Thursday, June 25, 2009

Complete DHS Daily Report for June 25, 2009

Daily Report

Top Stories

 According to the Associated Press, at least three people were injured on Tuesday in an explosion at the Guest Inn Motel in Yukon, Oklahoma. The cause of the blast, which forced the evacuation of 40 motel guests, has not been confirmed. (See item 38)

38. June 24, Associated Press – (Oklahoma) Pregnant woman, 2 others injured in hotel explosion. A pregnant woman and at least two others were injured on June 23 in an explosion at a motel in a suburb of Oklahoma City, authorities said. The woman, who is eight months pregnant, and a man were critically injured in the blast at the Guest Inn Motel in Yukon about 6 p.m., police spokeswoman said. Another person was treated at the scene, according to the emergency medical services authority. The police spokeswoman also said a couple other people may have suffered minor injuries. The cause of the blast has not been confirmed, but officials do not believe it was from a methamphetamine lab. “The walls were blown out and debris is across the parking lot,” the police spokesman said. At least eight of the motel’s units were damaged, the spokeswoman said. The pregnant woman, who is the motel’s manager, suffered burns to her hands, face, lips and ears. Emergency crews evacuated the motel, which had about 40 guests, and electric power was turned off, the spokeswoman added. Source: http://www.foxnews.com/story/0,2933,528881,00.html

 The Seattle Times reports that the U.S. Army Corps of Engineers may have to severely restrict how much stormwater the Howard Hanson Dam in Washington State can hold back for the next several winters after discovering that water is flowing through the dam’s right abutment “very fast.” (See item 41)

41. June 24, Seattle Times – (Washington) Water seeping through Howard Hanson Dam is picking up speed. The speed at which water is seeping through a flank of the Howard Hanson Dam has, by one key measure, increased since January, and the people who operate the dam do not know why. Officials with the Army Corps of Engineers said in a news release June 23 that water is flowing through the 48-year-old dam’s right abutment “very fast” and may mean the earth-and-rock structure could erode if too much water is stored behind the dam 32 miles upstream from Auburn. Nobody is saying there will be large-scale floods for the first time since the dam was built, but the weakness in the dam abutment — the side of the valley against which the dam was built — means the Corps of Engineers may have to severely restrict how much stormwater the dam can hold back for the next several winters. And that could mean more water flowing through the valley below, raising the risk of flooding for the cities of Kent, Renton, Tukwila, and Auburn. Seepage through the dam’s right abutment has caused concerns for much of its life. Improvements were made in 1965 and again in 2002, but engineers are worried the problem may have worsened. The Corps of Engineers publicly acknowledged new concerns about the stability of the dam abutment in January, when staffers found several “anomalies” during a storm that dumped 15 inches of rain in 24 hours behind the dam. The Corps is, again, in the process of lowering the reservoir. The Corps said in its news release that the water will not be released fast enough to endanger swimmers, boaters and other people on the river. But in the past few days, results of a dye test came back with surprising results. A small amount of dye moved through the abutment into a drainage tunnel far faster than it had during a January test after the storm. More dye-test results will be done in the coming weeks, and contractors are currently drilling into the abutment to help engineers understand what’s happening. By November the Corps will install a “grout curtain” to reduce seepage, and will drill more vertical and horizontal drains. The measures are expected to cost more than $20 million. Planning will then begin on a permanent solution, which is likely several years away. Dam-safety experts from around the country are advising the Corps on those interim measures and possible long-term solutions. Source: http://seattletimes.nwsource.com/html/localnews/2009376179_leakingdam24m.html

Details

Banking and Finance Sector

12. June 23, Associated Press – (Illinois) 37 charged in Ill. mortgage fraud crackdown. Two real estate companies, a title company, an investment company and 37 people have been charged in mortgage fraud cases in the Chicago area that cost lenders $48 million, federal officials announced on June 23. It was the third major batch of unrelated mortgage fraud cases unveiled in the last year by federal prosecutors eager to focus attention on the crime. “There certainly is a wave of mortgage fraud that we’re trying to crack down on,” a U.S. attorney said at a news conference. Properties in the batch of five unrelated cases ranged from dilapidated houses in Chicago’s blighted Englewood neighborhood to Near North Side condominiums to homes in the affluent suburbs of Glenview and Wheaton. Individuals charged included mortgage brokers, loan officers, real estate investors, appraisers and an attorney. The cases involve a total of $48 million in fraudulently obtained mortgages, federal officials said. Most of thee cases involved buyers who allegedly obtained mortgages with the intention of getting the loan money and then skipping out on the payments. In some cases, the buyers used fictitious names. In the largest case, a Buffalo Grove real estate man and his wife are charged with paying people to obtain mortgages on 70 properties, many in dilapidated condition in Chicago’s gang-ridden Englewood neighborhood. Once the mortgage money was in hand, the borrowers skipped out on the payments and the lenders suffered huge losses, prosecutors said. Most of the 15 people accused of taking part in the scheme are charged with mail fraud or wire fraud. Source: http://www.forbes.com/feeds/ap/2009/06/23/ap6578680.html

13. June 23, MarketWatch – (National) FDIC eyes extension to unlimited deposit insurance. The Federal Deposit Insurance Corp. on June 23 proposed extending a program that provides unlimited deposit insurance for non-interest-bearing deposits by six months. The coverage was set to expire December 31, 2009, but the agency extended it to June 30, 2010, seeking to calm fears of large businesses that have significant business customers that keep large deposit accounts at banks for their payrolls. The agency provided a temporary blanket deposit insurance coverage for non-interest-bearing accounts last year as the financial crisis worsened. Source: http://www.marketwatch.com/story/fdic-eyes-extension-to-unlimited-deposit-insurance

Information Technology

32. June 24, Wall Street Journal – (National) Military command is created for cyber security. The U.S. Defense Secretary created a new military command dedicated to cyber security on June 23, reflecting the U.S. President’s plans to centralize and elevate computer security as a major national-security issue. In a memo to senior Pentagon officials, the U.S. Defense Secretary said he intends to recommend that the director of the National Security Agency take on the additional role as commander of the Cyber Command with the rank of a four-star general. The U.S. Defense Secretary’s budget envisions training more than 200 cyber-security officers annually. The decision follows the U.S. President’s announcement last month that he will establish a new cyber-security office at the White House, whose chief will coordinate all government efforts to protect computer networks. The Pentagon initiative will reshape the military’s efforts to protect networks from attacks by hackers, especially those from China and Russia. It also consolidates the largest concentration of cyber warriors and investigators in the government under one military command, exacerbating concerns of some experts who worry about military control of civilian computer systems. Source: http://online.wsj.com/article/SB124579956278644449.html

33. June 24, Washington Post – (International) Microsoft debuts free antivirus software beta. Microsoft on June 23 released a beta version of its new free anti-virus offering, Microsoft Security Essentials (a.k.a “Morro”). MSE is basically the next generation of Microsoft’s Windows Live Onecare anti-virus and anti-spyware service, but without all of the extras, such as a firewall, data backup solution and restore or PC performance tuning. After installation, MSE spends a couple of minutes downloading additional files, and then prompts the user to perform a “Quick Scan.” Anti-virus products are notorious for sucking up system resources, but it barely uses more than 4 MB of system memory for scans. The program includes real-time protection, which Microsoft says “alerts you when viruses, spyware and other potentially unwanted software attempts to install itself or run on your computer.” In addition, MSE monitors file and program activity on a user’s computer, and automatically scans all downloaded files and attachments. If it finds something, it will ask a user what to do with the suspect file, and if the user takes no action after 10 minutes, Microsoft will decide what to do with the file(s) according to its default actions. Source: http://voices.washingtonpost.com/securityfix/2009/06/microsoft_debuts_free_antiviru.html?wprss=securityfix

34. June 24, IDG News Service – (International) Adobe issues security update for Shockwave Player. Adobe Systems has released a patch for its Shockwave Player to fix a critical vulnerability, the company wrote on its security blog on June 23. Adobe did not provide many details on the vulnerability but wrote that it is remotely exploitable, meaning a hacker could use it to infect a computer with malicious software over the Internet. Shockwave Player is used to display content created by Adobe’s Director program, which offers advanced tools for creating interactive content, including Flash. The Director application can be used for creating 3D models, high-quality images and full-screen or long-form digital content and offers greater control over how those elements are displayed. The vulnerability affects Shockwave Player version 11.5.0.596 and earlier. Users should uninstall the old version and install version 11.5.0.600, which is available for download. The company was tipped off to the vulnerability by security vendor TippingPoint Technologies’ Zero Day Initiative, which pays security researchers for vulnerability information that is responsibly disclosed. Source: http://www.pcworld.com/businesscenter/article/167258/adobe_issues_security_update_for_shockwave_player.html

35. June 24, MXLogic – (International) CISOs see insiders as greatest ‘human threat’ to data security. The vast majority of chief information security officers surveyed at a CISO summit in June said that insiders are the greatest human threat to data security, while only 18 said they are concerned about threats from external sources such as cybercriminals and corporate spies. The survey by NetWitness Corporation and MIS Training Institute revealed that 80 percent of CISOs and CSOs feel insiders are the greatest human threat. A conference director at MIS Training Institute said the survey findings are “alarming,” in that there is a “misperception that traditional security approaches alone can protect against information leaks and that some CISOs were not sure what they need for data protection or were not planning to focus any money in that area this year.” Although CISOs are at least thinking about insider threats, another recent survey of business managers found that executives seemingly do not think about insider threats to data security from ex-employees. A Courion Corporation survey revealed that 93 percent of business managers are confident that terminated employees pose no risk to their network security, even though many have limited knowledge of the systems to which their employees have access. Source: http://www.mxlogic.com/securitynews/network-security/cisos-see-insiders-as-greatest-human-threat-to-data-security132.cfm

36. June 23, IDG News Service – (International) Cloudmark security suite addresses growing SMS spam. As mobile users are more frequently pestered by SMS spam, one security vendor is applying its experience in stopping e-mail spam for mobile networks. Cloudmark released on June 23 a suite of services designed for operators to stop abuse on their networks, such as MMS (Multimedia Messaging Service) and SMS spam as well as malware aimed at mobile devices. The suite, called MobileAuthority, combines several features and services that Cloudmark had offered individually, but now make more sense to offer as a suite, said the head of technology services for Europe. The Sender Intelligence component of MobileAuthority allows operators to detect and then block mobile spam originating from either inside their network or from one of their partners. The filtering component looks for patterns in order to block spam, malware or phishing scams. Cloudmark has also set up a managed security service with a team that will monitor a mobile provider’s networks for abuse and make adjustments in filtering in order to stop further problems. As hackers and spammers see the potential for profit by hitting people with various scams over their mobiles, it is likely they will proliferate, the head of technology services said. Mobile users in North America and Europe have not been inundated with as much spam as people in Asia, but it is on the rise. “We haven’t seen that much, although it’s now starting to get reasonably pernicious in North America,” said Cloudmark’s CEO. Source: http://www.pcworld.com/businesscenter/article/167200/cloudmark_security_suite_addresses_growing_sms_spam.html

37. June 23, Homeland Security Newswire – (International) Effective cybersecurity requires common language. The former cybersecurity director at DHS had some sobering words last week about the battle for cybersecurity. “We lost,” the former director, now chief executive officer of NetWitness Corp., said at the Symantec Government Symposium in Washington. “We lost the cyber war over the last 15 years. Our computing environment is already compromised,” and things are likely to get worse going forward because we do not really understand security. “We lack any meaningful metrics or measures to say how secure a system is.” It no longer is true that the best minds are on the side of the hackers. The dark side of cyberspace has been co-opted by organized crime, entrepreneurs of questionable integrity and, possibly, terrorists. Much of the process of illegal hacking has been mechanized to the point that it involves automation, not innovation. Part of the problem was identified by the U.S. Computer Emergency Readiness Team director. ”We lack a common language for discussing many of the elements of security. We need to reinvent not only how we do incident response, but how we talk about events,” the director said at the symposium. Source: http://homelandsecuritynewswire.com/single.php?id=8200

Communications Sector

Nothing to report.

Wednesday, June 24, 2009

Complete DHS Daily Report for June 24, 2009

Daily Report

Top Stories

 According to the Toronto Star, journalism students from the University of British Columbia say they paid $40 in Ghana for a second-hand hard drive that contained information about multi-million-dollar defense contracts between the Pentagon, DHS, and private military contractor Northrop Grumman. (See item 12)

12. June 23, Toronto Star – (National) Secret U.S. data found on cast-off hard drive. Journalism students from the University of British Columbia say they paid $40 in Ghana for a second-hand hard drive that contained information about multi-million-dollar defense contracts between the Pentagon, U.S. Department of Homeland Security and one of the largest military contractors in the United States. The students were part of a team sent to three countries to investigate the problems caused by the global trade in electronic waste. Their documentary Ghana: Digital Dumping Ground airs June 23 on PBS’s Frontline/World season finale. One of the students said on June 22 the hard drive was purchased in an open-air market in the coastal town of Tema from a local dealer who bought second-hand hard drives by the cargo load. The students purchased five drives. Four were empty, but one contained information about hiring and personnel contracts and plans for U.S. defense agencies and the private military contractor Northrop Grumman, they say. Data on the hard drive included sensitive information about hiring practices, which could help people learn how to get into secured positions at places such as airports. The hard drive also contained information such as credit card numbers and family photos. Northrop Grumman has acknowledged it is looking into how its hardware and data ended up in Ghana. Source: http://www.thestar.com/news/canada/article/655048

 Reuters reports that transit authorities in Washington, D.C. were warned to upgrade the safety standards of older subway cars before a crash on Monday that killed seven people, an NTSB spokeswoman said at a news conference at the scene of the accident. (See item 16)

16. June 23, Reuters – (District of Columbia) Washington subway warned before crash that killed 7. Transit authorities in Washington, D.C. were warned to upgrade the safety standards of older subway cars before a crash on June 22 that killed seven people, U.S. investigators said on June 22. Federal officials investigating the cause of the crash, the deadliest in the 33-year history of Washington’s Metro Area Transit Authority, said a 2006 warning to upgrade or retire older, less protected cars had gone unheeded. “We recommended to WMATA to either retrofit those cars or phase them out of the fleet. They have not been able to do that and our recommendation was not addressed,” a National Transportation Safety Board spokeswoman said at a news conference at the scene of the accident. Seventy-six people were taken to hospitals after one train slammed into another that was stopped on above-ground tracks during the afternoon rush hour, said the mayor of the District of Columbia. He said there were seven confirmed fatalities. Two people had been in critical condition but one patient was upgraded overnight, he said. The operator of the moving train was among those killed in the crash, the impact of which drove one train into the air and on top of the other. It remained there on Tuesday morning as workers attempted to clear the wreckage. Source: http://www.reuters.com/article/newsOne/idUSTRE55L69G20090623

Details

Banking and Finance Sector

13. June 23, Oil and Gas Journal – (Indiana) SEC charges Berkshire Resources and its principals with fraud. The U.S. Securities and Exchange Commission charged Berkshire Resources LLC and its principals with securities fraud on June 7 in connection with their oil and gas offerings. The company’s head sales agents were also named in the complaint filed in federal district court for the Southern District of Indiana. In that complaint, the SEC said that it alleged that Berkshire raised $15.5 million from 265 U.S. and Canadian investors through a series of unregistered, fraudulent offerings of securities in the form of “units of participation.” The offerings’ purported purpose was to fund oil and gas operations which Berkshire was to oversee, the SEC said. It said that one of the company’s principles’ was the company’s public face and was portrayed as its lead manager with extensive oil and gas experience. In reality, he had no such experience and his father ran the company behind the scenes. The father has an extensive disciplinary history for securities fraud and is facing a criminal indictment in connection with another similar, but unrelated, oil and gas scam, the SEC said. It said that the complaint also alleges that Berkshire and its principals misled investors when they assured them that 100 percent of the investments would be used for oil and gas drilling projects. Instead, the SEC said, Berkshire spent $6.7 million on items having nothing to do with oil and gas drilling, including its own payroll, outside sales commissions, and marketing and promotional expenses. Of that amount, $1.7 million went to family members to pay for home mortgages, furnishings, and electronics, cars, and credit card charges, the federal securities regulator said. Source: http://www.pennenergy.com/index/articles/display/8007208127/s-articles/s-oil-gas-journal/s-weekly-washington-update/s-other-headlines/s-sec-charges_berkshire.html

14. June 22, Bloomberg – (New York) Fund manager Stein pleads guilty to $30 million fraud. A New York hedge-fund manager pleaded guilty to running a $30 million fraud and the friends and acquaintances whom he preyed on urged a federal judge to immediately jail him. The guilty party admitted on June 22 to four counts of securities fraud and one charge of wire fraud. He was initially accused March 31 of cheating a client out of $6.5 million. He faces as much as 19 years and seven months in prison, prosecutors said in court on June 22. He was allowed to remain free on a $2 million bond and ordered to restrict his travel within southeastern New York. The SEC also filed a separate civil action that accused the guilty party, who controls Gemini Fund I hedge fund, DISP LLC and Prima Capital Management Corp., of moving millions of dollars from at least 83 investors through accounts he controlled, according to the complaint filed in federal court in Manhattan. Source: http://www.bloomberg.com/apps/news?pid=20601103&sid=ae_bqFgJCFkM

15. June 22, Agence France-Presse – (New York) Madoff feeder fund charged with fraud. U.S. financial regulators charged a brokerage firm and several individuals with funneling billions of dollars to help finance a Wall Street swindler’s massive Ponzi scheme. The Securities and Exchange Commission (SEC) filed a complaint in a U.S. district court in New York against Cohmad Securities Corporation, its chairman, his daughter and chief operating officer, as well as a registered representative for securities fraud. Two of the defendants, the SEC said, “collectively raised billions of dollars from investors for the Ponzi scheme,” which is estimated at between 50 and 65 billion dollars. “They ignored and even participated in many suspicious practices that clearly indicated the director of the Ponzi scheme was engaged in fraud,” the SEC added in its filing. The defendants, it said, were paid over 100 million dollars by the director of the Ponzi scheme for raising billions of dollars and bringing in more than 800 investor accounts over two decades. Another defendant participated in the pyramid scheme “by soliciting investors and bringing more than 1 billion dollars” into Bernard L. Madoff Investment Securities LLC (BMIS), according to the SEC. Source: http://www.google.com/hostednews/afp/article/ALeqM5gXXzYDpW0Qz3gGF7QktoZ3qGusHw

Information Technology

32. June 23, TMJ 4 Milwaukee – (International) Call 4 action: Outlook phishing scam. A new phishing scam that appears to be from Microsoft about reconfiguring Outlook is making the rounds. The problem with this scam is that it appears to come from Microsoft, a source that it typically trusted. The e-mail also seems legitimate because a lot of people use Outlook and they might be tricked into believing that this is just a routine update that is needed to keep their account functioning. Clicking on a link that is included in the e-mail could potentially allow full access to an e-mail account, allowing the phishers to view e-mails containing personal information, and they could also use the account for sending out high volumes of spam. If a user is not sure about whether an update or re-configurations is needed, the user is advised to contact a system administrator or Microsoft direct. Source: http://www.todaystmj4.com/news/local/48876852.html

33. June 22, Computerworld – (International) Exploits of unpatched Windows bug will jump, says Symantec. An exploit of a still-unpatched vulnerability in Microsoft Windows XP and Server 2003 has been added to a multi-strike attack toolkit, Symantec said recently, a move that may mean attacks will increase soon. According to Symantec, an in-the-wild exploit of the DirectShow bug, which Microsoft acknowledged a month ago, has been added to at least one Web-based attack kit. “This will likely lead to wide-spread use in a short time,” said a researcher with Symantec’s security response group, in an entry posted to the company’s blog on June 19. Microsoft has not yet issued a fix for the DirectShow bug, which affects Windows 2000, XP and Server 2003, but not the newer Windows Vista or Server 2008. The flaw also does not affect the not-yet-released Windows 7. However, attacks leveraging the bug have been tracked since May, when Microsoft issued a security advisory and confirmed it had evidence of “limited, active attacks.” Unlike other recent exploits of Microsoft zero-days, vulnerabilities that have not been patched by the time attack code surfaces, the DirectShow attacks are not targeting specific individuals or organizations. “This is not a targeted attack, but is one of limited distribution,” a senior research manager with Symantec, said in a telephone interview. What caught researchers’ attention, added the manager, was that the DirectShow exploit piggybacked on a run-of-the-mill phishing attack. It is becoming more common that a phishing site, in this case a bogus log-in page for Microsoft’s Windows Live software, also hosts malware that tries to hijack PCs. Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9134645

34. June 22, ZDNet – (International) Mozilla tackles XSS vulnerabilities with new technology. Mozilla’s security engineers are working on new technology that promises to mitigate a large class of Web application vulnerabilities, especially the cross-site scripting (XSS) plague against modern Web browsers. The project, called Content Security Policy, is designed to shut down XSS attacks by providing a mechanism for sites to explicitly tell the browser which content is legitimate. It can also help mitigate clickjacking and packet sniffing attacks. Website administrators specify which domains the browser should treat as valid sources of script. The browser will only execute script in source files from the white-listed domains and will disregard everything else, including inline scripts and event-handling HTML attributes. Sites that never want to have JavaScript included in their pages can choose to globally disallow script. To combat clickjacking, which allows clicks on one Web page to actually apply to clicks on another page that is invisible to the end user, Mozilla said Content Security Policy allows a site to specify which sites may embed a resource. The open-source group said Content Security Policy will be fully backward compatible and will not affect sites or browsers which do not support it. Source: http://blogs.zdnet.com/security/?p=3654

35. June 22, CNET News – (International) New Facebook blog: We can hack into your profile. FBHive, a new blog devoted to the discussion of all things Facebook, has debuted with the revelation that its creators have discovered a hack that can expose some crucial profile data. It will not expose an individual’s personal photos or wall posts. But, FBHive says, it can bring up all the “basic information” that a user has entered into their profile, even if a user has elected to keep that information private. This is the section that includes location, gender, relationship status, relationships (significant other, parents, siblings), political views, religious views, birthday, and hometown. That is enough to be a problem in the identity theft department, as it could easily expose frequent password hints like dates of birth and mothers’ maiden names. FBHive has not shared the details of the newly discovered hack; more disconcertingly, it said Facebook has done nothing since it alerted the social network to the issue earlier this month. Source: http://news.cnet.com/8301-13577_3-10270002-36.html

Communications Sector

36. June 22, Richmond Register – (Kentucky) Ham radio operators prepare for emergency. Madison County “hams” will join more than 30,000 of other amateur radio operators across the country the weekend of June 27 and 28 as they practice their emergency capabilities. The public is invited to visit the hobbyists who are prepared to use their skills and equipment to provide emergency communication when a natural disaster disrupts conventional telecommunications. Using only emergency power supplies, ham operators will set up emergency stations in parks, shopping malls, schools and backyards around the country. They will use the newest digital and satellite capabilities, voice communications and even historical Morse code. In Madison County, the Central Kentucky Amateur Radio Society will set up at Camp Catalpa across off Irvine Road across from Lake Reba Park. There, the public can learn about ham radio’s new capabilities and learn how to get their own FCC radio license before the next disaster strikes. This weekend’s annual “Field Day” is the climax of a week long “Amateur Radio Week” sponsored by the American Radio Relay League, the national association for amateur radio. Source: http://www.richmondregister.com/localnews/local_story_173083256.html

37. June 22, Gigaom.com – (International) The coming trans-Atlantic bandwidth crunch. During the dot-com boom, so many undersea cables delivering the Internet traversed the bottom of the ocean between the U.S. and Europe that bandwidth prices plummeted and providers of submarine cables filed for bankruptcy. But those cables may soon no longer be enough to satisfy the global demand for bandwidth between the two continents, according to research out on June 22 from TeleGeography. The research firm estimates that bandwidth requirements will grow 33 percent between 2008 and 2015, and trans-Atlantic capacity will be exhausted by 2014. The report also notes that the wave of bankruptcies caused by the oversupply of trans-Atlantic fiber during the boom artificially lowered the cost of providing bandwidth on those cables because many of the pipe providers were able to erase their cable construction debts. That is good for the current customers who now pay lower prices for transporting their bits, but it means current prices do not take into account the construction cost of the cables. So future customers will likely see some price increases on wholesale bandwidth as pipe operators add more capacity, and find themselves paying for expensive optical infrastructure. Source: http://gigaom.com/2009/06/22/the-coming-trans-atlantic-bandwidth-crunch/