Fergie's Tech Blog

Mark Fiore: Terrorist Lockup II

More Mark Fiore brilliance.

Via The San Francisco Chronicle.

- ferg

posted by Fergie @ 11/19/2009 11:10:00 PM 0 comments

Fear of Fraud Prompts Massive Bank Card Recall in Germany

Via Spiegel Online.

Thousands of credit cards have been recalled in Germany over concerns about a potential fraud scam in Spain.

Responding to allegations of data theft in the popular holiday destination, German banks are conducting their largest ever credit card swap-out to prevent fraud.

A spokesman for Germany's cooperative banking group, known as the Bundesverband der Deutschen Volksbanken und Raiffeisenbanken (BVR), told the Financial Times Deutschland that it had removed approximately 60,000 issued credit cards from circulation in response to allegations that a service provider in Spain stole data. Other banks and savings institutions in Germany have also been affected. In the end the massive credit card recall will top 100,000.

"We play it safe," said a spokesman for the BVR on Tuesday evening. "At the slightest suspicion, we exchange the cards. So the numbers are high," he added.

The organization is working to prevent fraud through fake transactions, after the banking industry received a warning from Visa and MasterCard that an "attack by a Spanish company on credit card data from German customers," was possible. The warning applies to Visa and MasterCards that were used in Spain in previous months. To date, no claims of fraud have been detected from the affected Visa and MasterCards, and if there were customers would not be liable for damages.

posted by Fergie @ 11/18/2009 06:19:00 PM 0 comments

FBI Suspects Terrorists Are Exploring Cyber Attacks

Siobhan Gorman writes on The Wall Street Journal:

The Federal Bureau of Investigation is looking at people with suspected links to al Qaeda who have shown an interest in mounting an attack on computer systems that control critical U.S. infrastructure, a senior official told Congress Tuesday.

While there is no evidence that terrorist groups have developed sophisticated cyber-attack capabilities, a lack of security protections in U.S. computer software increases the likelihood that terrorists could execute attacks in the future, the official warned.

If terrorists were to amass such capabilities, they would be wielded with "destructive and deadly intent," Steven Chabinsky, deputy assistant director of the FBI's Cyber Division, told the Senate Judiciary Committee Tuesday.

"The FBI is aware of and investigating individuals who are affiliated with or sympathetic to al Qaeda who have recognized and discussed the vulnerabilities of the U.S. infrastructure to cyber-attack," Mr. Chabinsky told the committee, without providing details.

Such infrastructure could include power grids and transportation systems.

posted by Fergie @ 11/18/2009 05:23:00 PM 0 comments

In-Q-Tel Invests in FireEye

J. Nicholas Hoover writes on InformationWeek:

The independent venture arm of the U.S. intelligence community, In-Q-Tel, has invested in cybersecurity company FireEye, the company announced Wednesday.

In-Q-Tel and FireEye didn't disclose terms of the agreement, or which intelligence agencies are particularly interested in the technology. However, in a release, they said that the investment "will extend FireEye's cyber security product development and stealth malware technical capabilities to protect against cyber threats."

The intelligence community has a clear interest in cybersecurity investment. At a conference earlier this month, deputy secretary of defense William Lynn said that more than 100 foreign intelligence agencies are actively trying to hack into federal government systems. The NSA recently announced plans to build a $1.5 billion cybersecurity data center in Utah.

California-based FireEye sells an out-of-band security appliance that monitors all inbound network traffic, employing a blend of signatures and heuristics to analyze traffic for evidence of suspicious behavior. After identifying suspicious traffic, the appliance captures and replays the traffic on virtual machines running in the appliance, which imitate real PCs. If those PCs are compromised, FireEye alerts administrators. By routing the traffic to a virtual machine, FireEye claims it is able to mitigate false positives. The virtual machines are invisible to the customer's production network.

posted by Fergie @ 11/18/2009 12:49:00 PM 0 comments

U.S. Toll in Iraq, Afghanistan

Iraq and Afghanistan statistics via The Boston Globe (AP).

As of Tuesday, Nov. 17, 2009, at least 4,363 members of the U.S. military had died in the Iraq war since it began in March 2003, according to an Associated Press count.

The figure includes nine military civilians killed in action. At least 3,476 military personnel died as a result of hostile action, according to the military's numbers.

The AP count is two fewer than the Defense Department's tally, last updated Tuesday at 10 a.m. EST.

As of Tuesday, Nov. 17, 2009, at least 841 members of the U.S. military had died in Afghanistan, Pakistan and Uzbekistan as a result of the U.S. invasion of Afghanistan in late 2001, according to the Defense Department. The department last updated its figures Tuesday at 10 a.m. EST.

Of those, the military reports 649 were killed by hostile action.

posted by Fergie @ 11/17/2009 11:52:00 PM 0 comments

Classic xkcd: Academia vs. Business

posted by Fergie @ 11/17/2009 09:17:00 PM 0 comments

SCADA Watch: PG&E Lawsuit Spreads Down Smart Grid Supply Chain

Camille Ricketts writes on VentureBeat:

Last week, [it was] reported [about] the lawsuit being filed against Pacific Gas & Electric for price hikes seemingly caused by installation of smart meters in the Bakersfield area of California. Now the plaintiff’s attorneys say that PG&E’s suppliers should also be sued — a who’s who of Smart Grid companies including General Electric, meter maker Landis+Gyr and communications provider Silver Spring Networks.

The original plaintiff, Bakersfield resident Pete Flores, filed the suit after his electric bill tripled fro $200 to $600 a month — right after having a new smart meter installed in his home. Objecting that PG&E described the meter as a money-saving device, he decided to sue for fraudulent advertising, negligence and unjust enrichment.

Wrapping up Landis+Gyr in a lawsuit — considering it’s one of the biggest and most respected meter makers in the country, up there with Itron, and Silver Spring Networks, tapped as the most likely IPO in the Smart Grid space — is a pretty big deal. Silver Spring has raised upwards of $167 million from the likes of Kleiner Perkins Caufield & Byers and Foundation Capital — it’s even advised by Al Gore. Landis+Gyr has brought in more than $100 million in capital and is growing globally.

While PG&E has been adamant that the smart meters, capable of beaming data wirelessly back to the utility, are not the cause of Flores’ increased electrical bills, it has yet to produce a practical reason for the problem. The utility has invited a third-party representative from the California Public Utilities Commission to ensure the accuracy of its metering technology, but this has yet to take place.

posted by Fergie @ 11/17/2009 02:58:00 PM 0 comments

U.S. Cyber Agencies Mum on How They Try to Identify Cyber Attackers

Jill R. Aitoro writes on NextGov.com:

Members of a Senate subcommittee on Tuesday asked criminal and security agency officials responsible for securing the nation's most sensitive computer systems and networks how they identify who is behind a specific cyberattack, despite the difficulty in doing so.

Tracing cyberattacks back to a specific source can be a difficult process because attacks can be routed through numerous computer networks worldwide, making it nearly impossible to identify the computer network where the attack started. Cyberattacks that took down government Web sites in South Korea and the United States in July, for example, initially were attributed to North Korea, but no hard evidence has emerged identifying systems there as the origin of the disruption.

"When you're in a situation where you don't know if it's a hacker, foreign government, terrorist or criminal group, how do you proceed?" Sen. Ted Kaufman, D-Del., asked witnesses from the Justice and Homeland Security departments and the FBI during a hearing before the subcommittee on Terrorism and Homeland Security.

James Baker, associate deputy attorney general at Justice, said his department turns to its criminal division, which investigates and prosecutes cyber criminals, and to its national security division, which investigates, prosecutes and attempts to stop cyber activities of nation-states and terrorists that pose a threat to U.S. security.

posted by Fergie @ 11/17/2009 02:36:00 PM 0 comments

U.S. Cybersecurity Can Halt 80% of Attacks at Best

Kenneth Corbin writes on internetnews.com:

Senior government officials overseeing the nation's cyber defenses told a Senate panel this morning that agencies are doing more to coordinate their far-ranging efforts, but that even in the best-case scenario, the hackers are often one step ahead.

"The harder we can make the general network environment, the easier it's going to be to detect [threats]," said Richard Schaeffer, director of the National Security Agency's Information Assurance Directorate. "We believe that if one institutes best practices, proper configuration, good network monitoring... a system ought to be able to withstand about 80 percent of the commonly known attacks."

The Judiciary Committee's Subcommittee on Terrorism and Homeland Security convened the hearing to probe the threat of terrorist attacks against the nation's information and communications systems, though the proceeding ran along the more general lines of cybersecurity, which the panelists described as a scourge that takes many forms.

"There's no silver bullet here," said Philip Reitinger, director of the National Cyber Security Center at the Department of Homeland Security. "We do need to up our defensive game."

posted by Fergie @ 11/17/2009 01:45:00 PM 0 comments

UK: Trojan Bank Fraud Gang Sentenced

Nick Heath writes on Silicon.com:

Four men have been sentenced to prison time for being part of a gang that stole just under £500,000 (US$840,582) from UK bank customers.

The men were sentenced last Friday at Southwark Crown Court in London for their part in an international criminal network that stole the money from 138 account holders.

Azamat Rahmonov, Shohruh Fayziev, Joao Dos Santos Cruz and Paulo Jorgi were sentenced to a total of more than 13 years in prison, having pleaded guilty to charges relating to the case at an earlier hearing at Southwark Crown Court.

The gang were able to steal the money using a Trojan that transferred funds from victims to their own money laundering accounts.

Once users of PCs infected with the Trojan logged into genuine online bank accounts, the Trojan would insert a spoof banking webpage into their session, asking for personal and financial details.

The Trojan then used the information to create new transactions that sent money from the victim's account through a web of middlemen, known as money mules, to other members of the international criminal network in Eastern Europe and Russia.

posted by Fergie @ 11/17/2009 01:10:00 PM 0 comments

FBI: Hackers Targeting Law and PR Firms

An AP newswire article by Lolita C. Baldor, via MSNBC, reports that:

Hackers are increasingly targeting law firms and public relations companies with a sophisticated e-mail scheme that breaks into their computer networks to steal sensitive data, often linked to large corporate clients doing business overseas.

The FBI has issued an advisory that warns companies of "noticeable increases" in efforts to hack into the law firms' computer systems — a trend that cyber experts say began as far back as two years ago but has grown dramatically.

In many cases, the intrusions are what cyber security experts describe as "spear phishing," attacks that come through personalized spam e-mails that can slip through common defenses and appear harmless because they have subject lines appropriate to a person's business and appear to come from a trusted source.

"Law firms have a tremendous concentration of really critical, private information," said Bradford Bleier, unit chief with the FBI's cyber division. Infiltrating those computer systems, he said, "is a really optimal way to obtain economic, personal and personal security related information."

posted by Fergie @ 11/17/2009 12:49:00 PM 0 comments