DHS Daily Open Source Infrastructure Report

Friday, January 7, 2011

Complete DHS Daily Report for January 7, 2011

Daily Report

Top Stories

• CNN reports small explosions at two Maryland government office buildings caused by packages sent via mail, left one person with minor injuries January 6. (See item 27)

27. January 6, CNN – (Maryland) Small explosions at Maryland state offices injure 1. Small explosions at two Maryland state government office buildings left one person with minor injuries January 6, a Maryland state government official with knowledge of the situation told CNN. No one suffered serious injuries or was hospitalized, a government source said. Both buildings were evacuated. Authorities responded to devices found in the mailroom of a state house office building in Annapolis, and at the Maryland Department of Transportation headquarters near Hanover, said a spokesman for the mayor of Annapolis. Reports of the incidents came in “not simultaneously, but close,” said the government source. “While the investigation is ongoing, it appears that two incendiary devices were transported through State government mail rooms,” the Maryland House speaker wrote in a statement. “We would encourage you to use reasonable caution in handling any packages that come to your office for the time being, and not open any mail until we have more complete information.” The Annapolis police bomb squad and firefighters, as well as the FBI and the state bomb squad responded. A Department of Homeland Security official said the department is closely monitoring the situation and is working with law enforcement agencies. Source: http://www.cnn.com/2011/US/01/06/maryland.security.incident/index.html?hpt=T1

• According to Associated Press, the son of a police detective opened fire at a high school in Omaha, Nebraska, January 5, fatally wounding the assistant principal and injuring the principal. (See item 49)

49. January 5, Associated Press – (Nebraska) Student kills 1, self at Omaha high school. The son of a police detective opened fire at a high school in Omaha, Nebraska, January 5, fatally wounding the assistant principal and forcing panicked students to take cover in the kitchen of the building just as they returned from holiday break. The gunman, who had attended the school for no more than 2 months, also wounded the principal before fleeing from the scene and fatally shooting himself in his car. The vice principal died at a hospital hours after the shooting, police said. The principal was listed in stable condition. In a rambling Facebook post filled with expletives, the shooter warned January 5 that people would hear about the “evil” things he did and said the school drove him to violence. He wrote that the Omaha school was worse than his previous one, and that the new city had changed him. He apologized and said he wanted people to remember him for who he was before affecting “the lives of the families I ruined.” The post ended with “goodbye.” The police chief provided no details on the weapon the gunman used or how he obtained it. The gunman’s father is a detective for the Omaha Police Department. Investigators were interviewing the 7-year veteran to try and discern a motive. Source: http://www.usatoday.com/news/nation/2011-01-05-omaha-school-shooting_N.htm

Details

Banking and Finance Sector

16. January 6, Columbus Dispatch – (Ohio) Woman FBI calls the ‘church lady bandit’ indicted in 12 robberies. The first bank robbery now attributed to the “church lady bandit” occurred January 10, 2006 — right around the time, auditor’s records show, the suspect lost her Northeast Side house in Columbus, Ohio in foreclosure. Three more robberies linked to the bandit occurred in October 2008, the same month the suspect embezzled $2,500 from her employer using a company credit card, according to court records. The bandit’s pace picked up in the fall, when she robbed seven banks and a motel, authorities said. Those robberies started in September, 4 months after the courts agreed the suspect owed $12,400 for defaulting on a car loan. On January 5, the Franklin County prosecutor announced a 24-count indictment against the suspect, saying the 46-year-old woman was responsible for 11 bank robberies, and one at a motel. Source: http://www.dispatch.com/live/content/local_news/stories/2011/01/05/Church_lady_bandit_indicted.html?sid=101

17. January 6, Associated Press; Texarkana Gazette – (Arkansas) Police officers charged in armored car caper. Three Arkansas police officers have been charged with conspiracy to rob an armored car in Little Rock, and one of their two alleged accomplices was indicted for stealing $400,000 from an armored car driver in 2007, according to an indictment released January 5. Prosecutors would not say whether the conspiracy charges stemmed from the alleged heist or another plot, though all five men were named in the same terse, 2-page indictment. Source: http://www.texarkanagazette.com/news/WireHeadlines/2011/01/06/police-officers-charged-in-armored-car-c-41.php

18. January 6, Help Net Security – (International) Undetectable fake ATM keyboard steals PINs in real time. Thieves and scammers are an inventive bunch, especially when it comes to stealing money indirectly. And the latest discovery of a fake keyboard placed over an ATM’s legitimate one that records the typed-in PIN — in conjunction with a fake magnetic strip reader that can be manufactured from cheap spare electronic parts — shows this kind of crime does not require a lot of funds and can bring in quite a lot of money. According to Gizmodo, the keyboard is virtually undetectable by anyone who is not an expert, and looks exactly like the real thing. It records the PIN as you type it in and sends this information, and that regarding the credit card magnetic strip, to the criminals in real time, so they can immediately proceed to empty an account. U.S. ATM users are particularly susceptible to these types of theft, since many ATMs work on the same principle. The chip-and-PIN technology used in Europe is harder to crack, so a number of U.S. banks have started adopting it. Source: http://www.net-security.org/secworld.php?id=10402

19. January 6, WFXT 25 Boston – (Massachusetts) FBI investigating possible bank robbery ring. One bank robbery January 5 in Burlington, Massachusetts could turn out to be a hit by a major organized crime crew. The FBI violent crimes task force has been chasing a group of organized bank robbers for nearly a month now. Since December 15, they have hit banks in Lynnfield, Reading, Malden, Westford, Salem, Westford, and, most recently, Burlington. At first authorities thought they were dealing with a single bank robber, but now they believe this is a bank robbery ring — one that is considered armed and dangerous. Surveillance from the latest bank robbery January 5 at about 9:30 a.m. at the Central Bank on Wilmington Road shows a black man wearing a gray hooded sweatshirt with the hood up walking into the bank, passing a demand note threatening he had a gun, and then walking out. The FBI and the Massachusetts Bankers Association have put up a $15,000 reward for information leading to the arrest and conviction of the suspects. Source: http://www.myfoxboston.com/dpp/news/crime_files/crime_watch/bank-robberies-the-work-of-organized-crew-20110105

20. January 6, Willoughby News-Herald – (International) Federal charges filed against man accused of defrauding St. Paul Croatian Federal Credit Union. A person who resides in both Eastlake, Ohio, and Skopje, Macedonia, is facing two charges of bank fraud and one charge of money laundering. The suspect is accused of fraudulently obtaining several loans totaling $2.5 million from St. Paul Croatian Federal Credit Union in Eastlake between July and August 2009, according to the United States attorney for the Northern District of Ohio. Authorities believe he obtained most of the loans by falsely listing the names of other persons as the applicants and intended recipients, he said. The suspect is also accused of not being eligible to receive any loans from the credit union at that time because he had already defaulted on more than $1 million he previously received. Source: http://news-herald.com/articles/2011/01/06/news/doc4d25cc96ba93b719119840.txt

21. January 6, WLUK 11 Green Bay – (Wisconsin) Neenah police search for bank robbery suspect. A bomb threat, turned bank robbery had a Neenah, Wisconsin, grocery store evacuated for nearly 4 hours January 5. It began around 5:30 p.m. at the Pick ‘n Save on Fox Point Plaza. Authorities said a man wearing a black hooded sweatshirt pulled a package he claimed was a bomb from a grocery bag. He then demanded money from the Associated Bank inside the store. The Brown County Bomb Squad determined the package was harmless, but police said the robbery caused quite a scare. “We treated it as carefully as we could. We evacuated the building, got the employees out, and the patrons cleared, the parking lots and some of the other nearby buildings, then called for the bomb squad,” the Neenah police chief said. Employees were allowed back in the building shortly before 9 p.m. Source: http://www.fox11online.com/dpp/news/local/fox_cities/neenah-pick-n-save-evacuated

22. January 5, Orange County Register – (California) Fake-bomb bandit believed to be serial robber. A man who used a fake bomb to rob a Bank of America January 4 in Orange, California is believed to be a serial robber who has hit banks in Los Angeles County, officials said. At about 2:45 p.m., a man wearing a baseball cap sat down with an employee and opened what looked to be a day planner, authorities said. Inside was a device that looked like a bomb, complete with cylinder-shaped objects that resembled flares, wiring, and electronic components. A man law-enforcement officials have dubbed the “Scanner Bandit” is believed to be responsible for four robberies, including the January 4 heist. The serial bank robber is known for using devices that look like bombs. The object in the January 4 heist was determined to have been a fake bomb, and FBI officials said the robbery closely resembled similar incidents in banks in Torrance, Whittier, and Norwalk. Source: http://www.ocregister.com/news/bomb-282836-bank-officials.html

For another story, see item 61 below in Information Technology

Information Technology

57. January 6, H Security – (International) Flash Player sandbox can be bypassed. Flash applications run locally can read local files and send them to an online server — something which the sandbox is supposed to prevent. Flash includes a number of sandboxes which impose restrictions depending on the origin of, and access rights for, the SWF file. Local SWF files, for example, run within the local-with-file-system sandbox, are permitted to access local files. They are not able to access the network, so a malicious SWF applet should not be able to send local data to a remote server. However, an H Security specialist has determined that Adobe controls access to the network using a blacklist of protocol handlers. Protocols such as HTTP and HTTPS are blacklisted. He reports it is in principle possible to send files to a server using the file: protocol handler, but that this is only possible within the local area network. He has identified another protocol handler which can be used to send data to remote servers — mhtml. Source: http://www.h-online.com/security/news/item/Flash-Player-sandbox-can-be-bypassed-1164376.html]

58. January 6, Help Net Security – (International) MediaWiki 1.16.1 fixes clickjacking issue. MediaWiki released version 1.16.1, which is a security and maintenance release. Wikipedia user PleaseStand pointed out MediaWiki has no protection against “clickjacking”. With user or site JavaScript or CSS enabled, clickjacking can lead to cross-site scripting (XSS), and thus full compromise of the wiki account of any user who visits a malicious external site. Clickjacking affects all previous versions of MediaWiki. The fix involves denying framing on all pages except normal page views and a few selected special pages. To be protected, all users must use a browser which supports X-Frame-Options. Source: http://www.net-security.org/secworld.php?id=10405

59. January 5, Softpedia – (International) Survey scammers and adware pushers target TRON fans. Security researchers warn of multiple scams that trick fans of the “TRON” movie into subscribing to premium rate services or infecting their computers with adware. Most of the scams offer to view the movie online at high quality. These are usually advertised through YouTube videos with titles among the lines of “Watch TRON : Legacy Online HD Blu-Ray Quality.” Clicking on the links listed in the descriptions of these videos leads users to Web sites that ask them to take a survey before being given access to the movie. These deceptive surveys usually attempt to subscribe users to premium rate services and collect their personal information for future targeted spamming in the process. Other TRON free streaming scams use the “required codec” social engineering trick to get users to download and install Adware programs like ClickPotato, ShopperReports, QuestBrowser, and blinkx Beat. Source: http://news.softpedia.com/news/Survey-Scams-and-Adware-Pushers-Target-TRON-Fans-176321.shtml

60. January 5, Computerworld – (International) Researchers confirm Googler’s Internet Explorer bug. French security researchers at Vupen January 5 confirmed the presence of a bug in Internet Explorer (IE) that is at the center of a spat between Microsoft and a Google security engineer. According to Vupen, IE8 harbors a vulnerability that can be exploited to hijack a Windows system. Vupen said it confirmed the vulnerability and its exploitability in IE8 running on Windows XP Service Pack 3 (SP3), but believed it could also be leveraged on Windows Vista, Windows 7, Server 2003, Server 2008, and Server 2008 R2.The security company rated the bug as “critical,” its highest threat warning. In a follow-up tweet, Vupen said, “Reproducing was/is hard.” The bug was publicly reported by a Google security engineer, when he released a new “fuzzing” tool that had found more than 100 bugs in 5 major browsers. Source: http://www.computerworld.com/s/article/9203461/Researchers_confirm_Googler_s_Internet_Explorer_bug

61. January 5, IDG News Service – (International) Alleged Miley Cyrus hacker arrested. The 21-year-old hacker who boasted about breaking into the Gmail account of a famous singer and actress has been arrested in Tennessee on fraud charges. The arrest comes more than 2 years after FBI agents raided the suspect’s home looking for evidence in the case. In court documents, the FBI said he was an accomplished spammer, who hacked a large number of Gmail and MySpace accounts. But the suspect has not been charged in the celebrity hack — instead, he faces more serious financial fraud charges for allegedly storing about 200 stolen credit card numbers on his computer. He could go to prison for 10 years and pay a $250,000 fine if convicted of the charges. Source: http://www.computerworld.com/s/article/9203498/Alleged_Miley_Cyrus_hacker_arrested

Communications Sector

62. January 5, San Diego North County Times – (California) AT&T customers report service outages. Thousands of AT&T customers are reporting problems with their phone, Internet, and cable services throughout California, including some in North County. More than 70,000 customers statewide have reported connection problems since December, and many are likely caused by the recent storms, an AT&T spokeswoman said. No figures were available for San Diego County, she said. December was one of the wettest months on record for the state. In San Diego County, several days of nearly uninterrupted rain disrupted the region’s transit, power, and road systems. AT&T’s infrastructure was not spared, but the company is working to fix the problems, a spokesman said. The company could not provide an exact date when the problems would be resolved, but said public safety and customers with special needs are a priority. Source: http://www.nctimes.com/news/local/sdcounty/article_c9c2c65e-3927-5b5c-b87a-3376c6a8d2d4.html

63. January 5, KHQA 7 Hannibal – (Iowa; Missouri) LeeComm 911 service out of reach to some communities. A fiber optics cable was cut just south of Houghton in Lee County, Iowa January 5. Windstream customers in the in that area were only be able to dial within their own prefix and could not dial long distance. This also meant that they could not dial 911. The communities affected included Donnellson, Farmington, Montrose, Argyle, Primrose, and in Missouri the community of Athens. Work crews responded and repaired the cable and restored service by the afternoon. Source: http://www.connecttristates.com/news/story.aspx?id=563465