jeff will share the panel with San Antonio Mayor Julian Castro and MGen Richard Webber of the 24th Air Force discussing San Antonio's transformation into a "cyber city". Folks in the San Antonio area who are interested in cyber security should definitely plan to attend the talk that evening.

From the San Antonio Tech News site:

"Please join Technology Connexus Association Board of Directors with Special Guest Speaker, San Antonio Mayor Julian Castro to hear about transforming San Antonio into Cyber City USA. We also welcome MGen Richard Webber (Invited), Commander, 24th Air Force and Jeff Reich, Director of Research Operations, UTSA Institute for Cyber Security.

It's the original San Antonio Hi-Tech Mixer featuring fantastic food, great beverages, fabulous door prizes, and the best power networking in San Antonio."

Date: Tuesday, December 1st, 2009, 5:30PM
Location: Chisolm Building, Brass Professional Center 4400 NW Loop 410 San Antonio, TX 78229
Phone: (210) 582-5814

For more details, go to the conference site.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

Botnets Using Web 2.0 Sites as a Command and Control

In the last month, three botnet command-and-controls (C&Cs) have been spotted in the wild on Twitter and Google Groups. A botnet, perhaps better described as a "zombie network", is a distributed organization of programs that runs in the background of infiltrated computers (laptops, servers, cell phones, etc.) that performs tasks such as information stealing, email spamming, or other types of attacks. Usually these bots try to multiply, to remain hidden, and to scan for private data. Some are more sophisticated than others.

Usually, these bots operate on a peer-to-peer basis, but last month Arbor Networks found a botnet using a centralized C&C via Twitter and Jaiku. Once alerted, they each shut the offending account down, but just days later, a second one was found on Twitter. Meanwhile, just last week, Symantec uncovered a trojan using Google Groups as its C&C in a similar way.

Interestingly, these particular botnet C&Cs were very primitive. More stealthy approaches, such as using steganography to hide bot commands, are not as widely used (or worse, they are and haven't been discovered). With web 2.0 and social networking sites growing in popularity every day, look for more botmasters to abuse these sites in this way.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Cisco Releases its Annual Security Report for 2008

Cisco released its annual security report today. In its 52 pages, full of charts and graphs, the staff discuss online security risks and trends, threats and trust factors, cyber security threats, and conclusions with recommendations. There are many interesting factoids from the report, including:

• 90% of email sent worldwide is spam
• Disclosed security vulnerabilities grew by 11.5% from last year
• Over the course of 2008, Cisco saw 90% growth in threats originating from legitimate domains

Read the full report here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu