Fergie's Tech Blog

1976: The Best You've Never Heard Of...

Mother's Finest.

The best of the 70's.

I remember those days so vividly.

We love Mother's Finest.

- ferg

posted by Fergie @ 4/24/2010 01:26:00 AM 0 comments

Russian Cyber-Thief Case Illustrates Security Risks For U.S. Corporations

Stew Magnuson writes in National Defense Magazine:

“Vladimir” came from a good family in Moscow. His parents both had advanced degrees and he was an academic star in high school.

He studied finance at his university and was equally well versed in computer science and physics. Smart, well spoken and personable, he could have been anything he wanted to be. But he chose to become a cyberthief.

Vladimir, an alias, preyed on wealthy Americans, said Mark Danner, a former U.S. intelligence officer, who is now a consulting manager for public safety and homeland security at NSI, a Washington, D.C.-based consulting group. Danner interviewed Vladimir in prison in an effort to put a face on the hacking menace.

“When it comes to the criminal world, the problem is that the faces of these perpetrators are really unknown,” he said at the Gov Sec conference in Washington, D.C. “They’re unknown in public and expert circles.”

While the federal government and Congress are making a push to toughen up the nation’s defenses in cyberspace, experts note that most of the vulnerabilities that thieves and spies are exploiting through the Internet are in the private sector, where state actors, criminal syndicates and hackers like Vladimir steal money and secrets with alarming regularity. Defense Department officials have warned companies doing business with the Pentagon to protect their data from foreign hackers.

A joint report from the Internet Security Alliance and the American National Standards Institute said chief financial officers and company leaders don’t appreciate the seriousness of the problem. Many simply do not want to invest the money needed to strengthen defenses against cybercrimes, despite government estimates that U.S. companies lost to network intrusions some $1 trillion in intellectual property from 2008 to 2009.

posted by Fergie @ 4/23/2010 06:39:00 PM 0 comments

DHS Fills Key Cyber Security Posts

J. Nicholas Hoover writes on InformationWeek:

The Department of Homeland Security filled two key cybersecurity positions this month, a DHS spokesman confirmed, hiring former Defense Information Systems Agency CIO Bobbie Stempfley to head up the agency's National Cyber Security Division and giving interim U.S. Computer Emergency Readiness Team director Randy Vickers a permanent job.

Stempfley takes over for Peter Fonash, who had been acting director of NCSD since Cornelius Tate left last year. Stempfley comes to DHS from DISA, where she worked for 10 years (over the last year as CIO), helping serve the Department of Defense with its networking and computing needs. While at DISA, Stempfley oversaw the continued evolution of the agency's rapid access computing environment private cloud computing platform.

Vickers, meanwhile, takes over for Mischel Kwon, who left US-CERT in August to head up professional services at RSA. Much of NCSD's proposed budget -- $315 million, to be exact -- will go to US-CERT, which helps to coordinate responses to cybersecurity threats by sharing information on vulnerabilities and exploits through an alert system.

posted by Fergie @ 4/23/2010 12:49:00 PM 0 comments

FBI Names New Cyber Chief

Ben Bain writes on FCW.com:

The FBI has named Gordon Snow as head of its Cyber Division. Snow will oversee the FBI’s programs to thwart cyber-based attacks and high-technology crimes. Previously, Snow served as deputy assistant director of that division.

Snow joined the bureau in 1992, after serving in the U.S. Marine Corps for more than 10 years. The division’s previous head, Shawn Henry, left that post earlier this year to become assistant director in charge of the FBI’s Washington field office.

posted by Fergie @ 4/23/2010 12:43:00 PM 0 comments

Plans For New Global Anti-Cyber Crime Treaty Fail at Last Minute

Gary Flood writes on Public Technology:

To the dismay of law enforcement agencies globally, the UN just missed ratifying new international agreement to fight cybercrime that takes into account the global move to Cloud Computing.

A Russian proposal to update the legislation in place to take account of the objections of the Third World foundered last week due to ongoing differences in what developing countries and the stance of the EU, US and Canada.

This is a problem, say security experts, as cybercrime, which has gained more and more of an international aspect as criminals use the Web's anonymity to keep one step ahead of the law, may only be effectively curbed if things like suspect server sites in one country (e.g., ironically enough in the former Soviet Union) are closed down – something that can only happen with cross-border co-operation between governments and police forces.

posted by Fergie @ 4/22/2010 01:35:00 PM 0 comments

Love Your Mother: 40th Anniversary of Earth Day

Love Your Mother Earth.

- ferg

posted by Fergie @ 4/22/2010 12:01:00 AM 0 comments

Mark Fiore: Born to Lose

More Mark Fiore brilliance.

Via The San Francisco Chronicle.

Enjoy.

- ferg

posted by Fergie @ 4/21/2010 07:47:00 PM 0 comments

U.S. Politicians Jockey Over Cyber Security Positioning

Ben Bain writes on FCW.com:

Cybersecurity appears to be on the verge of losing its status as one of the few areas of national security to remain relatively free of partisan bickering.

Because the topic has never been colored neatly red or blue, debates about computer defense have focused largely on substantive rather than political differences, enabling policy discussions to continue despite the changing political fortunes of the political parties.

But now more than ever, the public is becoming aware of the dangers of computer attacks. As solely technology topics, they were once the province of geeks and policy wonks inside the Beltway. But they now make national headlines.

Given the highly politicized environment in Washington, cybersecurity will inevitably become a political lightning rod.

posted by Fergie @ 4/21/2010 01:04:00 PM 0 comments

Report: Undersea Telecoms Cables Face Growing Risks

A Reuters newswire article, via Epicenter, reports:

Investors should urgently diversify the web of undersea cables that serve as the world’s information and banking arteries to address soaring demand and piracy concerns and reduce the risk of catastrophic outages.

So says a report by a multinational research project that calls for the building of global backup routes for the submarine network that carries almost all international communications, including financial transactions and Internet traffic.

The report’s main author, Karl Rauscher of the Institute of Electrical and Electronics Engineers (IEEE), an international professional body, told Reuters changes should be made “before we have to learn the hard way.”

“This report is trying to have a September 10 mindset, where you actually do something about what you know on September 10 to avoid a September 11 situation,” Rauscher, who was an adviser to the U.S. government on cyber security after the September 11 attacks, said.

An executive summary of the report made available to Reuters says that the current probability of a global or regional failure of the network is very low, but is “not zero.”

posted by Fergie @ 4/20/2010 01:37:00 PM 0 comments

California Senate Moves On New Data Breach Law

George Hulme writes on InformationWeek:

With 2003's landmark data breach notification law, SB-1386, California set the tone for the wave of state breach notification laws that would follow. Today, more states have similar laws than don't. Last week, the California Senate approved SB-1166 which aims to add more detail to the existing law.

SB-1186, if signed in law, would require breach notification letters to shed more light on the nature of the breach affecting consumers. For instance, SB-1166 would require the letter include the type of information exposed, a description of the breach, and steps potential victims can take to mitigate risks.

Democratic California State Senator Joe Simitian, who authored SB-1186 and the original SB-1366, issued a statement detailing how the bill, should it become law, would strengthen California's existing law...

posted by Fergie @ 4/19/2010 09:25:00 PM 0 comments

Cyber Attack on Google Said to Hit Password System

John Markoff writes on The New York Times:

Ever since Google disclosed in January that Internet intruders had stolen information from its computers, the exact nature and extent of the theft has been a closely guarded company secret. But a person with direct knowledge of the investigation now says that the losses included one of Google’s crown jewels, a password system that controls access by millions of users worldwide to almost all of the company’s Web services, including e-mail and business applications.

The program, code named Gaia for the Greek goddess of the earth, was attacked in a lightning raid taking less than two days last December, the person said. Described publicly only once at a technical conference four years ago, the software is intended to enable users and employees to sign in with their password just once to operate a range of services.

The intruders do not appear to have stolen passwords of Gmail users, and the company quickly started making significant changes to the security of its networks after the intrusions. But the theft leaves open the possibility, however faint, that the intruders may find weaknesses that Google might not even be aware of, independent computer experts said.

The new details seem likely to increase the debate about the security and privacy of vast computing systems such as Google’s that now centralize the personal information of millions of individuals and businesses. Because vast amounts of digital information are stored in one place, popularly referred to as “cloud” computing, a single breach can lead to disastrous losses.

posted by Fergie @ 4/19/2010 06:13:00 PM 0 comments

Feds Bust Website That Catered to Identity Thieves

Dan Goodin writes on The Register:

Federal prosecutors have brought felony charges against an Eastern European man for running a website that allegedly helped thousands of criminals exploit stolen financial information.

In an indictment unsealed Monday, prosecutors in Manhattan charged Dmitry M. Naskovets with creating and running CallService.biz. The online business supplied identity thieves with English- and German-speaking individuals to call financial institutions and pose as authorized account holders. They would then confirm fraudulent withdrawals, transfers, and other transactions.

CallService.biz, which brazenly advertised its services on other websites, assisted more than 2,000 identity thieves carry out more than 5,000 instances of fraud, prosecutors alleged. The website was founded in June 2007 and remained in operation until earlier this month.

The service was designed to counteract security measures put in place by financial institutions to prevent account fraud. In exchange for a fee, the website took online orders that allowed identity thieves to enter instructions about the fraudulent transaction to be conducted over the phone. The website would then assign the job to an individual who spoke the appropriate language.

posted by Fergie @ 4/19/2010 05:43:00 PM 0 comments

Computer Virus Traps Over 2,000 Tourists on Russian-Chinese Border

Via RIA Novosti.

Over 2,000 Russian tourists were stranded in the Chinese town of Heihe on the Russian-Chinese border after a computer virus paralyzed the border's electronic pass entry system, a transportation company official said on Monday.

"According to the Chinese officials, at the customs office in Heihe, a computer virus caused computer systems to shut down on Sunday. Because of this, border crossing was closed until Monday morning," the spokesman said, adding that many of the Russian tourists were forced to spend the night in hotels.

The virus was deleted during the night and the border crossing will be operating normally again on Monday.

posted by Fergie @ 4/19/2010 12:03:00 AM 0 comments

TSA to Download Your iTunes?

Via The Washington Times.

Federal security workers are now free to snoop through more than just your undergarments and luggage at the airport. Thanks to a recent series of federal court decisions, the digital belongings of international fliers are now open for inspection. This includes reading the saved e-mails on your laptop, scanning the address book on your iPhone or BlackBerry and closely scrutinizing your digital vacation snapshots.

Unlike the more common confiscations of dangerous Evian bottles and fingernail clippers, these searches are not being done in the name of safety. The digital seizures instead are part of a disturbing trend of federal agencies using legal gimmicks to sidestep Fourth Amendment constitutional protections. This became clear in an April 8 court ruling that found admissible the evidence obtained by officials who had peeped at a passenger's laptop files at George Bush Intercontinental Airport in Houston.

According to court documents, FBI agents had identified an individual suspected of downloading child pornography on an Internet chat room. The G-men, however, did not want to take their evidence before a judge to obtain a search warrant, as the Constitution requires. Instead, they flagged the suspect's passport and asked officials at the Department of Homeland Security to seize and search his computer at the airport - without a warrant. Three incriminating images were found during the examination, but this case is not about whether a particular person is a scumbag. It's about abusing a principle that applies to all Americans.

U.S. District Judge Gray H. Miller found in this case that neither probable cause, justification nor warrant were required to seize and examine the suspect's laptop. Judge Miller, in accord with a 9th Circuit appellate ruling handed down two years ago, explained that "the court finds that reviewing the files of a computer does not rise to the level of invasion of the privacy and dignity of the individual to make the search non-routine."

posted by Fergie @ 4/18/2010 05:55:00 PM 0 comments