When the going gets tough, the bad get going

Former disgruntled Fannie Mae Employee and Unix engineer Rajendrasinh Makwana, 35 is not the kind to just pack up and leave quietly. After being fired from Fannie Mae, Makwana was apparently pissed off…very pissed off. Proving that you can be highly intelligent and still be stupid before packing off for one last time from his workstation, he proceeded to imbed malicious code on Fanny Mae servers, which had it kicked into action like it was supposed to on January 31, would have destroyed data on all Fannie Mae servers. The script was thankfully spotted by chance before it went off. For his little stunt he is now facing up to 10 years in prison, though currently out on a $100,000 bail. Well done genius.

In a recession, companies are often forced to take steps that leave a broad wake of unhappy and stressed workers, and according to a global survey, disgruntlement-driven damage is the No. 1 security worry of IT decision makers. The studies estimated that data theft and cybercrime breaches last year cost businesses worldwide more than $1 trillion in data loss and recovery expenses, and it warned that companies are more vulnerable now than ever. This could be a wake-up call because the current economic crisis is poised to create a global meltdown in vital information. Increased pressures on firms to reduce spending and cut staffing have led to more porous defenses and increased opportunity for crime. The economic downturn across the board is motivation enough for those who harbor hostility towards their ex-employers for their current sorry plight. It could be possibly on a lot of people's radar right now.

No. I don’t work for a IT security solution provider and have no vested interest other than to spread a word of caution.
.

Is it R.I.P for IT security vendors?

Fear is the key driver that sells insurance and - security software. So I don’t bother to read further if I see headlines like this. “Phishing attacks on banks rise six-fold: Symantec.” To me, it means Symantec badly needs to scale up revenues. Here is the sales talk in that report –

“The Symantec lab monitors the complete threat spectrum and malware activity all across the world. It provides support in 14 languages against phishers who are extensively using sophisticated methods to install spyware, Trojans, worms and viruses.”

All hogwash. Go read this. Trend Micro is another security vendor like Symantec and its own site is hacked ! When security vendors can’t protect their own sites from hackers, how will they secure others? It's embarrassing when security vendors fall victim to the attacks they are supposed to prevent and Trend Micro is not the lone ranger. It just ran out of luck and got reported :)

Time to short all IT security vendors…?

.

Hack Exchange

Go find a bug. Invite bids; sell it to the highest bidder. Cool?

Big IT vendors like CISCO, MS, IBM, Oracle all engage in-house snooper teams to do vulnerability research on their software – to find bugs and fix them. While these employees were highly paid, outside freelancers/users had to settle just for credits if they did it.

The newly opened auction site, WabiSabiLabi, doesn't require buyers to work with vendors on a fix before disclosing the flaw. Operators of the site say they try to validate both buyers and sellers -- for example, requiring copies of passports and bank account information -- but many people remain skeptical. The suspicion that there existed a thriving black market for this knowledge is vindicated. Now the question – is WabiSabi turning it legit?

Wabi-sabi seeks to represent the implicit imperfection of IT security and to contribute to its improvement, as claimed by the site. It seeks to achieve this goal by completely re-designing the traditional security research cycle, introducing for the first time ever a market-driven approach to correctly value the security researchers contributions.

.

Stoking up extortion? Well, this site would eventually be a hack exchange besides helping many crooks and a few enterprising samaritans figure out the FMV of their `find’ and/or its `patch' … Next what? A Hack index and Daily moving average?

.

To me that’s bad news…crunch time for FBI sleuths, I guess !

.