<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Defending against Advanced Persistent Threats ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-390866/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-22T01:48:28-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Something to think about  APT's indefinite hacket attack?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3664299]]></link>
        <description><![CDATA[is it descriptive? Is the constant use and marketing hype cause it to be debased.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3664299]]></guid>
        <dc:creator><![CDATA[bvergara@...]]></dc:creator>
        <pubDate>Fri, 27 Apr 2012 06:21:50 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Quite so.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3663083]]></link>
        <description><![CDATA[This is why we have quarterly attempts on each other's networks.  The victors get bragging rights as well as an all expense weekend...  The losers also benefit by learning something new and are able to fix the hole.Four years ago, these exercises were a different story. both sides got their weekends and when they came back, there was work to do.  Eventually the networks hardened and now it's rare for there to be a victor.Bottom line:  The only defence against APT and any other threat is to acknowledge that mistakes are made, technology and methods advance, and that the constant improvement cycle must be nurtured.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3663083]]></guid>
        <dc:creator><![CDATA[Alpha_Dog]]></dc:creator>
        <pubDate>Mon, 23 Apr 2012 10:22:14 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That's the biggest danger in having non-tech managers of tech depts...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662981]]></link>
        <description><![CDATA[It's very easy to become complacent when every report is positive... it's easy to make the mistake of going from an inductive &quot;We haven't failed&quot; to a deductive &quot;We don't fail&quot;, implying &quot;We can't fail&quot;. I more than suspect it's easier to fall into this trap if one doesn't have a firsthand idea about the work that goes into &quot;not failing&quot;.Every time some company lets a pointy-haired one out to say &quot;We don't make mistakes&quot;, I know that's a company worth hedging against ]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662981]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Mon, 23 Apr 2012 00:07:04 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[LOL! (nt)]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662946]]></link>
        <description><![CDATA[-]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662946]]></guid>
        <dc:creator><![CDATA[Alpha_Dog]]></dc:creator>
        <pubDate>Sun, 22 Apr 2012 13:24:08 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I'm trying to get that client...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662961]]></link>
        <description><![CDATA[to at least write a book. But that client has already lost some partners under &quot;suspicious&quot; circumstances, and is terrified to go public!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662961]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sun, 22 Apr 2012 12:13:18 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[OMFG!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662941]]></link>
        <description><![CDATA[That's absolutely horrendous. It's a wonder Hollywood hasn't already grabbed that scenario, it's just so terrifying.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662941]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Sun, 22 Apr 2012 10:59:45 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[From what little...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662895]]></link>
        <description><![CDATA[education I've received from reading article an video links on Brian Krebs site, the attacker does little until his bots find a mark, and then it becomes like the anti-tank guided missile analogy. Even then most of the surveillance and data gathering algorithms need little console participation from the cracker. Just a few minutes of analysis and a few clicks on the console to pick the next path or launch a new exploit pack.If the goal is just to steal money, then yes, the man-in-the-middle takes more personal attention. Some of my victims were robbed by these dedicated teams so they no longer had the funds to do business anymore. They like to keep them on a string, like a marionette puppet, so they can keep them in the gutter, where they can watch them and keep them from bringing in the Calvary or gaining legal help.In one instance I had to spend about a month waiting for the victim to find a way to contact me that wasn't poisoned or completely under control of the crackers. This included the victim's email and telephone!  !!Once contacted, I was able to give them advice on defeating the communications interruptions, until we at least had that factor cleared up; the rest of the case isn't over yet.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662895]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 12:54:04 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Take it easy on him Ansu...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662877]]></link>
        <description><![CDATA[he's probably use to the &quot;we&quot; vernacular, because of all the &quot;team building&quot; going on in our institutions. I know I can't do without my cohorts!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662877]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 12:41:24 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Dear Wunderbarb...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662894]]></link>
        <description><![CDATA[you seem educated on the matter; surely you are aware that many HD capabilities in PC systems, especially cable ready system(MCard), were required since 2008 to be only government approved MPAA standards, hardware. When I ordered my HP CTO desktop, It had to have a DRM approved bios, video adapter, multi-media bay, tv card, digital tuner module, and blu-ray burner. Even the operating system was specially coded for this scheme, and a separate product key was required for both the operating system and the media center package!!Just a FYI in case you weren't already aware. It has been a three year nightmare for me, and has only abated somewhat since SP2 for Vista Home Premium x64 systems. I'm sure even Microsoft had to abandon this scheme, as I see separate hardware devices are becoming available for private builders. I saw many government approved OEM go down the poop-shute since then, but then the stock market crash didn't help.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662894]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 12:29:52 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I use the brute force method...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662893]]></link>
        <description><![CDATA[Before beginning work, I remove the machine from the network - flash the bios, hard drive/blu-ray( if firmware capable), and remove all internal cards. Then I use the factory diagnostic disk and/or Darik's Boot and Nuke to blast any malware that is hidden in any sectors marked as damaged by the criminals. These are the reason wiping and re-installing doesn't work. This article should have gone into more depth on this, but it was about avoiding it altogether, but was too simplistic.I then re-install, but password protect and disable the original owner, or hidden administrator(in home versions), after creating an administrator account. I close all sharing loopholes as much as is possible without destroying functionality. I make sure the machine's operating system is fully updated behind a UTM gateway appliance before applying all layered defenses. I am relying less and less on AV/AM real time protection, and more and more on solutions that rely on more preventative measures, like behavioral heuristics, whitelists, registry hacks, and host files. Using a good perimeter hardware device can't hurt, but of course that is only one peg on the board. Kernel based solutions have become paramount to keep the malware from manipulating the solution. If I do use a popular AV/AM product, it has to offer real time protection of some form or another on standard accounts, or else it goes into the trash.The Microsoft NT5 or 6 kernels are both pretty good defenses, so I always assure the client uses standard accounts to receive the full protection of the new NTFS security structure. I can usually re-install their hardware, and see if any alarms go off, in a reinfection attempt.Even if the defense fails - by this time, it is obvious the attackers are serious, and a more radical plan has to be developed. Some of them have success moving to Apple or Linux - but then again, the threat profile on those is growing as time progresses too!As far as testing, I just had to try over and over again, combinations of solutions for home and SMB clients, that probably don't interest enterprises. So I rarely go through the list of successful utilities I've found to be the best. I ran them concurrently and looked for stability issues, and kept an eagle eye on the event viewer to see if there were any conflicts.System resources haven't been a problem with the candidates I've selected, and all of them use separate technologies to be effective toward this goal. The only problem, is many of these utilities get too successful and the developers think they need to load bloat onto their creations, and they turn into huge suites, that become more and more ineffective or down right unusable - so my lists changes by the month!For one of the innovators, I am trying Drive Vaccine, which started out being a card based(hardware) solution, but evolved into a software product. This solution is &quot;supposed&quot; to be better than Steady State on XP, and Faronics Deep Freeze. Their web site actually explains why, and it is very complicated, so you may find it an interesting read! I'm trying to get one of my most vexing problem situations solved with this, if I can just get the client to cooperate with this test. I'll will definitely post somewhere on TR, if and when this occurs. I'm too busy to run my honey pot lab anymore - I've found my clients make the best test bed - bless their hearts. This is a cruel way of doing business, but since most of them are indigent at this time of their life, I'm just doing it for the pure pleasure of thwarting the criminals in their master plans.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662893]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 12:02:15 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[What is the difference?...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662875]]></link>
        <description><![CDATA[A DRM scheme which has been taken over by criminals within an organization(remember Sony?); is a threat you will not easily extract from a PC system. That fits my understanding of an APT to a tee! The only recourse is to either remove all HD related hardware, or buy a computer without it; and definitely get a clean operating system from Microsoft.Microsoft seems resigned to the problem, because they are offering free installation disks with SP1 to aid in fixing this issue. I've been struggling with DRM issues for three years, and found many of my clients with similar problems, were in even deeper hot water. I very vigorously suspect they fell into a trap built into every new computer that have these features if they are surmised to be a potential target. Almost all of them, are industrial developers, or are in the information chain to an innovator.At the very least - it is a giant fiasco, and failed DRM scheme for one of my clients. The other victims had obvious attack evidence upon forensic examination. It didn't take much sleuthing to see this, because the attackers are so brazen.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662875]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 11:12:10 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[That's good]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662865]]></link>
        <description><![CDATA[as long as you don't let it go to your heads. ]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662865]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 08:35:04 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[So basically...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662855]]></link>
        <description><![CDATA[If one prepares for APT attacks by doing the research, taking precautions, understanding the parts of the org that are targets, etc... we have not only dealt with the bored teen, but also the determined intruder.  To my mind it simply states that we need to secure our assets by conducting the kind of wargames we should have been doing anyway, and then act upon the information.  To be blunt, we have always dealt with security in this way and have never had a breach, even in quarterly exercises with our sister organization who knows our architecture and physical security.  Then again, we all cut our teeth on DoD and HIPAA, and now do aerospace.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662855]]></guid>
        <dc:creator><![CDATA[Alpha_Dog]]></dc:creator>
        <pubDate>Sat, 21 Apr 2012 08:27:31 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[DRM creates many spectres though...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662713]]></link>
        <description><![CDATA[It's basically a government approved trojan... but one hell of a whopper of one.Big enough to have all sorts of flaws included, providing attack vectors in abundance in all likelyhood.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662713]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Fri, 20 Apr 2012 13:16:17 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I would like to see an article on how to test layered services...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662705]]></link>
        <description><![CDATA[I don't know how to check which solutions can actually be layered, and how to see if they are tripping each other up... and how to see if they leave holes open by covering too many of the same things and leaving too many of the same things uncovered.Of course, that might be a more costly article to research.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662705]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Fri, 20 Apr 2012 13:12:08 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[A bit like an ATGM]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662695]]></link>
        <description><![CDATA[The ATGM doesn't do anything without an operator, but the operator is still just pointing and clicking.However, the social engineering threat and the whole persistence thing are definitely un-bot techniques. They are the human touch. Too bad it's the withering kind.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662695]]></guid>
        <dc:creator><![CDATA[AnsuGisalas]]></dc:creator>
        <pubDate>Fri, 20 Apr 2012 13:09:30 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Or a team...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662688]]></link>
        <description><![CDATA[in instances I've observed. The automated parts of the, surveillance, acquisition, and attack, are 97% of the operation, from a figure I just grabbed out of the air. The remote participation from the cracker is just administrative, to oversee their 'bot' minions and finalize some of the configuration, to assure continuation of operations. I've even seen the attackers leave notes on the victim's machines! Usually in their native language, but not always. They are a very confident and outlandish lot!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662688]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Fri, 20 Apr 2012 12:19:26 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[What do DRMs have to come in this story?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662612]]></link>
        <description><![CDATA[&gt;&gt;&gt;Thanks to MPAA, we now have hardware based DRMDo you mean Trusted Platform Module (TPM) specified by TCG?  If it is what you meant, then some facts.  Many recent PC boards have a TPM.  Nevertheless, it is not systematically the case.   Thus, no commercial DRM does use them.  BTW, I doubt that many generic software do use TPM.  If you mean, some of the new features of future Intel SoC, then it is just a protection of the video path that is decrypted within the chip.  No trap channel here. Else, what did you mean by such hardware?And of course, there is no relationship with APT.  APT will exploit any potential available vulnerabilities, together with social engineering.  And there are enough around without having to go to the paranoia of hidden trap doors.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662612]]></guid>
        <dc:creator><![CDATA[Wunderbarb]]></dc:creator>
        <pubDate>Fri, 20 Apr 2012 07:44:51 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[This is more accurate...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662359]]></link>
        <description><![CDATA[One thing about it though. I have several cautions:1. Don't buy refurb machines; one of my victims looks like they were targeted by the attacker this way - but they were probably being surveiled before this action, and an unsupecting partner took bad advice on the source of the purchase(the bad advice coming from a plant in an outside vendor). More likely the refurber was doping all the machines going through their doors - an infiltrator is always a possiblity here of course - in fact more likely than not.2. Beware of any machine that has a blu-ray, or HDMI output on display chip/adapter. I very strongly suspect someone in high places is setting traps in both the hardware and software DRM here. I'm especially suspect of Cyberlink, although I now trust none of them!3. Beware of being or cooperating with Microsoft Partners! Their network has been cracked and you will never know if you are actually connected through them without being on VPN to the partners web sources. I strongly suspect there are inside rats in that maze! We were able to get Microsoft to admit the were redirects placed by crackers somewhere on the web, with bad certificates sending the built in updater to poser sites. We can't get them to admit it publicly - however. I'm willing to risk it all to argue with anyone from Redmond to prove me wrong.Its time we started calling a spade a spade, and think outside the box to get to the bottom of this!I'm beginning to think the only hope my clients have is to completely isolate the machines that have intellectual property and records on them from the web, and use Live CDs for any other web access, on machines in a DMZ. But then, you got to ask - which Linux source do you trust? So far for me, it is SourceForge and/or On-Disk.com; but how long will that last?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662359]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Thu, 19 Apr 2012 11:29:00 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Looks like maybe you should have written this article!...(nt)]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662384]]></link>
        <description><![CDATA[]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-390866-3662384]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Thu, 19 Apr 2012 11:08:34 -0700</pubDate>
    </item>
    </channel>
</rss>

