Off Beat: FBI Files Show Wide 'Deep Throat' Investigation
An AP newswire article by Matt Sedensky, via The Boston Globe, reports that:
Newly released FBI files show agents across the country and at the highest level of the agency investigated "Deep Throat" -- the 1972 porn movie, not the shadowy Watergate figure -- in a vain attempt to roll back what became a cultural shift toward more permissive entertainment.
The documents released to The Associated Press show the expanse of agents' investigation into the film: seizing copies of the movie, having negatives analyzed in labs and interviewing everyone from actors and producers to messengers who delivered reels to theaters.
All of it in a failed attempt to stop the spread of a movie that some saw as the victory of a cultural and sexual revolution and others saw as simply decadent.
To the list of collegiate types -- nerds, jocks, Greeks -- add one more: spies in training. The government is hoping they'll be hard to spot.
The Obama administration has proposed the creation of an intelligence officer training program in colleges and universities that would function much like the Reserve Officers' Training Corps run by the military services. The idea is to create a stream "of first- and second-generation Americans, who already have critical language and cultural knowledge, and prepare them for careers in the intelligence agencies," according to a description sent to Congress by Director of National Intelligence Dennis C. Blair.
In recent years, the CIA and other intelligence agencies have struggled to find qualified recruits who can work the streets of the Middle East and South Asia to penetrate terrorist groups and criminal enterprises. The proposed program is an effort to cultivate and educate a new generation of career intelligence officers from ethnically and culturally diverse backgrounds.
Under the proposal, part of the administration's 2010 intelligence authorization bill, colleges and universities would apply for grants that would be used to expand or introduce courses of study to "meet the emerging needs of the intelligence community." Those courses would include certain foreign languages, analysis and specific scientific and technical fields.
Nortel Networks Corp. said it will liquidate, ending efforts to restructure in bankruptcy court, and sell its businesses piecemeal. It agreed to accept a $650 million bid by Nokia Siemens Networks for the most lucrative part of its carrier-networks division and a wireless-research unit, the company said Friday.
Toronto-based Nortel has struggled to sell its assets since entering bankruptcy-court protection in January, as customers looked elsewhere for equipment upgrades and the value of the telecom-gear maker's assets fell.
For the most part, cyber gangs that create malicious software and spread spam operate as shadowy, exclusive organizations that toil in secrecy, usually in Eastern Europe. But with just a few clicks, anyone can jump into business with even the most notorious of these organizations by opening up the equivalent of a franchise operation.
Some of the most active of these franchises help distribute malicious software through so-called pay-per-install programs, which pay tiny commissions to the franchise operators, or so-called affiliates, each time a supplied program is installed on an unsuspecting victim's PC.
These installer programs will often hijack the victim's search results, or steal data from the infected computer. Typically, affiliates will secretly bundle the installers with popular pirated software titles that are made available for download on peer-to-peer file-trading sites. In other cases, the installers are stitched into legitimate, hacked Web sites and quietly foisted upon PCs when people visit the sites with outdated, insecure Web browsers.
Working with security researchers, Security Fix signed up for an account at IntsallsCash to learn what their affiliates were really installing.
What we found was the installation program given by InstallsCash to distributors installs some of the most sophisticated and aggressive malicious software in circulation today.
As of Thursday, June 18, 2009, at least 4,315 members of the U.S. military had died in the Iraq war since it began in March 2003, according to an Associated Press count.
The figure includes nine military civilians killed in action. At least 3,454 military personnel died as a result of hostile action, according to the military's numbers.
The AP count is one fewer than the Defense Department's tally, last updated Thursday at 10 a.m. EDT.
As of Thursday, June 18, 2009, at least 633 members of the U.S. military had died in Afghanistan, Pakistan and Uzbekistan as a result of the U.S. invasion of Afghanistan in late 2001, according to the Defense Department. The department last updated its figures Thursday at 10 a.m. EDT.
Of those, the military reports 467 were killed by hostile action.
"I moved to the USA from England a few years ago, and, one of the things I was not expecting was the sudden removal of my good credit record. If you’ve not made a transatlantic move, you might be surprised to know that your credit rating does not cross over with you. I speculate for some that could be a good thing, but for most (including myself), probably not. In my case I went from the equivalent of a 810 in USA terms to sub 600 - which I’m lead to believe is less than most high school kids, and also less than some people who’ve been repeatedly bankrupt. In fact, my score on arrival was so bad I was refused credit at Rooms-To-Go, after getting my score they would not even take a personal check from me. Rooms-To-Go has standards after all."
- Simon Hunt, commenting on the perilously horrible state of banking & e-commerce security in the U.S.
Terrorist Groups Using Cyber Space to Recruit for Cyber Warfare
An AP newswire article by Lolita C. Baldor, via NextGov, reports that:
Terrorist groups that have long used the Internet to spread propaganda are increasingly tapping the Web to teach Islamic extremists how to be hackers, recruit techies for cyberwarfare and raise money through online fraud, U.S. officials say.
A senior defense official said intelligence reports indicate extremist groups are seeking computer experts, including those capable of breaching government or other sensitive network systems.
The official, who spoke on condition of anonymity to discuss intelligence reports about the recruiting, said the extent and success of those recruiting efforts are unclear.
But jihadists' interest in hacking is evident in forums across the Internet. Law enforcement officials say terrorists are branching out into Internet fraud to raise money for their operations.
The electric-utility industry is planning a pilot initiative to see whether Chinese spies have infiltrated computer networks running the power grid, according to people familiar with the effort.
Officials of the North American Electric Reliability Corp., an industry regulatory group, are negotiating with a defense contractor for the job of searching for breaches by cyberspies, according to people familiar with the plans.
NERC is completing plans for the pilot program as it launches a separate, broader initiative to evaluate power companies' ability to withstand cyber attacks. The industry has sought to bolster computer-system security as public and congressional scrutiny of its potential vulnerability has grown.
The initiatives acknowledge the threat of cyber breaches, cybersecurity specialists said. NERC's limited pilot program would be the first industry-level look at cyberspying on electric networks.
Ben Worthen writes on the Wall Street Journal "Digits" Blog:
Heartland Payment Systems CEO Bob Carr is an unlikely spokesman for tech security. But that’s what he’s emerging as.
The credit-card processor suffered one of the largest data breaches ever disclosed last year. But rather than taking the time-honored approach of staying quiet and hoping that the negative publicity goes away, Carr is talking openly about what went wrong, the problems with the industry’s security standards, and a new product his company developed to help merchants protect customer data.
Heartland is the middleman in card purchases. When customers swipe their cards at stores, the data on them are transmitted to processors like Heartland, which passes them on to the banks that issued the cards. The company announced in January that a hacker had managed to gain access to this card information for the 100 million transactions it handles each month.
Aside from the scale, the breach stood out from the hundreds of others reported each year because Heartland had recently passed a security audit.
Officials at Johns Hopkins University's Applied Physics Laboratory have taken down their Web site to analyze their computer systems after a cyber attack.
Helen Worth, a spokeswoman for the Laurel-based lab that works closely with the military and NASA on research projects, said Tuesday that "penetration from an unwanted source" was discovered over the weekend.
Worth says the attack may have started about two weeks ago, but it's too soon to know who carried it out.
She says attackers accessed nonclassified information on the external Web site but did not gain access to classified information or the facility's internal network. Part of the internal review will be determining what information was accessed.
DHS Cyber Security Chief Warns of 'Market' in Malware
An AFP newswire article by Andrew Beatty, via PhysOrg.com, reports that:
More must be done to combat the lucrative trade in malicious software, which threatens sensitive government networks and personal data, the head of the US National Cybersecurity Center warned Tuesday.
In his first interview since taking up the post in March, Philip Reitinger told AFP the spread of so-called malware like botnets -- software that hijacks computers to mine sensitive data -- now constitutes an "underground market economy" that is spreading attacks.
"There is an entire community of people who are involved, organized crime is involved. Hackers now not only assemble botnets, they sell botnets. There is an underground market economy behind that.
"We have seen lately some of the risk to national government capabilities from botnet attacks," said Reitinger, who heads the Department of Homeland Security's cybersecurity operations.
Researchers at a web security firm have discovered what they term the latest milestone in the evolving cybercriminal underground: a one-stop-shop for hackers.
Called Golden Cash, the network enables cybercrooks to buy and sell control of compromised computers, as well as trade tools for creating malware and controlling and collecting data from botnets. Also, the platform contains about 100,000 stolen FTP credentials for sale.
The discovery of the Russian-based platform, believed to be run by individuals related to the Russian Business Network (RBN), was noted in the second issue of Finjan's 2009 Cybercrime Intelligence Report.
Andy Kordopatis is the proprietor of Odyssey Bar, a modest watering hole in Pocatello, Idaho, a few blocks away from Idaho State University. Most of his customers pay for their drinks with cash, but about three times a day he receives a phone call from someone he's never served -- in most cases someone who's never even been to Idaho -- asking why their credit or debit card has been charged a small amount by his establishment.
Kordopatis says he can usually tell what's coming next when the caller immediately asks to speak with the manager or owner.
"That's when I start telling them that I know why they're calling, and about the Russian hackers who are using my business," Kordopatis said.
The Odyssey Bar is but one of dozens of small establishments throughout the United States seemingly picked at random by organized cyber criminals to serve as unwitting pawns in a high-stakes game of chess against the U.S. financial system. This daily pattern of phone calls and complaints has been going on for more than a year now. Kordopatis said he has talked to the company that processes his bar's credit card payments about fixing the problem, but says they can't do anything because he hasn't actually lost any money from the scam.
James Risen and Eric Lichtblau write in The New York Times:
The National Security Agency is facing renewed scrutiny over the extent of its domestic surveillance program, with critics in Congress saying its recent intercepts of the private telephone calls and e-mail messages of Americans are broader than previously acknowledged, current and former officials said.
The agency’s monitoring of domestic e-mail messages, in particular, has posed longstanding legal and logistical difficulties, the officials said.
Since April, when it was disclosed that the intercepts of some private communications of Americans went beyond legal limits in late 2008 and early 2009, several Congressional committees have been investigating. Those inquiries have led to concerns in Congress about the agency’s ability to collect and read domestic e-mail messages of Americans on a widespread basis, officials said. Supporting that conclusion is the account of a former N.S.A. analyst who, in a series of interviews, described being trained in 2005 for a program in which the agency routinely examined large volumes of Americans’ e-mail messages without court warrants. Two intelligence officials confirmed that the program was still in operation.
China needs to bolster the security of its computer systems to guard against cyber attacks, as its relatively thin defenses against intrusion from hackers have left key systems at risk, the state-run China Daily newspaper said Wednesday.
The report said the U.S. has placed cyber security high on its national security agenda, while Beijing has been slow in recognizing the importance of the issue.
"In a worse-case scenario, a security breach could result in the breakdown of the energy supply and collapse of the financial system, not to mention a collapse of the national defense capability," the China Daily cited Yu Xiaofeng, a professor at Zhejiang University in Hangzhou who specializes in non-traditional security, as saying.
The report also said China had more than 300 million Internet users and one of the one of the world's largest information infrastructures.
Security start-up Dasient debuted Tuesday with a cloud-based service designed to detect malware on Web sites and quarantine it away from visitors prior to it being removed.
Dasient's three co-founders include two former Google employees, Neil Daswani, previously Google's security product manager, and software engineer Shariq Rizvi, along with Ameet Ranadive, whose background includes stints at consultancy McKinsey & Co. and HP.
The Web Anti-Malware service that Dasient is announcing today makes use of Web crawlers and heuristics to automatically detect code that cyber-criminals have loaded onto legitimate Web sites in order to download malware or push visitors to fraudulent sites. As a consequence, victimized sites infected by malware often end up on "blacklists" of suspected dangerous sites compiled by Google as well as security firms, including McAfee, Symantec and WebSense, that have ways to watch for compromised sites.
The U.S. State Department said on Tuesday it had contacted the social networking service Twitter to urge it to delay a planned upgrade that would have cut daytime service to Iranians who are disputing their election.
Confirmation that the U.S. government had contacted Twitter came as the Obama administration sought to avoid suggestions it was meddling in Iran's internal affairs as the Islamic Republic battled to control deadly street protests over the election result.
Twitter and Facebook have been used as a tool by many young people to coordinate protests over the election's outcome.
President Barack Obama said earlier on Tuesday he believed "people's voices should be heard and not suppressed" in Iran.
The notion of converting conceivably every computer on the planet into a server is certainly not new. But almost everywhere the notion has been attempted, it's been exploited. Microsoft's ActiveX experiment in the mid-1990s was a notorious example of collective inattention to the entire topic of exploitability, though it's not the only one. Since then, millions have willingly made their Web clients into P2P servers in the interest of file-sharing -- authorized or not -- while some of them unknowingly exposed their file systems to the whole planet, exposing sensitive government documents in the process.
History tells us to be skeptical when any software purports to enable ordinary computers, especially Web browsers, to act as servers. This morning, Opera Software unveiled its Unite server networking protocols, which consist of extensions to the existing widget system for its Opera Web browser. The objective there is to enable any Opera user to be a server in her own right, potentially serving up blogs, tweets, and files. Opera's own bank of servers -- which are already put to use providing pre-rendered pages for its "Turbo" feature -- serves as an intermediate proxy for all communications between Unite-enabled browsers.
Within minutes of our posting the news, Betanews readers expressed their time-tempered skepticism. As user zealus.com put it, "A united botnet owners community has released their statement where they thank Opera developers for making their lives extremely easy."
The Cyberspace Policy Review released by the White House last month was only the beginning of an effort being driven by President Barack Obama to reshape and strengthen the nation’s cybersecurity, according to Melissa Hathaway, who headed up the review.
Hathaway, acting senior director for cyberspace for the National and Economic Security Councils, said today her team plans to produce a comprehensive national incident response plan by the end of the year that will guide response to the cyber equivalent of a major natural disaster. The team also will be working to unravel the overlapping and sometimes contradictory laws and regulations identified in the study that get in the way of effective cooperation and responses to cyber threats.
“You can expect a dialog on this issue with the private sector,” Hathaway said at the Symantec Government Symposium in Washington. “You will also see us working with Congress because many issues will require a legislative fix.”
You answer the phone, and it's a recorded message:
"By now you should have received your written note regarding your vehicle warranty expiring. This call is to give you a final opportunity to extend coverage before it is too late. Press '1' now to speak to a warranty specialist regarding your options on your vehicle."
Upon pressing "1," you are transferred to a "warranty specialist" who lies to you, telling you he is affiliated with an automobile dealer or manufacturer and that your warranty is up. And before long, you may have agreed to put $450 down on an extended service contract that costs up to $3,000, the balance to be paid in monthly payments.
Or maybe you hang up — only to be called again. And again. Because more than a billion of these automatically dialed "robocalls" have been sent to cell phones, government offices and even 911 operators.
What's surprising is that these billion-plus calls allegedly stemmed from three companies — Transcontinental Warranty, Voice Touch and Network Foundations.
And behind those three companies are four human faces: Christopher Cowart, James and Maureen Dunne, and Kamian Kohlfeld.
Court documents filed last month in a Federal Trade Commission civil lawsuit against the three companies allege that their illegal calls have resulted in at least $10 million of ill-gotten gains since 2007. The FTC alleges that the firms' deceptive practices violated the Federal Trade Commission Act by misrepresenting or omitting material facts in their sales pitches, and that they violated the Telemarketing Sales Rule by "flatly ignoring" rules that prerecorded calls disclose the identity of the seller "promptly, and in a clear and conspicuous manner," according to court documents.
After an investigation that took more than a year, Microsoft has filed its first lawsuit [.pdf] over click fraud, where people manipulate clicks on a Web advertisement.
Microsoft filed the civil complaint on Monday in United States District Court in Seattle against Eric Lam, Gordon Lam and Melanie Suen, of Vancouver, British Columbia, along with several corporation names they were believed to have used, and several unnamed parties.
Microsoft is seeking at least $750,000 in damages. That might seem a small amount for a company that had sales of $13.7 billion last quarter. But about one in every seven clicks on an advertisement is estimated to be fraudulent, according to the traffic analysis firm ClickForensics, and Microsoft is trying to make that kind of deception more expensive for perpetrators.
“We have decided to become more active in the commercial fraud area on the enforcement side,” said Tim Cranton, associate general counsel for Microsoft. “The theory is you can change the economics around crime or fraud by making it more expensive.”
Here's Tom Brokaw in 1994 talking about "something called the Internet," with guest appearances by Eric Schmidt (then at Sun) and Bill Gates. Bill tells Tom that "It's very hip to be on the Internet now."
Brendan Kearney writes on the Maryland Daily Record:
The alleged technical expert behind a massive “scareware” scheme has agreed to a $1.8 million judgment and to refrain from various deceptive online marketing activities to settle an action by the Federal Trade Commission.
ByteHosting Internet Services LLC and CEO James M. Reno, who allegedly supported a multimillion-dollar scam carried out by a company called Innovative Marketing Inc., also agreed to a host of reporting requirements over the next five years and to cooperate with the government’s case going forward.
In a complaint filed under seal Dec. 2, the FTC claimed the companies “dupe” consumers into buying computer security software by scaring them, via pop-up ads, that their machine is infected with viruses or spyware. The “ruse” also usually involves a scan of the person’s computer that invariably finds problems — such as “illegal porn” — along with a pitch to buy the software to fix the problems.
More than a million consumers bought the defendant companies’ fake fix, which cost at least $39.95, the suit states.
An artist in the south-western city of Voronezh was arrested and questioned by police over a photo-collage of Prime Minister Vladimir Putin wearing a dress. Alexander Shchednov, who is also an opposition activist, was detained on June 11th as he tried to hang collages of Putin and President Dmitri Medvedev in front of the Voronezh town hall.
Yelena Dudukina of the Voronezh-Chernozem human rights group reported Shchednov’s arrest to the Kasparov.ru online newspaper.
According to Dudukina, the officers who detained Shchednov first demanded a bribe, and threatened to create problems for Shchednov at his university. When the activist refused, he was taken in for questioning and held overnight.
During his detention, Shchednov was interrogated for several hours by officers from the local Federal Security Service (FSB). Dudukina said that the agents resorted to physical force during the questioning. Law enforcement also searched the artist’s home, confiscating other collages and artwork he had created.
A Wall Street Journalarticle by Emily Steel, via Total Telecom, reports that:
On a Saturday night at the end of May, visitors to the forums section of Digital Spy, a British entertainment and media news Web site, were greeted with an ad that loaded malicious software onto their computers. The Web site's advertising system had been hacked.
A number of such attacks have occurred this year, as perpetrators exploit the complex structure of business relationships in the online advertising, with its numerous middlemen and resellers. Web security experts say they have seen an uptick in the number of ads harboring malware as the economy has soured and publishers, needing to boost their ad revenues, outsource more of their ad-space sales.
Viruses can be incorporated directly within an ad, so that simply clicking on the ad or visiting the site can infect a computer, or ads can be used to direct users to a nefarious Web site that aims to steal passwords or identities. In most cases, the problem becomes apparent within a matter of hours and quick fixes are put in place, but that's not fast enough for Internet surfers whose computers end up infected or compromised.
"The system is only as safe as its least secure members, and some of these members can be strikingly insecure," says Ben Edelman, an assistant professor at Harvard Business School who researches Web security issues.
The European Commission wants to introduce harsher penalties for cyber criminals, potentially increasing jail sentences to five years.
At a meeting of industry body the Messaging Anti Abuse Working Group in Holland, Radomir Jansky, a senior cyber crime official in the Commission, said new legislation was vital.
"We need new legislation to fight cyber attacks. Large-scale attacks are on the rise but penalties…are not severe enough to dissuade criminals," he said, according to The Financial Times.
"The cost for businesses, law enforcement and state authorities is on the rise, and we need to recognise that."
The Commission also wants to create an EU-wide reporting system so nations can raise the alarm over attacks, and data on attacks can be collected and aggregated.
Defense Secretary Robert Gates has not yet made a final decision about establishing a new major command in charge of cyber defense, Deputy Defense Secretary William Lynn said today.
A crowd of several hundred government, industry and academic officials gathered today at the Center for Strategic and International Studies in Washington hoping to hear an announcement about the new command, which will coordinate efforts across the services to defend the newly recognized cyber domain.
However, Lynn said that “as of today, Secretary [Robert] Gates has not made a decision on this. The secretary is evaluating proposals,” and the joint staff is still ironing out details of how the organization will work and what the chain of command will be.
New electricity meters being rolled out to millions of homes and businesses are riddled with security bugs that could bring down the power grid, according to a security researcher who plans to demonstrate several attacks at a security conference next month.
The so-called smart meters for the first time provide two-way communications between electricity users and the power plants that serve them. Prodded by billions of dollars from President Obama's economic stimulus package, utilities in Seattle, Houston, Miami, and elsewhere are racing to install them as part of a plan to make the power grid more efficient. Their counterparts throughout Europe are also spending heavily on the new technology.
There's just one problem: The newfangled meters needed to make the smart grid work are built on buggy software that's easily hacked, said Mike Davis, a senior security consultant for IOActive. The vast majority of them use no encryption and ask for no authentication before carrying out sensitive functions such as running software updates and severing customers from the power grid. The vulnerabilities, he said, are ripe for abuse.
"We can switch off hundreds of thousands of homes potentially at the same time," Davis, who has spent the past few months analyzing a half-dozen smart meters, told The Reg. "That starts providing problems that the power company may not be able to gracefully deal with."
AP IMPACT: Weak Security Enables Credit Card Hacks
An AP newswire article by Jordan Robertson, via SFGate.com, reports that:
Every time you swipe your credit card and wait for the transaction to be approved, sensitive data including your name and account number are ferried from store to bank through computer networks, each step a potential opening for hackers.
And while you may take steps to protect yourself against identity theft, an Associated Press investigation has found the banks and other companies that handle your information are not being nearly as cautious as they could.
The government leaves it to card companies to design security rules that protect the nation's 50 billion annual transactions. Yet an examination of those industry requirements explains why so many breaches occur: The rules are cursory at best and all but meaningless at worst, according to the AP's analysis of data breaches dating to 2005.
It means every time you pay with plastic, companies are gambling with your personal data. If hackers intercept your numbers, you'll spend weeks straightening your mangled credit, though you can't be held liable for unauthorized charges. Even if your transaction isn't hacked, you still lose: Merchants pass to all their customers the costs they incur from fraud.
