Cyber threats May 28, 2012
7. May 29, Nextgov – (National) UK researchers discover backdoor in American military chip. United Kingdom (U.K.)-based security researchers found a backdoor “deliberately” inserted into an American military chip to help attackers gain unauthorized access and reprogram its memory, according to a draft research paper. A researcher at Cambridge University discovered a military-grade silicon device made by California-based Microsemi Corp., the ProASIC3 A3P250, contained a glitch that would allow individuals to remotely tweak its functions. He collaborated with a researcher at U.K.-based Quo Vadis Labs, which researches sensor technology, and found “proof that the backdoor was deliberately inserted and even used as a part of the overall security scheme.” The duo did not disclose details, citing a “confidentiality agreement.” The backdoor is “close to impossible to fix on chips already deployed” because software patches cannot fix the bugs. The holes can only be removed by removing all such chips installed in systems, the duo said. Microsemi’s aggregate net sales to defense and security users represented about 29 percent of total net sales in 2012, according to its most recent quarterly regulatory filing. The device in question is “heavily marketed to the military and industry,” the draft report states. Source: http://www.nextgov.com/defense/2012/05/uk-researchers-discover-backdoor-american-military-chip/55949/
Information Technology Sector
38. May 29, Homeland Security News Wire – (International) Malware intelligence system allow organizations to share threat information. As malware threats expand into new domains and increasingly focus on industrial espionage, Georgia Tech researchers are launching a new tool to help battle the threats: a malware intelligence system that will help corporate and government security officials share information about the attacks they are fighting. A Georgia Tech news release reports the system, known as Titan, will be at the center of a security community which will help create safety in numbers as companies large and small add their threat data to a knowledge base that will be shared with all participants. Operated by security specialists at the Georgia Tech Research Institute, the system builds on a threat analysis foundation — including a malware repository that analyzes and classifies an average of 100,000 pieces of malicious code each day. Source: http://www.homelandsecuritynewswire.com/dr20120529-malware-intelligence-system-allow-organizations-to-share-threat-information
39. May 28, IDG News Service – (International) Researchers identify Stuxnet-like malware called ‘Flame’. A new, highly sophisticated malware threat predominantly used in cyberespionage attacks against targets in the Middle East was identified and analyzed by researchers from several security companies and organizations. According to the Iranian Computer Emergency Response Team, the new piece of malware might
be responsible for recent data loss incidents in Iran. Flame, as the Kaspersky researchers call it, is a very large attack toolkit with many individual modules. It can perform a variety of malicious actions, most of which are related to data theft and cyberespionage. Among other things, it can use a computer’s microphone to record conversations, take screenshots of particular applications when in use, record keystrokes, sniff network traffic, and communicate with nearby Bluetooth devices. One of the toolkit’s first versions was likely created in 2010 and its functionality was later extended by leveraging its modular architecture, said a chief malware expert at Kaspersky Lab. Flame spreads to other computers by copying itself to portable USB devices and also by exploiting a now-patched Microsoft Windows printer vulnerability that was also leveraged by Stuxnet. Source: http://www.computerworld.com/s/article/9227524/Researchers_identify_Stuxnet_like_malware_called_Flame
40. May 28, H Security – (International) Critical hole in Seagate BlackArmor NAS. Seagate’s BlackArmor NAS server is vulnerable to having its administrative password reset by anyone with access to it and a particular URL. The BlackArmor range of network-attached storage devices is aimed at small businesses and offers storage and backup options from Windows PCs and Mac OS X systems, ranging from 1TB to 12TB of hard disk media. The problem, documented by the U.S. Computer Emergency Readiness Team, involves an unauthenticated attack directly accessing an address where they will be given the opportunity to reset the device’s administrator password. There is no current solution to the problem. Source: http://www.h-online.com/security/news/item/Critical-hole-in-Seagate-BlackArmor-NAS-1585283.html
Internet Alert Dashboard
To report cyber infrastructure incidents or to request information, please contact US-CERT at sos@us-cert.gov or visit their Web site: http://www.us-cert.gov Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and Analysis Center) Web site: https://www.it-isac.org [Return to top]


