A new, stealthier version of a previously known Russian Trojan horse program called Gozi has been circulating on the Net since April 17 and has already stolen personal data from more than 2000 home users worldwide.
The compromised information includes bank and credit card account numbers (including CVV codes), Social Security numbers, and online payment account numbers as well as usernames and passwords. As with its predecessor, the new version of Gozi is programmed to steal information from encrypted SSL streams and send the stolen information to a server based in Russia.
As of Saturday, May 19, 2007, at least 3,414 members of the U.S. military have died since the beginning of the Iraq war in March 2003, according to an Associated Press count. The figure includes seven military civilians. At least 2,773 died as a result of hostile action, according to the military's numbers.
The AP count is 19 higher than the Defense Department's tally, last updated Friday at 10 a.m. EDT.
The thieves operated from small offices in Toronto and hangar-size rooms in India. Every night, working from lists of names and phone numbers, they called World War II veterans, retired schoolteachers and thousands of other elderly Americans and posed as government and insurance workers updating their files.
Then, the criminals emptied their victims’ bank accounts.
Richard Guthrie, a 92-year-old Army veteran, was one of those victims. He ended up on scam artists’ lists because his name, like millions of others, was sold by large companies to telemarketing criminals, who then turned to major banks to steal his life’s savings.
A Maricopa County Superior Court judge ruled that the Arizona Attorney General's Office may not force Western Union and two affiliates to turn over electronic data on wires transfers made to and from Nevada and Sonora, Mexico.
The Attorney General's Office wants the data to look for trends and money flows that will help them spot drug and human smugglers who use the companies' wire transfer services.
But in a ruling published Friday, Judge Kenneth Fields said that the request was overly broad, especially considering the amount of personal data of innocent people that would be turned over. The request, he wrote, was "unreasonable" because for the most part it was "without connection to a specific criminal investigation." He also said the Attorney General's Office had no jurisdiction to gather information on business conducted in Mexico and Nevada without an Arizona link.
The Attorney General's Office wanted Western Union to turn over the information on a regular basis. Western Union's attorney, Steven Wheeless said that was like "trying to force Western Union to be a subsidiary of the AG's Office, and Judge Fields said, 'no.' "
The state's professional-regulation department is notifying roughly 300,000 licensees and applicants that a computer server with some of their personal data was breached early this year, a spokeswoman for the agency said Friday.
Potentially at risk for identity theft are banking and real-estate professionals whose licensing information - including addresses, tax numbers and Social Security numbers - were kept on the storage server, said Sue Hofer, spokeswoman for the Illinois Department of Financial and Professional Regulation.
She said investigators have determined that the breach "looks like criminal conduct," and the hacking appears to have come from a source outside state government.
Department officials notified the Illinois State Police and FBI after they determined on May 3 that the computerized information had been compromised, probably in January, Hofer said.
The U.S. House of Representative's Committee on Homeland Security called this week for the Nuclear Regulatory Commission (NRC) to further investigate the cause of excessive network traffic that caused an Alabama nuclear plant to shut down last year.
During the incident, which happened last August at Unit 3 of the Browns Ferry nuclear power plant, operators manually shut down the reactor after two water recirculation pumps failed. The recirculation pumps control the flow of water through the reactor, and thus the power output of boiling-water reactors (BWRs) like Browns Ferry Unit 3.
An investigation into the failure found that the controllers for the pumps locked up following a spike in data traffic -- referred to as a "data storm" in the NRC notice -- on the power plant's internal control system network. The deluge of data was apparently caused by a separate malfunctioning control device, known as a programmable logic controller (PLC).
As societies become increasingly dependent on computer networks that cross national borders, security experts worry that in wartime, enemies will attempt to cripple those networks with electronic attacks.
The Department of Homeland Security has warned that U.S. networks should be secured against al-Qaeda hackers. Estonia's experience provides a rare chance to observe how such assaults proceed.
A signature update to Symantec's anti-virus software crippled thousands of Chinese PCs Friday when the security software took two critical Windows .dll files for malware.
According to numerous blog entries from Chinese computer users, a virus signature database seeded yesterday mistook two system files of a Chinese edition of Windows XP SP2 as a Trojan horse which Symantec dubs "Backdoor.Haxdoor." The anti-virus software -- Norton AntiVirus, for example, or the anti-virus component of the Norton 360 or Norton Internet Security suites -- then quarantined the netapi32.dll and lsasrv.dll files.
The National Association of State Boards of Education will elect officers in July, and for one office, president-elect, there is only one candidate: a member of the Kansas school board who supported its efforts against the teaching of evolution.
Scientists who have been active in the nation’s evolution debate say they want to thwart his candidacy, but it is not clear that they can.
The candidate is Kenneth R. Willard, a Kansas Republican who voted with the conservative majority in 2005 when the school board changed the state’s science standards to allow inclusion of intelligent design, an ideological cousin of creationism. Voters later replaced that majority, but Mr. Willard, an insurance executive from Hutchinson, retained his seat. If he becomes president-elect of the national group, he will take office in January 2009.
The group, based in Washington, is a nonprofit organization of state school boards whose Web site says it “works to strengthen state leadership in educational policymaking.”
As of Friday, May 18, 2007, at least 3,409 members of the U.S. military have died since the beginning of the Iraq war in March 2003, according to an Associated Press count. The figure includes seven military civilians. At least 2,773 died as a result of hostile action, according to the military's numbers.
The AP count is 14 higher than the Defense Department's tally, last updated Friday at 10 a.m. EDT.
Matt Hines writes on the InfoWorld "Zero Day Secutity" Blog:
In a new report issued on the WindowsSecrets.com resource site, researchers with the group have uncovered what they claim to be a dirty secret of the consumer anti-virus market.
According to the site's editors, recent tests carried out by WindowsSecrets staffers found that well-known consumer anti-virus providers including Symantec, McAfee and Microsoft are making it hard for end users to realize that they may be recurrently charged for subscriptions and updates to their anti-malware products.
New Zealanders' personal information - from passport information to credit card details - is being stored and processed in overseas databases, alarming the Privacy Commissioner.
Marie Shroff warns that New Zealand privacy laws do not apply beyond our shores.
"It raises real questions over whether we have protection," she told the Weekend Herald. "It's not something that one wants to get unduly panicked about, but we need to advance cautiously."
A computer disk containing personal information on thousands of Lucent employees and retirees has been missing for at least 10 days, Alcatel-Lucent said Thursday.
A vendor informed the company May 7 that the disk could not be located, Alcatel-Lucent said in a prepared statement.
The disk includes names, addresses, Social Security numbers, birth dates and salary data for U.S. employees who worked for Lucent and their family members and Lucent retirees and their dependents, the company said. It said the disk did not contain credit card numbers or bank account information.
Daniel Klaidman and Michael Isikoff write in Newsweek:
It read like a dime novel.
Former Deputy Attorney General Jim Comey shocked Washington this week with his testimony on Capitol Hill about a turning point in the Bush administration’s controversial domestic eavesdropping program. The program was about to expire, Comey testified, and then-Attorney General John Ashcroft lay incapacitated in a Washington hospital bed.
Comey’s Justice Department colleagues had persuaded him that the program was constitutionally unsound. But emissaries from the White House were rushing to Ashcroft’s hospital bed, Comey said—determined to convince the ailing Ashcroft to reauthorize the program as the deadline for its expiration approached. Comey enlisted FBI Director Robert Mueller as an ally, and raced to beat the White House team (then Chief of Staff Andrew Card and then White House Counselor Alberto Gonzales) to Ashcroft’s room. Comey threatened to resign if the program was reauthorized without changes.
Ultimately, the president intervened, and the program was revised to meet Comey’s concerns.
Newsweek’s Daniel Klaidman and Michael Isikoff, who covered the program for the magazine, discussed the developments—and what comes next.
Cannes is smacking its lips in anticipation of filmmaker and provocateur Michael Moore's latest jeremiad against the US administration, which receives its premiere at the film festival today. Sicko, a documentary tackling the state of American healthcare, focuses on the pharmaceutical giants, and particularly on health insurers.
The film has already caused Moore - who won the Palme d'Or at Cannes in 2004 with Fahrenheit 911 - to clash with the American authorities. Now, according to movie mogul Harvey Weinstein, whose Weinstein Company is behind the film, the US government is attempting to impound the negative.
The post-Sept. 11 flight data sharing agreement between the US and EU expires in July. But a new agreement is nowhere in sight. The Americans want to know even more, and the Europeans want to tell them even less.
Michael Chertoff's logic sounded convincing. Earlier this week, the US Secretary of Homeland Security provided the European Parliament with a succinct explanation as to how the Sept. 11, 2001 terrorist attacks could have been prevented. Had US authorities already been in possession of the so-called Passenger Name Record (PNR) -- which includes 34 items of data about every person travelling to the US -- before the attacks, Chertoff said, then 11 out of the 19 hijackers would have been denied entrance to the US. Consequently, Chertoff said, 9/11 would probably never have happened.
An AP newswire article by Anick Jesdanun, via NewsFactor Network, reports that:
In the new OpenNet study on censorship, China, Iran, Myanmar, Syria, Tunisia, and Vietnam were found to have the most extensive censorship filters for political sites, while Iran, Oman, Saudi Arabia, Sudan, Tunisia, the United Arab Emirates, and Yemen had the strictest social-filtering practices, blocking pornography, gambling, and gay and lesbian sites.
At least 25 countries around the world block Web sites for political, social or other reasons as governments seek to assert authority over a network meant to be borderless, according to a study out Friday.
The actual number may be higher, but the OpenNet Initiative had the time and capabilities to study only 40 countries and the Palestinian territories. Even so, researchers said they found more censorship than they had initially expected, a sign that the Internet has matured to the point that governments are taking notice.
Two or three online criminal gangs are waging an all-out battle for control of the largest botnets, sending out waves of malware aimed at stealing zombie computers from rival gangs to build up their own army.
Each online gang is trying to build up the biggest botnet because the bigger the army of infected computers they control, the more money spammers and hackers will pay to use them, explains Shane Coursen, a senior technical consultant for Kaspersky Lab. Since the gangs have their own botnets already built up, they're all trying to pilfer victimized computers from their rivals, to diminish their competitor's botnets while they build up their own.
"It's an ongoing war," said Coursen in an interview with InformationWeek. "The Internet is flooded with machines that already are compromised. What better way to take ownership of a machine than to get into one that is already owned. They can take advantage of it. It's like an open door to these guys."
Online applications for some UK visas have been suspended amid claims a security loophole left personal data vulnerable to identity thieves, it was reported last night.
IT systems covering India, Russia and Nigeria were affected and up to 50,000 Indian travellers could have been exposed to having their personal details stolen.
Home addresses, dates of birth and passport numbers were all said to be accessible for more than a year, creating what the Tories said was a security breach open to being exploited by terrorists.
The Information Commissioner, the government's data privacy watchdog demanded a "full explanation" from the Foreign Office over the apparent breach - to which it was alerted a year ago.
Google recently seemed to suggest that it was willing to wait several millennia for its Chinese business to take off. As it plays its very long game, despite losing heavily to the local players and having to face down shareholder protests on human rights issues only last week, it, like other Western internet companies, is sticking to Beijing’s rules.
It is easy to explain why, but harder to believe that the explanation will last the long term. China’s attractions are plain. It already has about as many internet users as the US, the world’s largest online market. Yet, so far, the dragon is barely blowing smoke rings when it comes to e-commerce.
For although it may be true that being rich is indeed glorious, few of China’s 1.3 billion people have tested Deng Xiaoping’s dictum. Indeed, the average Chinese citizen has roughly the same chance of being hit by lightning as of becoming a dollar millionaire.
The website of the Finnish Broadcasting Company (YLE) was hit on Monday and Tuesday by at least three denial-of-service (DoS) attacks, which effectively paralysed the site's service for short periods.
First indications, according to F-Secure expert Mikko Hyppönen, were that the attempts were launched by a Romanian or East European group, who had made earlier threats of such attacks.
Speaking on TV on Wednesday morning, Hyppönen did not rule out the possibility that there might be Finnish members in the attacking group.
In the course of Tuesday it was possible to access the YLE site only intermittently, owing to the massive loading from a hostile attack.
Jonathan Richards writes in The Times Online (UK):
The prospect of inter-governmental cyber-war was something for which countries needed to be increasingly prepared, security experts said today.
An attack launched by an army of zombie computers which could disable a country’s computer systems and cut off its essential services could “definitely” be pulled off by a Government, they said.
The comments come in the wake of allegations by Estonia that Russian authorities were responsible for a wave of attacks on Estonian government websites designed to make the Baltic state's systems crash and paralyse its infrastructure.
If the attacks, which Estonia claims can be traced to internet protocol (IP) addresses associated with Russian authorities, are found to be linked with the Kremlin, it would be the first known instance of one state 'declaring cyber-war' on another.
If you disable JavaScript in your browser, you'll notice that the recently updated Google.com doesn't have too many navigational links anymore. That's because the menu from the top left corner is written entirely in JavaScript.
Google, that usually writes pages with graceful degradation in mind and builds custom interfaces that don't require JavaScript (Google Maps, Gmail), forgot about the browsers that don't support JavaScript (text browsers, some mobile browsers) and the users that have JavaScript turned off for its biggest assets: the homepage and the search results pages.
We predicted in past posts that AACS, the encryption system intended to protect HD-DVD and Blu-ray movies, would suffer a gradual meltdown from its inability to respond quickly enough to attacks. Like most DRM, AACS depends on the secrecy of encryption keys built into hardware and software players. An attacker who discovers a player’s keys can defeat the protection on any disc that works with that player.
AACS was designed with a defense against such attacks: after a player has been compromised, producers can alter new discs so that they no longer work with the compromised player’s keys. Whether this defense (which we call “key blacklisting”) will do much to stop copying depends how much time elapses before each leaked key is blacklisted.
Adware maker Zango has sued PC Tools, makers of the popular Spyware Doctor software, in a dispute over the way the antispyware program flags and removes Zango's technology.
Representatives from both Zango and PC Tools confirmed that Zango had filed suit against the antispyware vendor. However they declined to provide details on the lawsuit except to say that it involved a dispute over the way Spyware Doctor rated Zango's software.
China's hacking scene appears poised for growth, as the number of Internet users rise with a commensurate interest in criminal hacking and government spying, according to a new Symantec study.
"China’s hacking scene is clearly an active one," the report said. "These individuals and groups are known for discovering vulnerabilities, writing exploit code, and developing sophisticated hacking techniques."
China ranks second behind the U.S. as far as malicious activity on the Internet as a whole, Symantec said, citing its own data. The country had 131 million Internet users as of the end of 2006, accounting for about 10 percent of its population and 11 percent of the world's Internet users.
A well-known cyberwar between Chinese and American hackers erupted in April 2001 following the collision of a U.S. military spy plane and Chinese fighter. U.S. government Web sites were hacked and defaced with slogans such as "Beat down imperialism of American," courtesy of a group calling itself the Honker Union of China.
Denial-of-service attacks on Web sites in the northern European country of Estonia have trailed off three weeks after civil unrest spurred partisan attackers to level massive data floods against government sites.
In an analysis of the last two weeks of attacks, a researcher for network security firm Arbor Networks identified at least 128 separate attacks on nine different Web sites in the country, including 35 attacks on the Web site of the Estonian Police, another 35 attacks on the Web site of the Ministry of Finance, and 36 attacks on the Estonian parliament's, prime minister's, and general government Web sites. Some of the attacks lasted more than 10 hours and topped 95Mbps.
"All in all, someone is very, very deliberate in putting the hurt on Estonia, and this kind of thing is only going to get more severe in the coming years," Jose Nazario, senior security researcher for Arbor Networks, said in the blog post.
A civil liberties group representing 16 attorneys of detainees at Guantanamo Bay on Thursday sued the National Security Agency and the Justice Department, claiming that the government illegally spied on the lawyers with warrantless wiretaps and has refused to turn over records of the snooping.
The Center for Constitutional Rights filed the FOIA suit in the U.S. District Court for the Southern District of New York. The group wants all records related to government eavesdropping on the lawyers' conversations with their clients, which would usually be considered legally protected privileged communication.
The suit alleges that the government failed to meet its FOIA obligations to turn over records the lawyers want in timely fashion.
The most sensitive and highly classified data communicated over the nation's internal computer networks remains at risk for exposure, according to key witnesses in the government's investigation into the United States Coast Guard's Deepwater procurement program.
According to Michael DeKort, a former lead systems engineer at Lockheed Martin who has become the primary whistleblower in the Deepwater case, and James Atkinson, an electronic intelligence expert hired by Congress to look into security issues with communications equipment purchased as part of the program, radios that have insufficient encryption in place to protect classified government information remain in use by the Coast Guard today.
When a thief began stealing high-end science equipment from Stanford University labs this year, a group of graduate students struck back using tools of their own.
About 5:30 a.m. Sunday, a camera rigged by the students caught a 20-seconds footage of a man breaking into a Stanford physics lab information that is now a part of the campus investigation, said Mike Killian, facilities manager of the Hansen Experimental Physics Laboratory.
In at least eight break-ins at Stanford physics labs since September, a thief targeted specific scientific electronics equipment, often stealing oscilloscopes and spectrum analyzers, Killian said.
David E. Kaplan writes on the U.S. News & World Report "Bad Guys" Blog:
This year is already shaping up as an impressive one for computer crime in America, with cases ranging from massive fraud to sophisticated "hack, pump, and dump" stock scams.
Here are highlights of the top cybercrimes for the year's first quarter, drawn from cases at the U.S. Justice Department's Computer Crime Section, the FBI, and Immigration and Customs Enforcement.
The legacy of World War II continues to haunt Europe and may have just started a new confrontation -- this one befitting the digital age. Computers in the entire nation of Estonia have been virtually shutdown, and the Estonians blame Russia.
Estonia, a country of only a million and a half citizens situated in Europe's far north between Finland and Russia, has undergone nearly three weeks of cyberattack and the country is accusing Russia for being behind it.
Google Korea plans to introduce an age-verification system to its search engine later this year that will restrict adult-themed searches to those 19 years of age and older, it said Thursday.
Users will be asked to verify their age when searching for any of about 700 words in Korean judged to be adult and supplied to the portal by the Korean government, said Lois Kim, a spokeswoman for the company in Seoul.
Users will have to enter their name and national resident registration number, which will be checked against a database to verify the user -- or at least the person whose data has been entered -- is old enough.
Officials are searching for a woman they say stole a Gwinnett County woman's identity to get a job at Equifax.
Tonia Leach said her identity was stolen by a woman who worked at a major U.S. credit reporting agency and investigators believe the identity thief is in the Gwinnett County area.
Leach first discovered that someone had stolen her identity after her credit report showed that Manpower and Equifax had conducted background checks on her. Since Leach had never applied for jobs there, she knew what happened.
Authorities said a woman stole Leach’s name, Social Security number and date of birth to get a job at Manpower, a temp agency. It was there the woman was also able to get a job at Equifax, a credit reporting agency.
UPDATE: 11:02 PDT: A UPI article quotes Estonian foreign minister, Urmas Paet, as saying "When there are attacks coming from official (Internet protocol) addresses of Russian authorities and they are attacking not only our Web sites but our mobile phone network and our rescue service network, then it is already very dangerous." Details here.
The Chinese government, which spent months mulling over ways to crack down on bloggers, is retreating from its campaign, a development that illustrates the difficulty China faces as it tries to control technology.
Since September, the central government has been deliberating the need to enforce a real-name registration system, which would have required nearly 20 million Chinese bloggers to register their real identities on the Web and give up the anonymity many have gotten used to, even though bloggers can never be entirely anonymous as they can be traced back to an IP address.
The Chinese government, which sees the online world as a conduit for slander, pornography and antigovernment views, believes the real-name system would force the Internet community to watch their words and actions. But the policy received sharp protests from the technology industry.
Now, the Ministry of Information Industry, the agency responsible for the policy, has abandoned plans for a law requiring all Chinese blog service providers to ask their users for verifiable personal details before they can start blogging.
Instead, the government is going for the soft approach.
When Firefox launched in beta release five years ago, it burst on the open-source browser scene like a young Elvis Presley -- slim, sexy and dangerous.
Since then it has attracted millions of users, generally set the agenda for browser development and unseated Microsoft's Internet Explorer as the de facto monopoly in the field. But, with Firefox 3.0 poised for release this summer, the "IE killer" is in danger of morphing into an early Fat Elvis, if increasing numbers of die-hard fans turned reluctant critics are any guide.
Anecdotal reports of problems, from sluggishness to slow page loads and frequent crashes, have begun circulating in web forums, along with increasingly loud calls for Firefox to return to its roots. The alleged culprit: bloat, the same problem that once plagued Mozilla, the slow, overstuffed open-source browser spawned by Netscape that Firefox was originally meant to replace.
"It's our brains again. We need to 'do something,' even if that something doesn't make sense; even if it is ineffective. And we need to do something directly related to the details of the actual event."
"So instead of implementing effective, but more general, security measures to reduce the risk of terrorism, we ban box cutters on airplanes."
- Bruce Schneier, writing in one of the best commentaries I think he's ever written. Read the entire commentary on Wired's 'Security Matters'here.
Google announced today [27 April 2007] that it will invest 250 million euros in a new data center in Baudour near Mons in Belgium. The datacenter will have a surface of 85 hectares (0.85 square kilometers) and is close to a channel, which is convenient for cooling purposes. Fiber is already present in the neighbourhood.
Google's Peter Fleischer is saying that the new datacenter will bring Google a few milliseconds closer to European users.
As of Wednesday, May 16, 2007, at least 3,399 members of the U.S. military have died since the beginning of the Iraq war in March 2003, according to an Associated Press count. The figure includes seven military civilians. At least 2,773 died as a result of hostile action, according to the military's numbers.
The AP count is four higher than the Defense Department's tally, last updated Wednesday at 10 a.m. EDT.
Two proposals being floated around Capitol Hill call for the Social Security card to be updated with biometric information and for U.S. employers to be required to verify it with the Department of Homeland Security when hiring.
Scared yet? You should be. While everyone was off fighting the REAL ID battle, national identification proponents were sneaking in the back door, arguing that the Social Security card should be updated with the latest technology to prevent illegal immigrants from working.
Under the so-called Bonner Plan, citizens and resident aliens alike would have to obtain a new Social Security card containing their photograph, a barcode or magnetic stripe containing an encrypted signature verifiable through card readers provided by the Department of Homeland Security, and would have to present this card in order to obtain work. The plan provides that employers who fail to verify the card face fines, prison time, and would be billed for the cost of deporting any illegal aliens they may have hired.
Of course, they’re still claiming that the card wouldn’t be a national ID card. But if it walks like a duck and quacks like a duck, it certainly isn’t a sheep.
The American Civil Liberties Union today urged that Congress subpoena all of the Justice Department documents relating to the NSA warrantless wiretapping program and the new FISA court-approved program in light of the testimony yesterday that Deputy Attorney General James Comey made at a hearing before the Senate Judiciary Committee.
The testimony yesterday clearly indicated that not only did the Bush administration reauthorize the NSA program in 2004 without a signature from the Justice Department; it reauthorized the program even after both the Attorney General and Comey, the acting Attorney General determined that the program was illegal.
The computer database infrastructure of Sarasota County, Fla., was attacked by a notorious Internet worm on the first day of early voting during the 2006 election, which featured the now-contested U.S. House race between Democrat Christine Jennings and Republican Vern Buchanan in Florida's 13th Congressional district.
In the early afternoon hours on Monday, Oct. 23, 2006, an Internet worm slammed into the county's database system, breaching its firewall and overwriting the system's administrative password. The havoc brought the county's network -- and the electronic voting system which relies on it -- to its knees as Internet access was all but lost at voting locations for two hours that afternoon. Voters in one of the nation's most hotly contested Congressional elections were unable to cast ballots during the outage, since officials were unable to verify registration data.
A three-week wave of massive cyber-attacks on the small Baltic country of Estonia, the first known incidence of such an assault on a state, is causing alarm across the western alliance, with NATO urgently examining the offensive and its implications.
While Russia and Estonia are embroiled in their worst dispute since the collapse of the Soviet Union, a row that erupted at the end of last month over the Estonians' removal of the Bronze Soldier Soviet war memorial in central Tallinn, the country has been subjected to a barrage of cyber warfare, disabling the websites of government ministries, political parties, newspapers, banks, and companies.
NATO has dispatched some of its top cyber-terrorism experts to Tallinn to investigate and to help the Estonians beef up their electronic defences.
"This is an operational security issue, something we're taking very seriously," said an official at NATO headquarters in Brussels. "It goes to the heart of the alliance's modus operandi."
Politicians on Wednesday endorsed new laws designed to rein in "rogue" online pharmacies that dispense drugs without government-approved prescriptions--and said they're considering a requirement that Internet service providers block those Web sites or ads for them.
Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.) and other senators said it was too easy for someone with access to the Internet and a credit card--teenagers, in particular--to buy large quantities of addictive prescription narcotics such as Vicodin and Oxycontin. Leahy cited a 2006 government survey on drug use and health that found about 6 million people currently misuse prescription drugs.
Today was the third day when the Web site of Finnish broadcasting company YLE (Yleisradio) suffer problems of large-scale DDoS attack:
"The company’s web pages were targeted by of a concerted attack on Monday and Tuesday. Two other major web sites, those of the telecommunications service provider Eniro, and the Suomi24 portal also reported similar attack."
The TJX Companies, whose computer systems containing customer credit and debit card information had been hacked, said the impact of that data breach showed up in the discount retailer's earnings for the first quarter.
The company suffered an after-tax charge of $12 million, or 3 cents per share, due to the money the company has been shelling out to investigate and contain the breach, beef up its information security, communicate with customers and pay attorneys.
Due to errors in Sun's Java Development Kit attackers could execute arbitrary code or crash systems that use the JDK to process images server-side. Chris Evans from the Google Security Team has published an advisory on these vulnerabilities, including links to files for demonstration purposes.
Manipulated JPEG images with integrated ICC colour profiles may be used to infiltrate malicious code into the JDK. These images are parsed without range-checking the values in the ICC profile. Excessively large values cause an integer overflow and a subsequent buffer overflow. Under Linux, manipulated BMP files may cause the image parsing thread to hang while trying to read from /dev/tty.
Millions of broadband Internet users across most of eastern Japan were unable to log on Tuesday evening after a problem at the country's largest broadband provider.
NTT East said 2.85 million customers lost Internet service at 6:44 p.m. (9:44 a.m. GMT) on Tuesday, the carrier said in a statement. The outage, the cause of which is still being investigated, lasted until 1:35 a.m. on Wednesday when the last of the affected customers was reconnected.
The outage is one of the largest in years and took out both PC Internet connections and IP telephone service across 14 of the 17 prefectures in which NTT East provides service. Customers in Tokyo and the surrounding prefectures of Kanagawa, Chiba and Saitama were not affected.
Ben Edelman made a name for himself while still a graduate student by digging into the shady dealings that spawned what most people considered an innocuous problem: pop-up Web advertising.
From his dorm room at Harvard University, Edelman investigated everything from the shady practices of "legitimate" advertising software companies like 180 Solutions and Claria, to the methods used by the People's Republic of China to filter Internet traffic. His patient research, which was frequently accompanied by movies showing how adware took over computers, prodded regulators to take notice of the adware business, and ultimately forced adware companies to change their business practices.
According to data culled from Secunia’s free software inspector, about 28% of all detected applications are vulnerable to a known security vulnerability.
The utility, which uses a signature database to pinpoint the specific versions of all installed programs (browsers, plugins, IM and e-mail clients, media players, operating systems) on a user’s computer, has conducted more than 350,000 inspections since December last year and the findings show exactly why we’re in the midst of a malware epidemic.
Secunia’s inspector identified about 4.9 million installed applications, and out of those, 1.4 million applications were found to be lacking critical security patches from the vendors.
After years of industry speculation, Amazon.com is getting into the digital music business.
Amazon, the Internet’s most successful seller of physical CDs, today announced plans to introduce a music download store later this year, selling songs and albums in the MP3 format without the anti-copying protection used by most online music retailers.
A U.S. federal appeals court ended a preliminary injunction on Wednesday against Google Inc.'s. image-search service from displaying thumbnail-sized photos from a sexually explicit publication.
Last year, a federal judge found that Google had violated the copyrights of adult magazine and Web publisher Perfect 10 Inc. but said the Internet search firm was likely not responsible for displaying the underlying images from Perfect 10's Web site.
A British judge admitted on Wednesday he was struggling to cope with basic terms like "Web site" in the trial of three men accused of inciting terrorism via the Internet.
Judge Peter Openshaw broke into the questioning of a witness about a Web forum used by alleged Islamist radicals.
"The trouble is I don't understand the language. I don't really understand what a Web site is," he told a London court during the trial of three men charged under anti-terrorism laws.
Prosecutor Mark Ellison briefly set aside his questioning to explain the terms "Web site" and "forum". An exchange followed in which the 59-year-old judge acknowledged: "I haven't quite grasped the concepts."
Violent Islamist material posted on the Internet, including beheadings of Western hostages, is central to the case.
Estonia has urged its allies in the European Union and NATO to take firm action against a new mode of warfare that has been unleashed on the Baltic state in a bitter row with Russia over a Soviet war memorial: cyber-attacks.
"Taking into account what has been going on in Estonian cyber-space, both the EU and NATO clearly need to take a much stronger approach and cooperate closely to develop practical ways of combatting cyber-attacks," Estonian Defence Minister Jaak Aaviksoo told AFP Tuesday.
"Considering the scale of damage and the way these cyber-attacks have been organised, we can compare them to terrorist activities," Aaviksoo said a day after raising the new mode of warfare at talks with his fellow EU defence ministers in Brussels.
Estonian institutional websites have been under regular cyber-attack since the end of last month, when a row blew up with Russia over the removal from central Tallinn of a memorial to Soviet Red Army soldiers.
Officials in Estonia, including Prime Minister Andrus Ansip, have claimed that some of the cyber-attacks, which forced the authorities in the Baltic state to temporarily shut down websites, came from Russian government computers, including in the office of President Vladimir Putin.
The Department of Homeland Security is breaking privacy laws by failing to tell the public all the ways it uses personal information to target passengers boarding flights entering or leaving the United States, according to a draft government report.
The Government Accountability Office, in a report to be released tomorrow, says DHS's Customs and Border Protection agency has never publicly disclosed all the sources of data such as name, credit card number and travel history that it uses to detect passengers who may pose a security risk.
"So many people in America think this does not affect them. They've been convinced that these programs are only targeted at suspected terrorists. … I think that's wrong. … Our programs are not perfect, and it is inevitable that totally innocent Americans are going to be affected by these programs," former CIA Assistant General Counsel Suzanne Spaulding tells FRONTLINE correspondent Hedrick Smith in Spying on the Home Front.
9/11 has indelibly altered America in ways that people are now starting to earnestly question: not only perpetual orange alerts, barricades and body frisks at the airport, but greater government scrutiny of people's records and electronic surveillance of their communications. The watershed, officials tell FRONTLINE, was the government's shift after 9/11 to a strategy of pre-emption at home -- not just prosecuting terrorists for breaking the law, but trying to find and stop them before they strike.
President Bush described his anti-terrorist measures as narrow and targeted, but a FRONTLINE investigation has found that the National Security Agency (NSA) has engaged in wiretapping and sifting Internet communications of millions of Americans; the FBI conducted a data sweep on 250,000 Las Vegas vacationers, and along with more than 50 other agencies, they are mining commercial-sector data banks to an unprecedented degree.
A Web site that matches roommates may be liable for what its users say about their preferences, a fractured three-judge panel of the federal appeals court in San Francisco ruled yesterday.
The suit was brought by two California fair housing groups that objected to postings on the matching service, Roommate.com. The groups said the site violated the Fair Housing Act by allowing and encouraging its users to post notices expressing preferences for roommates based on sex, race, religion and sexual orientation.
The ruling knocked down the main defense of the site. In 1996, Congress granted immunity to Internet service providers for transmitting unlawful materials supplied by others. Most courts have interpreted the scope of that immunity broadly.
MySpace, an online social network popular with teenagers, said in two statements yesterday that it was prepared to work with state attorneys general who have requested the identities of MySpace members who are known sex offenders.
But the company said its cooperation hinges on whether the state officials follow the law and subpoena the names, a step that a leader of the state attorneys general said was not necessary.
Popular online social network MySpace said on Tuesday it has identified, removed and blocked "a few thousand" user profiles of convicted sex offenders, as part of a program to protect its young members from adult predators.
The action comes a day after eight U.S. attorneys general demanded that the News Corp.-owned company hand over offenders' names and addresses, and delete their profiles from among MySpace's 175 million user base.
"We've made it clear we have a zero tolerance policy against convicted sex offenders," MySpace Chief Security Officer Hemanshu Nigam said in a phone interview on Tuesday. "We've said numerous times that the goal was to delete them."
Nigam said he was puzzled over the law enforcement authorities' actions on Monday, which he said would require MySpace to break the law.
President Bush intervened in March 2004 to avert a crisis over the National Security Agency’s domestic eavesdropping program after Attorney General John Ashcroft, Director Robert S. Mueller III of the F.B.I. and other senior Justice Department aides all threatened to resign, a former deputy attorney general testified Tuesday.
Mr. Bush quelled the revolt over the program’s legality by allowing it to continue without Justice Department approval, also directing department officials to take the necessary steps to bring it into compliance with the law, according to Congressional testimony by the former deputy attorney general, James B. Comey.
Although a conflict over the program had been disclosed in The New York Times, Mr. Comey provided a fuller account of the 48-hour drama, including, for the first time, Mr. Bush’s role, the threatened resignations and a race as Mr. Comey hurried to Mr. Ashcroft’s hospital sickbed to intercept White House officials, who were pushing for approval of the N.S.A. program.
As of Tuesday, May 15, 2007, at least 3,398 members of the U.S. military have died since the beginning of the Iraq war in March 2003, according to an Associated Press count. The figure includes seven military civilians. At least 2,772 died as a result of hostile action, according to the military's numbers.
The AP count is five higher than the Defense Department's tally, last updated Tuesday at 10 a.m. EDT.
The Defense Information Systems Agency has started to deploy throughout the Defense Department a Wi-Fi network monitoring tool dubbed “Flying Squirrel,” according to an internal agency briefing obtained by Tech Insider.
The name Flying Squirrel, I’m told, has nothing to do with DISA – whose headquarters on Courthouse Road in Arlington, Va., is pretty much in a squirrel-free zone – or with the actual device itself, but rather it’s just a moniker that caught the fancy of an unnamed developer at the Naval Research Lab, which created the monitoring tool. DISA, on the other hand, calls the system a “Wireless Discovery Tool.”
The Flying Squirrel provides the most basic defense of any Wi-Fi network against intruders who may monitor radio activity around a DOD facility or base, I’m told by an industry source well versed in its development.
Flying Squirrel’s software, the development of which was overseen by the U.S. Strategic Command’s Enterprisewide Information Assurance and Computer Network Defense Solutions Steering Group, sniffs for users on a Wi-Fi network and, once it finds one, captures the user’s unique identifying address and geolocation. Network personnel then check the address to determine if the user is an authorized or unauthorized user on the wireless network.
PayPal expects to accelerate the adoption of its online payment services in Europe now that it has obtained a banking license that will give it more freedom to market its services to merchants throughout the Continent.
The license, granted by the Commission de Surveillance du Secteur Financier (CSSF) in Luxembourg, kicks in July 2. As a result of obtaining the license, PayPal will move its European headquarters to Luxembourg from the United Kingdom, a PayPal spokeswoman said Tuesday.
On the night of March 10, 2004, a high-ranking Justice Department official rushed to a Washington hospital to prevent two White House aides from taking advantage of the critically ill Attorney General, John Ashcroft, the official testified today.
One of those aides was Alberto R. Gonzales, who was then White House counsel and eventually succeeded Mr. Ashcroft as Attorney General.
“I was very upset,” said James B. Comey, who was deputy Attorney General at the time, in his testimony today before the Senate Judiciary Committee. “I was angry. I thought I had just witnessed an effort to take advantage of a very sick man, who did not have the powers of the attorney general because they had been transferred to me.”
The hospital visit by Mr. Gonzales and Andrew H. Card Jr., who was then White House chief of staff, has been disclosed before, but never in such dramatic, personal detail. Mr. Comey’s account offered a rare and titillating glimpse of a Washington power struggle, complete with a late-night showdown in the White House after a dramatic encounter in a darkened hospital room — in short, elements of a potboiler paperback novel.
An AP newswire article, via USA Today, reports that:
IBM, one of the world's leading providers of encryption and other data-management technologies, is in the uncomfortable position of trying to solve its own mystery involving missing computer tapes with sensitive information about employees and records of customer transactions.
An outside vendor was transporting the tapes from one IBM facility to another on Feb. 23 when the tapes fell out of a contractor's vehicle in Westchester County, N.Y., not far from IBM headquarters in Armonk. IBM representatives went to the scene and couldn't find the tapes, spokesman Fred McNeese said Tuesday.
The incident surfaced in recent weeks when IBM's human-resources department wrote to affected workers — primarily former employees — to inform them. The letter said the tapes held archival information "such as your Social Security number, your dates of employment with IBM, birth date, contact information such as your address, and your IBM work history."
IBM also advertised in a local newspaper to ask for the return of the tapes.
It's like something out of 'The Sopranos'. Antivirus researchers at Moscow-based Kaspersky Labs have identified criminal gangs engaged in a turf battle online. The primary groups are responsible for the Warezov and Zhelatin worms; these worms then download Trojans that are in turn responsible for a majority of the spam and malware circulating on the Web.
Basically, new spam and new phishing attacks are designed to switch your remotely controlled PC from belonging to the Warezov gang or the Zhelatin gang. The resulting botnets--collections of remotely controlled PCs--have proved profitable, luring unsuspecting Internet users to purchase porn or other services attributed to organized crime activity.
Organized teams of Chinese hackers are breaking into the computers of Western companies to steal fashion ideas and counterfeit them before the genuine articles can hit the streets, Italy's domestic intelligence service reports.
"Platoons of seasoned, unscrupulous cyber pirates, crackers and hackers of every kind ... make up an exponentially growing and unstoppable army," says a report made public in Gnosis, a magazine published by Italy's SISDE counterintelligence agency.
As much as 20 percent of Internet viruses and "spam" messages that jam e-mails around the world originate in China, the article claims. It says Chinese mobsters profit most from pornography -- including sites that sell videos for pedophiles and traffic in date-rape drugs, heroin and counterfeit medicines.
A spokesman at the Chinese Embassy in Washington dismissed the "sensational" SISDE report as "irresponsible" and driven by "ulterior motives."
A tech trade group and a leading cybersecurity vendor applauded new legislation introduced in the U.S. Congress that would broaden penalties for cybercrime, including first-time penalties for botnet attacks.
The Cyber Security Enhancement Act, introduced Monday, would create for the first time criminal penalties for botnet attacks often used to aid identity theft, denial-of-service attacks and the spread of spam and spyware. Botnets are groups of compromised computers that hackers can control remotely.
The bill, introduced by Representatives Adam Schiff, a California Democrat, and Steve Chabot, an Ohio Republican, would also allow prosecutors to pursue racketeering charges against cybercriminal groups, would expand sentencing guidelines for cybercrime by allowing the forfeiture of property used to commit the crime, and would add US$30 million a year to the budgets of federal agencies fighting cybercrime.
MXN Limited acquires Porn.com for $9 Million. Terms of the transaction were not fully disclosed, but this is the second largest adult domain transactions behind sex.com. It was not more then two months ago when I saw this domain at auction for 7 .5 Million and thought it was a bargain.
The new owner is going to take their time to consider what long-term project plans they will take with Porn.com. They said, “It does not need to transform overnight. In the meantime, we will keep it parked with PremiumTraffic.com, a leading domain name monetization company”.
