Google noticed an increase in attacks on Microsoft Windows and Internet Explorer machines and is working with its rival to mitigate the MHTML exploit, which targets political activists.
Google said it is working with Microsoft to patch a hole in the Windows operating system hackers are trying to exploit to target activists, among other users.
The search engine, which called the attacks "highly targeted and apparently politically motivated," said the perpetrator(s) abuses a known vulnerability Microsoft treated with a temporary patch in late January.
Update: Google would not reveal which activists have been targeted or the origin of the attacks.
The bug lies in the MHTML (MIME Encapsulation of Aggregate HTML) protocol handler on Windows XP and later Windows versions, and is exploited as a cross-site scripting attack when users surf the Web with Microsoft's Internet Explorer browser.
An attacker could leverage the hole by writing an HTML link designed to trigger a malicious script and convince the targeted user to click it.
The exploit can be used to run JavaScript code on IE, giving an attacker a way to access user information stored in the browser and trick users into installing malicious code.
Microsoft issued this fix for the security flaw in January, but the flaw is being used to target political activists and even users on at least one popular social Website, Google said.
Google's security engineers recommend users, including businesses whose computers use IE, run Microsoft's Fixit solution on their computers to block this attack until permanent patch is available.
For its part, Google said it has set up several server-side defenses to protect users of its own Web services against the MHTML exploit.
"That said, these are not tenable long-term solutions, and we can't guarantee them to be 100 percent reliable or comprehensive," Google's security team wrote in a blog post March 11. "We're working with Microsoft to develop a comprehensive solution for this issue."
That Google is working directly with rival Microsoft is a testament to the seriousness of the issue. Rivalries tend to get placed on the backburner where computer security is concerned, but the joint effort certainly underscores the companies' shared concern.
Indeed, Google said the abuse of this vulnerability represents a new quality in the exploitation of Web-level vulnerabilities. The company said such attacks previously focused on directly compromising users' systems, as opposed to leveraging vulnerabilities to interact with Web services.
Read the views of online Certification Experts, which provide the real questions and correct answer and explanation for the students / professionals who are seeking or enhancing their level of expertise. more at certkingdom.com
August 11, 2011
August 9, 2011
Top 8 ways feds (and corporate users) can take advantage of green IT
GAO report outlines key federal green IT initiatives
How does the federal government go about implementing green IT? According to a report out today from the Government Accountability Office, the feds have adopted a number of practices that are useful not just for government IT but all manner of private and public company IT groups as well. These include everything from dedicated funding for green products, to improved employee training and reducing use of paper.
BACKGROUND: 25 tech touchstones of the past 25 years
From the GAO report, here's a green IT roadmap:
1. Utilize new IT tools, such as thin client technology. An alternative to the use of desktops that is gaining attention is the use of thin client technology. The Department of State, by the end of fiscal year 2010, replaced 8,187 standard desktop computers with thin clients, providing annual reported energy savings of 630,399 kilowatt hours and emission savings of 422.7 tons of carbon dioxide, an environmental impact equivalent to planting 1,900 trees or powering 71 households year round.
2. Implement print management actions beyond duplex printing. Using responses obtained from its 2009 survey of federal employees, an IT provider estimated that the federal government spends about $1.3 billion annually on employee printing, and about one-third of that total, or about $440.4 million per year, is spent on unnecessary printing. The survey indicated that 89% of federal employees report that their agencies do not have formal printing policies in place -- for example, according to federal employees, just 20% of agencies have restrictions on color printing; only 11% of agencies have policies dictating when to print or not to print; and only 5% of agencies require personal password codes to print. In the non-federal sector, Hewlett-Packard implemented managed print services that reportedly allowed a customer to reduce the number of printers by 47% globally, cut per-page print costs by up to 90% and save more than $3 million in two years in the United States alone. In addition, California implemented the Go-Online program as an alternative to mainframe printing, reportedly reducing the number of pages printed by 54 million and reducing costs by $700,000 annually.
3. Consolidate and standardize IT equipment and services. In an earlier 2011 report, the GAO found because procurement at federal departments and agencies is decentralized, the federal government is not fully leveraging its aggregate buying power to obtain the most advantageous terms and conditions for its procurements. The report also stated that applying strategic sourcing best practices throughout the federal procurement system could produce significant savings. Similarly, according to a 2010 report by a private-sector IT council, the federal government's costs of operating IT systems are higher than they need to be, in some cases by more than a factor of two. The report estimated that at least 20% to 30% of the more than $70 billion spent annually on IT assets could be eliminated by reducing overhead, consolidating data centers, eliminating redundant networks and standardizing applications. Therefore, the report recommended that the federal government consolidate IT infrastructure. In the non-federal sector, the IT council report indicated that IBM had cut its overall IT expenses in half over the past five years through consolidation and standardization. In addition, the National Association of State Chief Information Officers (NASCIO) identified consolidation/optimization, through centralizing or consolidating services, operations, resources, infrastructure and data centers, as its No. 1 priority for 2011.
How does the federal government go about implementing green IT? According to a report out today from the Government Accountability Office, the feds have adopted a number of practices that are useful not just for government IT but all manner of private and public company IT groups as well. These include everything from dedicated funding for green products, to improved employee training and reducing use of paper.
BACKGROUND: 25 tech touchstones of the past 25 years
From the GAO report, here's a green IT roadmap:
1. Utilize new IT tools, such as thin client technology. An alternative to the use of desktops that is gaining attention is the use of thin client technology. The Department of State, by the end of fiscal year 2010, replaced 8,187 standard desktop computers with thin clients, providing annual reported energy savings of 630,399 kilowatt hours and emission savings of 422.7 tons of carbon dioxide, an environmental impact equivalent to planting 1,900 trees or powering 71 households year round.
2. Implement print management actions beyond duplex printing. Using responses obtained from its 2009 survey of federal employees, an IT provider estimated that the federal government spends about $1.3 billion annually on employee printing, and about one-third of that total, or about $440.4 million per year, is spent on unnecessary printing. The survey indicated that 89% of federal employees report that their agencies do not have formal printing policies in place -- for example, according to federal employees, just 20% of agencies have restrictions on color printing; only 11% of agencies have policies dictating when to print or not to print; and only 5% of agencies require personal password codes to print. In the non-federal sector, Hewlett-Packard implemented managed print services that reportedly allowed a customer to reduce the number of printers by 47% globally, cut per-page print costs by up to 90% and save more than $3 million in two years in the United States alone. In addition, California implemented the Go-Online program as an alternative to mainframe printing, reportedly reducing the number of pages printed by 54 million and reducing costs by $700,000 annually.
3. Consolidate and standardize IT equipment and services. In an earlier 2011 report, the GAO found because procurement at federal departments and agencies is decentralized, the federal government is not fully leveraging its aggregate buying power to obtain the most advantageous terms and conditions for its procurements. The report also stated that applying strategic sourcing best practices throughout the federal procurement system could produce significant savings. Similarly, according to a 2010 report by a private-sector IT council, the federal government's costs of operating IT systems are higher than they need to be, in some cases by more than a factor of two. The report estimated that at least 20% to 30% of the more than $70 billion spent annually on IT assets could be eliminated by reducing overhead, consolidating data centers, eliminating redundant networks and standardizing applications. Therefore, the report recommended that the federal government consolidate IT infrastructure. In the non-federal sector, the IT council report indicated that IBM had cut its overall IT expenses in half over the past five years through consolidation and standardization. In addition, the National Association of State Chief Information Officers (NASCIO) identified consolidation/optimization, through centralizing or consolidating services, operations, resources, infrastructure and data centers, as its No. 1 priority for 2011.
August 8, 2011
5 cool tools for cloud management
Testing reveals powerful new ways to spin up, protect, manage and backup cloud services
Cloud management tools are as varied as cloud uses. For this test, we chose five tools that each attack cloud management from a different perspective.
We looked at Symplifed for identity management exclusively targeted to SaaS-based apps, Puppet Labs for virtual machine deployment, HP for building and managing private clouds, Abiquo for IaaS platform management and TurnKey Linux for low-cost cloud backup.
Cloud complexity
Symplified Identity Management and SinglePoint
Symplified Identity Manager (SIM) provides administrators with a way to deal with Web-based application identity and passwords. This is done through an "identity router" called SinglePoint. The SIM product, in turn, manages identity for users with SaaS applications.
The SaaS applications covered include LinkedIn, Google Apps (the business version), Salesforce and many more. Almost any Web app that has a login screen can be included, using HTTP federation.
With SAML-based SIM and SinglePoint, all of the construction of authentication is "behind the scenes" to users. Administratively, we found SIM and SinglePoint to be a little tough, but very usable once constructed.
SIM develops an identity vault that stores passwords and identities for selected websites. These identities can be linked to local in-house user stores such as LDAP or Active Directory via the included SimpleLink connector.
The identities and passwords are stored in a centralized vault that is encrypted with AES128, using a rotating encryption key. The vault is stored on the Identity Router, which can be installed locally or hosted by Symplified (ours was hosted).
The identity router becomes a middleman to connect the user to the apps. Single sign-on (SSO), access control and centralized auditing are some of the benefits of SinglePoint. But it must be emphasized that Symplified is only for Web-based apps.
Setup and configuration
SIM needs a virtual machine (VM) to connect your credentials (like Active Directory or LDAP) to the Symplified cloud-hosted proxy authentication system. The VM instance uses CentOS 5+ or Red Hat Linux. We used CentOS and only installed an SSH server on it.
After that we installed SimpleLink RPM (Red Hat Package Manager) kit. Symplified usually helps customers with this portion of the install; we tried doing it ourselves. After we had a setup call, we got help linking our Active Directory to Symplified's cloud platform. There is a local Web interface for uploading the credentials. The SimpleLink server then connects our infrastructure with its Identity Router(s), and behind the scenes SimpleLink uses openVPN to secure the channels.
SinglePoint Portal is the cloud-based admin Web portal where everything is set up and configured. SinglePoint Portal is a Flash-based app and is responsive, although the fact that it uses Flash will give some organizations security concerns. The portal allowed us to add user stores or entries of logon IDs and passwords. We could create application groups and links to the applications themselves. HTTP Federation or SAML type apps can be discovered, but it's also possible to manually configure HTTP-based apps that log users on.
Subscribe to:
Posts (Atom)
