Internet Security Alliance Review 7-18-09

July 18, 2009 by ADMIN

Share |

July 10, IDG News Service – Twitter suspends accounts of users with infected computers. Twitter is suspending the accounts of some users whose computers have fallen victim to a well-known piece of malicious software that has targeted other sites such as Facebook and MySpace. The malware, Koobface, is designed to spread itself by checking to see if person is logged into a social network. It will then post fraudulent messages on the person’s Twitter account trying to entice friends to click the link, which then leads to a malicious Web site that tries to infect the PC. The popular microblogging service has had a strong impact as a new communication platform, such as providing on-the-ground insight from participants in the recent protests over the presidential election in Iran. But it is also being targeted by fraudsters and hackers, who using it as a way to infect people’s PCs with malicious software. Twitter is the latest site to be targeted by a Koobface variant, said Rik Ferguson, senior security advisor for Trend Micro. Other sites have included Bebo, Hi5, Friendster and LiveJournal, according to the U.S. Computer Emergency Readiness Team. “Koobface has a long, inglorious history and has been relatively successful at infecting machines,” Ferguson said. At least a couple hundred accounts have been infected by Koobface’s latest efforts, according to Ryan Flores, an advanced threats researcher, writing on Trend’s blog. When it made its first appearance a couple of weeks ago on Twitter, Koobface was just sending out three shortened URLs (Uniform Resource Locators) leading to malware. Flores wrote that Koobface is sending out more bad links this time around. The use of URL shortening services on Twitter have made it difficult for people to tell what Web site they’ll end up at, Ferguson said. However, Twitter tools such as TweetDeck will show the full URL, which can help make people make a better security judgement, he said. Some of Koobface’s bad links have advertised, for example, videos of Michael Jackson, where the malware writers are trying to pique people’s interest in current news events, said Graham Cluley, senior technology consultant for Sophos. If a person followed the link, it would lead to a Web site asking the user to download an upgrade for their Flash multimedia players but is actually Koobface, he said. But Twitter has been fairly quick at shutting down accounts of people who are infected with Koobface and resetting their passwords, Cluley said. Malware has also spread on Twitter via fake accounts that have been registered using automated tools. Ferguson said Twitter could somewhat guard against that by sending a verification link to an e-mail address during registration, making it more difficult to register dummy accounts en masse. “That’s real low-hanging fruit for them to address,” Ferguson said. Koobface gets instructions from a command-and-control server, which tells the malware which messages to send out. Koobface is dangerous on other levels, however, as it can also steal data from a PC or download other malware. Security software suites should generally detect early versions of Koobface. However, its creators are crafting variants of the malware to try to escape detection, Ferguson said. They do that by obfuscating Koobface’s code and compressing it, which can make it more difficult for security software to spot.
Source: http://www.pcworld.com/businesscenter/article/168201/twitter_suspends_accounts_of_users_with_infected_computers.html

July 10, Bloomberg – (International) South Korea blocks sites to help end cyber attacks. South Korea blocked five Internet addresses to help end the cyber attacks that sought to cripple dozens of Web sites in the nation and the U.S. in the past week. Web sites based in the U.S., South Korea, Germany, Austria and Georgia may have spread malicious code, the Korea Communications Commission said today. The software, whose targets included Korea’s presidential office and the U.S. State Department, may begin self-destructing from July 10 by erasing the hard drives of infected computers, according to Seoul-based Ahnlab Inc., the nation’s largest maker of anti-virus software. South Korean and U.S. authorities are seeking to trace the attackers after they infected an estimated 20,000 computers using a tactic called “distributed denial of service” to crash Web sites by flooding them with data. While the scheme itself is common, the targeting of government sites and the coordinated nature of the assaults this week was unusual, according to some security-industry officials. “I believe they want to warn the government,” said Ken Kang, technical support director at Internet security firm Trend Micro Inc. in Taipei. “Most DDoS attacks are for a specific purpose — mostly it’s them wanting to make money — but this time the purpose was to attack the Korean government and the U.S. government.”
Source: http://www.bloomberg.com/apps/news?pid=newsarchive&sid=aOuT0TQyU9lw

July 10, Associated Press – (Kansas) Kansas audit raises computer security questions. A legislative audit in Kansas has raised questions about the security of State computer networks and whether agencies are vulnerable to cyber attacks like a recent one against U.S. government Web sites. The audit reviewed computer security issues at five State agencies and found some weak password controls and missing security patches for servers. And 39 percent of one unnamed agency’s passwords were cracked within five minutes using free software available on the Internet. Tests were performed on networks for the State pension system, the State treasurer’s office, the court system, the Department of Transportation, and the Board of Nursing. The audit did not specify the results for each agency for security reasons. Seventeen of 133 servers scanned at the five agencies, or 13 percent, were missing at least one security patch for their operating systems, the audit found. Forty-nine were missing at least one patch for their software applications, and 30 were missing three or more patches for applications. Even with encryption, after 24 hours, the lowest percentage of cracked passwords was 23 percent. Three of the four agencies that had their passwords tested had either weak policies or weak network password settings, and the fourth was weak in both areas, the audit said. Even the agency that had relatively strong policies and settings had 35 percent of its passwords cracked within five minutes. Source: http://www.kansascity.com/news/breaking_news/story/1317431.html

July 11, CIO.com – (International) Apple still mute to iPhone complaints. The iPhone 3GS has been an undeniable marketplace hit since its release on June 19, and will likely continue to soar in sales despite three customer complaints that have surfaced recently. The big three gripes: the iPhone 3GS battery life is dismal, the 3GS overheats, and there is a serious SMS vulnerability. The most serious of the iPhone’s problems concerns a new SMS vulnerability that could allow an attacker to remotely install and run unsigned software code with root access to the iPhone. A security expert, who hacked a Mac via Safari in 10 seconds at this year’s PWN2Own contest, said in a presentation that the weakness is in the way iPhones handle text messages. The seriousness of this problem has spurred Apple’s intent; Apple is reportedly working on a patch that should be available later this month. “I believe that the SMS vulnerability may be the most pressing, since stories of hijacked, zombie, misbehaving iPhones are more likely to leave a long-lasting negative impression than are the heat and battery life issues,” said a Forrester analyst.
Source: http://www.pcworld.com/article/168265/apple_still_mute_to_iphone_complaints.html

July 13, Computerworld – (International) Researcher says IE bug could spread quickly. A critical ActiveX vulnerability used by hackers to exploit Microsoft Corp.’s Internet Explorer browser is a prime candidate for another Conficker-scale attack, security experts said. On July 6, just hours after security companies reported that thousands of compromised sites were serving up exploits, Microsoft acknowledged the flaw in the ActiveX control that can be accessed using IE. The bug has been used by hackers since at least June 9. Microsoft said it will issue a patch for the flaw on July 14. The vulnerability “exposes the whole world and can be exploited through the firewall,” said the chief research officer at security software vendor AVG Technologies USA Inc. “That’s better than Conficker, which mostly did its damage once it got inside a network.” Conficker exploited a Windows flaw that Microsoft had thought dire enough to fix outside its usual update schedule in October 2008. The worm exploded into prominence in January, when a variant infected millions of machines that remained unpatched. Microsoft confirmed the latest flaw shortly after security researchers at Danish firms CSIS Security Group AS and Secunia said that thousands of hacks of legitimate Web sites over the July 4 weekend had exploited the bug. The hackers took advantage of the bug to reroute users to a malicious site, which in turn downloads and launches a multiexploit hacker tool kit.
Source: http://www.computerworld.com/s/article/340930/Researcher_Says_IE_Bug_Could_Spread_Quickly?taxonomyId=17

July 13, The Register – (International) U.S. State Dept. workers beg Clinton for Firefox. U.S. State Department workers have begged the U.S. Secretary of State to let them use Firefox. “Can you please let the staff use an alternative web browser called Firefox?” a worker asked the U.S. Secretary of State during the July 10 State Department town hall meeting. “I just moved to the State Department from the National Geospatial Intelligence Agency and was surprised that State doesn’t use this browser. It was approved for the entire intelligence community, so I don’t understand why State can’t use it. It’s a much safer program.” Presumably, the State Department is using Microsoft’s Internet Explorer. The State Department has yet to respond to the questions about its Firefox-less browsing mandate.
Source: http://www.theregister.co.uk/2009/07/13/firefox_and_us_state_department/

July 13, BBC News – (International) Snooping through the power socket. Security researchers found that poor shielding on some keyboard cables means useful data can be leaked about each character typed. By analyzing the information leaking onto power circuits, the researchers could see what a target was typing. The attack has been demonstrated to work at a distance of up to 15m, but refinement may mean it could work over much longer distances. “Our goal is to show that information leaks in the most unexpected ways and can be retrieved,” wrote two individuals of security firm Inverse Path, in a paper describing their work. The research focused on the cables used to connect PS/2 keyboards to desktop PCs. Usefully, said the pair, the six wires inside a PS/2 cable are typically “close to each other and poorly shielded.” This means that information travelling along the data wire, when a key is pressed, leaks onto the earth (ground in the U.S.) wire in the same cable. The earth wire, via the PC’s power unit, ultimately connects to the plug in the power socket, and from there information leaks out onto the circuit supplying electricity to a room. Even better, said the researchers, data travels along PS/2 cables one bit at a time and uses a clock speed far lower than any other PC component. Both these qualities make it easy to pick out voltage changes caused by key presses. A digital oscilloscope was used to gather data about voltage changes on a power line and filters were used to remove those caused by anything other than the keyboard.
Source: http://news.bbc.co.uk/2/hi/technology/8147534.stm

July 13, Enterprise Security Today – (International) New York official: Tagged site stole identities. New York’s attorney general charged on July 9 that Tagged.com stole the identities of more than 60 million Internet users worldwide, by sending e-mails that raided their private accounts. The attorney general said he plans to sue the social networking Web site for deceptive marketing and invasion of privacy. “This company stole the address books and identities of millions of people,” the attorney general said in a statement. “Consumers had their privacy invaded and were forced into the embarrassing position of having to apologize to all their e-mail contacts for Tagged’s unethical, and illegal, behavior.” Started in 2004 by Harvard math students, Tagged calls itself a “premier social-networking destination.” The California-based company claims to be the third-largest social networking site after Facebook and MySpace, with 80 million registered users. The attorney general said Tagged acquired most of them fraudulently, sending unsuspecting recipients e-mails that urged them to view private photos posted by friends. When recipients tried to access the photos, the attorney general said they would in effect become new members of the site, without ever seeing any photos. Recipients’ e-mail address books would then be lifted, the attorney general said.
Source: http://www.enterprise-security-today.com/story.xhtml?story_id=67676&full_skip=1

July 13, Softpedia – (International) DDoS worm starts damaging infected systems. The malware responsible for the recent denial of service attacks against many U.S. and South Korean government and commercial websites has received an update to damage the computers it infected. Starting with July 10, the worm began to rewrite HDD Master Boot Records (MBR), leaving the zombie computers unbootable. Recently, it was reported that serious distributed denial of service (DDoS) attacks had affected the stability of many websites operated by large organizations or the governments of United States and South Korea. Experts later concluded that a botnet of over 60,000 computers, infected with an updated Mydoom variant, had been used to launch the attacks. Security researchers from FireEye warn that, even though the DDoS has stopped, the impact of this malware might prove to be a lot bigger. Everything started with a DDoS component being shipped to computers infected with a particular strain of Mydoom, a worm dating back to the beginning of 2004. The attackers planned for the DDoS to start on July 4 (Independence Day) and to end on July 10. The worm drops a file called mstimer.dll and loads it as a windows service named “MS Timer Service.” The purpose of this component is to check the date and if it matches July 10 to execute yet another file, called wversion.exe. Originally, wversion.exe contained instructions to uninstall the timer service, suggesting that its authors intended for it to self-destroy. However, a malware researcher at FireEye explains that another, much more destructive version of wversion.exe was deployed shortly before July 10. The new version features a three-step plan to destroy data on the infected computers. First, it rewrites 512 bytes of every hard disk in the system, not only the one used to boot from. The first 512 bytes of a hard disk are used to store the Master Boot Record and Volume Boot Record, which are employed to store information about the file system and partitions. The new data written over the MBR and VBR includes a string reading “Memory of the Independence Day.” The second destructive step targets the personal files and documents stored on the hard disks. The component searches for files with one of 37 extensions, including .pdf, .doc, .ppt, and proceeds to compressing and password-protecting every one of them.
Source: http://news.softpedia.com/news/DDoS-Worm-Starts-Damaging-Infected-Systems-116551.shtml

July 13, DarkReading – (International) Researchers to release tool that silently hijacks EV SSL sessions. If a user thinks they are safe from man-in-the-middle (MITM) attacks as long as they are visiting an Extended Validation SSL (EV SSL) site, then think again: Researchers will release a new tool at Black Hat USA later this month that lets an attacker hack into a user’s session on an EV SSL-secured site. Two researchers, who in March first demonstrated possible MITM attacks on EV SSL at CanSecWest, will release for the first time their proxy tool at the Las Vegas conference, as well as demonstrate variations on the attacks they have discovered. The Python-based tool can launch an attack even with the secure green badge displaying on the screen: “It doesn’t alert the user that anything fishy is going on,” says the principal consultant at Intrepidus and one of the researchers. All it takes is an attacker having a non-EV SSL certificate for a Website, and he or she can hijack any SSL session that connects to it. That is because the Web browser treats the EV SSL certificate with the same level of trust as an SSL domain-level certificate. “There’s no differentiation between the two certs beyond the green badge,” the consultant says. If an attacker has a valid domain-level certificate, he can spoof EV SSL connections and execute an MITM attack, with access and view of all sensitive data in the session, all while the unsuspecting victim still sees that reassuring green badge displayed by his browser.
Source: http://www.darkreading.com/security/app-security/showArticle.jhtml?articleID=218500176July

July 14, IDG News Services – (International) HTC smartphones left vulnerable to Bluetooth attack. If a user has an HTC smartphone running Windows Mobile 6 or Windows Mobile 6.1, the user may want to think twice before connecting to an untrusted device using Bluetooth. A vulnerability in an HTC driver installed on these phones can allow an attacker to access any file on the phone or upload malicious code using Bluetooth, a Spanish security researcher warned on July 14. “HTC devices running Windows Mobile 6 and Windows Mobile 6.1 are prone to a directory traversal vulnerability in the Bluetooth OBEX FTP Service,” a security researcher said in an e-mail exchange. HTC handsets running Windows Mobile 5 are not affected. For the attack to work, the targeted device must have Bluetooth enabled and file sharing over Bluetooth activated. “This connection can be done either by standard Bluetooth pairing or taking advantage of the Bluetooth MAC spoofing attack,” the researcher said, referring to a process where the attacking device attempts to convince the target that it is another device on its list of paired devices. The directory traversal vulnerability allows an attacker to move from a phone’s Bluetooth shared folder into other folders, giving them access to contact details, e-mails, pictures or other data stored on the phone. They can use this access to read files or upload software, including malicious code. Because the driver, obexfile.dll, is an HTC driver, only handsets from the company are affected. However, HTC is the world’s largest manufacturer of Windows Mobile handsets, selling phones under its own brand as well as making phones under contract for other companies. That means millions of users are potentially vulnerable.
Source: http://www.pcworld.com/businesscenter/article/168358/htc_smartphones_left_vulnerable_to_bluetooth_attack.html

July 14, InformationWeek – (International) Firefox 3.5 vulnerability rated ‘highly critical.’ US-CERT on July 14 warned about vulnerability in the new Firefox 3.5 browser that could allow a remote attacker to execute malicious code. Proof-of-concept exploit code was posted on July 13 on Milw0rm.com, an exploit code aggregation site, so it is likely that the vulnerability is being actively exploited. The vulnerability is related to the way Firefox 3.5 processes JavaScript code. Mozilla has acknowledged the vulnerability and has a fix that is being tested. “The vulnerability can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,” the company said on its security blog. “The vulnerability can be mitigated by disabling the JIT in the JavaScript engine.
Source: http://www.informationweek.com/news/internet/security/showArticle.jhtml?articleID=218500486

July 14, IDG News Service – (International) Probe into cyberattacks stretches around the globe. British authorities have launched an investigation into the recent cyberattacks that crippled Web sites in the U.S. and South Korea, as the trail to find the perpetrators stretches around the world. On July 13, the Vietnamese security vendor Bach Khoa Internetwork Security (Bkis) said it had identified a master command-and-control server used to coordinate the denial-of-service (DDoS) attacks, which took down major U.S. and South Korean government Web sites. A command-and-control server is used to distribute instructions to zombie PCs, which form a botnet that can be used to bombard Web sites with traffic, rendering the sites useless. The server was on an IP (Internet Protocol) address used by Global Digital Broadcast, an IP TV technology company based in Brighton, England, according to Bkis. That master server distributed instructions to eight other command-and-control servers used in the attacks. Bkis, which managed to gain control of two of the eight servers, said that 166,908 hacked computers in 74 countries were used in the attacks and were programmed to get new instructions every three minutes. But the master server is not in the U.K.; it is in Miami, according to one of the owners of Digital Global Broadcast, who spoke to IDG News Service on July 13. The server belongs to Digital Latin America (DLA), which is one of Digital Global Broadcast’s partners. Digital Global Broadcast was notified of a problem by its hosting provider, C4L, the owner said. His company has also been contacted by the U.K.’s Serious Organized Crime Agency (SOCA). A SOCA official said she could not confirm or deny an investigation.
Source: http://www.computerworld.com/s/article/9135532/Probe_into_cyberattacks_stretches_around_the_globe?taxonomyId=17

July 14, The Register – (International) BlackBerry update bursting with spyware. An update pushed out to BlackBerry users on the Etisalat network in the United Arab Emirates appears to contain remotely-triggered spyware that allows the interception of messages and emails, as well as crippling battery life. Sent out as a WAP Push message, the update installs a Java file that one curious customer decided to take a closer look at, only to discover an application intended to intercept both email and text messages, sending a copy to an Etisalat server without the user being aware of anything beyond a slightly excessive battery drain. It was, it seems, the battery issue that alerted users to something being wrong. Closer examination seems to indicate that all instances of the application were expected to register with a central server, which could not cope with the traffic — thus forcing all the instances to repeatedly attempt to connect while draining the battery. A more phased reporting system might have escaped detection completely. The update is labelled: “Etisalat network upgrade for BlackBerry service. Please download to ensure continuous service quality.” The signed JAR file, when opened, reveals an application housed in a directory named “/com/ss8/interceptor/app”, which conforms to the Java standard for application trees to be named the reverse of the author’s URL. No one from Etisalat, RIM, or SS8 is saying anything about the issue, despite the fact that the application appears remarkably difficult to remove.
Source: http://www.theregister.co.uk/2009/07/14/blackberry_snooping/

July 14, Network World – (International) Latest malware trick: outsourcing quality assurance. Creators of Waledac malware enlisted the Conficker botnet as a tool to spread malware of their own, marking the first time Conficker was made available for hire, according to Cisco’s mid-year security report. This was symptomatic of a wider trend Cisco noted of malware purveyors using established business practices to expand their illegal enterprises. Cisco likened the arrangement between Waledac and Conficker to a partner ecosystem, a term Cisco uses to describe its collaboration with other vendors. Waledac used the Conficker distribution channel to send spam and to expand its own botnet, Cisco says. Malware distributors are also outsourcing their quality assurance programs to services provided by the likes of virtest.com, Cisco says. For a fee the site tests malicious files against the latest versions of 26 virus-scanning software products to determine whether the anti-virus software can detect the malware. Cisco says running the malware through this screening results in malware that is 10 to 20 times more effective than it would be otherwise, and frees up the attackers to work on other products rather than test how detectable their current exploits are. Source: http://www.networkworld.com/news/2009/071409-cisco-security.html

July 15, Reuters – (International) French workers threaten to blow up Nortel factory. Workers at the French arm of telecommunications manufacturer Nortel have threatened to blow up their factory unless they secure decent layoff terms, but gas cylinders placed around the plant were empty, a newspaper said. French daily Le Parisien said on July 15 the workers had placed gas cylinders in front of the plant in the Yvelines area near Paris, where 480 jobs are set to be axed following bankruptcy proceedings. In the second threat by French workers to blow up a factory in a week, the paper said the workers had threatened to stage an explosion as early as July 15 if their demands were not met, but said the gas cylinders were empty. No immediate comment was available from Toronto-based Nortel, once the largest North American telecommunications equipment manufacturer but which filed for bankruptcy protection in Canada and the United States in January. The workers were also bitter about the way the authorities handling the case in France were proceeding, the paper said.
Source: http://www.reuters.com/article/marketsNews/idUSLF8443920090715

July 15, Ars Technica – (National) FBI charges satellite descramblers under DMCA. The FBI has set its sights on satellite descramblers, charging three individuals behind the Viewsat satellite receiver with conspiracy to violate the Digital Millennium Copyright Act (DMCA). The indictment was unsealed this week after the owner of Viewtech was arrested in San Diego, where he is currently being held without bail. Several associates were also arrested. The group faces up to five years in prison and a $250,000 fine each. Viewsat is a free-to-air (FTA) satellite receiver box that claims to provide users with access to free satellite programming, such as religious and cultural content. However, as most Viewsat customers also know, the device is engineered in such a way that makes it simple for users to grab what is otherwise designated as for-pay satellite programming. All that is required is for the FTA boxes to spoof DISH’s smartcards so that the DISH Network can see that the boxes are authorized. The satellite companies know that this practice is not particularly rare, so they occasionally re-encrypt their signals and send out new smartcards to legitimate customers. In this case, DISH Network started rolling out new encryption known as either “Nagra 3” or “rom 240,” this update “dramatically” reducing the sales of Viewsat receivers, according to the indictment document. By March of 2008, the defendant began working with the other two defendants to circumvent this new encryption. The defendant allegedly agreed to reimburse their expenses and finance research on how to crack Nagra 3, while the other two worked together and recruited more hackers for the project.
Source: http://arstechnica.com/tech-policy/news/2009/07/fbi-charges-satellite-descramblers-with-conspiracy.ars

July 15, Washington Post – (International) Spammers, virus writers abusing URL shortening services. Purveyors of spam and malicious software are taking full advantage of URL-shortening services like bit.ly and TinyURL in a bid to trick unwary users into clicking on links to dodgy and dangerous Web sites. Fortunately, with the help of a couple of tools and some common sense, most Internet users can avoid these scams altogether. According to alerts from anti-virus vendors McAfee, Symantec and Trend Micro, the latest to abuse these services is the Koobface worm, which targets users of social networking sites like Facebook (Koobface is an anagram of Facebook) and Myspace. It is now also spreading via microblogging service Twitter. Koobface arrives as a message that urges users to click on a link to a video, which invariably leads to a site that prompts the visitor to install a missing video plug-in. The fake plug-in turns the user’s system into a bot that can be used for a variety of criminal purposes, from spamming to attacking other computers and spreading the worm. At the same time, URL shortening services appear to be fueling a massive ongoing commercial spam campaign.
Source: http://voices.washingtonpost.com/securityfix/2009/07/spammers_virus_writers_abusing.html?wprss=securityfix

July 15, Enterprise Security Today – (International) Researchers rate all six Microsoft patches as critical. Microsoft on July 14 released six bulletins as part of its monthly patch cycle. Three of the bulletins cover critical flaws, including two unpatched zero-day vulnerabilities. Three other bulletins address important risks that security researchers said can quickly escalate to critical. The CTO of Qualys said Microsoft’s advisories should be addressed immediately because they allow an attacker to take complete control of a victim’s computer. Microsoft proxy server ISA 2006 has a vulnerability rated as important that allows remote unauthenticated users to access the server. However, paired with a knowledge of the administrator’s username, attackers can take full control of the server. Because administrator usernames are often easy to guess, the CTO said, this vulnerability deserves special attention if IT organizations are using ISA with the Radius configuration. Likewise, MS09-030 is an advisory for the Publisher component in the MS Office 2007 suite rated as important, but can be used to take full control of a system if the victim is logged in as administrator. If an organization uses Publisher or has it installed as part of Office 2007, this should be treated as critical as well, the CTO said.
Source: http://www.enterprise-security-today.com/story.xhtml?story_id=67785

July 17, US-Cert – US-CERT Current Activity - Mozilla Firefox 3.5 Vulnerability. The Mozilla Foundation has released Firefox 3.5.1 to address a vulnerability. This vulnerability is due to an error in the way the Just-in-Time (JIT) compiler returns from native functions. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. US-CERT encourages users and administrators to review Mozilla Foundation Security Advisory 2009-41 and upgrade to Firefox 3.5.1 or apply the suggested workaround provided in the advisory. Additional information can also be found in the Vulnerability Notes Database.
Relevant Url(s):
http://www.mozilla.org/security/announce/2009/mfsa2009-41.html
http://www.kb.cert.org/vuls/id/443060
http://www.mozilla.com/

Download a complete copy of The Cyber Secuirty Social Contract: Policy Recommendations for the Obama Administration and 111th Congress.

Learn More About the ISAlliance

The Internet Security Alliance (ISAlliance) was created to provide a forum for information sharing and thought leadership on information security issues. The ISAlliance represents corporate security interests before legislators and regulators, in so doing the alliance aims to identify and standardize best practices in Internet security and network survivability, while creating a collaborative environment to develop and implement information security solutions.

* * *

Stay Informed With ISR News Feeds and Email Alerts Here:

The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com

These icons link to social bookmarking sites where readers can share and discover new web pages.