Thursday, July 23, 2009

Complete DHS Daily Report for July 23, 2009

Daily Report

Top Stories

 KJRH 2 Tulsa reports that an official with Magellan Midstream Partners says an intruder tampered with an ammonia pipeline that caused a massive leak in Pawnee County, Oklahoma on July 18. As many as 100 people were evacuated from a five square mile area around Skedee. (See item 5)


5. July 20, KJRH 2 Tulsa – (Oklahoma) Intruder caused ammonia leak, officials say. An official with Magellan Midstream Partners says an intruder tampered with an ammonia pipeline that caused a massive leak in Pawnee County on Saturday. In an email Monday, the government and media affairs director said, “Initial indications are that the release was caused by the unauthorized opening of a valve by an unknown third party. Magellan is working with local law enforcement authorities as part of the continued investigation.” The Pawnee County Sheriff’s office alerted Magellan about 1:30 a.m. on Saturday when ammonia began leaking from the pipeline. The undersheriff says the area is secured by a chain link fence. Law enforcement is investigating the incident as a criminal case. As many as 100 people were evacuated from a five square mile area around Skedee. Hazmat crews sealed the leak by that afternoon, and residents were allowed to return home. The Magellan Midstream Partners pipeline runs from Verdigris to Enid, then up to Minnesota. Source: http://www.kjrh.com/content/news/2viewgc/story/Intruder-caused-ammonia-leak-officials-say/Za4wgEm1gk-6hoybjcE1CQ.cspx


 According to AboutLawsuits.com, a class action lawsuit was filed Tuesday against McDonalds after thousands of patrons at a restaurant in Milan, Illinois were exposed to hepatitis A. The complaint alleges that management knew at least one employee was infected and failed to take steps to prevent patrons from becoming infected. Nearly 20 people in the area have been diagnosed with hepatitis A. (See item 18)


18. July 22, AboutLawsuits.com – (Illinois) Hepatitis exposure class action lawsuit filed against McDonald’s. A class action lawsuit was filed Tuesday against McDonalds after thousands of patrons at a restaurant in northwestern Illinois were exposed to hepatitis A. The complaint alleges that management knew at least one employee was infected with hepatitis A and failed to take steps to prevent patrons from becoming infected. The hepatitis exposure lawsuit was filed on behalf of all customers who ate at the McDonald’s on 400 W. 1st Street in Milan, Illinois and received preventative treatment for the virus as recommended by local health officials. Nearly 20 people in the area have been diagnosed with hepatitis A, with 11 of them have requiring hospitalization. It has been confirmed that at least two employees at the Milan McDonald’s were continuing to work at the restaurant while infected, and management allegedly knew about the condition several weeks before the Rock Island County health department temporarily shut the restaurant down last week. Vaccinations for hepatitis A were rushed into the area for an estimated 10,000 residents who may have been exposed to the infection after visiting the McDonalds. At least 2,000 people have already received vaccination shots. According to the Illinois Department of Public Health, a food service worker employed by the McDonald’s restaurant in Milan and diagnosed with hepatitis A was reported to have worked during his/her infectious period and handled food items that were not subsequently cooked. Source: http://www.aboutlawsuits.com/mcdonalds-hepatitis-exposure-class-action-lawsuit-4980/

See also: http://www.idph.state.il.us/public/press09/7.19.09HepAClusterResp.htm


Details

Banking and Finance Sector

10. July 23, Bloomberg – (International) Hong Kong banks agree to repurchase Lehman minibonds. BOC Hong Kong Holdings Ltd. and 15 other banks agreed to pay at least 60 cents on the dollar to investors in notes linked to failed Lehman Brothers Holdings Inc. after a 10-month dispute that stirred street protests and forced lenders to change the way they sell investment products. The banks will repurchase the so-called Lehman minibonds in two stages, the Securities and Futures Commission Chief Executive said at a press conference on July 22. The total compensation will amount to about HK$6.3 billion ($813 million), said the central bank deputy chief executive. Hong Kong, where banks sold $1.8 billion of the notes, is an example of how the financial devastation resulting from Lehman’s September 15 bankruptcy rippled across the globe. As the securities plunged and allegations of mis-selling mounted, citizens who lost their savings took to the streets and lawmakers scolded the heads of the city’s central bank and securities watchdog in public. Source: http://www.bloomberg.com/apps/news?pid=newsarchive&sid=avaWSCSXUkTc


11. July 22, Wall Street Journal – (New York) Ex-WG trading compliance officer pleads guilty to fraud. The former chief compliance officer at broker-dealer WG Trading Co. LP pleaded guilty on July 21 to criminal charges in connection with more than $100 million in loans allegedly made to her bosses. The 54 years old, of Mahwah, New Jersey pleaded guilty to conspiracy, securities fraud and money laundering at a hearing before a U.S. District Judge in Manhattan. The loans were made as promissory notes and the guilty party said she realized the loans were not being repaid and what they were doing was illegal. The guilty party, who is cooperating with prosecutors from the U.S. Attorney’s office in Manhattan, faces up to 20 years in prison on the securities fraud charge. On July 22, the guilty party, who worked at the firm from March 1991 to February 2009, also was separately charged in a civil complaint in U.S. District Court in Manhattan by the Securities and Exchange Commission. In its complaint, the SEC alleged nearly $554 million in investor assets were misappropriated and that the guilty party assisted the firm’s general partners in perpetrating the fraud. The WG Trading Co.’s principals were charged criminally with conspiracy, securities fraud and wire fraud in February. Prosecutors from the U.S. Attorney’s office in Manhattan have alleged that both former owners of the New York Islanders professional hockey team misappropriated $550 million of funds invested by charities, university foundations and pension plans and used that money to finance their luxurious lifestyles. Source: http://online.wsj.com/article/SB124819519777069093.html


Information Technology


33. July 22, FOX News – (International) Report: federal documents detail iPods overheating, catching fire. Apple iPods have burned users or caught fire more than a dozen times, but neither the company nor the federal government has disclosed this to the public, according to a Seattle television station. In a report posted on its Web site on July 22, KIRO-TV says it used the Freedom of Information Act to get more than 800 pages of Consumer Product Safety Commission documents regarding iPod-related injuries and property damage. Within the documents were details of at least 15 separate incidents where iPods overheated, sparked, smoked, caused burns or caught fire, KIRO-TV said. The station became interested when an individual of Arlington, Washington, was mystified by a penny-sized burn on her chest in November 2008. “At first I thought, how in the heck did I get burned?” she told a KIRO-TV reporter. “Then I remembered that I had my iPod right there.” KIRO-TV filed an FOIA request in December 2008, but said the CPSC documents took seven months to arrive, delayed by Apple lawyers filing several exemptions. A 14 year old of Portland, Oregon, described being burned by an iPod Nano she had gotten for Christmas in 2007, one of the incidents mentioned in the documents. “I picked it up and it was really hot, and so my first instinct was to drop it so I didn’t burn myself,” she told KIRO-TV. “But I looked at my hand and it was red and it started to get swollen.” Other incidents included a teenage girl’s bedside chair catching fire when an iPod overheated, and another iPod catching fire aboard a ship with thousands of people aboard. An Apple representative had no official comment. Source: http://www.foxnews.com/story/0,2933,534275,00.html

See also: http://www.kirotv.com/money/20089894/detail.html


34. July 22, Associated Press – (National) Report: Cyber expert shortage may hinder government in protecting Web sites, internal systems. U.S. federal government agencies are facing a severe shortage of computer specialists, even as a growing wave of coordinated cyberattacks against the government poses potential national security risks, a private study found. The study describes a fragmented federal cyber force, where no one is in charge of overall planning and government agencies are “on their own and sometimes working at cross purposes or in competition with one another.” The report, scheduled to be released on July 22, arrives in the wake of a series of cyberattacks in July that shut down some U.S. and South Korean government and financial Web sites. The recruiting and retention of cyber workers is hampered by a cumbersome hiring process, the failure to devise government-wide certification standards, insufficient training and salaries, and a lack of an overall strategy for recruiting and retaining cyber workers, the study said. “You can’t win the cyber war if you don’t win the war for talent,” said the president of the Partnership for Public Service, a Washington-based advocacy group that works to improve government service. “If we don’t have a federal work force capable of meeting the cyber challenge, all of the cyber czars and organizational efforts will be for naught.” The study was drafted by the partnership and Booz Allen Hamilton as the U.S. Administration struggles to put together a more cohesive strategy to protect U.S. government and civilian computer networks. Source: http://www.latimes.com/news/nationworld/politics/wire/sns-ap-us-internet-security,1,5665316.story


35. July 21, CNET News – (International) Firefox 3.0.12 patches five critical problems. Mozilla on July 21 released Firefox 3.0.12, an update to the open-source browser that fixes five critical security vulnerabilities and fixes a handful of other bugs. “We strongly recommend that all Firefox 3.0.x users upgrade to this latest release,” Mozilla said on its developer blog. “If you already have Firefox 3, you will receive an automated update notification within 24 to 48 hours. This update can also be applied manually by selecting ‘Check for Updates...’ from the Help menu.” Version 3.0.12 fixes five critical problems and one high-level security problem, according to the Mozilla security advisory site. Mozilla is trying to move people to the newer Firefox 3.5, which offers faster JavaScript program execution, new privacy features, and a handful of technologies geared for more powerful Web applications. And Mozilla is pushing the new browser hard. Security and stability fixes for the 3.0.x series will end in January 2010. Source: http://news.cnet.com/8301-1009_3-10292587-83.html?part=rss&tag=feed&subj=News-Security


36. July 21, The Register – (International) Open-source firmware vuln exposes wireless routers. A hacker has discovered a critical vulnerability in open-source firmware available for wireless routers made by Linksys and other manufacturers that allows attackers to remotely penetrate the device and take full control of it. The remote root vulnerability affects the most recent version of DD-WRT, a piece of firmware many router users install to give their device capabilities not available by default. The bug allows unauthenticated users to remotely gain root access simply by luring someone on the local network to a malicious website. “This means someone can even post some crafted [img] link on a forum and a dd-wrt router owner visiting the forum will get owned,” a user wrote in this posting to Milw0rm. “A weird vulnerability you’re unlikely to see in 2009. Quite embarrassing I would say.” Messages sent through the DD-WRT website to the software designers were not returned by time of publication, but comments posted to this user forum thread said the vulnerability affected the most recent builds, prompting a user by the name of autobot to declare the vulnerability a “mini code red.” The bug resides in DD-WRT’s hyper text transfer protocol daemon, which runs as root. Because the httpd does not sanitize user-supplied input, it is vulnerable to remote command injection. While the httpd does not listen on the outbound interface, attackers can easily access it using CSRF (cross-site request forgery) techniques. Source: http://www.theregister.co.uk/2009/07/21/critical_ddwrt_router_vuln/


For another story, see item 1 below

Communications Sector

See item 1 below

1. July 21, Nextgov – (National) Congress must do more to protect grid from cyber, nuclear attacks. Congress should pass measures to protect the nation’s electric grid against electromagnetic pulses emitted after a nuclear blast, witnesses told a hearing on July 21. When a nuclear warhead detonates at altitudes between 25 and 250 miles, it emits a high-altitude electromagnetic pulse, or EMP, which disrupts and damages electronic systems, including electric grids, the chairman of the Commission to Assess the Threat to the United States From Electromagnetic Pulse told the Subcommittee on Emerging Threats, Cybersecurity and Science and Technology. Geomagnetic storms that occur from significant changes in solar wind pressure can have a similar impact, he said. The chairman recommended that a bill, H.R. 2195, which would amend the Federal Power Act, address the threat of a cyberattack against the electric grid and address electromagnetic threats from nuclear EMP attacks and large-scale geomagnetic storms. Other critics have said the bill would not prompt owners and operators of electrical facilities to do their part to enhance cybersecurity and should be expanded to address other components of the nation’s critical infrastructure such as transportation and water. NERC released 40 Critical Infrastructure Protection standards designed to defend critical infrastructure from cybersecurity threats and is working on additional standards that are expected to have initial industry approval by the fourth quarter of 2009, said its chief security officer. NERC also might incorporate into security standards elements of the National Institute of Standards and Technology’s Special Publication 800-53, which provides recommended security controls for federal information systems. These standards do not address EMP directly, though NERC is looking into the threat. Federal government should hold emergency authority to take action in case of an attack, but should not set standards for protection of the electric grid, he added. “Preparedness and awareness efforts like the assessments, alerts and standards are necessary, but not sufficient, to protect the system against specific and imminent threats,” he said. “NERC firmly believes that additional emergency authority is needed at the federal level to address these threats, and NERC supports legislation that would give an agency or department of the federal government necessary authority to take action.” Source: http://www.nextgov.com/nextgov/ng_20090721_4170.php?oref=topstory