Friday, November 30, 2007

Daily Report

• According to a Reuters report Thursday, the U.S. government may tap emergency oil reserves after the deadly pipeline explosion in Minnesota Wednesday cut off 10 percent of U.S. foreign oil supplies. The DHS cited no known links to terrorism in the fire, and two of the four pipelines linking Ontario and the Central US reopened Thursday. Nevertheless, the system’s throughput will likely be reduced for weeks. (See item 1)

• According to the Associated Press and a GAO report released Wednesday, the nation’s nuclear weapons laboratories need tougher safety oversight to fix a recent track record that includes dozens of lapses, accidents and near misses. The report found a lax attitude toward safety procedures, weaknesses in identifying and correcting safety problems, and inadequate oversight by the National Nuclear Security Administration. The review cited nearly 60 serious accidents or near misses since 2000. (See item 7)

Information Technology

25. November 29, CNN – (National) FBI: Millions of computers roped into criminal “robot networks.” More than 1 million computers in the last five months have become part of robot networks, or “botnets,” in which hackers take over computers without their owners’ knowledge and use them in criminal campaigns, the FBI said Thursday. The bureau in June announced Operation Bot Roast to stop this emerging type of cyber attack, which the FBI estimates has resulted in $20 million in losses and theft. More than 1 million computers were infected with botnets when the FBI launched Bot Roast, and another million have been identified since then. Industry numbers suggest there are millions more. According to an FBI news release, since New Zealand authorities in tandem with the FBI searched the home of an individual whose “elite international botnet coding group” is suspected of infecting more than 1 million computers, 13 additional search warrants have been served around the world, and eight individuals – in Washington, Pennsylvania, Florida, California and Kentucky -- have been indicted or found guilty of crimes related to botnets. Such crimes include fraud, identity theft and denial of service attacks in which computer Web sites and other resources are made unavailable. The schemes target more than individual computer users. The FBI in a news release said recent attacks have ensnared a major financial institution in the Midwest and the University of Pennsylvania. According to a September report from Symantec Corp., China had the most infected computers at 29 percent, followed by the United States at 13 percent. However, Symantec said, 43 percent of all command-and control servers -- which botnet operators use to relay commands to infected computers in their network -- were located in the United States. Symantec reported that in the first half of 2007 it had detected more than 5 million computers that had been used to carry out at least one cyber attack a day. The number represented a 17 percent drop since the previous reporting period, Symantec said.
Source: http://www.cnn.com/2007/TECH/11/29/fbi.botnets/index.html

26. November 29, Reuters – (International) World faces “cyber cold war” threat. A “cyber cold war” waged over the world’s computers threatens to become one of the biggest threats to security in the next decade, according to a report published by McAfee on Thursday. About 120 countries are developing ways to use the Internet as a weapon to target financial markets, government computer systems and utilities, an Internet security company said, adding that intelligence agencies already routinely test other states’ networks looking for weaknesses and their techniques are growing more sophisticated every year. The report said China, which has been blamed for attacks in the United States, India and Germany, is at the forefront of the cyber war. It said China has been blamed for attacks in the United States, India and Germany. China has repeatedly denied such claims. The McAfee report predicted that future attacks would be even more sophisticated. The report is online at www.mcafee.com/us/research/criminology_report/default.html
Source:
http://www.reuters.com/article/topNews/idUSL2932083320071129?feedType=RSS&feedName=topNews&rpc=22&sp=true

27. November 28, Infoworld – (National) Cost of data breaches keeps rising. In its third annual study into the financial impact of data breaches, Ponemon Institute reports the episodes are costing an average of $197 per lost or stolen customer record during 2007, a slight bump from the figure of $182 per exposed record that it tracked one year ago, and a significant gain over the estimate of $128 per record that the research firm published in its initial 2005 survey. Based on interviews conducted with 35 organizations that experienced data incidents in the last year, the Ponemon study found the average total cost of the breaches rose to $6.3 million in 2007, compared to an average of $4.8 million in 2006. The average number of records exposed in the breaches Ponemon studied was roughly 20,000 per incident, although among those organizations surveyed the incidents ranged from as few as 4,000 records to more than 125,000 records. However, while the cost of breaches has continued to rise, the research company contends that many organizations have improved their ability to react to the events. Even those firms who have experienced repeated incidents seem to have woken up to the idea of planning ahead and trying to prepare for the situation, said the research firm’s founder and chairman.
Source: http://www.infoworld.com/article/07/11/28/Cost-of-data-breaches-keepsrising_1.html

28. November 28, IDG New Service – (National) Web apps, Office among top security headaches, says SANS. Web-based applications and security holes in Microsoft Office are among the biggest threats faced by Internet users today, according to the SANS Institute’s annual security report, which compiles information on security threats from governments, security companies, and academics. Developers are not using secure coding techniques to create Web applications, giving hackers an opportunity to tap the rich databases of information connected to them, according to SANS, a computer training and security organization. The report also found fault with Microsoft Office. Vulnerabilities in the applications suite jumped almost 300 percent between 2006 and 2007, notably because of new flaws in Excel that allow hackers to construct documents that, when opened, can infect a computer with malicious software. The hackers attach those malicious documents to e-mail and use social engineering techniques, like attaching a file with an enticing name, to trick recipients into believing the document is important or comes from someone they know. Also on the rise this year was spyware, or programs that surreptitiously collect data on a user’s computer. Webroot, one of the security companies that contributed to the SANS report, said the number of Web sites rigged with spyware increased 187 percent this year.
Source: http://www.infoworld.com/article/07/11/28/Web-apps-Office-top-securityheadaches_1.html

Communications Sector

29. November 29, Reuters – (International) Global cell phone use at 50 percent. Worldwide mobile telephone subscriptions reached 3.3 billion -- equivalent to half the global population -- on Thursday, 26 years after the first cellular network was launched, research firm Informa said. In recent years the industry has seen surging growth in the outskirts of China and India, helped by constantly falling phone and call prices, with cellphone vendors already eyeing inroads into Africa’s countryside to continue the growth. But although mobile subscriptions have reached the equivalent of 50 percent of the population, this does not mean that half the people in the world now have a mobile phone, since Informa said 59 countries have mobile penetration of over 100 percent -- where some owners have more than one phone.
Source: http://www.washingtonpost.com/wpdyn/content/article/2007/11/29/AR2007112901242.html

30. November 29, IDG News Service – (International) Cell phone battery explodes in the night. A New Zealand man was woken in the middle of the night when his cell phone battery exploded and burst into flames, the second exploding battery incident reported this week. The phone had been charging while he was asleep. The phone was made by Nokia, which asked the man to turn over the battery and charger so it can investigate. In August, Nokia issued an advisory about faulty batteries in some of its phones. It said 46 million Nokia-branded BL-5C batteries were vulnerable to a short circuit that could cause them to overheat while recharging, and offered to replace them for customers who are concerned. Also, on Wednesday, police in South Korea said a worker may have died because his cell phone battery exploded in his pocket, the Associated Press reported. The man was found dead at his workplace in a quarry with a melted cell phone battery in his shirt pocket, according to the report.
Source: http://www.pcworld.com/article/id,140101-c,cellphones/article.html

Thursday, November 29, 2007

Daily Report

• According to a USA Today report Wednesday, the Transportation Security Administration will take over background checks of 1.2 million aviation workers from the FAA starting in January. The move means licensed aviation workers will be checked against the FBI’s constantly-updated terror watch list, as opposed to the FAA’s impartial list. (See item 13)

• An Associated Press report Wednesday detailed steps being taken by Border Control and rescue personnel to prepare for the apprehension and rescue of illegal immigrants crossing the border often unprepared for the cold winter. In the past four years, the Border Control has recorded 27 deaths directly attributed to cold weather in its Tucson section alone. Agents carry emergency bags with blankets, rehydrants and other equipment, and specially trained search, rescue and trauma agents are ready treat hypothermia victims being transported for medical assistance. (See item 25)

Information Technology

26. November 28, IDG News Service – (National) Lotus Notes vulnerable to e-mail attack. A serious bug in IBM’s Lotus Notes software could be used by attackers to run unauthorized software on a victim’s PC, researchers at Core Security Technologies reported Tuesday. The flaw lies in the Autonomy KeyView software used by Lotus Notes to process Lotus 1-2-3 files. Core’s researchers found that when they opened a specially crafted Lotus 1-2-3 e-mail attachment in Lotus Notes, they could run unauthorized software on the PC. Although details of the flaw have not been published, and it has not been picked up by online criminals, it would not be hard for a determined attacker to write code that exploited the flaw, said Core’s chief technology officer. That’s because there have already been a number of similar KeyView bugs found this year, so sample exploit code for similar flaws can easily be found. “Previously there have been other flaws like this published for the same software development kit,” he said. “So anyone keeping track of that could write an exploit pretty quickly.” In the past year, security researchers have increasingly focused on these kinds of vulnerabilities, called file parsing bugs. Improvements in hacking software, called fuzzers, which send a barrage of data to programs in order to see if they can be made to act in unexpected ways, have made this type of research easier. The flaws researchers have found over the past two years involving file parsing bugs affect every major antivirus vendor, and many of them could allow attackers to run unauthorized code on a victim’s system, they say.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9049439&intsrc=hm_list

27. November 27, Computerworld – (Texas; International) Man indicted for allegedly emailing bomb threats to Texas airport. A grand jury in McAllen, Texas, indicted a U.S. citizen living in Mexico for allegedly e-mailing in bomb threats to an airport in McAllen. According to an affidavit, four different bomb threats were sent to the McAllen Miller International Airport online message board. Two of the threats, which were written in Spanish, were sent on August 22, and the other two were sent September 7 and September 10. All four threats were e-mailed in and used fake return email addresses. No bombs or explosives were found at the airport, according to the U.S. Department of Justice (DOJ). The DOJ contends that in the threat sent on September 7, the man demanded that airport workers deliver $20,000 to the reception desk area of a Holiday Inn hotel, but no one approached the hotel’s reception desk to claim the money. The man faces a maximum sentence of five years in prison and a $250,000 fine for each count.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9049263&taxonomyId=17&intsrc=kc_top

28. November 26, Associated Press – (National) Heavy online shopping traffic causes Yahoo outages. The online holiday shopping blitz known as “Cyber Monday” proved to be too much to handle for Internet bellwether Yahoo Inc. The heavy traffic triggered computer outages that prevented sales from being completed at thousands of Web sites that depend on an e-commerce service offered by Sunnyvale, California-based Yahoo. The trouble began around 8:30 a.m. Pacific Standard Time Monday morning and continued into the early afternoon. The problems affected more than half of the roughly 40,000 sites that subscribe to Yahoo’s e-commerce service.
Source:
http://extra.examiner.com/linker/?url=http%3A%2F%2Fcbs5%2Ecom%2Flocal%2FYahoo%2Ee%2Ecommerce%2E2%2E596040%2Ehtml

Communications Sector

29. November 28, Computerworld – (International) Report: Cell phone explosion may have killed man. Police in Cheongwon, South Korea, said a worker died Wednesday possibly because a cell phone battery exploded in his pocket, according to a report from the Associated Press. The report quotes an unnamed police official as saying, “We presume that the cell phone battery exploded,” but the official spoke on the condition of anonymity because the investigation is ongoing. The man was identified only as Suh, and was found dead at his workplace in a quarry Wednesday morning with a melted cell phone battery in his shirt pocket, according to the report. The AP quoted the Yonhap news agency as saying Suh’s body was examined by a doctor who said that Suh suffered a burn in the left chest area and had a broken spine and ribs. “It is presumed that pressure caused by the explosion damaged his heart and lungs, leading to his death,” the report quotes the doctor as saying. South Korea’s LG Electronics Inc. reportedly made the phone involved in the death, although the report quoted an LG official who said that a fatal explosion from the phone or its battery would be virtually impossible. An LG spokeswoman said the company is investigating the report and would only confirm that the phone is not sold in the U.S.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=networking_and_internet&articleId=9049579&taxonomyId=16

Wednesday, November 28, 2007

Daily Report

• As reported by The Associated Press, delegates from more than 40 nations pledged Tuesday to boost information exchanges on food safety and outbreaks of contamination in response to growing concern about the overall security of the global supply chain. The agreement came at the conclusion of a two-day international food safety conference in Beijing. (See items 15)

• According to WIVB News in Buffalo, New York, two area residents in need of medical care waited at least 19 minutes for ambulances to arrive Monday night, because all the ambulances were busy on other calls at area hospitals. Emergency officials say the whole system needs to be re-examined. Officials say calling 9-1-1 for real emergencies can go a long way to help the system. A local 2-1-1 hotline for non-emergency calls is being developed, but is not expected until next year at the earliest. (See item 23)

Information Technology

24. November 27, Computerworld UK – (International) ‘Man in the browser’ is new threat to online banking. Criminals infecting PCs with malware that is only triggered when they access their bank accounts are the latest threat to online banking, according to security software supplier F-Secure. Perpetrators act as a ‘man in the browser’ by intercepting HTML code in the Web browser. As bank security measures curb more traditional threats such as keystroke logging, phishing and pharming, F-Secure warned, the ‘man in the browser’ attacks will increase. Once a user’s PC is infected, the malicious code is only triggered when the user visits an online bank. The ‘man in the browser’ attack then retrieves information, such as logins and passwords, entered on a legitimate bank site. This personal data is sent directly to an FTP site to be stored, where it is sold to the highest bidder. Security products using behavioral analysis were the best solution against such attacks, because the malware was only distributed to the users of specific banking sites the chief research officer at F-Secure. This meant anti-malware software vendors were unlikely to be able to quickly release code to tackle all the new threats. Following the enhancements that banks have made to authentication on their sites, “phishing attacks are becoming less and less effective and attacks of the ‘Man in the Browser’ are set to increase,” he warned.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9049080&taxonomyId=17&intsrc=kc_top

25. November 27, Computerworld – (National) Mozilla patches overdue Firefox protocol handler bug. Mozilla Corp. on Monday patched six vulnerabilities in Firefox, including a flaw that gained notoriety because it went unfixed for most of the year. Firefox 2.0.0.10, the ninth security update to the open-source browser this year, patched two bugs associated with the jar: uniform resource identifier (URI) protocol handler. The original flaw was reported in early February, but work on a fix languished until three weeks ago, when a U.K. researcher reported that applications that allow uploading of jar or Zip files are vulnerable to cross-site scripting attacks. Cross-site scripting vulnerabilities are most often used by identity thieves and malware authors to steal passwords or spread malicious code. Days later, another researcher upped the ante and produced exploit that combined the jar: vulnerability with a separate bug in Google Inc.’s Gmail to let him access another user’s Web e-mail address book. Firefox 2.0.0.10 also fixed a flaw that could be used to launch cross-site request forgery attacks, which inject malicious commands into legitimate Web sites. Additionally, Mozilla said it patched three unspecified memory corruption bugs that posed immediate stability problems -- in some situations they could cause the browser to crash -- and might be exploitable enough to create attack opportunities. The new version of the browser can be downloaded from Mozilla in versions for Windows, Mac OS X and Linux. Current Firefox users should be notified of 2.0.0.10’s availability in the next day or two by the browser’s automatic update tool.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9049078&taxonomyId=17&intsrc=kc_top

Communications Sector

26. November 26, TMCnet – (National) U.S. broadband infrastructure to reach maximum capacity by 2010. Nemertes Research recently predicted that the broadband infrastructure in the United States will reach maximum capacity by 2010. The study says that the system will collapse because of this overload, but, more importantly, says the situation is inevitable unless there is a 60 to 70 percent increase in investment in broadband infrastructure. The report, titled “The Internet Singularity, Delayed: Why Limits in Internet Capacity Will Stifle Innovation on the Web”, says that, although the dynamic nature of the Internet will prevent a total breakdown, users will experience “Internet brownouts,” which are defined as periods of low connectivity speeds. According to Nemertes Research, the situation will definitely hurt innovation on the Internet -- a lack of reliability of connection speeds, will likely mean another Google or YouTube will have difficulty making inroads. The study points out that the lack of investment could be holding back the time at which the internet reaches a ‘singularity’ (a point at which accelerating change creates an unpredictable outcome, such as the Internet becoming independently sentient). Nemertes Research expects the corporate and personal demand for Internet connectivity to grow exponentially during the next two years. Nemertes estimates that the financial investment required by access providers to bridge the gap between demand and capacity ranges from $42 billion to $55 billion, or roughly 60-70 percent more than service providers currently plan to invest.
Source: http://www.tmcnet.com/voip/ip-communications/articles/15161-us-broadbandinfrastructure-reach-maximum-capacity-2010.htm

Tuesday, November 27, 2007

Daily Report

• The Washington Times reports that officials from Fort Huachuca, Arizona, the nation’s largest intelligence training center, changed security measures last May, after sources warned that possibly 60 Afghan and Iraqi terrorists were to be smuggled into the U.S. through underground tunnels with high powered weapons to attack the post. (See item 21)

• The Associated Press reports that firefighters in major cities are being trained to take on a new role as lookouts for terrorism. The Homeland Security Department is testing a program with the New York City fire department to share intelligence information so firefighters are better prepared when they respond to emergency calls. Homeland Security also trains the New York City fire service in how to identify material or behavior that may indicate terrorist activities. (See item 23)

Information Technology

26. November 25, Computerworld – (National) New QuickTime bug opens XP, Vista to attack. Security researchers warn that attack code targeting an unpatched bug in Apple Inc.’s QuickTime has gone public, and added that in-the-wild attacks against systems running Windows XP and Vista are probably not far behind. There was no word as of Sunday whether the Mac OS X versions of the media player are also vulnerable. The critical bug in QuickTime 7.2 and 7.3 (and perhaps earlier editions as well) is in the player’s handling of the Real Time Streaming Protocol, an audio/video streaming standard. According to alerts posted by Symantec Corp. and the U.S. Computer Emergency Readiness Team (US-CERT), attackers can exploit the flaw by duping users into visiting malicious or compromised Web sites hosting specially-crafted streaming content, or by convincing them to open a rigged QTL file attached to an e-mail message. Symantec credited a Polish researcher with first reporting the zero-day vulnerability on the milw0rm.com Web site Friday. By Saturday, he and another unnamed researcher had followed up with separate proof-of-concept examples that executed on Windows XP SP2 and Windows Vista machines running QuickTime 7.2 or 7.3. A successful exploit would let the attacker install additional malware -- spyware or a spambot, say -- or cull the system for information like passwords. An attack that failed would likely only crash QuickTime. A gaffe by Apple’s developers, however, makes an attack easier on Vista, said one of the researchers, who claimed that the QuickTimePlayer binary does not have Address Space Layout Randomization (ASLR) enabled. ASLR is a Vista security feature that randomly assigns data and application components, such as .exe and .dll files, to memory to make it tougher for attackers to determine the location of critical functions or vulnerable code. A Symantec analyst noted: “This makes reliable exploitation of the vulnerability a lot easier.”
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9048678&taxonomyId=17&intsrc=kc_top

27. November 23, Computerworld – (National) Once-fixed bug pops up again in Leopard’s Mail. Apple Inc. reintroduced a critical vulnerability in Leopard, the newest version of Mac OS X, that it had patched more than 20 months ago in Tiger, security experts said last week. Attackers can use the new-old vulnerability to hide malicious code in seemingly harmless file attachments and get Apple Mail to run the malware without warning the user, as it is designed to do, said Symantec in a warning to customers of its DeepSight threat management service. The Heise Security Web site first noted the returned flaw and said attackers could disguise their code as a benign file – a JPG image file, for example -- then exploit the file’s “resource fork” to launch Terminal, the Mac OS X command line interface, which in turn would run a camouflaged code. The site even produced a harmless proof-of-concept e-mail attachment that demonstrated an exploit of the bug. “The bug causing this has to do with the way Leopard manages [download] quarantines,” Intego said in an alert. “The first time a user opens an attachment, Mail opens the file directly without passing through the quarantine system.” Until Apple fixes Leopard, Symantec told users to use caution when handling e-mail attachments received in Mail.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9048638&taxonomyId=17&intsrc=kc_top

Communications Sector

28. November 24, Reuters – (International) EU agrees to public funding for satellite project. European Union nations clinched a deal late on Friday to fund an ambitious satellite navigation project to rival the U.S. Global Positioning System using unspent cash from the EU budget, a presidency spokesman said. The Portuguese spokesman said budget ministers agreed to finance a 2.4 billion euro ($3.55 billion) shortfall in start-up costs of the Galileo system by redeploying unspent money for farm subsidies and competitiveness projects. The EU executive warned it would have to drop the prestigious industrial project if there was no agreement among member states on public funding by the end of this year. Supporters say it is a vital technological platform for Europe, but critics say it could be a costly white elephant because the U.S. system already has a dominant market position and Russia and China are working on their own systems.
Source: http://www.news.com/EU-agrees-to-public-funding-for-satellite-project/2100-1032_3-6219990.html?tag=nefd.top

29. November 24, RCR Wireless News – (National) Katrina decision could cost industry millions. The mobile-phone and tower sectors could take a significant financial hit as a result of a new Federal Communications Commission (FCC) mandate requiring backup power sources at key facilities. The FCC rule, which industry sources claim could cost wireless carriers hundreds of millions of dollars to implement, flows from recommendations of the Independent Panel Reviewing the Impact of Hurricane Katrina on Communications Networks. The FCC softened the blow to industry somewhat by giving carriers six months to conduct inventories to determine which assets comply with the new guidelines and which either do not comply with the backup power rule or are precluded because of safety reasons and conflicts with federal, state or tribal laws. Carriers with wireless facilities covered by the new rule, but not in compliance, must rectify the situation, or file an action plan within 12 months on how they intend to meet new federal requirements. The FCC said it does not regard the reporting requirements as overly burdensome, but the cellular and tower industries call them brutal. It is even questionable whether compliance is reasonably achievable under terms laid out by the FCC, given physical and practical limitations related to the amount of space at sites and the need to modify structures with cell transmitters. The wireless industry argues roofs of some structures are not tall enough to accommodate requirements of the backup power rule and floors may be unable to support added weight of new generators. Moreover, the introduction of hazardous materials (gas, diesel, propane, batteries) associated with backup power sources could be prohibited in some leases involving cell sites on private and public property.
Source: http://www.rcrnews.com/apps/pbcs.dll/article?AID=/20071124/SUB/71124015/1005

Monday, November 26, 2007

Daily Report

• · Bloomberg reports that Suez SA, the French energy and water group planning to merge with Gaz de France SA, wants to own and operate “third-generation” nuclear reactors by 2020 and is studying atomic energy expansion in Europe, the Middle East and the U.S. The Paris-based group already operates two nuclear plants in Belgium with a total of seven reactors through its Electrabel SA unit. (See item 6)

• · The Associated Press reports that Southern California’s major water wholesaler announced plans to buy billions of gallons of water from farmers in the state to make up for a shortfall left by drought and restrictions on pumping out of the Delta. The water is being brokered by the state Department of Water Resources, which will look to farmers to voluntarily offer parts of their water supply for sale. (See item 21)

Information Technology

27. November 23, TechWorld.com – (National) Researcher releases proof-of-concept VoIP hack. An expert has released a proof-of-concept program to show how easy it would be for criminals to eavesdrop on the VoIP-based phone calls of any company using the technology. Called SIPtap, the software is able to monitor multiple Voiceover- IP (VoIP) call streams, listening in and recording them for remote inspection as .wav files. All that the criminal would need would be to infect a single PC inside the network with a Trojan incorporating these functions, although the hack would work at ISP level as well. The program can index ‘IP-tapped’ calls by caller -- using SIP identity information -- and by recipient, or even by date. Running from August this year until the most recent tap on November 21st, SIPtap had no problems in extracting enough information on the test network to prove that call recording of any and every VoIP call at a hypothetical company was now a trivial exercise. SIPtap demonstrates that the worst-case nightmares of VoIP vulnerability are now well within the capabilities of organized crime, which could use such a program to steal confidential data from companies, governments and even the police. The demonstrator, a UK-based VoIP expert, said “the threat is that an attacker engineers a Trojan and has it sit there passively [on a network], recording calls from anywhere on the Internet.” His advice was simple. “Apply the same vigor when building a VoIP network you would when building a Web site.”
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048618&intsrc=hm_list

28. November 22, Reuters – (International) Skype encryption stumps German police. German police are unable to decipher the encryption used in the Internet telephone software Skype to monitor calls by suspected criminals and terrorists, Germany’s top police officer said on Thursday. Skype allows users to make telephone calls over the Internet from their computer to other Skype users free of charge. Law enforcement agencies and intelligence services have used wiretaps since the telephone was invented, but implementing them is much more complex in the modern telecommunications market where the providers are often foreign companies. “The encryption with Skype telephone software ... creates grave difficulties for us,” said the president of Germany’s Federal Police Office (BKA) at an annual gathering of security and law enforcement officials. “We can’t decipher it. That’s why we’re talking about source telecommunication surveillance -- that is, getting to the source before encryption or after it's been decrypted.” Experts say Skype and other Voice over Internet Protocol (VoIP) calling software are difficult to intercept because they work by breaking up voice data into small packets and switching them along thousands of router paths instead of a constant circuit between two parties, as with a traditional call. The police rep said they were not asking Skype to divulge its encryption keys or leave “back doors open” for German and other country’s law enforcement authorities. “There are no discussions with Skype. I don’t think that would help,” he said, adding that he did not want to harm the competitiveness of any company. He said there was a vital need for German law enforcement agencies to have the ability to conduct on-line searches of computer hard drives of suspected terrorists using “Trojan horse” spyware. These searches are especially important in cases where the suspects are aware that their Internet traffic and phone calls may be monitored and choose to store sensitive information directly on their hard drives without emailing it. Spyware computer searches are illegal in Germany.
Source:
http://news.yahoo.com/s/nm/20071122/wr_nm/security_internet_germany_dc;_ylt=AncWQ6lt4vFTvWGNmcTWN876VbIF

Communications Sector

29. November 22, Reuters – (International) Skype encryption stumps German police. German police are unable to decipher the encryption used in the Internet telephone software Skype to monitor calls by suspected criminals and terrorists, Germany’s top police officer said on Thursday. Skype allows users to make telephone calls over the Internet from their computer to other Skype users free of charge. Law enforcement agencies and intelligence services have used wiretaps since the telephone was invented, but implementing them is much more complex in the modern telecommunications market where the providers are often foreign companies. “The encryption with Skype telephone software ... creates grave difficulties for us,” said the president of Germany’s Federal Police Office (BKA) at an annual gathering of security and law enforcement officials. “We can’t decipher it. That’s why we’re talking about source telecommunication surveillance -- that is, getting to the source before encryption or after it’s been decrypted.” Experts say Skype and other Voice over Internet Protocol (VoIP) calling software are difficult to intercept because they work by breaking up voice data into small packets and switching them along thousands of router paths instead of a constant circuit between two parties, as with a traditional call. The police rep said they were not asking Skype to divulge its encryption keys or leave “back doors open” for German and other country’s law enforcement authorities. “There are no discussions with Skype. I don’t think that would help,” he said, adding that he did not want to harm the competitiveness of any company. He said there was a vital need for German law enforcement agencies to have the ability to conduct on-line searches of computer hard drives of suspected terrorists using “Trojan horse” spyware. These searches are especially important in cases where the suspects are aware that their Internet traffic and phone calls may be monitored and choose to store sensitive information directly on their hard drives without emailing it. Spyware computer searches are illegal in Germany.
Source:
http://news.yahoo.com/s/nm/20071122/wr_nm/security_internet_germany_dc;_ylt=AncWQ6lt4vFTvWGNmcTWN876VbIF

Friday, November 23, 2007

Daily Report

• The Daily Press reports that the Nuclear Regulatory Commission gave the Virginia-based Dominion power plant the permit to build a new power plant next to its existing North Anna reactors. The construction will be the first new nuclear power plant in the country since the Three Mile Island disaster in 1979. (See item 6)

• The Associated Press reports that the nation’s oldest subways are in dire need of repairs and upgrades. Transit officials say problems abound in subway systems in New York City (the nation’s largest), Boston, Washington, D.C., and, most of all, Chicago. (See item 11)

Information Technology

25. November 21, IDG News Service – (National) Firefox plans bug fix release for next week. Mozilla plans to release a bug fix for its Firefox browser next week, repairing a long-standing security flaw in the software. The 2.0.0.10 update is in testing right now and should be released to the public next week, following the Thanksgiving holiday in the U.S. “We are giving it a couple of days to make sure that there are no issues found and we’ll release it after Thanksgiving,” said Mozilla’s vice president of engineering. Mozilla is calling on the Firefox community to test the browser during a quality assurance “testday” this Friday. The issue was first reported last February, but it gained widespread attention earlier this month when another prominent researcher pointed out on his blog that the flaw could be used to launch a cross-site scripting attack against the Firefox browser. The flaw has to do with the fact that Firefox does not properly check files that are compressed using the .jar (Java Archive) format. Attackers could sneak malicious code into the Jar-compressed documents, which would then be run by the victim. Shortly thereafter, yet another researcher showed how this attack could be launched against Google users, giving them access to victims’ Gmail accounts, Google searches and other sensitive data stored on the Google Web site. Though both vulnerabilities are related to the way Firefox handles .jar files, Mozilla considers them to be two separate issues, both of which are set to be patched in next week’s 2.0.0.10 release.
Source: http://www.infoworld.com/article/07/11/21/Firefox-plans-bug-fixrelease_1.html

26. November 20, Computerworld – (National) Are XP, Vista vulnerable to random number generator attack? The flaw in Windows 2000’s random number generator uncovered by Israeli researchers is a vulnerability -- but not a security vulnerability, Microsoft Corp. said late last week, as it left users wondering if newer versions of the operating system shared the same problem. In a paper published earlier this month, a professor from the University of Haifa and two Hebrew University graduate students described how attackers could exploit a weakness in Windows’ pseudo-random number generator (PRNG) to predict encryption keys generated by the operating system and its applications. After reverse-engineering the algorithm used to power the PRNG, they found that they could easily predict its future results and reveal what it had produced in the past. They could then compute both future and previously used encryption keys. The past was most important. “For you as a user, it means that if you are managing sensitive information today, it is not enough for you to verify that your computer hasn’t been compromised in the past,” said the group’s leader Monday. “You should also worry about future attacks, since a compromise in the future might reveal the sensitive information used today.” “In the security world, this is called an attack on ‘forward secrecy,’ and is taken very seriously,” he added for emphasis. Microsoft acknowledged that the PRNG has a “local information disclosure vulnerability,” though in a recent statement the company’s security response communications manager said “there is no security vulnerability.” “Information is not disclosed inappropriately to unauthorized users on any supported Windows systems. In all cases discussed in the claim, information is visible only to the users themselves or to another user logged on to the local system with administrator credentials,” he said. Symantec Corp. issued a low-level alert for it Tuesday to customers of its DeepSight threat network, calling it a design error.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9048198&taxonomyId=17&intsrc=kc_top

27. November 20, Computerworld – (New Jersey; National) Commerce Bank breached – don’t tell. Commerce Bank of Cherry Hill, New Jersey, has notified an unspecified number of its 3 million customers of a recent data breach involving the potential compromise of their personal data. In an e-mailed statement to a query regarding the incident, a Commerce Bank spokesman only confirmed that a “security matter” had taken place recently that impacted “only a small segment” of its three million customers. Without referring to what happened, the statement said that immediate actions had been taken to address “this matter,” including an extensive internal investigation by the bank’s corporate security team as well as notification about the incident to federal and state law enforcement authorities. The email alluded to a letter sent by the bank to the affected customers, but did not say what information on them might have been compromised in the incident. “If customers did not receive a specific letter regarding this incident there is no need for them to be concerned,” the statement said. Local media reports suggested that the compromise resulted when a bank employee apparently handed over customer information such as Social Security numbers and account information to an external third party. There was no indication, however, whether that happened inadvertently or was the result of a malicious action on the part of the employee. One blogger on LiveJournal, who claimed to be a customer of the bank, said that a Commerce Bank representative had told her about 3,000 people had been affected in the incident. Commerce was targeted by hackers earlier in the year. According to reports earlier in the fall, the bank was able to deflect most of a hacking attempt on its database, but not before some customer information was divulged.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9048278&taxonomyId=17&intsrc=kc_top

Communications Sector

28. November 20, IDG News Service – (National) FCC awards spectrum to public safety group. The U.S. Federal Communications Commission (FCC) has awarded the license for 10 MHz of valuable wireless spectrum to a public safety organization in anticipation of the spectrum being used to build out a nationwide emergency communications network. The FCC yesterday awarded the license for the spectrum in the 700-MHz band to the Public Safety Spectrum Trust Corp. (PSST), a nonprofit organization with representatives from several public safety groups, including the International Association of Chiefs of Police, the International Association of Fire Chiefs and the National Sheriffs’ Association. The 10 MHz awarded to the PSST will be combined with an adjacent 10 MHz of spectrum that will be auctioned in early 2008, with the winning bidder required to create a nationwide wireless network for both public safety agencies and commercial use. The FCC award to the PSST was expected. The PSST was the only applicant for the nationwide license. The group will negotiate a network-sharing agreement with the winning bidder on the adjacent 10 MHz of spectrum, and it will administer usage fees for the nationwide network. The organization will also review requests for early build-outs and will manage public safety access to the commercial portion of the spectrum during emergencies, according to the FCC. The PSST spectrum is part of a chunk of spectrum being abandoned by U.S. television stations after Congress in late 2005 required them to move to all-digital broadcasts by early 2009. Several lawmakers and groups pushed for part of the spectrum to be used for an emergency communications network. During the September 11 terrorist attacks, and in more recent disasters, emergency response agencies found they couldn’t talk to one another because they were using a variety of equipment on different spectrum bands.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9048180&taxonomyId=17&intsrc=kc_top

Wednesday, November 21, 2007

Daily Report

• Reuters reports that UK officials have confirmed a second outbreak of bird flu in as many weeks. An agriculture ministry spokesperson said all the turkeys at the site have been culled, a new protection zone had been established around the second farm, and the surveillance zone had been extended. (See item 20)

• IDG News Service reports that, according to a new study by the independent Nemertes Research Group, rapidly expanding consumer and corporate use of the Internet could overwhelm current capacity and lead to Internet brown-outs by 2010 unless backbone providers invest up to $137 billion in new capacity, more than double what service providers plan to invest. (See item 28)

Information Technology

25. November 20, Network World – (National) Hackers poised for Black Friday assault. Security researchers say hackers are poised to launch a slew of Web-based attacks against consumers. “The holiday season in general is a huge time for hackers ... [and] Black Friday is typically the start,” says the vice president of strategic accounts for Secure Computing. “This year, my biggest concern for consumers is all the Web-borne malware out there.” Black Friday, the day after Thanksgiving, is followed in marketing lingo by Cyber Monday. Both are big days for retailers and online fraudsters. Consumers should watch out for e-mails advertising incredible deals that seem too good to be true. “Freebies may be freebies in the sense that you get free malware,” says a senior threat researcher at Trend Micro. A common scam is to pick the hot toy of the season and send out a spam e-mail blast offering it for much less than the typical price, one researcher said. Victims end up entering credit card information on malicious sites designed to look like well-known, trusted ones. They might also unknowingly download a keylogger that can steal personal information people type in when making any kind of Internet transaction. “Be leery of sites being advertised [in e-mail that might be spam]. In all likelihood you’re being directed to a malware-connected site,” he said. “Do not click on URLs within e-mails even for well-known public sites.” In an HTML e-mail, it is a trivial task for hackers to hide the real URL a victim is clicking on. “It might say ‘ebay.com,’ but you’re actually clicking on something entirely different,” he says. In addition to being wary of e-mails, be careful when searching for holiday deals or specific products on Google and other search engines. Operators of malicious sites have figured out ways to rise to the top of search listings, researchers warn.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048038&intsrc=hm_list

26. November 20, Computerworld – (National) Hackers jack Monster.com, infect job hunters. Monster.com took a portion of its Web site offline Monday as researchers reported that it had been compromised by an IFrame attack and was being used to infect visitors with a multi-exploit attack kit. According to Internet records, the Russian Business Network (RBN) hacker network may be involved. Parts of the Monster Company Boulevard, which lets job hunters search for positions by company, were unavailable Monday; by evening, the entire section was dark. Most major American companies are represented on the site. Job seekers who used Monster’s by-company directory on Monday before the site was yanked were exposed to Neosploit, an attack tool kit similar to the better-known Mpack, said the chief technology officer at Exploit Prevention Labs Inc. The injection of the malicious IFrame code into the Monster.com site probably happened Monday, he added. Like many other IFrame exploits, this one silently redirected the user’s browser to another site hosting Neosploit. In the case of at least one of the exploit sites the researcher identified, there is a connection to the notorious RBN, the hacker and malware hosting network that recently shifted operations to China, then mysteriously abandoned the IP blocks it had acquired in China, seemingly vanishing from the Internet.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048019&intsrc=hm_list

Communications Sector

27. November 20, IDG News Service – (Ohio; National) ‘Swatters’ tricked AT&T while making fake 911 calls. A Cleveland, Ohio, man has pled guilty to participating in a scheme that involved using AT&T employee passwords and identities to place false 911 calls to emergency dispatch centers. The man is facing up to five years in prison and a $250,000 fine after pleading guilty to charges of harassing people by tricking 911 operators into dispatching police SWAT (Special Weapons And Tactics) teams to the homes of unsuspecting victims. He was part of a group of about 15 to 20 people who met in chat rooms and telephone party lines to exchange information on how to conduct their attacks, according to court documents. The Ohio man is considered the lead defendant in a federal case against members of the group. Two other members have pled guilty, and two others are still facing trial. Virtually unknown until recently, “swatting” gained national attention last month when a 19 year-old was arrested after allegedly dispatching a SWAT team to the home of an unsuspecting couple in Orange County, California. That incident cost county officials nearly $20,000. On Friday, the 19-yearold pled not guilty to charges stemming from the March 29 incident. He is not believed to be connected with the other ‘swatter’ group, which has been connected to about 60 incidents, including one in January 2007, according to a detective with the Snohomish County Sherriff’s Office in Washington State.
Source:
http://www.infoworld.com/article/07/11/20/Swatters-tricked-ATT-while-making-fake-911-calls_1.html

28. November 19, IDG News Service – (National) Study: Internet could run out of capacity in two years. Consumer and corporate use of the Internet could overwhelm the Internet’s current capacity and lead to brown-outs by 2010 unless backbone providers invest up to $137 billion in new capacity, more than double what service providers plan to invest, according to a study by Nemertes Research Group, an independent analysis firm. In North America alone, backbone investments of $42 billion to $55 billion will be needed in the next three to five years to keep up with demand, Nemertes said. The study is the first to “apply Moore’s Law (or something very like it) to the pace of application innovation on the ‘Net,’” the study says. “Our findings indicate that although core fiber and switching/routing resources will scale nicely to support virtually any conceivable user demand, Internet access infrastructure, specifically in North America, will likely cease to be adequate for supporting demand within the next three to five years.” The study confirms long-time concerns of the Internet Innovation Alliance (IIA), an advocacy group focused on upgrading U.S. broadband networks, said the group’s cochairman. The study gives “good, hard, unique data” on the IIA concerns about network capacity, he said. The Nemertes study suggests demand for Web applications like streaming and interactive video, peer-to-peer file transfers, and music downloads will accelerate, creating a demand for more capacity.
Source: http://www.infoworld.com/article/07/11/19/Internet-could-run-out-of-capacity-in-twoyears_1.html

Tuesday, November 20, 2007

Daily Report

• According to the Chicago Tribune, an apparent miscommunication Saturday between airtraffic controllers at a radar facility near Chicago caused two private planes flying incentral Wisconsin to pass closer than federal regulations allow. This is the second nearmiss error attributed to the facility in less than a week. (See item 12)

• The Associated Press reported that a group representing the cattle industry filed an emergency request Friday in U.S. district court seeking to block the rule that was set to permit Canadian cattle over 30 months of age into the U.S. market starting Monday. More than two dozen nations suspended U.S. beef imports in 2003 after mad cow disease was found in a U.S. cow imported from Canada. (See item 16)

Information Technology

25. November 18, Computerworld – (National) Mozilla to fix 9-month-old Firefox bug as concerns grow. Mozilla Corp. will patch Firefox against a nine-month-old protocol handler bug, its chief security executive announced Friday, after researchers demonstrated that the vulnerability was more serious than first thought. The bug is another uniform resource identifier (URI) protocol handler flaw, and the news of an impending fix comes on the heels of Microsoft patching Windows to repair problems in the handlers it registers. Protocol handlers – “mailto:” is among the most familiar – let browsers launch other programs such as an e-mail client through commands embedded in a URL. But Firefox’s jar: protocol handler (the “.jar” extension stands for Java ARchive, a Zip-style compression format) does not check that the files it calls are really in that format. Attackers can exploit the flaw by uploading any content – malicious code, for example, or a malformed Office document -- to a Web site, then entice users to that site and its content with a link that includes the jar: protocol. Because the content executes in the security context of the hosting site, if that site (e.g., a commercial photosharing service) is trusted, then the malicious code runs as trusted within the browser, too. This cross-site scripting vulnerability was discovered in February and reported to Mozilla’s Bugzilla database early that month. But over the last two weeks, two more researchers demonstrated the danger of the vulnerabilities -- one of which allowed the researcher to access another user’s Gmail contacts list -- leading Mozilla to take action. According to Mozilla’s head of security strategy, the vulnerabilities “will be addressed in Firefox 2.0.0.10, which is currently in testing.” Until Mozilla patches the browser, users can block jar:-based cross-site scripting attacks with the newest version of NoScript.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9047658&pageNumber=1

26. November 17, IDG News Service – (National) Senate OKs restitution for cybercrime victims. The U.S. Senate has passed a bill that would allow victims of online identity theft schemes to seek restitution from criminals and expands the definition of cyberextortion. The Senate passed the Identity Theft Enforcement and Restitution Act by unanimous consent last week. The bill allows victims of identity theft to seek restitution for the time they spend to fix the problems. The bill would allow prosecutors to go after criminals who threaten to take or release information from computers with cyberextortion, and it would allow prosecutors to charge cybercriminals with conspiracy to commit a cybercrime. Current law only permits the prosecution of criminals who seek to extort companies or government agencies by explicitly threatening to shut down or damage a computer. The bill would also make it a felony to use spyware or keystroke loggers to damage 10 or more computers, even if the amount of damage was less than US$5,000. In the past, damage of less than $5,000 was a misdemeanor. The legislation, among other things, would also allow the federal prosecution of those who steal personal information from a computer even when the victim’s computer is in the same state as the attacker’s computer. Under current law, federal courts only have jurisdiction if the thief attacks from another state.
Source:
http://news.yahoo.com/s/pcworld/20071117/tc_pcworld/139757;_ylt=AjUvZd8x3m8PXfqjjdKHSEwjtBAF

27. November 16, Computerworld – (National) Storm botnet spreading malware through GeoCities. Storm, the botnet-building Trojan horse, has come up with another twist to dupe users into infecting their PCs with malware, a security researcher said Friday. Longtime clients of the Russian Business Network (RBN), a notorious hacker- and malware-hosting network that mysteriously vanished last week after shifting operations from St. Petersburg, Russia, to Shanghai are involved in the attack, said Trend Micro Inc.’s network architect. Thursday, Trend watched as existing bots controlled by Storm were seeded with new spam templates that included links to sites on GeoCities, the free Web hosting service owned by Yahoo Inc. Friday, Storm kicked off the new attacks. “This has developed into a full-fledged attack vector,” he said. The GeoCities sites are infected with malicious JavaScript code that redirects the user’s browser to secondary URLs hosted in Turkey, he said. The Turkish URLs, meanwhile, try to persuade the user to download a new codec that is supposedly necessary to view images on the GeoCities sites. According to Trend Micro’s analysis, the bogus codec -- which claims to be for the 360-degree IPIX format -- is actually an identity- and information-stealing piece of malware. Fake codecs have become the latest choice of hackers, with several notable attacks recently relying on users’ naiveté about what a codec is, why it might be necessary and why they can be untrustworthy.
Source:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9047483&taxonomyId=17&intsrc=kc_top

Communications Sector

28. November 19, Associated Press – (Iowa) Rogue cell phone dials 911 - again, and again and again. A rogue cell phone is not accepting calls, but it sure likes to dial 911 operators in eastern Iowa. Operators at the Black Hawk County Consolidated Communications Center said that they received about 400 calls from the same cell phone last week and that no one seems to be on the other line. “It will ring in, and it’s an open line. Sometimes it rings in and drops off,” said a dispatcher. Officials can’t locate the phone but have figured out that it is an old line not currently associated with a cell phone provider. Such phones, once charged up, can still place 911 calls under Federal Communications Commission rules set in 1994. The cell phone can’t receive calls, and emergency workers haven’t been able to track the owner through service records, either. “With this, we are pretty helpless,” said the center’s administrative supervisor. Officials are suspicious that it could be a prank - but they say it is not funny and potentially dangerous. Until the source of the calls is found or they stop, dispatchers still have to answer every call just in case someone is on the line with an emergency.
Source: http://www.azcentral.com/offbeat/articles/1119roguecell19-ODD.html

29. November 19, Multichannel News – (California) Handling California’s wildfires. Cable-system operators needed to keep in touch with widely dispersed, evacuated customers during recent wildfires in California. Service providers also had to assist neighborhoods in recovery efforts. They responded with an assortment of quick actions. Time Warner Cable’s L.A. South division contacted a local Rent-A-Center, which donated six big screen televisions to deliver video service at the National Orange Show Grounds in San Bernardino. A “Surf Shack” vehicle, normally used to market video, data and phone services, provided communications services to 3,000 evacuees. Charter Communications culled billing records to send a targeted e-mail to ZIP codes in Lake Arrowhead. Displaced residents could log onto charter.net from anywhere and find out when service had returned and to check billing credits. When fires cut off video and Internet service from its backbone on one side of a mountain, Internet service was routed through telephone cables on the other side. Time Warner Cable in San Bernardino also provided broadcast signals via the Charter phone lines. Cox Cable Orange County quickly wired the El Toro High School evacuation center. Phone numbers of destroyed homes were reserved for 18 months, for families who had to rebuild or repair homes. Email addresses will also be maintained. Forwarding of calls to cell phones was made free, for the displaced. Cox also wired eight evacuation centers in San Diego, offering free long-distance calls to fire victims to the U.S. and Mexico.
Source: http://postproduction.digitalmedianet.com/articles/viewarticle.jsp?id=236836