The biggest threats to the internet

Page 1 of 2Introduction, routers and government censorship Are data centres safe? (Image: Wikimedia)

With over seven billion people on the planet and approximately 40% of them online, the internet is one of the most important resources to protect, but is it completely protected? We've all heard about bugs like Shellshock and the 512k router problem, but are there other menaces that could bring down the worldwide web?

"While there are extreme scenarios like natural disasters and terrorist attacks that can cause disruption to the web, it is actually far more commonplace to see the internet fall foul due to shortcomings with routine maintenance and operations, such as hardware upgrades," says Mike Palladino, director of IP infrastructure and operations at internet hosting company Internap in Atlanta, US. Palladino is talking about widely-deployed, older routers hitting their default 512k routing table limit, a problem that has this year seen websites and networks knocked down.

It's time to move to IPv6

At around 500,000 routes – a figure that's increasing by around 1,000 routes per week – the growth of the global internet routing table shows no signs of slowing. "It's putting many organisations on a collision course with network instability over the coming months and years as millions of legacy routers hit their physical limits," thinks Palladino. "What makes the problem even more challenging is that companies don't want the headache of fully migrating to IPv6, so they are trying to squeeze as much IPv4 out of the remaining allocations as possible, which is only adding to the inflation of the routing table."

Many companies are getting caught off guard, Palladino believes, and smaller enterprises in particular could learn some very painful lessons.

This is the real baddie. "Some of the largest instances of internet outages weren't caused by natural disasters or terrorist attacks, but rather government censorship," says Brian Chappell, Director, Technical Services EMEAI & APAC at the Leeds office of BeyondTrust.

There are theoretical threats – such as the Kremlin's plans to take control of the .ru domain and take Russia off the global internet during an 'emergency' – and there are real problems caused by governments, such as the 'great firewall' in China. The latter's latest effort is Green Dam, a piece of web censorship software that will soon be pre-installed inside every computer sold in China.

The NSA might be monitoring, but other governments actively switch off the internet

That, and Edward Snowden's NSA online surveillance revelations, are mere asides in the fight against governments who think it is their right to switch the internet on and off. Censorship by the Chinese government was thought to be behind an internet outage in January that severed access to the web for hundreds of millions of people, while governments in both Libya and Egypt effectively banned the internet during the Arab Spring uprisings of 2011.

And who can forget the almost comical stance of Turkish Prime Minister Recep Tayyip Erdogan, who called social media "the worst menace to society" before banning it in April? Luckily, the country's constitutional court overturned the ban after two weeks. However, the ban had an unexpected consequence. "When the Turkish prime minister banned Twitter, tweets about the ban and from Turkey increased significantly," says Dinah Alobeid at the New York office of analyst company Brandwatch.

It might be interrupted by earthquakes, hurricanes, ageing hardware or banned by power-crazy governments, but the internet consistently does one thing very well – it always fights back.

Page 1 of 2Introduction, routers and government censorship

See more internet news Sign up to receive TechRadar Pro's free weekly newsletter with the week's IT insights.

View the original article here

In depth: WireLurker: what you need to know about Apple's biggest ever threat

Nobody bats an eyelid when malware shows up in the Windows world, but when it manoeuvres itself Mission Impossible-style into Apple's traditionally locked-down ecosystem, everything tends to descend into a frenzy.

It's par for the course, then, that WireLurker, a strain of malware that's transferred from infected Macs to USB-connected iOS devices, has caused quite a stir in the past 24 hours.

According to Unit 42 - the threat intelligence team at Palo Alto Networks that discovered the vulnerability - WireLurker has made its way onto potentially hundreds of thousands of China-based people's Apple devices. What's more, the company reckons it has the potential to spread its tentacles much further afield.

We don't want to leave you hanging, so here's a run down of the vital information that you need to know about what has been called "a new breed of threat to all iOS devices". It has been provided by Ryan Olson, Head of Intelligence at Unit 42.

WireLurker is a strain of malware that has been discovered in a third-party Chinese OS X app store called Maiyadi. According to Unit 42, it marks a "new era in malware across Apple's desktop and mobile platforms" and poses a threat to businesses, governments and Apple device customers worldwide.

Rather than attacking OS X and iOS separately, WireLurker targets both platforms at the same time. It does so by monitoring any iOS device connected via USB with an infected OS X computer and installs downloaded third-party applications or automatically generated malicious applications onto the device, depending on whether or not it's jailbroken (hence the name "wire lurker"). Researchers have succesfully pulled off similar methods fo attack non-jailbroken devices before, but WireLurker is sophisticated enough to combine several techniques to make it even more dangeous than what has gone before.

WireLurker can boast a number of firsts - all of which make it a particularly nasty piece of work. It's the first known strain of malware that can infect installed iOS apps in a similar way to how a traditional virus on a desktop computer would.

It's also the first-in-the-wild malware family that can install third-party apps on iOS devices that haven't been jailbroken using enterprise provisioning (a way of companies installing their own apps without going through Apple's app approval process).

Additionally, until WireLurker came along, only one other malware family was known to have attacked iOS devices through OS X via USB.

WireLurker is believed to have been built by cyber criminals in China, who have trojanised (infected) 467 OS X applications in Maiyadi. Maiyadi is also a website that provides Apple-related news and resources, whereas the app store of the same name is a sub-site known to host pirated premium Mac, iPad and iPhone apps.

Think before you connect

Some criminals act first and think later, which appears to be what the perpetrators of WireLurker are doing. Unit 42 reckons they're still considering their motives while developing attack plans and fine-tuning the malware to be more stealthy and harder to remove.

WireLurker is capable of stealing data - from address book contacts to Apple device information and iMessage contact details - and could be capable of much more due to its ability to communicate with a "command control server" for updates. In other words, it's constantly becoming more powerful and sophisticated.

More than you might think. It's thought that 467 infected applications have been downloaded over 356,104 times, mainly by Mac and iOS users in China.

Because WireLurker is only found in third-party Mac apps, you can stay safe from harm by only downloading apps from Apple's own Mac App Store. In other words: keep away from third-party app stores that aren't only infested with malware, they're of dubious legality due to reasons related to copyright and IP.

The security vulnerability was discovered by Claud Xiao of Unit 42 after he came across a Chinese forum documenting highly suspicious files and processes on Macs and iPhones.

Xiao found that all of the apps trojanized by WireLurker included an installation interface that used a "Pirates of the Caribbean" themed wallpaper. The infected apps also use a QQ (an IM software service) account number that corresponds to the owner of the Maiyadi website. The packages also contained an application named "User Manual', which was displayed in Chinese.

Let's be clear: although WireLurker is affecting Apple devices, it's not an Apple vulnerability. That's because the techniques that it uses are deployed using legitimate APIs either from Apple on in Cydia (a third-party app store on iOS), which is used by jail-broken devices.

However, in a statement Apple confirmed to TechRadar that it has blocked infected apps that it has identified to prevent them from launching.

View the original article here