White House Memos on Wiretapping Sought
Joan Lowy writes in The Los Angeles Times:
A judge has ordered the Justice Department to produce White House memos that provide the legal basis for the Bush administration's post-Sept. 11 warrantless wiretapping program.
U.S. District Judge Henry Kennedy Jr. signed an order Friday requiring the department to produce the memos by the White House legal counsel's office by Nov. 17. He said he would review the memos to determine whether any information could be released publicly without violating attorney-client privilege or jeopardizing national security.
Kennedy issued his order in response to lawsuits by civil liberties groups in 2005 after news reports disclosed the wiretapping program.
The department argued that the memos were protected attorney-client communications and contained classified information.
More
here.
Dont' Forget to Fall Back: Daylight Savings Time Ends Tonight
Don't forget - here in most of the U.S. (everywhere except Arizona, Hawaii and Puerto Rico) it's time to turn back the clock an hour (at 2:00 AM, Sunday morning, 2 November 2008) as daylight-saving time ends.
- ferg
In Passing: Jacques Piccard
Toon of The Day: Happy Hallowe'en
Click for larger image.
Spooky: BBC's Magic TV Detector Vans Kept Secret
Mike Masnick writes on techdirt.com:
As many of you probably know (especially if you live in the UK), you have to buy a license to have a TV (or even a TV tuner card for a computer). The license fees go to pay the BBC to operate. Apparently, the BBC has some secret "TV detector" vans that can sit outside your house and determine if you have an illegal TV (I only wish I were making this up).
Someone filed a Freedom of Information request to find out how these supposed detector vans worked, but the request has been denied, and these magic detector vans shall remain a state secret. The BBC claimed that it could not reveal the details of the van "because if it did so it would damage the public's perception of the effectiveness of TV detector vans."
More
here.
New York Coder Charged With Helping TJ Maxx Hacker
Kevin Poulsen writes on Threat Level:
A New York man was hit with a federal conspiracy charge this week for allegedly lending his programming expertise to the head of a hacking gang accused of stealing and selling over 40 million credit and debit card numbers.
Stephen Watt, 25, allegedly customized a packet-sniffing program called "blabla" for use by Albert Gonzalez, a former Secret Service informant who was indicted earlier this year as the mastermind of a 2005-2007 intrusion into clothier T.J. Maxx, as well as breaches at BJ’s Wholesale Club, Boston Market, Barnes & Noble, Sports Authority, Forever 21, DSW and OfficeMax.
Gonzalez allegedly used sniffers to scoop up credit and debit card numbers from hacked networks as they sped from cash registers to processing servers. Watt modified blabla "on diverse dates" to meet Gonzalez's evolving needs, according to the one-count federal information [.pdf] filed in federal court in Boston on Wednesday.
More
here.
U.S. Army OKs Optical Network Security Tool
Kathleen Hickey writes on GCN.com:
The Army has added the Interceptor Optical Network Security System to its Information Assurance Approved Product List. Army units and installations worldwide will be able to use Interceptor to protect command and control, intelligence, surveillance and reconnaissance networks, and SCIF facilities.
The new fiber-optic protection technology from Network Integrity Systems monitors fibers within the cable being protected to detect handling, and can be used in support of the Army’s initiative to deploy SIPRNet to each Brigade Combat Team and to enable network-centric warfare through the Army’s Area Processing Centers.
Networks carrying sensitive or classified government information rely on encryption, hardening or intrusion detection alarms to protect the information from breaches. Unlike traditional intrusion alarms, Interceptor doesn’t rely on an extra optical fiber to sense vibrations. Instead, the system monitors the lit or dark fibers in a network’s fiber cables to detect motion of the cables themselves.
More
here.
In Passing: Studs Terkel
May 16, 1912 - October 31, 2008
Friday Monkey Blogging: Chimps Compile Nixon-Style 'Enemies List'
As I mentioned a couple of weeks ago, I have started a regularly recurring blog entry meme every Friday afternoon, inspired by Bruce Schneier's regular series of "Friday Squid Blogging" posts, and my very own maddening Monkey Theory.
Here is this week's installment.
Ewen Callaway writes on New Scientist Environment:
Chimpanzees have at least one thing in common with the late US president Richard Nixon: tracking those who do them favours and putting those who don't come up to scratch on an "enemies list".
Nearly 3000 hours of observations of wild chimpanzees show that they keep tabs on which of the troop has groomed them the most – returning the favour to frequent groomers, while freezing out the selfish ones.
More
here.
Image source: Cristina Gomes / New Scientist
Welcome, Oidhche Shamhna (Samhain Eve)
Via Wikipedia.
The Samhain celebrations have survived in several guises as a festival dedicated to the harvest and the dead. In Ireland and Scotland, the Féile na Marbh, the "festival of the dead" took place on Samhain.
Samhain Eve, in Irish and Scots Gaelic, Oidhche Shamhna, is one of the principal festivals of the Celtic calendar, and is thought to fall on or around the 31st of October. It represents the final harvest. In modern Ireland and Scotland, the name by which Halloween is known in the Gaelic language is still "Oíche/Oidhche Shamhna". It is still the custom in some areas to set a place for the dead at the Samhain feast, and to tell tales of the ancestors on that night.
Traditionally, Samhain was time to take stock of the herds and grain supplies, and decide which animals would need to be slaughtered in order for the people and livestock to survive the winter. This custom is still observed by many who farm and raise livestock.
More
here.
ODNI Establishes Security Center for U.S. Embassies
Alice Lipowicz writes on FCW.com:
Under a new directive, the Office of the Director of National Intelligence (ODNI) has established a new center that will be involved in securing U.S. embassies from physical and cyber intrusions.
Under Intelligence Community Directive 707 signed Oct. 17, ODNI’s Center for Security Evaluation will work with the State Department to ensure the protection of classified national security information and other intelligence at U.S. diplomatic and consular facilities.
The center will advise on new constructions and major renovations of embassies and assist in national technical surveillance countermeasures. The center also will assist the intelligence community in activities for continuity of government and operations.
More
here.
U.S. State Dept. Warns Passport Applicants Of Danger of Credit Card Fraud
Glenn Kessler writes in The Washington Post:
The State Department has notified approximately 400 passport applicants in the D.C. area of a breach in its database security that allowed a ring of thieves to obtain confidential information so they could fraudulently use credit cards stolen from the mail, officials said.
The scheme, involving two major government agencies, came to light months ago through a fluke. On March 25, D.C. police officers on a routine patrol stopped a car on the suspicion that its windows were excessively tinted, an apparent violation of city law. Smelling marijuana, the officers searched the car and discovered that the 24-year-old driver was carrying 21 credit cards not in his name and printouts of eight passport applications -- and that four of the names on the passport applications matched the names on four of the credit cards, according to documents filed in U.S. District Court.
Upon his arrest, the driver, Leiutenant Q. Harris Jr., told police that he worked with a co-conspirator who was employed by the State Department and another co-conspirator who worked for the U.S. Postal Service, court documents said. Officers on the scene called American Express about some of the cards in Harris's possession, and were told that they had recently been used and that a fraud alert had been placed on them.
More
here.
Virtual Heist Nets 500,000+ Bank, Credit Accounts
Brian Krebs writes on Security Fix:
A single cyber crime group has stolen more than a half million bank, credit and debit card accounts over the past two-and-a-half years using one of the most advanced strains of computer spyware in existence, according to research to be published today. The discovery is among the largest stolen data caches ever recovered.
Researchers at RSA's FraudAction Research Lab unearthed the massive trove of purloined data while tracking the activities of a family of spyware known as the "Sinowal" Trojan, designed to steal data from Microsoft Windows PCs.
RSA investigators found more than 270,000 online banking account credentials, as well as roughly 240,000 credit and debit account numbers and associated personal information on Web servers the Sinowal authors were using to set up their attacks. The company says the cache was the bounty collected from computers infected with Sinowal going back to February 2006.
More
here.
Toon of The Day: Bush On The Move
We love Mr. Fish.
Via Truthdig.com.
- ferg
Former McAfee Employee Arrested on Theft Charges
Tracey Kaplan writes in The Mercury News:
Santa Clara-based McAfee touts its security software. But its marketing department was anything but impregnable , based on a complaint Santa Clara County prosecutors filed Thursday.
For the second time, a former employee in McAfee's marketing department has been charged with stealing from the big antivirus software and computer security company — this time, about $3.8 million.
Former product marketing manager Susan Despinic, 35, of Los Gatos is accused of awarding contracts to a firm she and her husband owned, and to a shell company they set up. She and her husband, Aurawm Almaneih, each face one count of felony theft and one excessive-taking enhancement for allegedly stealing more than $2.5 million. Deputy District Attorney Dale B. Lohman said the companies involved in the alleged fraud provided such services as translations, competitive analysis and promotions.
Prosecutors suspect the couple bought a house in Los Gatos with some of the loot, according to Lohman, who alleges the crimes took place from May of 2005 through August of 2007. If convicted, they each face up to seven years in state prison.
Another former employee, Ayshah Maiorano was arrested last year on similar charges. That case is still pending. Maiorano could not be reached for comment.
More
here.
Site of The Day: 100 Illustrated Horror Film Posters (Part 1)
100 Illustrated Horror Film Posters (Part 1) via Well Medicated.
Hat-tip: Neat-O-Rama.
ICANN Targeting Notorious Domain Name Seller
Ryan Singel writes on Threat Level:
The net's authority over domain names is set to pull the plug on an Estonia-based seller of domain names that security researchers say has been a refuge for cyber-criminals for years.
ICANN told the EstDomains on Tuesday that it was revoking its accreditation since it learned the company's president Vladimir Tsastin had been convicted in February in Estonia for online credit card fraud and money laundering.
The Tuesday notice said that ICANN, which controls the distribution of the net's names and IP addresses, was immediately freezing EstDomain's ability to register new domain names and looking to find stewards for the 281,000 domain names that EstDomains manages.
ICANN put the action on hold on Wednesday, however, to investigate EstDomain's immediate appeal, which claimed that it had changed its CEO months ago without telling anyone.
Security experts have long accused EstDomains of being too friendly with online criminals, including the ultra-professional Russian Business Network.
More
here.
DDoS Attack Strikes NOonProp8.com
Ryan Singel writes on Threat Level:
Websites of political groups fighting anti-gay marriage amendments were hit by a flood of fake traffic Wednesday, in an apparent attempt to muzzle the sites and interfere with a fundraising effort, California's No on Prop 8 group said Thursday.
The Secret Service is now investigating the denial-of-service attack on NOonprop8.com, an attack that began Wednesday afternoon and eventually made the site unreachable that evening, according to spokeswoman Julia Spiess.
No on Prop 8 described the attack as "what appears to be a coordinated attack designed to bring the system down."
More
here.
Morris Worm Turns 20: Look What It's Done
Carolyn Duffy Marsan writes on NetworkWorld:
The Internet will mark an infamous anniversary on Sunday, when the Morris worm turns 20.
Considered the first major attack on the 'Net, the Morris worm served as a wake-up call to the Internet engineering community about the risk of software bugs, and it set the stage for network security to become a valid area of research and development.
"It was a really big deal," says Eric Allman, a computer programmer who in 1981 authored sendmail, open source Internet e-mail software, while he was a student at the University of California at Berkeley. Today, Allman serves as chief science officer at Sendmail, a company that sells commercial-grade versions of the software.
"The biggest implication of the Morris worm was that the Internet was very small … and it was considered a friendly place, a clubhouse," Allman says. "This [attack] made it clear that there were some people in that clubhouse who didn't have the best interests of the world in mind … This made it clear we had to think about security."
Despite the high-profile nature of the worm, some experts say its importance was not fully appreciated at the time.
More
here.
Quote of The Day: Adam Shostack
"As we come to the close of the longest campaign in American history, it is time to make a call on who to vote for. In these turbulent and chaotic times, America needs a candidate who will cause more chaos to emerge. Now is not the time for calm and reasoned leadership. Now is not the time for thoughtfulness. Now is the time for chaos that makes us gasp. Chaos that makes us cry. Chaos that makes us question the ability of government to solve problems."
"There is only one ticket which has the experience and proven ability to generate chaos on that sort of scale, and that is McCain/Palin."
- Adam Shostack, waxing satirically over on Emergent Chaos.
French Police Arrest Six People Over Sarkozy Bank Fraud
John Leyden writes on The Register:
French police have arrested six people on suspicion of fraud involving the bank account of French president Nicolas Sarkozy.
Sarkozy filed a criminal complaint last month following fraudulent payments from his personal bank account in Paris. Stolen payment card details were reportedly used to mobile phone subscriptions.
A Police investigation has since led to the arrest of six including workers at a mobile phone store in Rouen in the Normandy district of northern France and two Senegalese men. Three of the six suspects detained were cuffed on Wednesday.
Meanwhile, the inquiry has widened after it emerged that around 50 victims have been hit including Sarkozy's father and his first missus, Marie-Dominique Culioli. The thefts from these individuals is being treated as linked to the Sarkozy bank fraud case.
More
here.
Mark Fiore: Hallowe'en Horrors
More Mark Fiore brilliance.
Via The San Francisco Chronicle.
Boo!
- ferg
Israeli Hacker 'The Analyzer' Indicted in New York
Kim Zetter writes on Threat Level:
Israeli hacker Ehud "The Analyzer" Tenenbaum was indicted Tuesday by a federal grand jury in Brooklyn on felony charges of conspiracy and fraud.
Between Feb. 2008 and May 2008 Tenenbaum and others engaged in a scheme to initiate transactions on account numbers belonging to other people, "to receive payment and other things" with an aggregate value of more than $1,000, the indictment charges [.pdf].
The U.S. attorney's office in New York did not immediately respond to a call for comment.
Tenenbaum achieved worldwide notoriety as a teenager in 1998, when he was caught pulling off a series of recreational intrusions into Pentagon computers, in an investigation the Defense Department code named "Solar Sunrise."
More
here.
Stark Warning Over Cyber Attacks On UK Businesses
Nick Heath writes on Silicon.com:
Sustained cyber espionage attacks are being waged on companies that play a key role in the UK national infrastructure, a UK cyber defence chief has warned.
The computer systems of critical businesses in the UK, such as power companies and large financial institutions, are being repeatedly probed to steal information or uncover weaknesses that could take them down.
That was the warning from Mark Oram, head of the threat and infosec knowledge department at the Centre for the Protection of National Infrastructure (CPNI) - the security service tasked with protecting key government and private organisations in the UK.
More
here.
Antiviral ‘Scareware’ Just One More Russian Criminal Intruder
John Markoff writes in The New York Times:
How much money can criminals make scaring naïve computer users? Try $5 million a year.
That is how much a marketing associate of one Russian operation appears to be earning from its sales of fake antivirus software through an elaborate scheme that relies on e-mail spam and indirectly controlling thousands of unprotected PCs, according to internal company files posted online by a Russian hacker.
The company is Bakasoftware, a clandestine effort based somewhere in Russia that markets what it claims is an antivirus program strictly to English-speaking computer users.
The program, whose name has recently been updated from Antivirus XP 2008 to Antivirus XP 2009, lodges itself on a victim’s computer and then begins generating a series of pop-up messages warning that the user’s computer is infected. If the user responds to the warnings, he is urged to buy a $49.95 program for disinfecting the machine.
Although tens of millions of Windows PC users have seen these irritating programs that purport to warn against malware infections, there are few details about the operators who develop and distribute the software, known as scareware.
More
here.
EstDomains Update: Notice of Termination Stayed
Via ICANN.org.
On 28 October 2008, ICANN sent a notice of termination [.pdf] to EstDomains . Based on an Estonian Court record, ICANN has reason to believe that the president of EstDomains, Vladimir Tsastsin, was convicted of credit card fraud, money laundering and document forgery on 6 February 2008.
Pursuant to Section 5.3 of the Registrar Accreditation Agreement (RAA), ICANN may terminate the RAA before its expiration when, “Any officer or director of [a] Registrar is convicted or a felony or of a misdemeanor related to financial activities, or is adjudged by a court to have committed fraud or breach of fiduciary duty, or is the subject of judicial determination that ICANN deems as the substantive equivalent of any of these; provided such officer or director is not removed in such circumstances.”
ICANN received a response [.pdf] from EstDomains regarding the notice of termination. To assess the merits of the claims made in EstDomains’ response, ICANN has stayed the termination process as ICANN analyzes these claims.
More
here.
APWG Joins Domain Registrars in Fight Against Phishing
Via CircleID.com.
The Anti-Phishing Working Group (APWG), in consultation with the ICANN Registrar Constituency and several domain name registrars, has published a "best practices" advisory [.pdf] for registrars to help them implement mechanisms to make it more difficult to register and use domains for illicit uses such as phishing, a confidence scheme used to dupe consumers out of personal financial information.
Several globally active registrars, including APWG members Go Daddy, the world's largest registrar and Network Solutions, the world's oldest commercial registrar, have already implemented or are planning to implement many of the best practices prescribed by the APWG's Anti-Phishing Best Practices Recommendations for Registrars, released this month.
More
here.
Drug Cartel Spy In U.S. Embassy in Mexico?
Derek Kravitz writes on The Washington Post Investigations Blog:
The U.S. State Department is investigating an allegation that an employee of the American Embassy in Mexico City passed sensitive information to a major drug cartel.
The report stems from a scandal at the organized crime unit of the Mexican attorney general's office, where 35 employees were accused yesterday of passing information about investigations to the Beltran-Leyva narcotics organization. The informants collected as much as $450,000 a month, The Associated Press reported.
More
here.
Akamai Wants to Sell User Data For Targeted Ads
Saul Hansell writes on The New York Times "Bits" Blog:
So Akamai, a company woven deep into the plumbing of the Internet that helps make Web sites faster, now wants to help collect data about Internet users on behalf of companies that want to advertise to them.
Last week, Akamai agreed to buy Acerno, a three-year old advertising network that draws data about what people shop for from more than 400 online stores. (I wrote about some of the privacy implications of Acerno’s existing business last week.)
But the bigger question is what does it mean that Akamai, one of the most important Internet companies that most people have never heard of, wants to collect data about people?
More
here.
Analysis: New Army Cyber Task Force
A UPI newswire article by Shaun Waterman, via SpaceWar.com, reports that:
The U.S. Army has set up a special task force to counter the theft of sensitive data about cutting-edge defense technology by hackers who are breaking into the computer networks of military contractors.
The Defense Industrial Base Cyber Security Task Force was quietly established earlier this year in the face of what an Army document says are continuing large-scale thefts of "controlled unclassified information" from contractor systems.
"Exfiltrations of unclassified data from (military contractor computer) systems have occurred and continue to occur," states the document, "potentially undermining and even neutralizing the technological advantage and combat effectiveness of the future force."
At stake is sensitive data "used in the development of war-fighting systems during the acquisition life-cycle" -- in other words, information about and for weapons programs being developed and produced by private-sector contractors.
More
here.
Hat-tip: Danger Room
SCADA Watch: Cyber-Covering Your Assets Is More Than Fending Off Terrorists
Walt Boyes and Joe Weiss write on ControlGlobal.com:
“We have information from multiple regions outside the United States of cyber intrusions into utilities, followed by extortion demands,” said CIA executive Tom Donahue, in a written statement released at the SANS Security Conference held in January in New Orleans. “We suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge. We have information that cyber attacks have been used to disrupt power equipment in several regions outside the United States. In at least one case, the disruption caused a power outage affecting multiple cities. We do not know who executed these attacks or why, but all involved intrusions through the Internet.”
While the CIA may not be much more forthcoming for fairly obvious reasons, there are lots of clear signs that our infrastructure is being menaced by more than rust and corrosion. In process plants, in water, wastewater, power, nuclear power, pipelines and in transportation, the trend over the past 20 years has been interconnection—interconnection of devices, of subsystems, of control systems; interconnection to government systems, to business partners, and of control systems to business and enterprise networks. This has led to a serious problem regarding protection of cyber-connected assets in all those industry verticals.
More
here.
ICANN Terminates EstDomains' Registrar Accreditation
Via ICANN.org. [.pdf]
Dear Mr. Tsastsin,
Be advised that the Internet Corporation for Assigned Names and Numbers (ICANN) Registrar Accreditation Agreement (RAA) for EstDomains, Inc. (customer No. 919, IANA No. 943) is terminated...
More
here [.pdf].
Other ICANN Notices of Breach and Termination are available
here.
Cyber Advice For The Next U.S. President
William Jackson writes on GCN.com:
A commission formed to offer advice on cybersecurity to the next president is nearing the completion of its work, and some of the recommendations are likely to conflict with elements of President Bush’s Cyber Initiative.
“It will be finalized very shortly,” said Rep. Jim Langevin (D-R.I.), co-chairman of the bipartisan Commission on Cyber Security for the 44th Presidency. “The findings are preliminary at this point.”
The commission, created in November 2007 by the Center for Strategic and International Studies (CSIS), held a series of public meetings to hear recommendations on issues of information security, identity theft and government leadership. It plans to present its findings to the new president prior to his inauguration in January.
When it does, one of the biggest departures from current cybersecurity policy will be the commission’s recommendation to take the lead away from the Homeland Security Department and give it to the White House.
More
here.
Economic Crisis May Be Boon For Cybercriminals
Kelly Jackson Higgins writes on Dark Reading:
One industry sector is actually happy about the current state of the global economy: cybercriminals.
"One thing we've seen is financially based cybercrime is recession-proof," says Darren Mott, supervisory special agent for the FBI's Cyber Division. "With [this] changing economy, the only thing that changes is the way they go about obtaining their information."
Organized cybercrime has already begun capitalizing on the global financial crisis, cybercrime experts say, with targeted phishing attacks on customers whose banks have folded, and attacks that scam consumers who may be shopping less online, but are now spending more time at home. With fewer business and consumer targets available, the bad guys are redirecting their efforts to adapt to the market. For example, credit cards are out; debit cards are in.
More
here.
Intel Budget Disclosure and the Myths of Secrecy
Steven Aftergood writes on Secrecy News:
The Director of National Intelligence today disclosed the 2008 budget for the National Intelligence Program: $47.5 billion. That figure does not include spending for the Military Intelligence Program, which is at least another $10 billion.
The disclosure marks only the fourth time that the intelligence budget has been officially disclosed. The aggregate intelligence budget figure (including national, joint military and tactical intelligence spending) was first released in 1997 ($26.6 billion) in response to a Freedom of Information Act lawsuit filed by the Federation of American Scientists. It was voluntarily released in 1998 ($26.7 billion). The National Intelligence Program budget was next disclosed in 2007 ($43.5 billion), in response to a Congressional mandate, based on a recommendation of the 9/11 Commission. And then there was today’s release for 2008.
In recent years, the most passionate opponent of intelligence budget disclosure has been none other than Sen. Ted Stevens (R-AK), whose own financial non-disclosure practices have recently earned him multiple felony convictions.
More
here.
U.S. Toll in Iraq, Afghanistan
Iraq and Afghanistan statistics via The Boston Globe (AP).
As of Monday, Oct. 27, 2008, at least 4,188 members of the U.S. military have died in the Iraq war since it began in March 2003, according to an Associated Press count.
The figure includes eight military civilians killed in action. At least 3,388 military personnel died as a result of hostile action, according to the military's numbers.
The AP count is three fewer than the Defense Department's tally, last updated Monday at 10 a.m. EDT.
As of Monday, Oct. 27, 2008, at least 551 members of the U.S. military had died in Afghanistan, Pakistan and Uzbekistan as a result of the U.S. invasion of Afghanistan in late 2001, according to the Defense Department. The department last updated its figures Monday at 10 a.m. EDT.
Of those, the military reports 399 were killed by hostile action.
More
here and
here.
And as always, the
Iraq Coalition Casualty Count keeps the grim watch on their website
here.
Honor the Fallen.
U.S. Immigration Officials Held U.S. Citizen For Two Weeks
Anna Gorman writes in The Los Angeles Times:
Federal authorities have released a Los Angeles man from immigration detention after acknowledging that he is a U.S. citizen.
Guillermo Olivares Romero, 25, was held at an Otay Mesa detention center from Sept. 25 until Oct. 9, when an American Civil Liberties Union attorney presented his birth certificate, school and vaccination records to immigration authorities. He was released that day.
Olivares, who has criminal convictions for robbery and forgery, had been deported twice and denied entry into the United States multiple times. Olivares said he and his mother, a legal permanent resident, showed authorities his birth certificate many times.
"They didn't believe me," Olivares, from Los Angeles, said Friday. "There was nothing I could do."
But Immigration and Customs Enforcement spokeswoman Virginia Kice said Friday that Olivares said he was born in Guadalajara, Mexico. Olivares' statewide criminal rap sheet also shows that he was born in Mexico, Kice said.
"ICE would never knowingly remove or voluntarily return an individual who is a U.S. citizen," she said.
Right. See
here and
here for escalations in terminology.
-fergMore
here.
Toon of The Day: Puddles
We love Mr. Fish.
Via Truthdig.com.
Quote of The Day: Jim Harper
"Twitter is right up there with telephones, pen and paper, email, SMS, and smoke signals as a potential tool for terrorism."
- Jim Harper, writing on The Technology Liberation Front.
The Great Firewall of Russia?
Via The Other Russia.
RUSSOFT, a trade association of the largest software companies in Russia, the Ukraine and Belarus, has come forward with a new proposal to separate the Russian internet from the rest of the world. The group’s president, Valentin Makarov, told the CNews internet newspaper that a funnel could readily be created to control the flow of information through Russia’s online borders. Makarov underscored that such a move would cost several hundred million dollars, and would likely take around 10 years to implement.
The proposal seems to mimic an idea expressed by Russia’s Minister of Communication, Igor Schegolev. Schegolev had earlier spoken about the need to protect the Russian share of the internet (called the Runet for websites ending in .ru), from external threats. The ministry is currently working on creating a Cyrillic alphabet alternative to the Latin-based domain name system, and the controls could feasibly go hand-in-hand.
More
here.
Turkish Police May Have Beaten Encryption Key Out of TJ Maxx Suspect
Chris Soghoian writes on the C|Net "surveill@nce st@te" Blog:
When criminals turn to disk encryption to hide the evidence of their crimes, law enforcement investigations can hit a brick wall. Where digital forensics software has failed to recover encryption passwords, one tried and true technique remains: violence. It is is this more aggressive form of good cop bad cop behavior which the Turkish government is alleged to have turned to, in order to learn the cryptographic keys of one of primary ringleaders in the TJ Maxx credit card theft investigation.
The 2005 theft of tens of million credit card numbers from an unsecured wireless network run by TJ Maxx stores has lead to over 150 million dollars in damages for the company. The two gentlemen behind the heist sold the pilfered credit card information to others online. Eventually, the stolen cards reached Maksym Yastremskiy, a Ukrainian citizen, and, according to media reports, a "major figure in the international sale of stolen credit card information."
Mr Yastremskiy was later arrested in 2007, while on vacation in Turkey. The US government has formally requested that Yastremskiy be extradited, and has charged him with a number of crimes including aggravated identity theft.
More
here.
Note: I was traveling on Friday and missed this -- hat-tip goes to
Schneier.
-ferg
Crime Still Pays For ID Thieves - Just a Bit Less Than Before
Taylor Buley writes on Forbes.com:
Your personal identity isn't worth quite as much as it used to be--at least to thieves willing to swipe it.
According to experts who monitor such markets, the value of stolen credit card data may range from $3 to as little as 40 cents. That's down tenfold from a decade ago--even though the cost to an individual who has a credit card stolen can soar into the hundreds of dollars.
The black market for personal data is even less transparent the market for derivatives and other unregulated financial instruments, but it works like any other market: When the supply of goods is plentiful, prices start to sink.
And in spite of authorities' efforts to take down the markets that serve as clearing houses for other people's financial data, the black market in personal identity is flush with product.
More
here.
ITU Criticised For Its Role in Internet Snooping
Via heise Security Online.
At EuroDIG, the first European Dialogue on Internet Governance, the scientists and experts of the Council of Europe have sharply criticised the International Telecommunication Union (ITU) for acting behind closed doors in its initiatives towards cybersecurity standardization. Bertrand de la Chapelle, godfather of the first EuroDIG on behalf of the French government, said EuroDIG should tell the ITU to allow all interest groups to participate in discussing new technology standards. The recent meeting in Strasbourg emphasized the idea of cooperation between governments, the industry and users as one of the central points to be presented at the UN Internet Governance Forum in Hyderabad.
Just recently, the ITU's work on standards for back-tracing IP addresses caused something of a furore. Yet, said Bill Drake, a scientist at the Center for International Governance at the Graduate School in Geneva, this work was only a tiny part of the work being done in the sensitive area of IT security. He warned that China, Russia and the USA could become the new axis of evil, pushing forward the integration of new ways of snooping on the internet. There was in his view an ambitious agenda extending beyond technical questions all the way up to legal regulations to counter cybercrime.
More
here.
DoD: Controlled But Unclassified Data Is Leaking
Alice Lipowicz writes on FCW.com:
Controlled but unclassified Defense Department information is leaking to the public from thousands of Web sites sponsored by DOD, according to a recent memo by DOD Chief Information Officer John Grimes.
In the memo, Grimes emphasizes the importance of protecting controlled unclassified information, especially in systems that are connected to the Internet with insecure protocols such as File Transfer Protocol or Peer-to-Peer sharing.
“The Department of Defense is currently hosting thousands of such sites, and in spite of previous direction, Controlled Unclassified Information data is still publicly accessible from these Defense Department sites,” Grimes wrote in the memo, which was published by the Federation of American Scientists on Oct. 22.
More
here.
Toon of The Day: Squared Circle
Click for larger image.
Quote of The Day: James Hannaham
"Overconfident, smug, convinced of her superiority -- the vice-presidential candidate doesn't belong in the White House; she belongs on basic cable."
- James Hannaham, writing on Salon.com.
1984: UK Police Will Use New Device to Take Fingerprints in Street
Owen Bowcott writes on The Guardian:
Every police force in the UK is to be equipped with mobile fingerprint scanners - handheld devices that allow police to carry out identity checks on people in the street.
The new technology, which ultimately may be able to receive pictures of suspects, is likely to be in widespread use within 18 months. Tens of thousands of sets - as compact as BlackBerry smartphones - are expected to be distributed.
The police claim the scheme, called Project Midas, will transform the speed of criminal investigations. A similar, heavier machine has been tested during limited trials with motorway patrols.
To address fears about mass surveillance and random searches, the police insist fingerprints taken by the scanners will not be stored or added to databases.
Yeah, right.
-fergMore
here.
Image source: Roger Tooth / The Guardian
Image of The Day [2]: Browser Cookies
Via GraphJam.com.
Enjoy!
- ferg
Ongoing Phishing Attack Exposes Yahoo Accounts
Via Netcraft.
The Netcraft toolbar community has detected a vulnerability on a Yahoo website, which is currently being used to steal authentication cookies from Yahoo users — transmitting them to a website under the control of a remote attacker. With these stolen details, the attacker can gain access to his victims' Yahoo accounts, such as Yahoo Mail.
The attack exploits a cross-site scripting vulnerability on Yahoo's HotJobs site at hotjobs.yahoo.com, which currently allows the attacker to inject obfuscated JavaScript into the affected page. The script steals the authentication cookies that are sent for the yahoo.com domain and passes them to a different website in the United States, where the attacker is harvesting stolen authentication details.
More
here.
Image of The Day: 100-Mile U.S. 'Constitution-Free' Zone
Click for larger image.
