FBI Resists Inquiries Into DNA Testing Accuracy
Jason Felch and Maura Dolan write in The Los Angeles Times:
State crime lab analyst Kathryn Troyer was running tests on Arizona's DNA database when she stumbled across two felons with remarkably similar genetic profiles.
The men matched at nine of the 13 locations on chromosomes, or loci, commonly used to distinguish people.
The FBI estimated the odds of unrelated people sharing those genetic markers to be as remote as 1 in 113 billion. But the mug shots of the two felons suggested that they were not related: One was black, the other white.
In the years after her 2001 discovery, Troyer found dozens of similar matches -- each seeming to defy impossible odds.
As word spread, these findings by a little-known lab worker raised questions about the accuracy of the FBI's DNA statistics and ignited a legal fight over whether the nation's genetic databases ought to be opened to wider scrutiny.
The FBI laboratory, which administers the national DNA database system, tried to stop distribution of Troyer's results and began an aggressive behind-the-scenes campaign to block similar searches elsewhere, even those ordered by courts, a Times investigation found.
At stake is the credibility of the compelling odds often cited in DNA cases, which can suggest an all but certain link between a suspect and a crime scene.
More
here.
Hat-tip: /.
Library Confrontation Points Up Privacy Dilemma
An AP newswire article by John Curran, via Salon.com, reports that:
Children's librarian Judith Flint was getting ready for the monthly book discussion group for 8- and 9-year-olds on "Love That Dog" when police showed up.
They weren't kidding around: Five state police detectives wanted to seize Kimball Public Library's public access computers as they frantically searched for a 12-year-old girl, acting on a tip that she sometimes used the terminals.
Flint demanded a search warrant, touching off a confrontation that pitted the privacy rights of library patrons against the rights of police on official business.
More
here.
Off Beat: Chinese Authorities Order Bars Not To Serve Black People
Tom Miller writes in The South China Morning Post:
Beijing authorities are secretly planning to ban black people and others it considers social undesirables from entering the city's bars during the Olympic Games, a move that would contradict the official slogan, "One World, One Dream".
Bar owners near the Workers' Stadium in central Beijing say they have been forced by Public Security Bureau officials to sign pledges agreeing not to let black people enter their premises.
"Uniformed Public Security Bureau officers came into the bar recently and told me not to serve black people or Mongolians," said the co-owner of a western-style bar, who asked not to be named.
The local authorities have been cracking down on blacks and Mongolians in an attempt to stamp out drug dealing and prostitution ahead of the Games, the proprietors said.
More
here.
Hat-tip: Dave Farber's "Interesting People" (IP) mailing list
AKILL: Bustin' The Botnet Brain
Owen WalkerJane Phare and Carolyne Meng-Yee
write in
The New Zealand Herald:
When Owen Walker was 16 he began to develop a highly sophisticated system to infiltrate computers and effectively control them without anyone knowing.
For two years, between January 2006 and November 2007, he controlled tens of thousands of computers through servers outside New Zealand either by leasing space or by accessing them illegally using software he had developed himself.
The exact number of computers he infected may never be known. Known by his online ID AKILL (a name taken from the "automatic kill" command used to knock unwanted participants off chat channels), Walker is said to have led a small, elite group of computer programmers who used malware to infect and remotely control computers, using them as robots - or bots.
Walker created his own bot code, considered by investigators to be among the most advanced bot programming encountered.
More
here.
U.S. Toll in Iraq, Afghanistan
Iraq and Afghanistan statistics via The Boston Globe (AP).
As of Friday, July 18, 2008, at least 4,124 members of the U.S. military have died in the Iraq war since it began in March 2003, according to an Associated Press count.
The figure includes eight military civilians killed in action. At least 3,360 died as a result of hostile action, according to the military's numbers.
The AP count is the same as the Defense Department's tally, last updated Friday at 10 a.m. EDT.
As of Friday, July 18, 2008, at least 476 members of the U.S. military had died in Afghanistan, Pakistan and Uzbekistan as a result of the U.S. invasion of Afghanistan in late 2001, according to the Defense Department. The department last updated its figures July 12 at 10 a.m. EDT.
Of those, the military reports 335 were killed by hostile action.
More
here and
here.
And as always, the
Iraq Coalition Casualty Count keeps the grim watch on their website
here.
Honor the Fallen.
Users Reporting Failed Microsoft WGA and OGA Activations
Emil Protalinski writes on ARS Technica:
A few of our readers have written in to report problems trying to activate copies of Microsoft Office 2003. One user has been receiving a message telling him that the service is temporarily down since Thursday morning. Phone calls to Microsoft would result in a message asking him to try activating again later and to call back in an hour or two.
Ars has contacted Microsoft and has confirmed that both the Windows Genuine Advantage (WGA) and the Office Genuine Advantage (OGA) servers are currently down.
More
here.
The Ghost in Your Machine: IPv6 Gateway to Hackers
Kim Zetter writes on Threat Level:
It may be years before the new internet protocol IPv6 takes over from the current IPv4, but a security researcher is warning that many systems – corporate and personal – are already open to attack through channels that have been enabled on their machines to support IPv6 traffic.
Joe Klein, a security researcher with Command Information, says many organizations and home users have IPv6 enabled on their systems by default but don't know it. They also don't have protection in place to block malicious traffic, since some intrusion detection systems and firewalls aren't set up to monitor IPv6 traffic, presenting an appealing vector through which outsiders can attack their networks undetected.
"Essentially, we have systems that are wide open to a network," says Klein, who is a member of an IPv6 task force and will be speaking about the issue tonight at the HOPE (Hackers on Planet Earth) conference in New York. "It's like having wireless on your network without knowing it."
More
here.
U.S. House Defeats Paper Ballot Funding
Michael Hardy writes on FCW.com:
The House rejected a bill last week that would have funded the purchase of paper ballots as a backup to electronic voting systems for the upcoming election.
The bill would have directed the Election Assistance Commission to establish a program to make the grants in time for the November vote.
Aviel Rubin, a professor of computer science at the University of Maryland and longtime skeptic of electronic voting, said he was disappointed by the House.
"It’s a real missed opportunity," he said. "I just hope we won’t be sorry in November."
More
here.
Note: I humbly remind you of
"Hacking Democracy".
-ferg
Why San Francisco's Network Admin Went Rogue
Paul Venezia writes on InfoWorld:
Last Sunday, Terry Childs, a network administrator employed by the City of San Francisco, was arrested and taken into custody, charged with four counts of computer tampering. He remains in jail, held on $5 million bail. News reports have depicted a rogue admin taking a network hostage for reasons unknown, but new information from a source close to the situation presents a different picture.
In posts to my blog, I postulated about what might have occurred. Based on the small amount of public information, I guessed that the situation revolved around the network itself, not the data or the servers. A quote from a city official that Cisco was getting involved seemed to back that up, so I assumed that Childs must have locked down the routers and switches that form the FiberWAN network, and nobody but Childs knew the logins. If this were true, then regaining control over those network components would cause some service disruption, but would hardly constitute the "millions of dollars in damages" that city representatives feared.
Apparently, I wasn’t far off the mark. In response to one of by blog posts, a source with direct knowledge of the City of San Francisco’s IT infrastructure and of Childs himself offered to tell me everything he knew about the situation, under condition that he remain anonymous. I agreed, and within an hour, a long e-mail arrived in my in box, painting a very detailed picture of the events. Based on this information, the case of Terry Childs appears to be much more – and much less – than previously reported.
More
here.
UK: MoD Loses More Laptops, USBs, And 'Secret Files'
Siobhan Chapman writes on Computerworld UK:
The Ministry of Defence has revealed that 658 laptops have been stolen over the past four years. It had previously claimed that 347 laptops were stolen between 2004 and 2007.
In addition a further 747 laptops have been lost in that period, the MoD said, rather than the 89 laptops previously claimed.
The department also disclosed 121 of its USB memory sticks, some containing sensitive information, have been lost or stolen since 2004.
More
here.
SF Net Hijacker Gives Up Passwords
Tim Wilson writes on Dark Reading:
Terry Childs, the former IT administrator accused of kidnapping the city of San Francisco's data network, is ready to give up the administrative passwords to the system, his attorney said yesterday.
Childs is accused of changing all of the city's network passwords so that only he could access the network, which contains email, payroll, law enforcement, and inmate booking files, apps and data.
According to a report in Wired, Childs pleaded not guilty yesterday to four felony counts of denying access to the city's network and of producing an unauthorized access device to control the government's network remotely.
More
here.
Dutch University Can Publish Controversial Oyster Research
Jan Libbenga writes on The Register:
Dutch researchers will be able to publish their controversial report on the Mifare Classic (Oyster) RFID chip in October, a Dutch judge ruled today.
Researchers from Radboud University in Nijmegen revealed two weeks ago they had cracked and cloned London's Oyster travelcard and the Dutch public transportation travelcard, which is based on the same RFID chip. Attackers can scan a card reading unit, collect the cryptographic key that protects security and upload it to a laptop. Details are then transferred to a blank card, which can be used for free travel.
Around one billion of these cards have been sold worldwide. The card is also widely used to gain access to government departments, schools and hospitals around Britain.
Chipmaker NXP - formerly Philips Semiconductors - had taken Radboud University to court to prevent researchers publishing their controversial report on the chip during a the European computer security conference in Spain this autumn.
More
here.
Mark Fiore: Politishop
More Mark Fiore brilliance.
Via The San Francisco Chronicle.
Enjoy!
- ferg
Hacker Runs Up Big Phone Bill For Library
Via The Boston Globe.
A computer hack has run up a phone bill of more than $15,000 at the Duxbury [Massachusetts] public library.
Town manager Richard MacDonald tells The Patriot Ledger of Quincy that the calls last March included one 30-hour connection to India that cost $7,000.
The FBI is investigating.
Manny Santos, director of engineering for CranCom Inc., the library’s phone company at the time, says a hacker apparently got access to the phone system through an employee’s voice mail. He said the scammer then linked a library extension to an outside number.
The library now has a new phone system.
More
here.
Off Beat: Proposed Bush Sewage Plant Will Appear SF Ballot
The plant that could be renamed the George W. Bush Sewage Plant.
Via CBS5.com (AP).A San Francisco measure seeking to commemorate President Bush's years in office by slapping his name on a city sewage plant has qualified for the November ballot.
The measure certified Thursday would rename the Oceanside Water Pollution Control Plant the George W. Bush Sewage Plant.
Backers said the idea is to commemorate the mess they claim Bush has left behind by actions such as the war in Iraq.
More
here.
Image source: The Independent / San Francisco Public Utilities Commission
DNSstuff Freeware Detects Vulnerable DNS Servers
Brian Prince writes on eWeek:
DNSstuff.com is offering a free tool for organizations looking to test the susceptibility of their domain name servers to a fundamental flaw in the Domain Name System (DNS) protocol revealed publicly last week.
A provider of on-demand DNS and network analysis tools, DNSstuff made the freeware, which company officials have dubbed DNS Vulnerability Check, available on its site Wednesday. The tool is meant to test for the vulnerability reported by Dan Kaminsky, director of penetration testing for IOActive.
The researcher reportedly uncovered a flaw in the DNS protocol that can be exploited to poison DNS server caches and re-direct Internet traffic. While he has publicly kept details of the vulnerability close to his vest, several vendors coordinated the release of a patch in response.
More
here.
House Approves 2009 Intelligence Bill Despite Veto Threat
Steven Aftergood writes on Secrecy News:
The House of Representatives yesterday overwhelmingly approved its version of the Fiscal Year 2009 intelligence authorization act, including new requirements that the executive branch provide more complete briefings for all members of the intelligence oversight committees.
The White House threatened a veto if that and other provisions were enacted.
More
here.
U.S. Fears Threat of Cyber Spying at Olympics
Siobhan Gorman writes on WSJ.com:
A debate is brewing in the U.S. government over whether to publicly warn businesspeople and other travelers heading to the Beijing Olympics about the dangers posed by Chinese computer hackers.
According to government officials and security consultants, U.S. intelligence agencies are worried about the potential threat to U.S. laptops and cellphones. But others, including the State and Commerce departments and some companies, are trying to quiet the issue for fear of offending the Chinese, these people say.
U.S. intelligence and security officials are concerned by the frequency with which spies in China and other countries are targeting traveling U.S. corporate and government officials. The Department of Homeland Security issued a warning last month to certain government and private-sector officials stating that business and government travelers' electronic devices are often targeted by foreign governments. The warning wasn't available to the public.
More
here.
Unpatched Code Execution Bug Haunts BlackBerry
Ryan Naraine writes on the ZDNet "Zero Day" Blog:
Security alerts aggregator Secunia has raised an alarm for a “highly critical” vulnerability that puts users of the BlackBerry Enterprise Server at risk of code execution attacks.
Technical details of bug are not available but Secunia says it is caused by an unspecified error in the BlackBerry Attachment Service when processing PDF files.
The vulnerability is reported in versions 4.1 Service Pack 3 (4.1.3) through 4.1 Service Pack 5 (4.1.5). Other versions may also be affected. It carries a CVSS Base Score of 9.0.
More
here.
Romanian Authorities Arrest Cyber Crime Suspects
Grant Gross writes on Computerworld UK:
Authorities have arrested more than 20 people in Romania who are suspected of running online fraud schemes, according to media reports.
The Tuesday arrests were confirmed by the US Federal Bureau of Investigation, which has been working with Romanian officials on cybercrime in recent months. The FBI would say only that the agency is aware of the arrests and because "this is an ongoing matter, we will have no further comment at this time."
Romanian news reports suggested the number of people arrested there was between 21 and 24. Mediafax.ro reported that the suspects were accused of stealing identities online, in apparent phishing or auction-fraud schemes, and that they had taken $640,000 (£319,999) from non-Romanians. Several US websites, including eBay, were targets of the fraud, according to news reports.
The group's alleged leader, Romeo Chita, was arrested in an apartment owned by a Romanian lawmaker, Mediafax.ro reported.
More
here.
AOL Spammer Gets 30 Months in Prison
Jeremy Kirk writes on Computerworld UK:
A 27-year-old man has been sentenced to 30 months in prison for blasting AOL subscribers with spam over a four-month period.
Adam Vitale was also ordered to pay AOL $180,000 in restitution, according to his attorney, David Touger. He was sentenced in US District Court for the Southern District of New York in Manhattan.
Vitale and his partner, Todd Moeller, were caught after they offered their spam services to a government informant, according to an indictment filed in May 2006.
The two sent around 250,000 spam messages to more than 1.2 million email addresses belonging to AOL subscribers, the indictment said.
More
here.
San Francisco IT Admin Pleads Not Guilty to Network Tampering
Robert McMillan writes on InfoWorld:
A disgruntled network administrator pleaded not guilty Thursday to charges of computer tampering for allegedly setting up an unauthorized access system and holding much of the city of San Francisco's computer network hostage.
Terry Childs, 43, entered the plea in San Francisco Superior Court on Thursday morning. His next court appearance is a bail hearing set for July 23.
Administrators have been struggling for the past few weeks to regain control of the city's Fibre WAN after Childs allegedly reset administrative passwords to its switches and routers, and refused to hand them over.
More
here.
