During our last meeting, we discussed worms…and not those of the Mother Nature variety. Our
discussion took us on a short journey into the dark side of those who use their technical know-how in more Sithian ways to create a whole new class of worms – destructive ones not created by Mother Nature.

Ed Skoudis, one of the best security consultants in the field of information security, informs us of potentially worse things to come in the form of superworms.

What, you ask, is a superworm? Well, these critters are particularly destructive and very nasty. It’s suggested that some of their nastiness will come to us via attacks on multiple operating systems, versus past attacks that focused on one type of operating system. So, these worms might infect Microsoft and Linux and a host of other operating systems, all at the same time. While some of these have already been released on a small scale, thankfully, they haven’t made themselves too well-known.

Another way that havoc will be wreaked will be via attacks that exploit multiple vulnerabilities instead of a single one. In other words, these superworms will exploit multiple security holes. Interestingly enough, Nimda fell into this category.

Should these superworms evolve, we’ll probably be faced with a worm that will be so new that we won’t be able to patch our systems because the patches won’t be available. These are called zero-day exploits and this won’t be a good day for us should they grace us with their presence.

There are other ways that these worms will make our lives challenging, but for now, just note that the potential for chaos is all to real.

The good news is that so far these worms haven’t brought about the end of days. We’re still here able to carry on with our lives. However, should trends towards the creation of nastier worms continue, particularly with the anticipation of superworms, we might be in for some very interesting challenges ahead.

With that….have a great day!

Last week, I alluded to the suggestions by some that hackers were responsible for the 2003 blackout. This week, I’d like to pick up on that hacker and attacker theme a little more and look at some of their nasty tricks, many of which are aimed to separate you from your hard earned cash.

Back in the Stone Age (ok, not that far back, but you get my point) hackers knew a lot about computers. In fact, if you were called one, you probably wouldn’t have been too upset. They would dig deep to find out how computers worked. In fact, during that time they weren’t considered “evildoers.” They were the ones contacted when something went wrong with computers. And even today, some suggest that we should be careful not to malign all hackers because without them poking around and finding security loopholes, products might not become more secure. You can ponder this last statement and note that I report, you decide.

But let’s get back to those hackers who have crossed over to the dark side. Nowadays, these hackers and attackers are engaging in the same crimes committed in the offline world. Perhaps what’s even more unsettling is that many of today’s attackers and hackers don’t need to know much about computers. By using certain tools, these folks can carry out dangerous and sophisticated attacks and perhaps not even know the consequences of such attacks. But of course, there are those particularly dangerous ones who do know a lot about computers and put their knowledge to work in more Sithian ways.

So yes, hackers and attackers are busy. Consider this: 6 out of 10 American companies and government agencies have already been hacked. Yes, you read that correctly. Any company that accepts credit cards, allows us to view our bank accounts and/or offers products and services is vulnerable to hackers and attackers. But this isn’t just an American problem. Amazingly enough, in the pre-9/11 world, one survey found that an Australian company was spending more on its coffee needs than on information security. Say what? Hope that company isn’t holding any of my information! And that had better be some darn goooooooood coffee.

Since 9/11, companies have stepped up their security measures. As hackers and attackers are hunting for new victims, we must be ready to combat them.

As you probably know, there are more than a few nasty people out there who’d love to bring down a nation’s information infrastructure. And in August of 2003, it felt like someone did just that.

Do you recall where you were when the northeast blackout occurred in 2003? Well, I was in the thick of it in Michigan. On a beautiful and hot August day, my carpooler and myself thought we’d sneak out of work a little early. Upon getting in the car, I recall not being able to get our favorite radio station. Oh well, that was an easy fix, pop in a CD.

As we proceeded near the highway, we noticed all the traffic lights were out. Strange, we thought, but didn’t think to much of it…until we couldn’t move any further. The highways were jammed. We noticed that gas stations were crowded, but that was because they ran out of ice on what was a very hot day. What we also found out was that one couldn’t get gas because of the lack of electricity. Luckily we filled up before going to work that morning.

So, what was normally about a 1.5 hour drive turned into five hours. Surprisingly, people were rather calm. As we sat there, it was eerie to wonder what was lurking on everyone’s minds since 9/11 wasn’t in the too-distant-past. Once home, we arrived to no electricity, thus no air conditioning, no water, and no TV. But I can tell you as one of the 5.4 million people in Michigan affected that day, it was truly an eye-opening experience to the realization of our dependence on technology.

It’s been reported that financial losses resulting from that blackout were about $6 billion. The official cause of that blackout was a software bug. Of course, there are those who believe this was the work of a hacker(s). I’m not sure, but just so that I can sleep a little better at night, I’m going with the official story. However, should the day come and our critical systems do get into dangerous hands, I’m sure that August 2003 might be child’s play compared to what we might really be up against.

Needless to say, technology touches almost every facet of our lives everyday. Therefore, we all have a vested interest in doing our part to keep the computer systems safe, at work and home. I’m not sure about you, but when my lights go out, I want to be the one flicking the switch.

Oh, and the moral of the story is – don’t leave work early. Oh, who am I kidding? Before you do, look into your crystal ball. Make sure there are no blackouts planned. They have a bad habit of rendering your “sneaking out” pointless.