Neil Daswani, PhD

Introducing Dasient Web Anti-Malware (WAM)

admin — Mon, 08 Mar 2010 12:16:14 +0000

posted by Neil Daswani, Ameet Ranadive, and Shariq Rizvi,
Co-Founders, Dasient

If you’ve been following our blog, you’ll know that we’ve been talking quite a bit about the latest security threats on the web. One of the threats we’ve been focusing on specifically is web-based malware. This kind of attack — in which hackers compromise a legitimate site and turn it into a delivery vehicle for drive-by malware downloads — has long been regarded as an emerging threat.

But one look at the numbers makes it clear that this threat has officially arrived: In the last two years, there’s been a 600% increase in the number of malware-infected webpages, and 80% of those pages are legitimate. Google first reported the problem of malware-infected pages exploding from April 2007 to January 2008. Microsoft estimated in an April 2009 report that the total number of legitimate webpages being compromised per month is more than 1 million. And now that search engines like Google and Yahoo; browsers like IE8, Firefox, and Chrome; and desktop AV providers like Norton and McAfee are blacklisting compromised sites, those sites are seeing double-digit losses in traffic and revenue and taking significant hits to their reputation.

Those are just some of the reasons we’re proud to be opening up our Dasient Web Anti-Malware service to a broader audience today. Dasient Web Anti-Malware — or “WAM,” as we like to call it — is the world’s first complete anti-malware solution for websites. Dasient WAM monitors, automatically identifies, and quarantines malware on websites, before those sites suffer significant losses in traffic, revenue, and reputation.

We’re making the monitoring and diagnostic elements of WAM openly available in public beta today, and making the quarantining element available in private beta. WAM is available both to site owners and to web hosting providers interested in offering their customers protection against web-based malware. If you want to learn more, jump down to the full text of our news release, which we’ve included below. If you’re ready to get started right away, head here to sign up for free blacklist monitoring for your site.

We’re excited to be bringing these necessary protections to the web, and are looking forward to your feedback. Stay tuned to this space for more news on Dasient WAM and further insights on the development of new web-based threats.

Here is the press release:

Dasient Introduces First Web Anti-Malware Service

Addresses Growing Need for Protection From New Web-Based Attacks

PALO ALTO, June 16, 2009 – Dasient today introduced the industry’s first service to protect companies against a fast-growing class of web-based attacks that compromise legitimate websites and then use them to spread malware to the sites’ visitors. Dasient’s new Web Anti-Malware (WAM) service continually monitors websites, diagnoses any infections, and helps businesses address the infections, before the sites suffer significant losses in traffic, revenue, and reputation.

“In the last two years, we’ve seen a fundamental shift in the way malware is spread,” said Dasient co-founder Dr. Neil Daswani. “Hackers are using highly automated and mutable attacks to turn websites into delivery vehicles for malicious software. This is a web problem at its core, and it requires a solution that can function at web speed and web scale. That’s exactly what we had in mind when we designed the Dasient WAM service.”

Sharp Increase in Malware-Infected Webpages

Each day, thousands of legitimate websites are infected with malicious code, often without their knowledge. The speed, scale, and complexity of these attacks makes it extremely difficult for website owners to identify and fix the resulting infections, and in some cases to even know they’ve occurred.

The most immediate result of web malware infection is blacklisting by search engines like Google and Yahoo; browsers like Internet Explorer, Firefox, and Chrome; and desktop anti-virus providers like Norton and McAfee. When blacklisted, a website’s visitors are redirected to a warning that the site they’re about to visit might be dangerous. In many cases, being blacklisted causes a sharp drop in traffic to the site, depriving the site owner of advertising or e-commerce revenue, damaging the site’s brand, and spurring additional support costs.

Dasient Identifies and Contains Malware That Can Infect Site Visitors

Today Dasient is announcing the following updates to its patent-pending Web Anti-Malware service, which has been in alpha testing with thousands of websites since early this year:

Free Blacklist Monitoring: Regularly monitors blacklists from search engines, browsers, and desktop anti-virus companies and provides customers with instant alerts if they’ve been flagged by those providers. The WAM Blacklist Monitoring service is now in public beta, and is available for free to direct customers and web hosting providers.
Premium Monitoring and Diagnosis: Continuously monitors customer websites for malicious code that can be distributed by web applications, user-generated content, third-party widgets, advertisements, and other vulnerable site elements. When an infection is identified, customers are notified and provided with detailed diagnostic information, including all malicious source code and infected URLs. The WAM Premium Monitoring service is now in public beta, and is available on a subscription basis to direct customers and web hosting providers.
Quarantining: Used in conjunction with the Premium Monitoring service, Dasient’s quarantining technology automatically contains infections as soon as they’re diagnosed, serving the webpages in question but not the malicious code. Quarantining prevents the site from spreading malware broadly to its visitors and keeps it from being flagged by blacklist providers. The WAM Quarantining service is now in private beta, and direct customers and web hosting providers can sign up to join the beta on the Dasient site.

The Dasient WAM monitoring and diagnostic services are built on a set of behavioral analysis technologies that continually crawl customer sites and the web, identifying new web-based malware infections. The monitoring and diagnostic tools are provided to customers as a web service, and the quarantining technology is made available as a web server module that can be installed by customers or web hosting providers.

More information about the Dasient WAM service and pricing can be found at www.dasient.com.

About Dasient

Dasient is an Internet security company that protects businesses from web-based malware attacks. It is the first to develop a complete Web Anti-Malware service that can monitor, automatically identify, and quarantine malware on websites before it can infect visitors and cause a loss of traffic, reputation, and revenue. Dasient was founded by former Google engineers Neil Daswani and Shariq Rizvi and former McKinsey strategy consultant Ameet Ranadive. They are backed by a group of seed investors who also invested in VeriSign, Citrix, Twitter, Digg, Tumbleweed, Finjan, and more. More information about Dasient can be found at www.dasient.com.

Dasient details new attack @ Cyber Security East

admin — Mon, 08 Mar 2010 09:58:34 +0000

Late last week I gave a talk at the Cyber Security East Conference in Washington, DC. Some of the other speakers included Robert Lentz (Deputy Assistant Secretary of Defense), Dr. Eric Cole (Chief Scientist of Lockheed Martin), and Robert Carey (Chief Information Officer, Department of the Navy). There was a lot of interesting and useful discussion, and I was glad to be able to contribute to the event.
In my talk, I reviewed the fundamental shift we’ve seen in the way malware is spreading, focusing on the 600% increase in web-based malware in the last two years. These attacks — in which legitimate sites are compromised and turned into delivery vehicles for malware — are impacting more than a million webpages per month, and in turn more and more legitimate sites are being blacklisted by major search engines, browsers, and AV companies.
I also shared a few examples of how web-based malware attacks are growing more sophisticated, based on data we’ve gathered in the last year using our proprietary malware analysis platform. As you may know, some web-based malware attacks can be attributed to a single injection of an iFrame or JavaScript code snippet, with a relatively obvious malicious domain in the SRC of the iFrame. Others employ heavily obfuscated JavaScript that can often be hundreds of characters long, and as such can be more difficult to spot or remove from an infected site — but they still use a single injection point.
We are now starting to see attackers insert code via multiple injection points, to further obfuscate the bad code and make it more difficult for webmasters and traditional scans to detect. In the screen below is an example of this kind of attack that I presented last week:

Note that the attacker has injected JavaScript here, but it is not obfuscated, and it doesn’t appear to point to a malicious domain. Hence, anyone who does a simple check for malicious domains may be easily fooled into thinking that the JavaScript is innocuous. The reality is quite different: The call to “getElementById” in the JavaScript reaches into another part of the document (where the first injection took place) to retrieve and clarify the malicious domain. Once the domain is decoded (in the second injection), the attacker’s domain is revealed to be the source of a malicious iFrame.
This new attack makes it clear that the purveyors of web-based malware are actively looking for ways around malware scans, and it underlines the importance of going above and beyond signature-based analysis in the battle against this threat. For example, the Dasient WAM malware-analysis platform was able to proactively capture this new multiple-injection attack in no small part because of its strengths in behavioral analysis. We believe that as the web becomes more sophisticated and as attackers continue to embrace new, increasingly automated attack vectors, businesses on the web will need to deploy protections that work at web speed and web scale to keep themselves safe.
To learn more about how Dasient WAM can help you protect your site, check out our product overview.

More industry attention on web-based malware

admin — Mon, 08 Mar 2010 07:13:32 +0000

Yesterday, Google announced that it plans to start providing owners of malware-infected sites with samples of the bad code that its scanners have uncovered. This new functionality is launching as an experimental feature in Webmaster Tools, and as I mentioned in the talk I gave at Google this past July, we’re excited to be working in concert with Google and others to tackle the threat of web-based malware and help make the web a safer place overall.
This announcement clearly underlines the growing need for this kind of information and for new tools to help site owners protect themselves and their users. As we’ve mentioned before in this space, millions of legitimate webpages are infected with web-based malware every month, and the size of the blacklists maintained by search engines, browsers, and AV providers continues to grow.
Another issue the announcement raises is how difficult it can be for businesses whose sites have been infected to locate the source of the infections and address them (especially since the malicious code is sometimes heavily obscured). And since businesses often don’t discover these infections until their sites have been blacklisted, they’re taking a hit in traffic, revenue, and reputation with every hour that passes as they try to solve the problem.
We’ve helped tens of thousands of site owners deal with web-based malware infections in the last eight months — providing not just snippets, but also full, regular site scans, immediate infection alerts, and automatic remediation tools — and we’ve seen firsthand how frustrating these infections can be for them, and how helpful services like Dasient WAM can be.
If you’re concerned about web-based malware infections and the impact they can have on your business, sign up for Dasient’s monitoring service, which can identify infections and alert you before your site ends up on one of the blacklists. We also encourage you to try out our free, open-source server plugin, which will automatically block any malicious code we detect from being served to users — helping you keep those users safe and keep your site off the blacklists.

Another step forward in the fight against malvertising

admin — Mon, 08 Mar 2010 06:47:58 +0000

Last week, Googleannounced that it will now be taking a zero-tolerance approach to dealing with advertisers that place ads that violate its terms of service, including malicious ads that can infect users with malware. Google had previously been removing these ads from its network as it identified them; it will now be permanently disabling the AdWords accounts of the advertisers that put those ads into its network. This new policy shift should force individual advertisers and affiliate to think twice before placing malicious ads with Google, but hopefully it will also start to make an impact in addressing the broader malvertising threat.
To provide some context, the quality and safety of ads has been a concern for users, publishers, advertisers, and technology companies since advertising first appeared on the web more than a dozen years ago. Some of the first ads embedded in webpages took the form of banners — some of which were criticized for the bandwidth that they required when most of the world was still using dial-up modems to access the Internet, and for their “loudness.”

As companies such as Sun and Netscape worked together to bring more interactive forms of content and ads to browsers, sandboxes like the Java Virtual Machine were introduced to protect users from potentially malicious interactive content. In parallel to the development of Java, other forms of interactivity were brought to market, including JavaScript, ActiveX, Flash, and Shockwave, and different levels of security and interactivity distinguish these technologies. Some of them leverage browser “plugins” that ran code natively and in an unrestricted fashion on the user’s machine (such as ActiveX), while others employ sandboxes in an attempt to protect users (though not always effectively). Often, functionality wins out over security when developers are faced with the pressing market needs of advertisers and content publishers, leading to much more frequent uses of technologies that are more interactive but less safe than technologies that are less interactive but more safe.

As a result, we today have a world where attackers interested in harming users with malicious ads can take advantage a large variety of vulnerabilities in browsers, plugins, and operating systems to do so. Here at Dasient, we’ve seen a significant increase in the amount of malvertising activity in the last year, and have worked with a number of companies and site owners who have been impacted by it. Some of these sites’ users were infected by malicious ads; others ended up on the unsafe-site blacklists maintained by search engines, browsers, and anti-virus companies. Either way, the sites ended up losing traffic, revenue, and brand equity because a malicious ad popped up on their site via a syndicated ad network.

We’re optimistic that Google’s new policy shift will inspire similar moves from other online ad syndicators, and that in turn the advertisers and affiliates who traffic in malicious ads will have fewer channels to distribute their wares. Some commentators are already arguing that it won’t; that not everyone can afford to take Google’s principled stand. We hope that’s not the case, but either way, it’ll likely take a long time to stamp this threat out altogether. In the meantime, businesses and site owners interested in protecting their users and their reputation on the web can take advantage of tools like Daisent Web Anti-Malware (WAM), which regularly monitors your site and provides you with immediate alerts and detailed diagnostic information as soon as an infection or a malicious ad is detected.
To learn more about Dasient WAM, check out this page. And for all the latest news on web-based malware and the security space in general, be sure to follow us on Twitter at http://twitter.com/dasient

Help Secure The Internet!

admin — Thu, 04 Mar 2010 10:22:49 +0000

Hi Everyone,

Welcome to my blog! From time to time, I’ll post interesting tidbits of info and/or opinions. For now, check out the new book that I have co-authored with Christoph Kern and Anita Kesavan entitled “Foundations of Security: What Every Programmer Needs To Know” (now available at Amazon at:

http://www.amazon.com/gp/product/1590597842?ie=UTF8&tag=learnsecurity-20&linkCode=as2&camp=1789&creative=9325&creativeASIN=1590597842

or at your local bookstore).

*** If you know or work with programmers, please let them know about it. ***

Summary of the Book

The book teaches new and current software professionals state-of-the-art software security design principles, methodology, and concrete programming techniques they need to build secure software systems – making them highly marketable to companies and employers.

Why Security Is So Critical

Chances are that unless we all learn something about security, the Internet will continue to be a very vulnerable place in which cybercriminals thrive.

* The number of security vulnerabilities reported to the federally-funded Computer Emergency Response Team (CERT) at Carnegie-Mellon University climbed from 5,990 in 2005 to 8,064 in 2006.

* According to IBM’s Internet Security Systems division, 88.4 percent of all 2006 vulnerabilities could be exploited remotely, and over half the vulnerabilities would allow an attacker to gain access to the host (e.g., your computer) after successful exploitation.

Many of these vulnerabilities are used by cyberthieves to commit identity theft, steal credit card numbers, and launch online attacks using malware and botnets. That’s really bad. So bad that popular technology websites like C|net dedicate an entire section of their sites to high-profile threat announcements, and they are filled with new articles every single day.

What’s the Root Cause of Security Failures?

Software. Software with security design flaws and software with implementation bugs. As a technologist, given my love for software and my embarrassment at the current state of the world, I worked with the Stanford Center for Professional Development (SCPD) near the tail end of my PhD to help create a Computer Security Certification program ( http://proed.stanford.edu/?security) that has to-date helped many companies and software professionals mitigate security flaws in software.

The courses that make up the certification program became the basis for the material in this book. Given the importance of the material in this book to the security of the future of the Internet, I was extremely honored to have Dr. Vint Cerf, often called one of the “Fathers of the Internet” (due to his work on the original design of the TCP/IP protocols) and a recipient of the Presidential Medal of Freedom, write the foreword to this book.

Detailed Information About the Book

This book takes a principled approach to helping you design and implement your applications to be secure from the ground up, and illustrates these principles using running examples of web applications throughout the book. Just as you might use object-oriented design principles to achieve extensibility and code-reuse, you need to learn about security design principles, such as the principle of least privilege, fail-safe stance, and securing the weakest link to achieve security, all of which is covered in this book. This book does not just focus on merely teaching you “tips” and “tricks” that allow you to “band-aid” the security of your systems. Instead, it illustrates how security principles can be employed to prevent some of the most significant, current day attack types such as SQL injection and cross-site scripting (XSS) as well as more traditional attack types such as buffer overflows. We also cover session and password management, and show you how you can use cryptography to help achieve various security goals.

How to Get Your Copy

To help aggressively disseminate knowledge about the techniques and practices that programmers need to know to achieve security, I have worked with the publisher to provide this book to the market at a low price of $40 retail, or only $26 on Amazon. If you are a teacher or an IT decision maker potentially interested in buying copies for your students or your organization, respectively, I would be more than happy to have the publisher provide you with a free evaluation copy of the book. The book’s web site ( http://www.learnsecurity.com/ntk) provides slides and source code that you are free to use for your own courses and needs. Also, those who enroll in the SCPD Advanced Security Certification ( http://scpd.stanford.edu/scpd/courses/proed/CompSecCampus/) will receive the book for free.

I look forward to your help in making the Internet more secure such that it can continue to transform global commerce, communication, and entertainment. Please feel free to let me know if you have any questions or feedback by dropping me an email at daswani@learnsecurity.com, and I look forward to working together with you to continue to secure the Internet!

Sincerely,

Neil Daswani, PhD
http://www.neildaswani.com/

How much security is enough security?

admin — Thu, 04 Mar 2010 10:20:58 +0000

For most businesses, it is important for security to be “good enough” and to make sure that you are investing enough to mitigate risk.

Of course, for some companies, such as those in the payment and financial spaces, just one exploited security vulnerability could severely impact customer confidence and result in loss of business. In 2005, for instance, CardSystems, a credit card payment processor, got hit with a SQL injection attack that allowed the bad guys to steal 263,000 credit card numbers over a period of six months, and a total of 43 million unencrypted credit card numbers were exposed to the attack. Visa and Mastercard canceled their contracts with the company, the incident was investigated by the FTC and Congress, and CardSystems’ assets were sold off.

There is debate as to whether or not CardSystems was compliant with all of the existing VISA and Mastercard data security requirements prior to the attack. After the attack, the requirements for such compliance were beefed up, but it also demonstrates that compliance, certifications, and audits may have limited value. There is a significant difference between being able to pass an audit and having “real” security. In layman’s terms, it is sometimes easier to “talk the talk” than it is to “walk the walk.”

TJ Maxx, Marshalls, and other dept. stores hacked!

admin — Thu, 04 Mar 2010 10:18:38 +0000

In Chapter 8 of my book, I discussed what was the largest cyberattack at the time of its writing. That attack was against CardSystems, a credit card payment processor, in 2005 in which 43 million credit card numbers were exposed to attackers (but only about 263,000 were stolen). In late March of this year, the TJX group of retail department store companies (which includes TJ Maxx, Marshalls, HomeGoods, A.J. Wright, and Bob’s Stores, etc.) announced they were the victim of what is being called by some as the largest cyberattack of all time in which over 45.7 million credit and debit card numbers was actually stolen.

The attack against the TJX group of companies reminds us that security vulnerabilities are still very prevalent, and the attacks due to them are getting worse because of systems with security design and implementation flaws. From my reading of various articles and TJX’s SEC filing on the issue, it seems that there wasn’t just a single flaw that resulted in the security breach, but that there were many flaws in TJX’s security practices, which together resulted in such a spectacular attack. The data stolen even dates back to transactions from 2002. In the coming months, a Federal Trade Commission investigation will take place. If you ever shopped at any of these retail chains, you may want to consider keeping an eye on your credit report and credit/debit card statements to watch out for fraud and identity theft.

Recent Security Events

admin — Thu, 04 Mar 2010 10:17:14 +0000

It has been a while since I last wrote a blog entry, so I’ll summarize some recent events:

* It was revealed that the TJX / Marshalls hack involving over 45 million credit card numbers occurred due to the fact that they were using WEP, a protocol that the security community has been known to be broken since 2001 (see page 219 of my book, and Slashdot for more info). Don’t forget to get credit monitoring if you have ever shopped at a TJ Maxx or Marshalls department store! A group of banks has organized a class-action lawsuit against TJX, the criminals have gone on million dollar shopping sprees, and the FTC investigation is in progress.

* In Bruce Schneier’s May CRYPTO-GRAM, he asked the question of whether or not we should have a security industry. While this might sound odd at first, if hardware and software products were designed correctly (securely), we perhaps wouldn’t need additional hardware and software to secure our systems, nor an industry that produces such additional hardware and software. Applying his argument to programmers, writing secure code could be part of every programmer’s job, and we hopefully shouldn’t need so many “software security” experts in some hopefully not-too-far future. The goal would be to, as per Bruce’s suggestion, “make IT products and services naturally secure out of the box.” Of course, we may potentially need a few specialists to advance the “state-of-the-art,” but largely I’d love to see safety and security be a regular part of every software engineer’s job. “Foundations of Security: What Every Programmer Needs To Know” makes a contribution to move the world in that direction by making security part of every programmer’s job.

* I helped co-author and publish a paper entitled “The Anatomy of Clickbot.A.” (The paper is mentioned on Google’s Blog and also got some press coverage.) It is a good read if you want to learn more about botnets.

The iPhone has been hacked!

admin — Thu, 04 Mar 2010 10:16:18 +0000

It was only a matter of time, I guess– a buffer overflow vulnerability has been found against the iPhone:

http://www.securityevaluators.com/iphone/

From the article, the researchers were able to “get access to the log of SMS messages, the address book, the call history, and the voicemail data” by sending an attack string to the iPhone via a wireless access point, a web site, or an SMS message. If you have an iPhone:

“

Only visit sites you trust. If you don’t visit attackers’ sites, you give them one less attack vector.
Only use WiFi networks you trust. If attackers have control of your Internet connection, they have the ability to insert exploits into any website you visit.
Don’t open web links from emails. Many current viruses send links to malicious sites in emails that look like they are from trusted contacts.”

What does Neil work on at Google?

admin — Thu, 04 Mar 2010 10:14:46 +0000

Hi Folks,

Some of you have complained that I don’t tell you about what I work on at Google… well, I certainly can’t tell you about everything that I work on, but here is some info about a “launch” that I contributed to…

Google launched the “ad traffic quality” center late last week featuring articles by yours truly:

http://www.google.com/adwords/adtrafficquality/tech.html