Số "nạn nhân" của chương trình nguy hiểm khai thác lỗ hổng xuất hiện cách đây 2 tháng trong Windows đã lên đến 9 triệu máy, giúp nó trở thành một trong những virus có tốc độ lan truyền kỷ lục.

Công ty bảo mật F-Secure (Phần Lan) cho biết chỉ trong ngày 13/1, hệ thống bị nhiễm sâu Downadup, hay còn gọi là Conficker và Kido, đã tăng từ 2,4 triệu lên 3,5 triệu và hiện con số này còn cao hơn nữa.

Downadup, được nhiều hãng bảo mật xếp vào hàng "rất nguy hiểm", khai thác lỗi trong dịch vụ Windows Server của các phiên bản Windows 2000, XP, Vista, Server 2003 và Server 2008. Nó có thể kích hoạt hàng trăm tên miền bằng thuật toán phức tạp, khiến các chuyên gia không dễ dàng ngăn chặn việc phát tán.

Microsoft đã phát hành bản vá từ cuối tháng 10/2008 sau khi nhiều khách hàng phàn nàn về sự cố. Giới phân tích nhận định kẻ phát tán đang muốn xây dựng một mạng máy tính ma (botnet) khổng lồ.
-----------------------------------------------------------------------------------------------------------------------

25 mã lập trình nguy hiểm nhất thế giới

Hơn 30 công ty và tổ chức bảo mật, trong đó có Microsoft và Symantec, đã lập danh sách những sơ xuất của các chuyên gia phát triển phần mềm có thể bị tội phạm mạng khai thác và tấn công.

Tổ chức bảo mật SANS Institute (Mỹ) cho biết nhiều trong số các lỗi này không được giới lập trình đánh giá đúng đắn mức độ nguy hiểm. Thậm chí, đã có 2 đoạn mã gây ra lỗ hổng ảnh hưởng tới hơn 1,5 triệu website trong năm 2008.

Danh sách này về cơ bản dành cho những người chịu trách nhiệm chính trong xây dựng một hệ thống nhằm cảnh báo họ cần nhận thức và khắc phục sai sót trước khi giao sản phẩm cho khách hàng.

Website chính thức về 25 mã lập trình trên là nguy hiểm cho thế giới !

(January 12, 2009) Today in Washington, DC, experts from more than 30 US and international cyber security organizations jointly released the consensus list of the 25 most dangerous programming errors that lead to security bugs and that enable cyber espionage and cyber crime. Shockingly, most of these errors are not well understood by programmers; their avoidance is not widely taught by computer science programs; and their presence is frequently not tested by organizations developing software for sale.

The impact of these errors is far reaching. Just two of them led to more than 1.5 million web site security breaches during 2008 - and those breaches cascaded onto the computers of people who visited those web sites, turning their computers into zombies.

People and organizations that provided substantive input to the project are listed below. They are among the most respected security experts and they come from leading organizations ranging from Symantec and Microsoft, to DHS's National Cyber Security Division and NSA's Information Assurance Division, to OWASP and the Japanese IPA, to the University of California at Davis and Purdue University. The MITRE and the SANS Institute managed the Top 25 Errors initiative, but the impetus for this project came from the National Security Agency and financial support for MITRE's project engineers came from the US Department of Homeland Security's National Cyber Security Division. The Information Assurance Division at NSA and National Cybersecurity Division at DHS have consistently been the government leaders in working to improve the security of software purchased by the government and by the critical national infrastructure.

What was remarkable about the process was how quickly all the experts came to agreement, despite some heated discussion. "There appears to be broad agreement on the programming errors," says SANS Director, Mason Brown, "Now it is time to fix them. First we need to make sure every programmer knows how to write code that is free of the Top 25 errors, and then we need to make sure every programming team has processes in place to find, fix, or avoid these problems and has the tools needed to verify their code is as free of these errors as automated tools can verify."

The Office of the Director of National Intelligence expressed its support saying, "We believe that integrity of hardware and software products is a critical element of cybersecurity. Creating more secure software is a fundamental aspect of system and network security, given that the federal government and the nation's critical infrastructure depend on commercial products for business operations. The Top 25 is an important component of an overall security initiative for our country. We applaud this effort and encourage the utility of this tool through other venues such as cyber education."

Until now, most guidance focused on the 'vulnerabilities' that result from programming errors. This is helpful. The Top 25, however, focuses on the actual programming errors, made by developers that create the vulnerabilities. As important, the Top 25 web site provides detailed and authoritative information on mitigation. "Now, with the Top 25, we can spend less time working with police after the house has been robbed and instead focus on getting locks on the doors before it happens." said Paul Kurtz, a principal author of the US National Strategy to Secure Cyberspace and executive director of the Software Assurance Forum for Excellence in Code (SAFECode).

CỤ THỂ LÀ NHƯ VẬY...

Which People and Organizations Made Substantive Contributions to the Top 25 Errors List?

Please note that the proposed procurement guidelines incorporates in part language utilizing the OWASP Secure Software Contract Annex. https://www.owasp.org/index.php/OWASP_Secure_Software_Contract_Annex.

Robert C. Seacord, CERT
Pascal Meunier, CERIAS, Purdue University
Matt Bishop, University of California, Davis
Kenneth van Wyk, KRvW Associates
Masato Terada, Information-Technology Promotion Agency (IPA), (Japan)
Sean Barnum, Cigital, Inc.
Mahesh Saptarshi and Cassio Goldschmidt, Symantec Corporation
Adam Hahn, MITRE
Jeff Williams, Aspect Security
Carsten Eiram, Secunia
Josh Drake, iDefense Labs at VeriSign, Inc.
Chuck Willis, MANDIANT
Michael Howard, Microsoft
Bruce Lowenthal, Oracle Corporation
Mark J. Cox, Red Hat Inc.
Jacob West, Fortify Software
Djenana Campara, Hatha Systems
James Walden, Northern Kentucky University
Frank Kim, ThinkSec
Chris Eng and Chris Wysopal, Veracode, Inc.
Ryan Barnett, Breach Security
Antonio Fontes, New Access SA, (Switzerland)
Mark Fioravanti II, Missing Link Security Inc.
Ketan Vyas, Tata Consultancy Services (TCS)
Lindsey Cheng, Ian Peters and Tom Burgess, Secured Sciences Group, LLC
Hardik Parekh and Matthew Coles, RSA - Security Division of EMC Corporation
Mouse
Ivan Ristic
Apple Product Security
Software Assurance Forum for Excellence in Code (SAFECode)
Core Security Technologies Inc.
Depository Trust & Clearing Corporation (DTCC)
The working group at the first OWASP ESAPI Summit
National Security Agency (NSA) Information Assurance Division
Department of Homeland Security (DHS) National Cyber Security Division

Robert Martin, CWE Project Leader at MITRE heralded the effort of these contributors by saying, "It is gratifying to see the amount of collaboration and energy that all these serious, security-savvy people invested in making this list as accurate and authoritative as it can be. Very impressive!"