Wednesday, July 01, 2009

IT Governance Tip #1: Know where your assets are.

http://www.databreaches.net/?p=5886

Sutter Employee Info Found On Broken Laptop

June 30, 2009 by admin Filed under Breach Incidents, Healthcare Sector, Other

Thousands of Sacramento area Sutter Health employees are being warned that their personal information may have been leaked after a computer repair shop found the data on an old laptop that had been brought in for repair.

Sutter Health is notifying about 6,000 former and current employees about the possibility that their social security numbers and other private information may have been accessed.

Until the laptop was brought into a computer repair shop, Sutter Health had believed the computer was in the possession of a Sutter employee since 2007.

Read more on http://cbs13.com/local/sutter.health.laptop.2.1066081.html

[From the Article:

Sutter's computer technicians checked out the computer and say it has not been used by anyone since 2007.

Sutter says there is no police investigation into the incident and that appropriate action was taken against the employee who was originally issued the computer.



For your Security Manager...

http://it.slashdot.org/story/09/06/30/2237256/New-Click-Fraud-Attack-Is-Stealthiest-Yet?from=rss

New Click-Fraud Attack Is Stealthiest Yet

Posted by kdawson on Tuesday June 30, @09:35PM from the penny-here-penny-there dept.

An anonymous reader sends news from The Washington Post's Security Fix blog of a new Trojan horse program that takes click fraud to the next level. The Trojan, dubbed FFsearcher by SecureWorks, was among the pieces of malware installed by sites hacked with the Nine-Ball mass compromise, which attacked some 40,000 Web sites this month. The Trojan takes advantage of Google's "AdSense for Search" API, which allows Web sites to embed Google search results alongside the usual Google AdSense ads. (SecureWorks' writeup indicates that Yahoo search is targeted too, but the researchers saw no evidence if the malware redirecting Yahoo searches.) While most search hijackers give themselves away on the victim's machine by redirecting the browser through some no-name search engine, FFsearcher

"...converts every search a victim makes through Google.com, so that each query is invisibly redirected through the attackers' own Web sites, via Google's Custom Search API. Meanwhile, the Trojan manipulates the victim's PC and browser so that the victim never actually sees the attacker-controlled Web site that is hijacking the search, but instead sees the search results as though they were returned directly from Google.com (and with Google.com in the victim browser's address bar, not the address of the attacker controlled site). Adding to the stealth is the fact that search results themselves aren't altered by the attackers, who are merely going after the referral payments should victims click on any of the displayed ads. What's more, the attackers aren't diverting clicks or ad revenue away from advertisers or publishers, as in traditional click fraud: They are simply forcing Google to pay commissions that it wouldn't otherwise have to pay."

If FFSearcher were the only piece of malware on the machine, it would have a better chance of staying under the radar.



This should be amusing/depressing. You could almost automate the “government waste” articles it will generate.

http://news.slashdot.org/story/09/07/01/0032230/US-Gov-Launches-Web-Site-To-Track-IT-Spending?from=rss

US Gov. Launches Web Site To Track IT Spending

Posted by kdawson on Wednesday July 01, @08:03AM from the how-much-for-the-retractable-drink-holders dept. government internet usa it

andy1307 writes

"Vivek Kundra, the federal chief information officer, announced on Tuesday a new Web site designed to track more than $70 billion in government IT spending, showing all contracts held by major firms within every agency. The (Flash-heavy) site, USAspending.gov, shows detailed information about whether IT contracts are being monitored and budgets being met. [If they are in this database they are “monitored” and I doubt any government project meets its budget. Bob] The data also show which contracts were won through a competitive process or in a no-bid method (the latter approach is criticized by good-government advocates for excluding firms from business opportunities). Each prime contractor is listed as well as the status of that project; sub-contractors are not yet shown."



How do Tech firms help their customers avoid sales tax? Would they move to an Island in the Caribbean if they were offered a 'no sales tax' guarantee?

http://yro.slashdot.org/story/09/06/30/1515222/Rhode-Island-Affiliates-Banned-From-Amazoncom-Sales?from=rss

Rhode Island Affiliates Banned From Amazon.com Sales

Posted by timothy on Tuesday June 30, @11:44AM from the oh-just-wait-for-the-feds-to-tax-it-instead dept. government money internet usa politics

Rand Huck writes

"Amazon.com has now added Rhode Island to its blacklist of affiliates in response to its proposed budget changes to enforce a tax on Internet sales, which includes commissions on their affiliate program by content providers based in Rhode Island. The first state to be blacklisted was North Carolina, for the same reason. If you go to a Rhode Island-based or North Carolina-based website that advertises Amazon.com goods as an affiliate, that website will no longer have the goods available because otherwise Amazon.com would be forced to pay sales tax to the State of Rhode Island and Providence Plantations or the State of North Carolina. The state's rationale is, if someone clicks to buy a good from Amazon.com via a site based in Rhode Island, it's equivalent to buying a good from a brick and mortar chain store located in Rhode Island."



A project too big to fail? “Yes, it's stupid, but we are committed?” How un-compulsory can it be if you need the card to avoid a full cavity search before boarding planes, trains or subways?

http://www.pogowasright.org/?p=1032

ID cards ‘will never be compulsory’ for Britons

June 30, 2009 by Dissent Filed under Featured Headlines, Govt, Non-U.S.

Alan Johnson signalled a major retreat by the Government on identity cards when he ruled out ever making them compulsory for UK citizens.

The Home Secretary also abandoned plans for a pilot project at two airports which would have required some staff and pilots to carry the cards.

The schemes for new workers wishing to go airside at Manchester airport and London city airport will now only be voluntary.

But the Government is to press ahead with creating a national identity register which, from 2011/12, will include the details of everyone who applies for a passport.

[...]

Chris Grayling, the shadow Home Secretary, said: “This decision is symbolic of a Government in chaos. They have spent millions on the scheme so far - the Home Secretary thinks it has been a waste and wants to scrap it, but the Prime Minister won’t let him. So we end up with an absurd fudge [Wow! Makes me wish I spoke English! Bob] instead. This is no way to run the country.”

Read more in The Times Online.

[From the article:

The announcement means that the only people for whom it will be compulsory to have an identity card will be foreign citizens. However, the Government is to press ahead with creating a national identity register that, from 2011-12, will include the details of everyone who applies for a passport.



An indication that the fix hasn't been installed in many ATMs yet.

http://www.wired.com/threatlevel/2009/06/atm-vendor-halts-talk/

ATM Vendor Halts Researcher’s Talk on Vulnerability

By Kim Zetter Email Author June 30, 2009 * 11:07 am

An ATM vendor has succeeded in getting a security talk pulled from the upcoming Black Hat conference after a researcher announced he would demonstrate a vulnerability in the system.

Barnaby Jack, a researcher with Juniper Networks, was to present a demonstration showing how he could “jackpot” a popular ATM brand by exploiting a vulnerability in its software.

Jack was scheduled to present his talk at the upcoming Black Hat security conference being held in Las Vegas at the end of July.

But on Monday evening, his employer released a statement saying it was canceling the talk due to the vendor’s intervention.



Just in case you thought that Pirate Bay was the only site of its kind...

http://www.zeropaid.com/news/86532/5-alternative-the-pirate-bay-bittorrent-sites/

5 Alternatives to The Pirate Bay

The admins of The Pirate Bay have stressed that in order for the Bay to stay alive, they need to adapt the site to a legitimate one, selling the site for $7.8 Million in the process. While some users showed their support for the infamous website, others are already jumping ship, demanding that their accounts be removed in the process. We were curious to know what alternatives there are out there these days and have come up with 5 alternative websites.



Does this explain why some CEOs don't understand technology? Thankfully brief slideshows,,,

http://www.bespacific.com/mt/archives/021713.html

June 30, 2009

Reports: Fortune 100 CEOs and Social Media

UberCEO: Fortune 100 CEOs and Social Media - "...top CEOs in the country appear to be mostly absent from the social media community. That's the result from research we conducted over the past several weeks. We looked at Fortune's 2009 list of the top 100 CEOs to determine how many were using Facebook, Twitter, LinkedIn, Wikipedia, or had a blog. The results show a miserable level of engagement."



Now McDonald's can recover their lost millions from their over-paid employees...

http://www.pogowasright.org/?p=1044

McDonald’s can sue employee over naked pix

June 30, 2009 by Dissent Filed under Breaches, Businesses, Court

There was another development in court concerning the lawsuit (pdf) filed by Arkansas couple Tina and Phillip Sherman against McDonald’s, Matthews Mangement, and the franchise’s manager, Aaron Brummley after nude pictures on a cellphone accidentally left in the Fayetteville McDonald’s were uploaded to the web.

Although the court wouldn’t dismiss the complaint (see Matthews Management’s motion to dismiss [pdf], McDonald’s motion to dismiss [pdf] and the Sherman’s response [pdf]), Washington County Circuit Judge Mary Ann Gunn has now granted McDonald’s motion to sue a franchise employee, Cody Hess. McDonald’s claims that he is the cause of any damages Phillip and Tina Sherman might have experienced.



Isn't there a nice safe place we can put this (clearly) mentally challenged individual?

http://news.yahoo.com/s/ap/20090630/ap_on_fe_st/us_odd_college_student_jail_theft

College student tries to steal jail computer

AP

KALAMAZOO, Mich. – Western Michigan University student William K. Bradley was sentenced for larceny in a building. He stole a computer. From the Kalamazoo County jail. Where he already was serving a sentence in a different case.

Kalamazoo County Circuit Judge Gary Giguere Jr. sentenced Bradley on Monday, telling the Kalamazoo resident his jailhouse theft was "the dumbest crime I've heard today" and "may be in the top half-dozen in my career."

Bradley, who has racked up six felonies and four misdemeanors by the age of 25, agreed with the judge, saying, "I'm not the best criminal."



For my fellow geeks... (The site has been Slashdotted, but mirrors are in the comments)

http://digg.com/software/151_Convenient_Firefox_Add_ons_for_Advanced_Users

151 Convenient Firefox Add-ons for Advanced Users

investintech.com — Since Firefox is rich with standard features, many users are content with running the browser as is after installing it. Advanced users, however, know that they can tailor the browser to fit their individual browsing needs. Here are 151 Firefox add-ons for advanced users.

No comments: