Friday, November 13, 2009
Complete DHS Daily Report for November 13, 2009
Daily Report
Top Stories
Bloomberg reported that Brazil’s integrated electricity grid leaves it vulnerable to the types of outages that occurred this week, when 40 percent of the country was plunged into darkness, according to a government energy research agency. As many as 70 million people lost power on the night of November 10. (See item 2)
2. November 12, Bloomberg – (International) Brazil agency says power grid vulnerable to outages. Brazil’s integrated electricity grid leaves it vulnerable to the types of outages that occurred this week, when 40 percent of the country was plunged into darkness, according to a government energy research agency. “Brazil has the largest integrated power grid in the world; it’s fantastic because it facilitates electricity transmission between regions, but the domino effect that happens when we have a problem is a major inconvenience,” said the president of Brazil’s Energy Research Agency. As many as 70 million people lost power on the night of November 10. The energy minister said wind, rain and lightning strikes on transmission lines connected to the 14,000- megawatt Itaipu hydroelectric dam probably caused the failure, which affected 18 of 26 states for as long as 3 1/2 hours. Companies including Vale SA, Gerdau SA and Petroleo Brasileiro SA reduced output because of the lack of electricity. Brazil’s Federal Prosecutor, known as MPF, said that it had opened an investigation of the outage. Itaipu and government officials have 72 hours to submit their preliminary reports, MFP said in a statement. Unlike in the U.S., which has three main regional power grids, almost all of Brazil’s electricity runs through an interconnected network. The blackout occurred because the system could not cope with the three transmission lines failing at about the same time. It was the first time that transmission from the world’s largest dam by output was forced to shut down since power began to flow from Itaipu in 1983, he added. Source: http://www.bloomberg.com/apps/news?pid=20601086&sid=assqIe.PMIRs
According to the Washington Post, China is significantly boosting its capabilities in cyberspace as a way to gather intelligence and, in the event of war, hit the U.S. government in a weak spot, U.S. officials and experts say. China apparently hopes that by concentrating on holes in the U.S. security architecture, it will collect intelligence that could help it counter the United States. (See item 42 below in Information Techology)
Details
Banking and Finance Sector
16. November 11, Reuters – (International) Feds bust hacking ring accused of stealing millions. A U.S. grand jury indicted eight foreigners on charges that they hacked a computer network used by the credit card processing company RBS WorldPay and stole more than $9 million, the U.S. Justice Department said on November 10. The group, which included people from Estonia, Russia and Moldova, was accused of compromising the data encryption used by RBS WorldPay, based in Atlanta and part of Royal Bank of Scotland, and gaining access to accounts a year ago. RBS WorldPay is one of the leading payment processing businesses globally. U.S. cybersecurity officials long have been worried about hacks into global financial networks that could harm the financial system. This indictment marked the latest in a series of cases that have highlighted the risk to such networks. The ring was charged with hacking data for payroll debit cards, which enable employees to withdraw their salaries from automated teller machines. Those accused in the case allegedly raised the limits on some cards so they could withdraw the money, the U.S. government said. More than $9 million was withdrawn in less than 12 hours from more than 2,100 ATMs around the world, the Justice Department said, adding that RBS WorldPay immediately reported the breach once it was discovered. Source: http://www.foxnews.com/story/0,2933,573670,00.html?test=latestnews
17. November 10, Rapid City Journal – (South Dakota) Attorney General warns of debit card scam. The South Dakota attorney general is warning consumers to be cautious of a scam that is targeting bank customers. Law enforcement statewide has reported complaints from consumers who have been receiving fraudulent phone calls. These calls come from individuals alleging to be an employee of either their bank or their credit card company. The consumers were told that their debit card had been compromised and were asked to provide their PIN number. Some individuals have reported unauthorized charges on their cards. Source: http://www.rapidcityjournal.com/news/article_91507b9a-ce22-11de-bef6-001cc4c002e0.html
Information Technology
39. November 12, The Register – (International) Attackers conceal exploit sites with Twitter API. Drive-by exploit writers have been spotted using a popular Twitter command to send web surfers to malicious sites, a technique that helps conceal the devious deed. The microblogging site makes application programming interfaces (APIs) such as this one available so legitimate websites can easily plug into the top topics being tweeted. As the concerns and opinions of Twitter users change over time, so too will the so-called top 30 trending topics. But it turns out that the API for generating the never-ending stream of keywords is being used by miscreants, too. According to a researcher, it’s being added to heavily obfuscated redirection scripts injected into compromised websites. The scripts, which redirect victims to drive-by sites that attempt to exploit unpatched vulnerabilities in programs such as Apple’s QuickTime, use the second letter of a trending topic to arrive at a secret code that’s a key ingredient in determining the contents of the domain. The top term “Jedward” from a few days ago, for instance, becomes ghoizwvlev.com. Other domain names generated this month included abirgqvlev.com, fgxhzgvlev.com and abxhcgvlev.com. Source: http://www.theregister.co.uk/2009/11/12/attackers_use_twitter_command/
40. November 12, The Register – (International) Win 7 remote kernel crasher code released. Microsoft has reportedly begun investigating a potentially nasty denial of service vulnerability affecting Windows 7. A security bug in windows 7 and Windows 2008R2 makes it possible to lock up affected systems. The crash would happen without a Blue Screen of Death or other visible indication that anything was amiss. The system freeze can be triggered remotely by sending malformed packets to targeted systems - specifically a NetBIOS (Network Basic Input/Output System) header that specifies an incoming Server Message Block (SMB) packet is either four bytes smaller or larger than it actually is. SMB is a network protocol used to provide shared access to files and printers. Proof of concept code was posted by a white hat security researcher in a blog entry on November 11. “Whatever your firewall is set to, you can get remotely smashed via IE or even via some broadcasting nbns tricks, [with] no user interaction,” he writes. While it might be used to knock over targeted systems, there’s no evidence that the latest flaw lends itself to code injection, a far more serious type of problem. News of the bug broke a day after Microsoft’s regular Patch Tuesday updates came and went. Source: http://www.theregister.co.uk/2009/11/12/win7_kernel_crasher/
41. November 11, DarkReading – (International) iPhone targeted yet again. European researchers discovered the so-called iPhone/Privacy.A malware, which targets jailbroken iPhones and iTouch handsets, via a wireless network. Jailbroken devices are disabled such that the user can run code or apps on the device that are not “signed” by Apple. The hacking tool can copy the user’s email, contacts, SMS text messages, calendar, photos, music, video, and other data gathered by an iPhone app, according to Intego, the security firm that discovered it, and the victim would have no idea his iPhone was hacked. The attacker would run the tool on a desktop or laptop machine and be able to identify and break into a jailbroken iPhone or iTouch via WiFi or via the same mobile network. “I haven’t seen anything like this before...that’s automated to remotely log into the device wirelessly,” says a senior manager of security research for Websense. But the tool can hack only a limited number of iPhones. It targets a jailbroken iPhone or iTouch that has SSH (Secure Shell) installed and is using the default password that comes with the SSH utility. “You’re not at risk unless you have all three” of these factors, the manager says. Source: http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=221601340&subSection=Attacks/breaches
42. November 11, Washinton Post – (International) China proves to be an aggressive foe in cyberspace. China is significantly boosting its capabilities in cyberspace as a way to gather intelligence and, in the event of war, hit the U.S. government in a weak spot, U.S. officials and experts say. Outgunned and outspent in terms of traditional military hardware, China apparently hopes that by concentrating on holes in the U.S. security architecture, its communications and spy satellites and its vast computer networks, it will collect intelligence that could help it counter the imbalance. The U.S. President, who is scheduled to visit China next week, has vowed to improve ties with the Asian giant, especially its military. But according to current and former U.S. officials, China’s aggressive hacking has sowed doubts about its intentions. U.S. officials and experts of all political persuasions in the Pentagon, on Capitol Hill, in private industry and in think tanks are convinced that China is behind many of the most egregious attacks. A senior Air Force official estimated that, as of two years ago, China has stolen at least 10 to 20 terabytes of data from U.S. government networks, the larger figure equal, by some estimates, to one-fifth of the Library of Congress’s digital holdings. Nuclear weapons labs, defense contractors, the State Department and other sensitive federal government agencies have fallen prey. What experts do not know is exactly what has been stolen or how badly U.S. systems have been exposed. Source: http://www.washingtonpost.com/wp-dyn/content/article/2009/11/10/AR2009111017588.html
Communications Sector
43. November 11, CNET News – (California) Powering cell phone towers with wind. Helix Wind announced Wednesday that it is beginning a trial run in Southern California to see if its wind turbines might be useful for powering cell phone towers. The manufacturer is becoming known for its small vertical-axis wind turbines that can generate electricity with winds as low as 10 mph, as well as its unique business model to finance them. The pilot program, conducted in conjunction with cell phone tower operator Core Communications, will experiment with whether the turbines powering cell phone towers could also generate surplus energy to sell back to the energy grid. If they generate enough surplus power, small wind turbines could provide a new source of income for cell phone tower operators as well as a new power source. Helix Wind’s turbines, which will be installed in early 2010, will run for up to three months before being re-evaluated. According to statistics provided by Helix Wind, there are approximately 3,500 cell phone towers in Southern California, and another 1,000 expected to be added in the next five years to cover consumer growth. Source: http://news.cnet.com/8301-11128_3-10395216-54.html
44. November 11, Brookline TAB – (Massachusetts) Demolition cuts off phone service for hundreds in Brookline. Around 350 homes near the Brookline Reservoir lost phone service Monday after demolition crews accidentally ripped open a cable line near the intersection of Warren Street and Route 9. The Building commissioner said the line was damaged early Monday when a contractor attempting to remove the concrete foundation of a 75-year-old pump house accidentally caught the cable on one corner and ripped it open. The Building commissioner said the cable contained roughly 900 individual wires, and was housed in an old wooden conduit. Verizon crews have been working around the clock since the line was severed to bring service back, though some residents may not have their phones reconnected until Thursday, November 12, he said. Crews had begun demolishing the dilapidated pump house and adjacent transformer building, both located on the northeast corner of the reservoir, on November 6, but suspended work over the weekend. Work resumed after the phone line was ruptured Monday, but was disrupted again when oil began leaking from the transformer building into the storm-water drain. Source: http://www.wickedlocal.com/brookline/news/x809130136/Demolition-cuts-off-phone-service-for-hundreds-in-Brookline
No comments:
Post a Comment