Home » Data Protection » Malware/Cybercrime

FUD Watch | When Did the Sky Start Falling?

CSO's senior editor goes on vacation and the world falls apart. Bill Brenner looks at the recent, alarming headlines and looks for reason

By Bill Brenner, Senior Editor

August 14, 2008 — CSO —

About FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD - overhyped security threats that ultimately have little impact on a CSO's daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry's most egregious FUD, send an e-mail to bbrenner@cxo.com.

It seems like the world melted into a big puddle of sweat while I was away on vacation.

Bill Brenner

As I soaked up the beauty of Campobello Island (Franklin Roosevelt's former summer destination) and New Hampshire's White Mountains, the DNS panic deepened at the Black Hat confab in Las Vegas, Russia and the former Soviet republic of Georgia started fighting and the security vendors started making ominous predictions about Microsoft's August Patch Tuesday.

And so I'm taking a break from the post-vacation dig-out to look for some reason in all that has happened:

The DNS panic
My colleague Robert McMillan went to Black Hat and followed up on all the hoopla over the big DNS flaw researcher Dan Kaminsky discovered months ago and announced a few weeks back. McMillan reported that, according to Kaminsky and other researchers at Black Hat, the DNS issue was much more exploitable than previously suggested.

The DNS flaw is indeed a nasty one, as I said in the last FUD Watch column. And it was inevitable that more chilling headlines would come out of Black Hat. But I don't think what came out of Black Hat was much worse than what we already knew.

The good news is that a patch exists, and companies will be protected if they apply it. That fact isn't going to change.

Russia vs. Georgia
As word spread that Russia was bombing Georgia over the latter nation's military offensive against the breakaway province of South Ossetia, rumors of a cyber attack against Georgia spread like wildfire. Indeed, the attacks were real, but it's less certain if this is an act sponsored by the Russian government.

For a more reasoned perspective on this mess, I point you to a column from security expert Gadi Evron, who dealt with this sort of attack all the time when he worked for the Israeli government.

"Could this somehow be indirectly related to Russian military action? Yes, but there is no evidence to indicate it is the case as of yet. If anything, the opposite seems likely at this point in time," he writes. "Running security for the Israeli government Internet operation and later founding the Israeli government CERT, I found that such attacks were routine. Seeing the panicked reaction this type of attack has generated seems quaint from my perspective."