Monday, March 31, 2008

Daily Report

• The Associated Press reports a man fatally shot three people Thursday at a Columbus, Georgia, hospital. Police shot the man, who is being charged with murder and will be turned over to police after an overnight stay in another hospital. (See item 28)

• According to the Examiner, the District of Columbia Police Department will spend about $1.2 million to provide security at Nationals games, nearly doubling its presence from last year while assigning officers from around the city to ballpark duty, officials said. (See item 37)

Information Technology

34. March 27, IDG News Service – (National) Google: Web sites slow to fix serious Flash flaws. Two months after Adobe Systems patched a serious flaw in its Flash development software, there are still hundreds of thousands of Web pages serving up buggy Shockwave Flash (.swf) files that could be exploited by hackers, according to a Google researcher. The Google security engineer discovered the widespread vulnerability in his spare time while researching a book on Web security. It turned out that many Flash development tools created files that could be used by hackers in what is known as a cross-site scripting attack. This attack can be used in phishing, but it also gives the bad guys a nearly undetectable route into a victim’s bank account or almost any type of Web service. The researcher estimates that more than 10,000 Web sites are still affected by the issue. He first noticed the bug on Google’s Web site and tracked down the Google employee responsible for the flaw: a sales representative who had been using Dreamweaver to create buggy Flash files. The bug was in other Flash development tools too, but Adobe and others quickly patched their software after the findings were disclosed.
Source:

http://www.infoworld.com/archives/emailPrint.jsp?R=printThis&A=/article/08/03/27/Google-Web-sites-slow-to-fix-serious-Flash-flaws_1.html

35. March 27, Computerworld – (Washington) Washington state passes RFID anti-spying law. Washington’s governor this week signed a bill making it a Class C felony to use radio frequency identification (RFID) technology to spy on someone. The bill was signed about a week after the Washington State Senate unanimously passed Bill 1031, which makes it a crime to intentionally scan people’s IDs remotely, without their knowledge and consent, for the purpose of fraud, identity theft, or some other illegal purpose. The bill specifically cites RFID and facial recognition technology. Violators face a prison sentence of up to 10 years. In addition, if the illegally gathered data is used in a separate crime, up to 10 years could be added to whatever sentence violators receive for the second crime. “Our intent was to put some basic rules of the road in place,” said a state congressman. “As the technology is being deployed, it needs to be done in a way that the public won’t sense there’s a huge violation to their privacy rights. My fear is that state legislatures are good at being reactionary when something atrocious happens. We wanted to be ahead of this one.” The congressman, who sponsored the bill, noted that Washington state began using enhanced driver’s licenses this winter. The new licenses use RFID tags and can be used at the Canadian/U.S. border crossing instead of a passport. In light of these new ID cards and the growing number of RFID-based customer-loyalty cards and company ID cards, he said it was time for a law that protects people’s privacy. The law, which goes into in July, focuses on skimming or lifting information from RFID tags without the knowledge of the owner.
Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=mobile_and_wireless&articleId=9072438&taxonomyId=15&intsrc=kc_top

Communications Sector

36. March 28, IDG News Service – (International) Analyst: Money will lead to more mobile spying programs. Spying programs for mobile phones are likely to grow in sophistication and stealth as the business of selling spying tools grows, according to a mobile analyst at the Black Hat conference on Friday. Many of the spy programs on the market are powerful, but are not very sophisticated code, said a senior antivirus researcher at Finnish security vendor F-Secure, which makes security products for PCs and mobile phones. But there is increasing evidence that money from selling the tools will create a stronger incentive for more accomplished programmers to get into the game, which could make the programs harder to detect, he said. He said his prediction follows what has happened with the malware writers in the PC market. Many hackers are now in the business of selling easy-to-use tools to less technical hackers rather than hacking into PCs themselves. One of the latest tools on the market is Mobile SpySuite, which he believes is the first spy tool generator for mobiles. It sells for $12,500 and enables a hacker to custom-build a spy tool aimed at several models of Nokia phones, Niemela said. The number of mobile spyware programs pales in comparison to the number of such programs available for PCs. However, mobile spying programs are harder to track, since security companies such as F-Secure do not see as many samples circulating on the Internet as they do of malicious software for PCs. However, anecdotal evidence has emerged that enterprises may be increasingly encountering mobile spyware on their fleets of phones.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9072798&taxonomyId=17&intsrc=kc_top

Friday, March 28, 2008

Daily Report

• According to the Associated Press, federal officials are investigating a problem with electrical transformers at the Exelon Generation Company’s Byron Nuclear Power Plant in northern Illinois. Officials at the plant said the incident presents no threat to public safety. (See item 11)

• Fox News reports the Virginia State Police said that at least four cars were struck by bullets along an 11-mile stretch of the highway. A Virginia Department of Transportation vehicle was found with bullet holes near an exit for I-64 along Route 250, FOX News has confirmed. The freeway was shut down between about midnight and 6 a.m. Thursday, and Albemarle County Schools were closed. (See item 13)

Information Technology

34. March 26, IDG News Service – (National) Hackers seize on Excel vulnerability. Researchers at Symantec Corp. said late Tuesday they have spotted a Web site that tries to exploit computers lacking one of the recently issued patches for versions of Microsoft’s Excel spreadsheet program. The vulnerability involves a malicious Excel file that when opened can allow a hacker to execute other code on a PC. In its advisory, Symantec said one Web server is hosting the malicious file, which it calls Trojan.Mdropper.AA. Users could become infected if they open the malicious Excel filsent to them as an e-mail attachment. Also, they could be redirected to the Web site hosting the file by an iFrame embedded in a page on a compromised Web site, the vendor said.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9071838&taxonomyId=17&intsrc=kc_top

Communications Sector

35. March 26, Reuters – (National) Wireless carriers get a break on E911 support. An appeals court on Tuesday put the brakes on stricter standards that regulators are seeking to impose on wireless phone carriers to help police and firefighters more accurately locate callers in an emergency. The stay had been sought by a group of rural wireless phone companies who, along with major carriers such as AT&T, Verizon Wireless, and Sprint Nextel Corp, had sought to stop the new standards from going into effect while they pursue an appeal. The new standards are aimed at allowing public safety workers to find someone who has dialed 911 from a cellular telephone. The new standards would require wireless carriers to meet location accuracy standards within the area of each local emergency call center.
Source: http://www.pcworld.com/article/id,143851-c,legalissues/article.html

Thursday, March 27, 2008

Daily Report

• According to Patriot News, the security at Three Mile Island (TMI) is under scrutiny by federal regulators because of a reported deficiency. But the problem, which was identified by plant operator AmerGen Energy last summer and quickly corrected, will remain a secret under federal rules that prevent the public disclosure of security weaknesses. (See item 3)

• The Associated Press reports authorities revealed Tuesday that a man carrying a loaded shotgun was arrested in January near the U.S. Capitol, and explosives left in his truck nearby went undetected for three weeks. According to an indictment filed in District of Columbia Superior Court the suspect faces charges of planning to set off a bomb. (See item 24)

Information Technology

28. March 25, InfoWorld – (National) Apple’s Safari browser likened to malware. Mozilla’s chief executive has lambasted Apple for its use of iTunes to offer the Safari web browser to Windows users, saying the technique “borders on malware distribution practices” and undermines the security of the Internet. “What Apple is doing now with their Apple Software Update on Windows is wrong,” he wrote on his personal blog. “It undermines the trust relationship great companies have with their customers, and that’s bad - not just for Apple, but for the security of the whole web.” Mozilla makes the Firefox browser, currently the most popular alternative to Microsoft Internet Explorer with about 15 percent of the market to IE’s 78 percent, according to figures cited recently by Apple. Apple said Safari currently has about five percent of the market, a figure the company intends to increase. In June of last year, when the company announced Safari would be coming to Windows, Apple’s CEO said Apple would be using iTunes to deliver Safari to Windows users. Mozilla’s CEO is concerned that Apple would be “adding Safari by default to an update mechanism normally used for updates to already-installed programs, including urgent security updates.” Apple Software Update, which is installed along with QuickTime or iTunes on Windows PCs, currently lists Safari 3.1 as a default download, already checked, alongside the latest update to iTunes.
Source:
http://news.yahoo.com/s/infoworld/20080325/tc_infoworld/96359;_ylt=AkXQ23Fwr.8g49k4ej5AOmeDzdAF

29. March 25, heise online – (National) Firefox update fixes critical security vulnerabilities. Mozilla is distributing version 2.0.0.13 of its popular open source Firefox browser. This release fixes several critical vulnerabilities which could be exploited by attackers to inject malicious code or fake page content. The browser’s JavaScript engine contains several of the security vulnerabilities. Due to incorrect processing, attackers can execute external code with maximum privileges in the browser and also perform cross-site scripting (MFSA-2008-14 and MFSA-2008-15). Security advisory MSFA-2008-18 describes a vulnerability which allows Java applets to access any port on a local computer. According to the Mozilla security advisory, Sun has integrated a bug fix into the current version of Java Runtime, but the Mozilla programmers have also introduced counter-measures into their new version. A security vulnerability allows attackers to fake a borderless popup from a background tab using crafted web pages and place it in front of the user’s active tab. This could be used to spoof form elements and phish for data such as login data. Attackers can also circumvent the method used by some websites to protect against cross-site request forgery (CSRF) if server-side protection is based solely on referrer checking, as it is possible to fake the HTTP referrer (MSFA-2008-16). The Mozilla browser may reveal personal data if a user possesses a personal certificate which the browser presents automatically during SSL client authentication. According to security advisory MFSA-2008-17, following the update the browser asks the user before presenting the client certificate when it is requested by a website. Most of the security vulnerabilities also affect the Thunderbird mail client and the Seamonkey browser suite. The security advisories refer to Thunderbird version 2.0.0.13 and Seamonkey 1.1.9, in which these bugs should be fixed. These versions are not yet, however, being distributed automatically. Firefox users should install the update without delay, as the vulnerabilities can be exploited using crafted web pages to inject trojans. Source: http://www.heise.de/english/newsticker/news/105550

30. March 25, PC World – (National) Sites’ personal questions may pose security risk. If
you have an online account at a retailer like Amazon.com, you have probably run into security questions when opening an account or when trying to recover one of the dozens of passwords you juggle in your head. Online businesses everywhere have embraced the technique, which is called knowledge-based authentication. Theoretically, the answers to these questions are so personal and obscure that knowing them proves you are you. Experts say, however, that the technology could end up helping hackers compromise your online accounts more easily. Knowledge-based authentication does not replace user names and passwords; it is an extra layer of security on top of such schemes, since hackers who stumble across your log-in credentials will not easily figure out the name of your high-school sweetheart. Collecting log-in information and answers to secret questions from your computer requires keylogging software, making it harder for malicious hackers to triumph. Scammers have adapted, adding secret questions to their decoy pages, says the CTO of fraud research company Secure Science. Bank phishing sites may include their own fraudulent drop-down lists that capture people’s answers, which bad guys can then use to hack real accounts. Even when hackers do not resort to subterfuge, these nuggets of information can sometimes be easier targets than passwords since there are a limited number of answers to questions such as “What was the make of your first car?”
Source:
http://www.pcworld.com/article/id,143712-c,onlinesecurity/article.html

Communications Sector

31. March 25, Associated Press – (National) Verizon’s open access may not be that open. Verizon Wireless picked up coveted wireless airwaves at a recent auction held by the Federal Communications Commission, which imposed certain consumer-friendly provisions on how that network can be used and what it will it eventually look like.
Source: http://www.cnn.com/2008/TECH/ptech/03/25/verizon.access.ap/index.html

Wednesday, March 26, 2008

Daily Report

• According to CNN, of the 28,000 commercial airline flights that take to the skies on an average day in the United States, fewer than one percent are protected by on-board, armed federal air marshals, a nationwide CNN investigation has found. That means that a terrorist or other criminal bent on taking over an aircraft would be confronted by a trained air marshal on as few as 280 daily flights. (See item 13)

• The Associated Press reports a security lapse made it possible for unwelcome strangers to see personal photos posted on Facebook Inc.’s popular online hangout, circumventing a recent upgrade to the Web site’s privacy controls. (See item 26)

Information Technology

25. March 25, InfoWorld – (National) Criminals target CA’s BrightStor in new attack. Just days after Microsoft warned of attacks targeting its Jet Database Engine software, cybercriminals have found a new program to attack: CA’s BrightStor ARCserve Backup. The new attack was reported Monday by Symantec, which said that a malicious Web page with a .cn domain was serving the attack code. By tricking an ARCserve user into visiting the Web site in question, attackers could leverage the flaw to install malicious software on a victim’s PC, Symantec said. A proof-of-concept example of the code was made public last week on the Milw0rm.com Web site. Symantec quickly predicted that it would likely be modified and used for attack. The flaw lies in the Unicenter DSM r11 List Control ATX ActiveX control, found in ARCserve Backup version 11.5, Symantec said. Other versions of the product may also be vulnerable, however. CA has not commented on the bug, so there is no indication when it might be patched. Symantec is advising users to turn off the buggy ActiveX control within the Windows Registry, something that should only be attempted by technologically savvy users.
Source:
http://news.yahoo.com/s/infoworld/20080325/tc_infoworld/96342;_ylt=AkymFMKQV5lzg8G4ITqQpnyDzdAF

26. March 24, Associated Press – (International) Security lapse exposes Facebook photos. A security lapse made it possible for unwelcome strangers to see personal photos posted on Facebook Inc.’s popular online hangout, circumventing a recent upgrade to the Web site’s privacy controls. The Associated Press verified the loophole Monday after receiving a tip from a Vancouver, Canada, computer technician, who began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles. The added protections were not enough to prevent the researcher from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few. After being alerted Monday, a Facebook spokeswoman said the Palo Alto-based company would look into the problem. By late Monday, Facebook appeared to have closed the security hole.
Source:
http://www.msnbc.msn.com/id/23785561/

27. March 24, InfoWorld – (International) Most sites still hack-able. The latest research report out of Web applications security specialist WhiteHat finds that most sites are still woefully vulnerable to hacker attacks. Just as in its previous research, WhiteHat estimates that some 90 percent of all pages are hack-able, the same figure that it has attached to several previous reports. Over the last two years that WhiteHat has been issuing its paper, the company has reported that the volume and variety of Web site attacks have in fact only continued to rise, with Cross-Site Request Forgery (CSRF) tabbed as the next big thing by the experts this go round. According to the company, nine out of ten sites still have serious vulnerabilities, with an average of seven vulnerabilities per site. The leading forms of exploit that WhiteHat is observing on the Net have not budged much in recent months either, with classic techniques including SQL injection, buffer overflows, and cross-site scripting (XSS) leading the way. However, the company is predicting that CSRF threats will soon begin to multiply.
Source:
http://weblog.infoworld.com/zeroday/archives/2008/03/web_site_hack_e.html?source=rss

Communications Sector

Nothing to Report

Tuesday, March 25, 2008

Daily Report

According to the Asbury Park Press, the U.S. Nuclear Regulatory Commission (NRC) recently responded to concerns regarding radiation emissions from Oyster Creek Generating Station, telling Ocean County officials the power plant meets all of its radiation safety requirements. (See item 7)

• Local6.com Orlando reports a chunk of a US Airways wing separated during a flight from Orlando to Philadelphia and cracked a passenger’s window. Officials said somewhere over Baltimore on Saturday, a panel from the left wing of a US Airways 757 flew off and hit the plane. (See item 12)

Information Technology

26. March 24, Washington Technology – (National) Virtualization to the rescue. Charlotte County, Florida, has implemented a plan to protect critical information systems and ensure that first responders will continue to have access to important data, including the county’s geographic information system. They use the GIS to locate important resources and structures such as water mains. The traditional way to build an IT infrastructure is to have a separate server for each application. With virtualization, multiple applications are loaded onto a single piece of hardware that is divided into virtual servers. Traditional servers are often underused, running at two to ten percent of their potential utilization. Virtualization allows agencies to reclaim some of those unused resources.
Source:
http://www.washingtontechnology.com/print/23_05/32479-1.html

27. March 23, Techworld – (National) Holes plugged in Kerberos Security System. The Massachusetts Institute of Technology developers of the Kerberos authentication system have released patches for several serious security holes, which could allow remote attackers to obtain sensitive information, shut down a system, or execute malicious code. The first problem is with the Kerberos Key Distribution Center (KDC) and involves the way the KDC handles incoming krb4 requests. The problem can be exploited to crash the KDC server, execute malicious code, or disclose memory, according to MIT. The second problem is in the way the KDC sends responses for krb4 requests, which can be exploited to disclose potentially sensitive stack memory via a specially crafted krb4 request. Exploitation for these first two bugs requires that krb4 support is enabled in the KDC; it is disabled by default in newer versions. These bugs affect Kerberos 5 versions 1.6.3 and earlier. The third bug is in the Kerberos RPC library when handling open file descriptors. Under certain conditions, an attacker could send an overly large number of RPC connections, causing a memory corruption and allowing the execution of malicious code. This bug affects Kerberos 5 versions 1.2.2 to 1.3 and 1.4 through 1.6.3, according to MIT. Independent security firm Secunia gave the bugs a “highly critical” ranking.
Source:
http://www.pcworld.com/article/id,143741-c,softwarebugs/article.html

28. March 22, IDG News Service – (National) Microsoft warns of new attack on Word. Microsoft on Friday warned that cyber criminals may be taking advantage of an unpatched flaw in the Windows operating system to install malicious software on a victim’s PC. The reported attack, now under investigation by Microsoft, involves a malicious Word document, but there may be other ways of exploiting the flaw, Microsoft said. The flaw lies in the Jet Database Engine that is used by a number of products including Microsoft Access. Microsoft is investigating whether other programs may also be exploited in this type of attack. Although this kind of unpatched, “zero day” attack is always cause for concern, Microsoft downplayed the risk, calling it “limited.” Following its usual policy, Microsoft did not say when – or if – it planned to patch the bug. But in a statement sent to the press, the company did not rule out the possibility of an emergency patch, released ahead of its next set of security updates, which are expected on April 8.
Source:
http://news.yahoo.com/s/pcworld/20080322/tc_pcworld/143749;_ylt=AmoFadjQUvKAfbOXgPoTJn.DzdAF

Communications Sector

29. March 24, Reuters – (National) Google tells FCC of “white space” airwave plans. Internet search engine Google Inc gave U.S. regulators on Monday a proposal for allowing the airwaves between broadcast channels to be used for mobile broadband services. In comments filed with the Federal Communications Commission (FCC), Google said it would propose an enhanced system to prevent wireless devices operating in the so-called “white space” from interfering with adjacent television channels and wireless microphones. The FCC currently is testing equipment to see if they can make use of the white space spectrum without interfering with television broadcasts. However, the idea is opposed by U.S. broadcasters and makers of wireless microphones, who fear the devices would cause interference. A proposal being studied by the FCC would create two categories of users for the airwaves: one for low-power, personal, portable devices, and a second group for fixed commercial operations. The proposal would require that the devices include technology to identify unused spectrum and avoid interference. Source: http://news.yahoo.com/s/nm/20080324/wr_nm/google_fcc_dc;_ylt=AuDthEAE8.9_GSCXwIgXFoz6rEF

Monday, March 24, 2008

Daily Report

According to the Seattle Times, a wanted felon arrested last Wednesday may be responsible for stealing nearly 20,000 gallons of gasoline at fueling stations in Washington and Oregon. (See item 3)

CNN reports officials in Minnesota have closed a major bridge on the Mississippi River, citing safety concerns. A recent inspection showed bending in plates that connect steel beams that support the span. (See item 13)

Information Technology

27. March 21, InfoWorld – (National) Thousands of Web sites under attack. On March 12, McAfee’s AVERT labs reported 10,000 Web pages using Active Server Pages (ASP) had been infected through SQL injection. A few days later, Microsoft employee Neil Carpenter detected 14,000 maliciously-modified Web pages. After the initial SQL injection, the automated attack injected a malicious Javascript or Iframe code to redirect visitors to criminal-controlled Web sites. The malicious Web sites then attempted to invisibly exploit end-users using multiple, previously patched vulnerabilities, or if no vulnerabilities were found, attempted to socially engineer the visitor into running additional software. Following on the heels of this massive scale attack was another automated attack that made the first one seem small. McAfee reported more than 200,000 Web pages infected by an automated attack against phpBB software. phpBB is an open source Internet forum software product written in php. Users visiting an infected Web site were socially engineered into running additional (malicious) software programs. Web site hacking is very popular. Zone-h, which tracks web site defacements, reported almost 500,000 hacked Web sites in 2007. And this is obviously a serious under-count, as most of Zone-h’s data is self-reported by the hackers who hacked the Web sites. The professional criminal gangs involved in the majority of the Web hacks today do not report their activities to Zone-h. Even more interesting is Zone-h’s track of the mechanism the hacker used to attack the Web site. By far the most popular method was simple password sniffing/cracking/guessing, but they track attacks against the DNS servers and routers that protect the Web servers. Perhaps the most interesting new Web hack trend is where inputted search phrases end up causing malicious cross-site scripting or poison normal search results.
Source:

http://weblog.infoworld.com/securityadviser/archives/2008/03/organized_crimi.html

28. March 21, EFluxMedia – (New Jersey) Sequoia voting systems admits to hackers attacking their website. After New Jersey officials specifically asked e-voting machines used in the February 5 presidential primary elections to be submitted to an in depth analysis, Sequoia Voting Systems, the retailer company, announced that its website became inaccessible on Thursday night due to unauthorized access. The company took action as soon as they realized what had happened and removed the “intrusive content,” a spokeswoman said, adding that the company took further security measures and proceeded to “security enhancements” in order to protect the website from similar attacks. The incident was uncovered by the computer scientists in charge of investigating the e-voting machines in the New Jersey case. According to the same source, he reported that around 6:30 a.m. Eastern Time, Sequoia’s Ballot Blog had been replaced with a message saying it had been hacked, also including the name of the authors. When the New Jersey officials requested the investigation on the February 5 voting machines after unusual errors appeared, Sequoia Voting Systems threatened to attack the decision in court for violation of the license agreement. Sequoia has opposed releasing the machines citing concerns about intellectual property.
Source:

http://www.efluxmedia.com/news_Sequoia_Voting_Systems_Admits_To_Hackers_Attacking_Their_Website_15405.html

Communications Sector

Nothing to Report

Friday, March 21, 2008

Daily Report

According to the Star-Telegram, a fire near two crucial south Texas power plants prompted an emergency advisory Wednesday by operators of the state’s power grid, who also had to quickly get assistance from Mexico to guard against blackouts. (See item 1)

• WYFF 4 Greenville reports an apparent problem with an air duct caused smoke to pour into the cabin of a Delta passenger plane on Wednesday afternoon, causing some terrifying moments for passengers and forcing the plane to make an emergency landing in the Upstate South Carolina. (See item 15)

Information Technology

31. March 20, IDG News Service – (International) Hacker pleads guilty to computer fraud. A 21-year-old Florida man could face up to 10 years in prison in the U.S. after pleading guilty to installing advertising software on PCs located around Europe without permission. He is scheduled for sentencing May 28 in U.S. District Court for the Northern District of Florida. He could also face a fine of up to US$250,000. The man’s plea culminates a wide-ranging international investigation that started with London’s Metropolitan Police Computer Crime Unit in December 2006, according to an FBI news release. Around that time, U.S.-based Newell Rubbermaid, whose products include Sharpie markers and plastic food-storage containers, reported their European computer network had been hacked. One other European-based company also complained. That launched a law enforcement effort called “Bot Roast II” that included the U.S. Secret Service, the Federal Bureau of Investigation, the Finland National Bureau of Investigation, and other local U.S. agencies. The man was indicted by a federal grand jury in November last year for computer fraud and conspiracy to commit computer fraud. He and others infected hundreds of computer in Europe with advertising software, or adware, using botnets, which are networks of hacked computers. His botnet was located within Newell Rubbermaid’s network.
Source:
http://news.yahoo.com/s/pcworld/20080320/tc_pcworld/143620;_ylt=AqXAodakYDM0DtpGGk9mMZuDzdAF

32. March 19, Computerworld – (International) Hackers vs. Windows, Mac, Linux next week in big-money contest. The security conference that last year made headlines with a hacking challenge whose winner walked away with a $10,000 prize will reprise the contest next week – this time with more money at stake, the contest’s organizer said today. CanSecWest, which will run from March 26 to 28 in Vancouver, British Columbia, will feature a second “PWN to Own” contest that pits researchers against a trio of laptops armed with the latest versions of Windows Vista Ultimate, Mac OS X 10.5, and the Ubuntu Linux distribution, said the conference’s organizer. The first to hack one of the laptops by exploiting a remote preauthentication code-execution vulnerability in a default service on the notebook’s operating system will take home the machine and a $10,000 prize. 3Com Corp.’s TippingPoint unit and its Zero Day Initiative bug-bounty program are providing the cash, as they did last year.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9069818&intsrc=hm_list

Communications Sector

Nothing to Report

Thursday, March 20, 2008

Daily Report

• According to the New York Times, when a New York woman died aboard an American Airlines flight last month, her death raised concerns among passengers about the level of medical treatment available at 30,000 feet. Medical emergencies happen on planes more often than people might think. (See item 13)

• The Associated Press reports police arrested more than a dozen people who crossed a barricade and blocked entrances at the Internal Revenue Service building Wednesday, the start of a day of protests marking the fifth anniversary of the U.S. invasion of Iraq. (See item 31)

Information Technology

36. March 19, Computerworld – (National) Apple issues mega-monster security update. Apple Inc. Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems. Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5. This single update’s total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both which saw 40 or more bugs patched. Apple also updated its Safari browser for both Mac and Windows, patching 13 vulnerabilities. The much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac’s version of the X Window System.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9069538&intsrc=hm_list

37. March 19, IDG News Service – (Pennsylvania) Pennsylvania pulls plug on voter site after data leak. With voting in Pennsylvania’s presidential primary just a month away, the state was forced to pull the plug on a voter registration Web site Tuesday after it was found to be exposing sensitive data about voters in the state. The problem lay in an online voter registration application form that was designed to simplify the task of registering to vote. State residents used it to enter their information on the Web site, which then generated a printable form that could be mailed to state election officials. Pennsylvania’s Department of State disabled the registration form late Tuesday after being informed of the vulnerability by IDG News Service. Because of a Web programming error, the Web site was allowing anyone on the Internet to view the forms, which contained data such as the voter’s name, date of birth, driver’s license number, and political party affiliation. On some forms, the last four digits of Social Security numbers could also be seen. The flaw was first reported by a reader of Digg.com, who stumbled upon the bug after filling out a voter registration form. The bug did not expose all registration data – just the information supplied by those who used the Web site’s online form. About 30,000 voter registration records appeared to be available on the site.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=spam__malware_and_vulnerabilities&articleId=9069578&taxonomyId=85

38. March 19, Financial Times – (National) Beware: Printing can be data security’s Achilles Heel. Since January 2005, more than 218 million records involving sensitive personal information belonging to U.S. citizens have been exposed by security breaches. Drill down into the data, collected by U.S. lobbying group the Privacy Rights Clearinghouse, however, and it is clear that it is not only electronic media that are to blame. Last year, more than a dozen serious data protection breaches resulted not from the loss of a laptop, a disk, or memory drive, but from printed data. Some of the breaches resulted from errors in bulk or commercial printing houses, such as inadvertently printing customers’ social security numbers on envelopes or labels. But others were the result of employees printing sensitive data, which was subsequently lost or stolen - often because the paperwork was in the same bag or case as a laptop targeted by thieves. The true number of cases of data loss from paper documents could be far greater.
Source:
http://www.ft.com/cms/s/0/f05e51e8-f557-11dc-a21b-000077b07658.html

39. March 19, ZDNet UK – (International) RSA sees increase in fast-flux botnets. Security vendor RSA has reported that it has seen an increase in the use of sophisticated techniques that hide command-and-control servers in networks of compromised computers. However, University of Cambridge researchers have disputed the claim, saying fast-flux use has remained constant over the past year. Fast-flux is a DNS technique that distributes command-and-control by constantly reallocating the servers controlling peer-to-peer botnets. It makes those servers difficult to identify and shut down, as they “move” around the network. Fast-flux can also be associated with the allocation of proxy servers to hide static command-and-control servers in botnets. RSA said on Monday that the technique, widely reported as being used by the controllers of the Storm botnet, is now being used by at least three other compromised networks. RSA refused to name the botnets or the gangs involved, and said naming them would compromise its surveillance.
Source:
http://www.zdnetasia.com/news/security/0,39044215,62039095,00.htm

40. March 18, Computer Weekly – (National) Cyber Storm 2 exercise reveals security preparedness. Cyber Storm II, the world’s largest international cyber security exercise so far, ended on March 15. Undoubtedly, the U.S. Department of Homeland Security-sponsored event will report it as a resounding success and learning experience in its final report due in late summer. The exercise simulated a coordinated cyber attack on information technology, communications, chemical, and transportation systems and assets. It simulated a crash of the US and international telephone system, which in turn caused problems for top level domains such as .com, .net, and .gov. Crisis managers had to identify, evaluate, and respond to more than 1,800 malware incidents. These included botnet, phishing, and denial of service attacks. Some were “white noise.” These were relatively harmless events designed to mask or confuse more serious attacks on the systems. Cyber security is one of four priorities at DHS, which is responsible for securing the government’s IT and critical national infrastructure. Federal departments use an intrusion detection system called Einstein, as well as US-Cert, a 24x7 public-private operation that monitors and defends against malware attacks. DHS also plans to cut the number of internet access points that link to federal systems from about 4,000 to 50 to make the federal IT system easier to guard.
Source:
http://www.computerweekly.com/Articles/2008/03/18/229909/cyber-storm-2-exercise-reveals-security-preparedness.htm

Communications Sector

41. March 19, Reuters – (National) Google sees surge in Web use on mobile phones. Google has seen an acceleration of Internet activity among mobile phone users in recent months since the company has introduced faster Web services on selected phone models, fueling confidence the mobile Internet era is at hand, the company said on Tuesday. Early evidence showing sharp increases in Internet usage on phones, not just computers, has emerged from services Google has begun offering in recent months on Blackberry e-mail phones, Nokia devices for multimedia picture and video creators and business professionals and the Apple iPhone, the world’s top Web search company said. Google made the pronouncement as it introduced a new software download for mobile phones running Microsoft Corp’s Windows Mobile software that conveniently positions a Google Web search window on the home screen of such phones. The software shortcuts the time it takes for people to perform Web searches on Google by eliminating initial search steps of finding a Web browser on the phone, opening the browser, waiting for network access, and getting to Google.com. By making a Google search box more convenient, mobile phone users have begun using the Internet more, the company said. Source: http://news.yahoo.com/s/nm/20080319/wr_nm/google_mobile_dc;_ylt=AgxMlVSbRsdKquDIjfiubC767rEF

Wednesday, March 19, 2008

Daily Report

• According to the Associated Press, a security breach at an East Coast supermarket chain exposed 4.2 million credit and debit card numbers and led to 1,800 cases of fraud, the Hannaford Bros. grocery chain announced Monday. The breach affected all of its 165 stores in the Northeast, 106 Sweetbay stores in Florida, and a smaller number of independent groceries that sell Hannaford products. (See item 12)

• The Gainesville Daily Register reports emergency responders from various Cooke County agencies arrived at Era, Texas, for a mass casualty exercise. The exercise brought together volunteer firefighters, state troopers, emergency management officials, EMS responders, members of the media, and others to test how well these life-saving organizations can work together during a crisis. (See item 28)

Information Technology

29. March 18, Ars Technica – (National) Ongoing IFrame attack proving difficult to kill. One of the factors that make an ongoing malware attack so difficult to stop is the speed with which the assault can evolve. Over the past 12 days, an IFrame injection attack that originally focused on ZDNet Asia has been spreading across the Net, changing targets and payloads on an almost daily basis. An iFrame (short for inline frame) is an element of HTML that is used to embed HTML from another source into a webpage. This particular IFrame exploit takes advantage of web site query caching. Web sites often cache the results of search queries that are run locally. These search results are forwarded to search engine providers (think Google or Yahoo), who use the information to generate their own search results. Hackers exploit the system by typing a query immediately followed by the text of an IFrame. This data (including the IFrame) is then passed to various search engines and displayed if a user searches for a relevant keyword. When the user visits an apparently legitimate document, the IFrame activates and attempts to complete whatever instructions it has been given. The major advantage of an injected attack versus an embedded one is that an injected attack requires no direct access to a web site’s server backend. Instead, it takes advantage of the company’s SEO (Search Engine Optimization) practices and poisons the results that are fed back to web surfers. The first wave of injections targeted ZDNet Asia and torrentreactor.net. The attackers shifted away from these two domains quickly and branched out into other web sites. One key purpose of the attack was to advertise the rogue antivirus product developed by the RBN (Russian Business Network), XP Antivirus.
Source:
http://arstechnica.com/news.ars/post/20080318-ongoing-iframe-attack-proving-difficult-to-kill.html

30. March 18, Computerworld – (National) Malicious subtitle file could trip up media player. A flaw in the widely-used open-source VLC media player could allow an attacker to execute harmful code on a PC. The problem stems from a buffer overflow that can occur when the player processes subtitle files used for movies, according to a security advisory. The vulnerability existed before VLC was upgraded to version 0.8.6e in late February, but the bug appears to have escaped the last round of patches. Video files can contain a link to a separate subtitle file, which VLC automatically loads when it plays the video. An attacker could use the buffer overflow flaw in VLC to execute malicious code contained in a subtitle file, and thus tamper with a PC. The flaw affects VLC players running on Windows, Mac, BSD and possibly more operating systems. The VLC media player is part of the VideoLAN project. The player is free, and it is released under the GNU General Public License. VLC can also be used as a streaming media server for a variety of platforms.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9069178&taxonomyId=17&intsrc=kc_top

31. March 17, Information Week – (National) Internet Explorer 8 could break applications, Gartner warns. Microsoft’s improved support for Web standards in its Internet Explorer 8 browser “will result in pages that don’t display correctly for some enterprise applications,” analysts at tech research firm Gartner warn. This is because many Web- or intranet-facing applications used in business were built to work with previous versions of Explorer, in which Microsoft often favored its own protocols over universal Web standards. With Explorer 8, slated for full release later this year, Microsoft has promised default compatibility with W3C guidelines. Among other things, the browser features support for Web programming standards such as CCS 2.1 and HTML 5. It also promises improved support for the Ajax programming language. “Microsoft is trying to woo the Web 2.0 world,” Gartner said in a document published last week. The researchers said it is “an indicator of what some have called ‘the new Microsoft.’”
Source:
http://www.informationweek.com/news/showArticle.jhtml?articleID=206904001&subSection=All+Stories

32. March 17, Associated Press – (National) It’s prison for ID thief who used P2P software. A Seattle man was sentenced to more than four years in prison Monday in what prosecutors said was the first federal case against someone using file-sharing software to steal identities. The man pleaded guilty in November to mail fraud, aggravated identity theft, and accessing a protected computer without authorization to further fraud. Although people have been prosecuted for using networks to illegally share copyrighted music, movies, and software, the Justice Department called the prosecution its first case against someone accused of using file-sharing programs to commit identity theft. The man received four years and three months in prison.
Source:
http://www.msnbc.msn.com/id/23682023/

Communications Sector

33. March 18, vnunet.com – (International) Boffins bounce photons off satellite. Scientists have successfully hit a satellite with a stream of protons in an experiment to build a global quantum-encrypted communications network. A professor and his team from the University of Vienna used a 1.5 meter telescope at the Matera Laser Ranging Observatory in Italy to bounce single photons off the Ajisai geodetic satellite 1400km above the earth. The project smashed his previous record of 144km. With the right satellite in orbit the stream could be used to send quantum-encoded data that is virtually unbreakable using current known technology. But, up until now, the blurring effects of the atmosphere has made sending data in this way practically impossible. The team managed to hit the Ajisai satellite, which is one of a number of ‘mirror ball’ satellites used solely for measurement, and receive coherent data back. The researchers tried to establish contact with similar satellites further away, but were unable to do so, according to the physics arXiv blog. The next stage would be to build satellites capable of receiving signals and either decoding them and sending back information, or firing them sideways to other satellites to establish a global communications network. Source: http://www.vnunet.com/vnunet/news/2212264/boffins-bounce-photons

34. March 18, Information Week – (National) VoiceCon: Nortel adds mobility to unified communications mix. New communications server software from Nortel lets enterprises extend VoIP and unified communications features to cell phones and smartphones, improving decision making and productivity, the vendor said Monday at the VoiceCon tradeshow in Orlando, Florida. Nortel’s mobile unified communications solutions are embedded in Communication Server 1000 IP PBX 5.5, available in April, and the new Mobile Communication 3100 2.0, a fixed-mobile convergence system for enterprises that’s available now. The vendor also unveiled IP Softphone 2050 3.0 for laptop PCs and a new high-capacity SIP DECT system for outside the U.S. Business-people use about six different communication devices and almost as many applications on those devices, but that’s not helping people connect any more easily, Nortel said. By adding mobility to the unified communications mix, workers can eliminate wasted time and the frustration of managing multiple phone numbers and voice-mail boxes, the company said. Now, mobile workers get access to the same voice calling features as the corporate network, like dialing by extension, conferencing, and call transferring. Nortel has also added single phone number and voice mail across multiple devices (desk phone, PC, and mobile). As with instant messaging, a presence indicator lets colleagues know an individual’s availability and online status. A handoff key allows users to transfer calls from their mobile to their desktop phones. Unified communications can help reduce mobile communications costs by up to 30 percent through more efficient handling of mobile calls using corporate dial plans, the vendor said. Source: http://www.informationweek.com/news/showArticle.jhtml?articleID=206904195

Tuesday, March 18, 2008

Daily Report

According to the WRIC 8 Richmond, reports of a bomb on an Amtrak train in Emporia, Virginia, forced hundreds of people onboard to evacuate. A number of streets were shut down overnight around where the Amtrak train stopped in the middle of town. The nearly 300 passengers on board the train bound from New York down to Florida were forced to evacuate after a man on board said he had a bomb. (See item 17)

• The Daily Item reports the mayor of Peabody, Massachusetts, and the Northeast Homeland Security Regional Advisory Council (NERAC) announced the completion of the “Southern Essex Regional Area Planning Council” daylong tabletop exercise drill hosted by Peabody on Thursday morning. The drill, moderated by Precision Planning and Simulations, Inc., was designed to help determine the North Shore’s ability to respond to hypothetical terrorist attacks by exploring key emergency response roles and communications protocols. (See item 34)

Information Technology

36. March 17, IDG News Service – (International) Google News, YouTube blocked in China amid Tibet riots. Beijing appears to have taken a page out of Myanmar’s playbook by blocking some Internet access amid rioting in Tibet that has already seen as many as 80 people killed, according to the Tibetan government in exile. China has blocked access to Google News and YouTube in an apparent attempt to stop the spread of video footage related the rioting going on in several cities in Tibet, including the capital Lhasa. Demonstrations in the city started on March 10, a day commemorating the anniversary of a 1959 uprising against Chinese rule after which the spiritual leader of the country, the Dalai Lama, fled to India. China’s decision to block access to the sites follows similar government censorship of protests by Myanmar. Last September, Myanmar cut off Internet access entirely to block people from viewing pictures and videos or sending them out of the country. Two videos about the situations in Tibet posted on YouTube by the user Amdo2007 both appear to show peaceful demonstrations. The first shows a public gathering, including Tibetan monks in their distinctive saffron robes, while the second video shows what appears to be peaceful marching. Some videos, including one from Amdo2007, have been “flagged by YouTube’s user Community” so that users have to verify they are 18 or older by logging in or signing up. The video shows bodies on the streets, protesters throwing rocks at Chinese army vehicles, and other images. It may have the most hits, over 80,000 so far, on the subject.
Source:
http://www.infoworld.com/article/08/03/17/Google-News-YouTube-blocked-in-China-amid-Tibet-riots_1.html

37. March 17, USA Today – (National) Botnet scams are exploding. Largely unnoticed by the public, botnets have come to inundate the Internet. On a typical day, 40 percent of the 800 million computers connected to the Internet are bots engaged in distributing e-mail spam, stealing sensitive data typed at banking and shopping websites, bombarding websites as part of extortionist denial-of-service attacks, and spreading fresh infections, says the CEO of Support Intelligence, a San Francisco-based company that tracks and sells threat data. The botnet problem shows no sign of easing. Security firm Damballa pinpointed 7.3 million unique instances of bots carrying out nefarious activities on an average day in January - an astronomical leap from a daily average of 333,000 in August 2006. That included botnet-delivered spam, which accounted for 91 percent of all e-mails in early March, up from 64 percent last June, says e-mail management firm Cloudmark. The upshot of this deluge is profound, if not immediately obvious, says Adam Cloudmark’s director of emerging technology. Telecoms and Internet service providers must absorb the cost of carrying botnet traffic; they can be expected to pass that expense onto companies and consumers, he says. Meanwhile, tens of millions of botted computer users are experiencing degraded performance with no clue why. Beyond that, cybercrime gangs are stockpiling enough stolen data to fuel identity theft scams for years to come. Meanwhile, law enforcement is negligible, and security protections for consumers and businesses remain, at best, patchwork and haphazardly deployed, says a computer science professor at the University of Wisconsin-Madison.
Source:
http://news.yahoo.com/s/usatoday/20080317/tc_usatoday/botnetscamsareexploding;_ylt=AvCKp_DTaaXjiyj2FdVFM2iDzdAF

Communications Sector

38. March 16, Associated Press – (National) Wireless firms fight FCC on cell-tower backup-power rules. When Hurricane Katrina assaulted the Gulf Coast in 2005, wind and flooding knocked out hundreds of cell towers and cell sites, silencing wireless communication exactly when emergency crews and victims needed it. To avoid similar debacles in the future, the Federal Communications Commission wants most cell-transmitter sites in the U.S. to have at least eight hours of backup power in case power fails, one of several moves regulators say will make the nation’s communication system more reliable. Two and a half years after Katrina and eight months after the FCC’s regulations were released, the two sides are still wrestling with the issue. A federal appeals court in Washington recently put the regulations on hold while it considers an appeal by some in the wireless industry. Several cell-phone companies, while agreeing that their networks need to become more resilient, have opposed the FCC’s backup-power regulations, claiming they were illegally drafted and would present a huge economic and bureaucratic burden. There are almost 210,000 cell towers and roof-mounted cell sites in the U.S., and carriers have said many would require modification. At least one industry estimate puts the per-site price tag at up to $15,000. Sprint Nextel Corp. told the FCC the rules would lead to “staggering and irreparable harm” for the company.
Source: http://www.orlandosentinel.com/technology/orl-cell1608mar16,0,3379047.story

Monday, March 17, 2008

Daily Report

• According to the KAKE 10 Wichita, a series of explosions at a chemical plant in Sterling, Kansas, woke up residents there Friday morning. Residents in the area say they heard explosions between five to eight minutes at the Jacam Chemicals plant in the southern part of the town. Sterling Police are confirming they received a call to the plant shortly after 5 a.m., but are not saying it was explosion at this time. (See item 3)

• Agence France-Presse reports U.S. officials said Thursday that “real and growing” threats to U.S. computer and telecommunications networks were behind the holding of Cyber Storm II, the largest-ever cyber-security exercises, this week. Computer security experts from five countries, more than 40 private sector companies, and numerous government and state agencies are spending a week fielding simulated “real-world,” on-line attacks on the computer systems of government bodies, corporations, transportation and other key industries. (See item 27)

Information Technology

26. March 13, Associated Press – (National) Electronic gadgets latest sources of computer viruses. Many of today’s new technologies have unwanted extras from the factory: pre-installed viruses that steal passwords, open doors for hackers, and make computers spew spam. Recent cases reviewed by the Associated Press include some of the most widely used tech devices: Apple iPods, digital picture frames sold by Target and Best Buy stores, and TomTom navigation gear. In most cases, Chinese factories – where many companies have turned to keep prices low – are the source. So far, the virus problem appears to come from lax quality control, perhaps a careless worker plugging an infected music player into a factory computer used for testing, rather than organized sabotage by hackers or the Chinese factories. It is the digital equivalent of the recent series of tainted products traced to China, including toxic toothpaste, poisonous pet food, and toy trains coated in lead paint. But sloppiness is the simplest explanation, not the only one. If a virus is introduced at an earlier stage of production, by a corrupt employee or a hacker when software is uploaded to the gadget, then the problems could be far more serious and widespread. Knowing how many devices have been sold, or tracking viruses with any precision, is impossible because of the secrecy of electronics makers and the companies they hire to make their products. But given the nature of mass manufacturing, the numbers could be huge.
Source:
http://www.cnn.com/2008/TECH/ptech/03/13/factory.installed.virus.ap/index.html

27. March 13, Agence France-Presse – (National) US holds largest ever simulated cyber-attack exercise. U.S. officials said Thursday that “real and growing” threats to US computer and telecommunications networks were behind the holding of Cyber Storm II, the largest-ever cyber-security exercises, this week. Computer security experts from five countries, more than 40 private sector companies, and numerous government and state agencies are spending a week fielding simulated “real-world,” on-line attacks on the computer systems of government bodies, corporations, transportation, and other key industries. The Department of Homeland Security (DHS) Under Secretary for the National Protection and Programs Directorate said the Cyber Storm II exercise sought to foster personal links between key officials in business and government. Those people, he said, are not always willing to share information about security issues involving the networks they run. Cyber Storm II tested the warning systems in place for attacks and sought to identify gaps in the way information was shared and reactions coordinated across various sectors. DHS officials declined to say what kinds of threats they found were most dangerous or what specific weaknesses were identified, citing security needs, but said a report on the exercise would be released later this year.
Source:
http://news.yahoo.com/s/afp/20080313/tc_afp/uscomputerinternetsecurity_080313232801;_ylt=Aq2VbO4qhZVic5Wjm8.igiDYa7gF

28. March 13, USA Today – (National) Bush calls for tighter cybersecurity. A sudden spike in the number of successful attacks against federal government information systems and databases has led President Bush to propose a multibillion-dollar response. The number of incidents reported to the Department of Homeland Security rose by 152 percent last year, to nearly 13,000, according to a new government report. The security breaches, more than 4,000 of which remain under investigation, ranged from the work of random hackers to organized crime and foreign governments, says the president of the Cyber Security Industry Alliance. The increase and severity of data breaches prompted Bush to recommend a 10 percent increase in cybersecurity funding for the coming fiscal year, to $7.3 billion. That is a 73 percent increase since 2004. Much of heightened concern focuses on China, which could be infiltrating U.S. government information technology systems despite denials by Beijing. In its annual report to Congress last week on China’s military power, the Pentagon said several cyberspace attacks around the world in 2007 were sourced back to China.
Source:
http://www.usatoday.com/news/washington/2008-03-13-cybersecurity_N.htm?csp=34

Communications Sector

29. March 13, EETimes.com – (National) iPhone ups ante for security software. Apple’s iPhone and Microsoft CE-based devices are upping the ante for security software in embedded systems, according to experts presenting at the Cellular Telecommunications and Internet Association Wireless conference next month. Embedded security software has become essential to these open-system-based mobile devices, as they grapple with traditional security in addition to new concerns, such as providing a safe execution environment for third-party applications. Besides security software for embedded systems that must manage copy-protected content, Discretix, Safenet and others, such as Mocana Corp., are now being asked by mobile-device makers to supply safe operating environments in addition to all the bits and pieces necessary to secure that transactions can be safely handled by open-system mobile devices.
Source: http://www.eetimes.com/rss/showArticle.jhtml?articleID=206903458&cid=RSSfeed_eetimes_newsRSS

Friday, March 14, 2008

Daily Report

• According to the NBC News, the Department of Homeland Security and the FBI issued a joint bulletin Wednesday addressing an uncorroborated threat to Wall Street, a senior Homeland Security official confirmed. The intelligence was characterized as “fragmented” pieces from various undisclosed sources. (See item 13)

• The Associated Press reports Southwest Airlines Co. canceled flights Wednesday and temporarily grounded 43 planes to examine if they were sound enough to carry passengers, the latest twist in the low-cost carrier’s saga of missed safety inspections and civil penalties. The groundings affected about 8 percent of Southwest’s fleet, and came as the airline faces a $10.2 million civil penalty for continuing to fly nearly 50 planes that had not been inspected for cracks in their fuselages. (See item 17)

Information Technology

33. March 13, New York Times – (National) Video road hogs stir fear of internet traffic jam. According to some industry groups, analysts, and researchers, the threat of surging growth in the amount of data on the internet stems mainly from the increasing visual richness of online communications and entertainment — video clips and movies, social networks and multiplayer games. Moving images require far more bandwidth than text and audio files. Last year, by one estimate, the video site YouTube, owned by Google, consumed as much bandwidth as the entire Internet did in 2000. In a widely cited report published last November, a research firm projected that user demand for the Internet could outpace network capacity by 2011. The title of a debate scheduled next month at a technology conference in Boston sums up the angst: “The End of the Internet?” But the Internet traffic surge represents more a looming challenge than an impending catastrophe. Even those most concerned are not predicting a lights-out Internet crash. An individual user, they say, would experience Internet clogging in the form of sluggish download speeds and frustration with data-heavy services that become much less useful or enjoyable. Some researchers are less worried — at least in the short term. A professor at the University of Minnesota, estimates that digital traffic on the global network is growing about 50 percent a year, in line with a recent analysis by Cisco Systems, the big network equipment maker. That sounds like a daunting rate of growth. Yet the technology for handling Internet traffic is advancing at an impressive pace as well. The router computers for relaying data get faster, fiber optic transmission gets better, and software for juggling data packets gets smarter. “The 50 percent growth is high. It’s huge, but it basically corresponds to the improvements that technology is giving us,” the professor, a former AT&T Labs researcher said, adding that demand is not likely to overwhelm the Internet.
Source:
http://www.nytimes.com/2008/03/13/technology/13net.html?em&ex=1205553600&en=4d97ca2365bff48c&ei=5087%0A

34. March 13, IDG News Service – (International) Password-stealing hackers infect thousands of Web pages. Hackers looking to steal passwords used in popular online games have infected more than 10,000 Web pages in recent days. The Web attack, which appears to be a coordinated effort run out of servers in China, was first noticed by McAfee researchers on Wednesday morning. Within hours, the security company had tracked more than 10,000 Web pages infected on hundreds of Web sites. McAfee is not sure how so many sites have been hacked, but “given how quickly some of these attacks have come on, it does seem like some automation has gone on,” said a researcher with McAfee’s Avert Labs. In the past, attackers have used search engines to scour the Internet for vulnerable Web sites and then written automated tools to flood them with attacks, which ultimately let criminals use legitimate sites to serve up their malicious code. The infected Web sites look no different than before, but the attackers have added a small bit of JavaScript code that redirects visitors’ browsers to an invisible attack launched from the China-based servers. This same technique was used a year ago, when attackers infected the Web sites of the Miami Dolphins and Dolphins Stadium just prior to the 2007 Super Bowl XLI football game. The attack code takes advantage of bugs that have already been patched, so users whose software is up-to-date are not at risk. However, McAfee warns that some of the exploits are for obscure programs such as ActiveX controls for online games, which users may not think to patch. If the code is successful, it then installs a password-stealing program on the victim’s computer that looks for passwords for a number of online games, including the Lord of the Rings Online. These online game passwords are a popular hacker target, in part because many online gaming resources can be stolen and then sold for cash.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=cybercrime_and_hacking&articleId=9068219&taxonomyId=82&intsrc=kc_top

35. March 12, Associated Press – (International) Security card chip can be hacked. The Dutch interior affairs minister says a technology being used in up to a billion security cards around the world can easily be hacked. The “Mifare” chip technology owned and licensed by NXP Semiconductors is frequently used in public transport systems such as London’s “Oyster” card. It is also used by corporations and governments in “swipe” access cards. Researchers at the Radboud University in Nijmegen, Netherlands have “developed a method by which a large number of (Mifare) chip-cards is relatively easy to crack and duplicate.” A Dutch politician wrote in a letter to Parliament that she was preparing supplemental security measures for some government buildings as a result. She said the chip is used in an estimated 2 million cards in the Netherlands and a billioglobally — though Mifare’s Web site gives a total of 500 million, and it was not clear whether the vulnerability to hackers would apply to all versions of the chip.
Source:
http://news.yahoo.com/s/ap/20080312/ap_on_hi_te/techbit_netherlands_security_2

Communications Sector

36. March 12, Tech Web – (National) Hackers report breaking iPhone 2.0. Hackers calling themselves the iPhone Dev. Team have reported breaking into the iPhone firmware upgrade that ships with the recently launched software development kit for the smartphone. The group reported late Tuesday it had “decrypted the disk image and jail-broken the firmware.” In essence, the hackers had found a way to run applications on the firmware without a development certificate from Apple. If true, the hack calls into question whether Apple will be able to maintain the tight-fisted control it wants on iPhone application development. Meanwhile, Apple on Wednesday reported more than 100,000 downloads of the iPhone SDK in the first four days following its launch. Source: http://news.yahoo.com/s/cmp/20080313/tc_cmp/206903250;_ylt=AmRlDZA.croa.jqPaZ_wuauDzdAF