Zarquon
Jan 19th 2010, 05:24 AM
...In a survey of 443 companies and government agencies published last month, the Computer Security Institute found that 64 percent reported malware infections, up from 50 percent the previous year. The financial loss from security breaches was $234,000 on average for each organization...
Often, malware infections are a result of high-tech twists on old-fashioned cons. One scam, involves small U.S.B. flash drives, left in a company parking lot, adorned with the company logo. Curious employees pick them up, put them in their computers and open what looks like an innocuous document. In fact, once run, it is software that collects passwords and other confidential information on a user’s computer and sends it to the attackers. More advanced malware can allow an outsider to completely take over the PC and, from there, explore a company’s network...
Recently, security experts have started seeing malware that surreptitiously switches on a cellphone’s microphone and camera. “It turns a smartphone into a surveillance device,” said Mark D. Rasch, a computer security consultant in Bethesda, Md...
The complexity of software code from different suppliers, as it intermingles in corporate networks and across the Internet, also opens the door to security weaknesses that malware writers exploit..
The software products themselves, they say, are riddled with vulnerabilities — thousands of such flaws are detected each year across the industry.
The long-term answer, some experts assert, lies in setting the software business on a path to becoming a mature industry, with standards, defined responsibilities and liability for security gaps, guided by forceful self-regulation or by the government.
Source (http://www.nytimes.com/2010/01/18/technology/internet/18defend.html?pagewanted=all)
I found the last bit to be rather interesting, in that it is rather fishy that all those vulnerabilities are identified annually and yet they are only fixed belatedly when still newer ones crop up and these firms always seem to be one-step behind supposedly independent/uncoordinated, collegiate/upstart, and few hackers, and the exploitative advantage these firms are generating from new bogeymen of 'cyberterrorists' form relatively backward countries like PRC.
I can see how without any oversight and an obvious vested interest perhaps these security companies may be responsible for 'accidentally leaking' their codes or worser still creating these threats themselves .
Often, malware infections are a result of high-tech twists on old-fashioned cons. One scam, involves small U.S.B. flash drives, left in a company parking lot, adorned with the company logo. Curious employees pick them up, put them in their computers and open what looks like an innocuous document. In fact, once run, it is software that collects passwords and other confidential information on a user’s computer and sends it to the attackers. More advanced malware can allow an outsider to completely take over the PC and, from there, explore a company’s network...
Recently, security experts have started seeing malware that surreptitiously switches on a cellphone’s microphone and camera. “It turns a smartphone into a surveillance device,” said Mark D. Rasch, a computer security consultant in Bethesda, Md...
The complexity of software code from different suppliers, as it intermingles in corporate networks and across the Internet, also opens the door to security weaknesses that malware writers exploit..
The software products themselves, they say, are riddled with vulnerabilities — thousands of such flaws are detected each year across the industry.
The long-term answer, some experts assert, lies in setting the software business on a path to becoming a mature industry, with standards, defined responsibilities and liability for security gaps, guided by forceful self-regulation or by the government.
Source (http://www.nytimes.com/2010/01/18/technology/internet/18defend.html?pagewanted=all)
I found the last bit to be rather interesting, in that it is rather fishy that all those vulnerabilities are identified annually and yet they are only fixed belatedly when still newer ones crop up and these firms always seem to be one-step behind supposedly independent/uncoordinated, collegiate/upstart, and few hackers, and the exploitative advantage these firms are generating from new bogeymen of 'cyberterrorists' form relatively backward countries like PRC.
I can see how without any oversight and an obvious vested interest perhaps these security companies may be responsible for 'accidentally leaking' their codes or worser still creating these threats themselves .