Opinion

CanSecWest: Let’s talk about non-targeted attacks

Today is the last day of CanSecWest – a security conference taking place in Vancouver, Canada.
On Wednesday I filled in for Costin Raiu and talked about our forensics work into Duqu’s C&C servers.

As I’m writing this, Google Chrome just got popped. Again. The general feeling is that $60k, even with a sandbox escape, isn’t a whole lot of money for a Chrome zero-day.
So, to see multiple zero-days against Chrome is quite the surprise, especially when considering the browser’s Pwn2Own track record.

Separately, I found the Q&A session following Facebook’s Alex Rice’s presentation immensely intriguing.

Alex presented on Facebook’s social CAPTCHA, a secondary authentication step that uses friends’ photographs that kicks in when Facebook suspects a compromised/phished account.

The introduction of this system has meant that mass Facebook phishing attacks have gone away. They’ve become ineffective.

However, during the Q&A, there were a lot of comments about how this system can be circumvented in a targeted attack.

Clearly, any system which simply eradicates an entire ‘class’ of attack, while not really impacting user experience, should be considered a huge success.

Facebook should be applauded for their solution, but instead they mostly got criticism from the audience.

Seeing so much criticism is extremely worrisome. We shouldn’t be dismissing ideas or systems simply because they’re not particularly effective against targeted attacks. It’s not always black or white.

After all, the vast majority of (cyber-)crime is not targeted. Let’s not forget that.

CanSecWest: Let’s talk about non-targeted attacks

Your email address will not be published. Required fields are marked *

 

Reports

MoonBounce: the dark side of UEFI firmware

At the end of 2021, we inspected UEFI firmware that was tampered with to embed a malicious code we dub MoonBounce. In this report we describe how the MoonBounce implant works and how it is connected to APT41.

Subscribe to our weekly e-mails

The hottest research right in your inbox