Much news this week, proving our new theory that neither the bad guys, nor the good, take a break for the festive period or New Year.
We have known for years that the bad guys appear to take a break over summer to visit their island lairs or superyachts, and in the past, this time of year was also slow. Not any more.
Since it is the season to be jolly, let’s start with an early present from the good guys. This week, the FBI took down the websites of 15 ‘stresser’ sites – you know the ones that claim to be for testing purposes but are used instead to knock out competitors, enemies, colleagues and pretty much everyone in between.
Regular readers of this blog may remember the stress (see what we did there) that The Most Venerable Brian Krebs had with an Israeli outfit, which ultimately resulted in the incarceration of two entrepreneurial twenty-something-year-old Israelites.
Well if you did, you will not be surprised to learn that Mr Krebs has reported this story in its full glory, complete with a lovely picture of the Fed’s takedown notice on one of the sites. Well worth a read to gruntle the parts before the grim reality, sorry happy family time, arrives.
Everybody knows that these takedowns will not stop this problem, however it just might focus their minds of some of the miscreants who wish to ever visit the USA or avoid local justice.
Together with the US Government’s charging of two Chinese nationals for being key figures in the APT10 group, who you will remember are the (most likely) Chinese state-sponsored hackers who infected Managed Service Providers in order to ride the back channel to their customers and rape and pillage (‘copy’ just doesn’t sound as cool) their Intellectual Property, this has been a good week for the FBI and we should take a moment to appreciate its hard work.
Now on to someone that straddles the line between good and bad. A hacker who goes by the name SandBoxEscaper, who released a Microsoft Zero Day back in August, before it had been patched and possibly without alerting Microsoft (yes, yes, we know it’s the same link), has been at it again with the publication of another bug, complete with proof of concept code, which enables users to read files that they shouldn’t be able to on Windows systems.
Now this isn’t the biggest news in the world, but when you see that Microsoft has rushed out an emergency patch (for something different) to Internet Explorer claiming that it has seen exploits in the wild, it really should bring home how active the real bad guys are. We suspect they are much more grinchy, greedy, nasty and more numerous than one could imagine.
It may be easy to be slightly remiss about patching over the Christmas period, but we would urge you to ensure that you have patched your Windows systems with this, and watch out for the inevitable emergency patches yet to come.
Of course as usual, the security elves at ITC towers will be available to support you over the ‘holidays’ (disambiguation for our American customers), supported by the ghosts of Christmas Past and Present. Contact us at: [email protected] or 020 7517 3900.
Wishing you and yours a very Merry Christmas and a prosperous New Year.
