Wyndham Hotels Hacked Again
Bob McMillan writes on ComputerWorld:
Hackers broke into computer systems at Wyndham Hotels & Resorts recently, stealing sensitive customer data.
The break-in occurred between late October 2009 and January 2010, when it was finally discovered. It affected an undisclosed number of company franchisees and hotel properties that Wyndham manages. Wyndham has acknowledged the incident in a note posted to its Web site.
"A hacker intruded on our systems and accessed customers information from a limited number of franchised and managed properties," the company said. "The hacker was able to move some information to an off-site URL before we discovered the intrusion."
Hackers were able to steal data required for credit card fraud, the company said, including "guest names and card numbers, expiration dates and other data from the card's magnetic stripe."
More
here.
Mark Fiore: The Clapper
More Mark Fiore brilliance.
Via The San Francisco Chronicle.
Enjoy.
- ferg
China's Military Warns Washington, Denies Hacking
Via Reuters.
China's military warned the United States on Thursday to "speak and act cautiously" to avoid reigniting tensions between the two powers, denying the People's Liberation Army played a part in Internet hacking.
Huang Xueping, spokesman for the Chinese Ministry of Defense, said his government would not reverse its decision to suspend "bilateral military plans" with Washington after it said in late January that it would sell $6.4 billion of arms to Taiwan, the self-ruled island Beijing claims as its own.
In January, the giant Internet search company Google Inc threatened to pull back from China after complaining of censorship and hacking attacks on it and other companies.
Analysts said those attacks were sophisticated operations, possibly overseen or abetted by the Chinese military.
More
here.
Newborns' Blood Used to Build Secret DNA Database
Ewen Callaway writes on New Scientist:
Texas health officials secretly transferred hundreds of newborn babies' blood samples to the federal government to build a DNA database, a newspaper investigation has revealed.
According to The Texas Tribune, the Texas Department of State Health Services (DSHS) routinely collected blood samples from newborns to screen for a variety of health conditions, before throwing the samples out.
But beginning in 2002, the DSHS contracted Texas A&M University to store blood samples for potential use in medical research. These accumulated at rate of 800,000 per year. The DSHS did not obtain permission from parents, who sued the DSHS, which settled in November 2009.
Now the Tribune reveals that wasn't the end of the matter. As it turns out, between 2003 and 2007, the DSHS also gave 800 anonymised blood samples to the Armed Forces DNA Identification Laboratory (AFDIL) to help create a national mitochondrial DNA database.
This came to light after repeated open records requests filed by the Tribune turned up documents detailing the mtDNA programme. Apparently, these samples were part of a larger programme to build a national, perhaps international, DNA database that could be used to track down missing persons and solve cold cases.
More
here.
Cyber-Whistleblower Stuns Latvia With Tax Document Heist
An AP newswire article by Gary Peach, via The Washington Post, reports:
Latvian officials struggled Wednesday to come to grips with an enigmatic group that stole millions of classified tax documents from government computers in a purported effort to expose waste and graft in Europe's weakest economy.
The massive data theft from the tax authority's computer system has raised concerns about cybersecurity in the Baltic country.
It has also embarrassed politicians and other public officials whose income and wealth - often many times the national average - are being exposed to the public at a time when Latvia is undergoing painful budget cutbacks to rebound from a severe recession.
News of the electronic security breach surfaced last week, when an organization calling itself the People's Army of the Fourth Awakening told Latvian TV it had downloaded millions of classified documents over several months from the revenue service's Web site.
More
here.
Security Expert: Obama Order Resembles Controversial Bush-Era Data-Mining Tool
Aliya Sternstein writes on NextGov.com:
The Obama administration has called for the development of a computer network that one security expert said on Tuesday resembles a controversial system that President Bush initiated after the 9/11 terrorist attacks, which was eventually abandoned due to public outcry over invasions of privacy.
In 2002, under the leadership of John Poindexter, former national security adviser to President Reagan, the Defense Department began building the Total Information Awareness system to discover, combine and filter information that may flag incidents indicating terrorist activities. Defense envisioned a program that would probe private databases, including those containing Americans' personal credit card accounts, medical data and cell phone records.
The system, which the Defense Advanced Research Projects Agency oversaw, later was renamed the Terrorism Information Awareness program to make it seem less threatening. TIA effectively was killed when Congress refused to fund parts of the program for fiscal 2004 because citizens viewed it as an encroachment on their privacy.
TIA resembles an initiative President Obama called for after the failed attempt to bring down a Detroit-bound jet on Christmas Day, said K. A. Taipale, executive director of the Stilwell Center for Advanced Studies in Science and Technology Policy and a member of the Markle Foundation Task Force on National Security in the Information Age. He revived talk of such a system at a discussion in Washington on using information technology that can make relationships among huge amounts of personal information worldwide to prevent another homeland security disaster.
More
here.
Snowe: Cyber Security Coordinator Lacks Accountability
A Congressional Daily article by Chris Strohm, via NextGov.com, reports:
A senior Republican on the Senate Commerce Committee criticized the Obama administration Tuesday for appointing a cybersecurity coordinator who cannot testify before Congress.
The committee heard from former federal cybersecurity officials and other experts who sounded alarm bells that the nation is failing to mount an effective defense against attacks on critical infrastructure networks, such as those in the nation's financial industry, telecommunications system and electrical grid.
"If the nation went to war today in a cyber war, we would lose," said retired Adm. Michael McConnell, who served as director of national intelligence in the Bush administration. "We're the most vulnerable. We're the most connected. We have the most to lose."
Sen. Olympia Snowe, R-Maine, noted that absent from the hearing was Howard Schmidt, who President Obama appointed in December as the nation's first cybersecurity coordinator.
More
here.
N.Y. Firm Faces Bankruptcy from $164,000 e-Banking Loss
Brian Krebs:
A New York marketing firm that as recently as two weeks ago was preparing to be acquired now is facing bankruptcy from a computer virus infection that cost the company more than $164,000.
Karen McCarthy, owner of Merrick, N.Y. based Little & King LLC, a small promotions company, discovered on Monday, Feb. 15 that her firm’s bank account had been emptied the previous Friday. McCarthy said she immediately called her bank – Cherry Hill, N.J. based TD Bank – and learned that between Feb. 10 and Feb. 12, unknown thieves had made five wire transfers out of the account to two individuals and two companies with whom the McCarthys had never had any prior business.
“She was told to go to the branch next day, and she did, and the people at the branch were very nice, apologetic, and said, ‘Whatever happened, we’ll replace it,’” Karen McCarthy’s husband Craig said. “She called them up on Wednesday, and they gave her the runaround. Then she finally got to talk to someone and they said ‘We don’t see the error on our side.’”
Immediately before the fraud occurred, Mrs. McCarthy found that her Windows PC would no longer boot, and that the computer complained it could not find vital operating system files. “She was using it one day and then this blue screen of death just came on her screen,” said a longtime friend who was helping McCarthy triage her computer.
Later, McCarthy’s friend would confirm that her system had been infected with the ZeuS Trojan, a potent family of malware that steals passwords and lets cyber thieves control the infected host from afar. ZeuS also includes a feature called “kill operating system,” which criminals have used in prior bank heists to effectively keep the victim offline and buy themselves time to make off with the cash.
More
here.
‘Sophisticated’ Hack Hit Intel in January
Kim Zetter writes on Threat Level:
Intel is the latest U.S. corporation to acknowledge that it was hacked in January in a sophisticated attack that occurred at the same time that Google, Adobe and others were targeted.
The giant California-based chip maker was rumored to have been among some 34 companies that were targeted, but said on Tuesday there was no evidence to tie its hack to the attack on Google and others.
“We did not see the kind of broad-based attack as described by Google,” said Intel spokesman Chuck Mulloy. “Companies routinely see hackers trying to get into their system. It is a risk factor and that’s why it was in the 10k. We’ve seen no loss of [intellectual property] as a result of any of these attacks.”
In its latest 10k filing to the Securities and Exchange Commission, Intel disclosed that it had been the target of a “sophisticated incident occurred in January 2010 around the same time as the recently publicized security incident reported by Google.
More
here.
Hackers Expose Security Flaws With 'Elvis Presley' Passport
Atika Shubert writes on CNN.com:
In the name of improved security a hacker showed how a biometric passport issued in the name of long-dead rock 'n' roll king Elvis Presley could be cleared through an automated passport scanning system being tested at an international airport.
Using a doctored passport at a self-serve passport machine, the hacker was cleared for travel after just a few seconds and a picture of the King himself appeared on the monitor's display.
Adam Laurie and Jeroen Van Beek, who call themselves "ethical hackers," say the exercise exposed how easy it is to fool a passport scanner with a fraudulent biometric chip.
The Presley test was carried out at Amsterdam's Schiphol airport in September 2008 -- by Laurie and Van Beek -- to highlight potential security shortcomings.
Passports, and the ability to fake them, are back in the spotlight after the apparent use of false documents during the gang assassination of a Hamas militant in Dubai in January.
More
here.
When is a New Something an Old Something? Foo.
When it's ZeuS, it's ZeuS.
Nothing personal on the folks at NetWitness, but they really did the community harm by trying to classify an old threat as new hype.
Shame on them.
- ferg
