Another SunGard victim. It will be interesting to see how long they can hide the magnitude of this one... One of my students pointed me to the Univ of Miami

http://www.pogowasright.org/article.php?story=20080422071108916

Personal info at risk in laptop theft (Sungard Update)

Tuesday, April 22 2008 @ 07:11 AM EDT Contributed by: PrivacyNews News Section: Breaches

Another security breach — this time following the theft of a laptop owned by the company which implements the Banner system — has exposed the names and Social Security numbers of over 130 individuals related to Binghamton University.

This weekend the University notified 11 students and about 120 applicants that their names and Social Security numbers were saved on a laptop belonging to an employee of SunGard Higher Education, which was stolen on March 13.

Source - Pipe Dream

hat-tip, ESI

[One of my students pointed me to this article on the Univ of Miami Bob]

http://www.scmagazineus.com/University-of-Miami-admits-to-stolen-medical-records/article/109195/

Don't you love British sarcasm?

http://www.pogowasright.org/article.php?story=20080421162625306

UK: Someone's put their foot in it at Boots

Monday, April 21 2008 @ 04:26 PM EDT Contributed by: PrivacyNews News Section: Breaches

Boots is the latest company to be embarrassed by the loss of confidential information after a drug addict stole a back-up tape with details of customers to whom the company had sold dental insurance. Boots is blaming Medisure, the insurer, which is blaming the security firm that was transporting the tape. No one is saying much more, and the whereabouts of the tape, or indeed why it should have attracted the interest of an opportunistic thief, is unclear.

The thief was caught on CCTV. [It's the UK. CCTV is everywhere! Bob] The pharmacist and the insurer have written to an unspecified number of customers reassuring them that the data, including dates of birth and bank account details, are inaccessible without specialist machinery. [You need a tape drive, or one of those services that move the data to CDs for you. Bob] As The Register, the online IT magazine, points out acidly: “That's all right then, because surely there are no ties between thieves in this country and hackers in, for example, the former Soviet bloc?”

Source - Times Online

Perspective: If you don't have mandatory disclosure laws, there is little incentive to move quickly.

http://www.pogowasright.org/article.php?story=20080421161738759

Ie: Data probe after BoI laptops theft

Monday, April 21 2008 @ 04:17 PM EDT Contributed by: PrivacyNews News Section: Breaches

Sensitive information about 10,000 Bank of Ireland customers has been stolen.

[...] The records of 10,000 customers on the computers included credit history, some medical backgrounds for life insurance quotes, personal pension plan details, dates of birth, addresses and bank account details. All the material was contained on the four laptops stolen between June and October 2007.

The laptops were not encrypted, therefore whoever has them has full access to the customers' data. A spokesperson for the bank has confirmed to RTE that it is currently encrypting all its computer - up to 5,000 of the bank's laptops - a process that is likely to take two weeks.

Source - RTÉ.ie

[From the article:

RTE News understands that none of the customers has been informed, but the bank is intending to do so shortly.

I bet they have a reeeeallly strong policy that permits them to do this. “In an attempt to 'make the punishment fit the crime,' we have discarded these employees without thinking about it...”

http://www.pogowasright.org/article.php?story=20080421171505548

(follow-up) Two employees out of a job after discarding files incorrectly

Monday, April 21 2008 @ 05:15 PM EDT Contributed by: PrivacyNews News Section: Breaches

Two employees of an organization that serves homeless veterans are out of their jobs.

This after, a 24-Hour News 8 exclusive report over the weekend that discovered hundreds of files containing personal information about some of those veterans in a dumpster.

Source - WISH-TV

[From the article:

"One of our case managers erroneously labeled a box trash, actually three of them that came out of his office. The supervisor did not do what she should have done and check those. Neither one of them is with us any more,...

Makes you wonder: if this is more important than finding Osama? if it was a reciprocal agreement? If governments truly believe they can do anything to “mere citizens?”

http://www.pogowasright.org/article.php?story=20080421124605312

Secret pact allows the US to spy on UK motorists

Monday, April 21 2008 @ 12:46 PM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

THE UK Home Secretary secretively signed a "special certificate" last year that gives foreign security agencies real-time access to traffic camera images and related data monitoring British motorists on highways throughout the UK.

Opposition politicians and civil liberties advocates yesterday accused Gordon Brown's government of attempting to hide from Parliament its covert plans to facilitate international surveillance of UK citizens in violation of privacy laws.

Source - The Inquirer

[From the article:

Opposition politicians and civil liberties advocates yesterday accused Gordon Brown's government of attempting to hide from Parliament its covert plans to facilitate international surveillance of UK citizens in violation of privacy laws. [Indicating it was reciprocal... Bob]

Some interesting questions and a proposal or two...

http://www.phiprivacy.net/?p=290

Apr-21-2008

Contractor or vendor woes (commentary)

A few recent breaches involving health information have gotten me thinking more about contractor or third party data losses. Is our reaction to such incidents the same as it would be if the hospital, insurance company, or other covered entities directly experienced the breach or loss themselves?

Related? Who 'repairs' your computer?

http://www.pogowasright.org/article.php?story=20080421175225860

CT: Hard Drive Containing Personal Info Sold To Student

Monday, April 21 2008 @ 05:52 PM EDT Contributed by: PrivacyNews News Section: Breaches

A student bought a computer hard drive and discovered that it contains personal information about people with ties to the University of Connecticut.

Ryan Green, a junior at UConn, bought the drive at the UConn Co-op for $200 and discovered it already contained information.

[...] Green found about 10,000 private pictures, 10,000 Microsoft Word documents and even some sensitive personal information like credit cards and driver's licenses. " It's multiple people's data, entire computers," Green said.

[...] Authorities said the information belongs to 10 people, all who have a connection to the university. Police said early indications suggest that all had their computers serviced at the co-op between November and March.

Source - WFSB

CyberWar? (I wonder if they created the PowerPoint on their Lenovo laptop?)

http://hardware.slashdot.org/article.pl?sid=08/04/22/1317212&from=rss

FBI Concerned About Implications of Counterfeit Cisco Gear

Posted by timothy on Tuesday April 22, @10:10AM from the now-watch-these-chickens-well dept. Security United States Hardware

SpicyBrownMustard writes

"An FBI PowerPoint presentation provides details about a criminal investigation into counterfeit CISCO hardware originating from China, and sold by Gold/Silver partners to numerous US government, military, and intelligence agencies. The concern of the article's author and the FBI is that the counterfeit equipment may be state-sponsored to aid in accessing otherwise secure systems (slides 46+47). Says the article author: 'The threat is real. Compromised hardware of potentially hostile foreign origin sits within secure networks of the US government, military, and intelligence services. And as you now see, the FBI has been concerned about it.'"

We've mentioned the seizure of some of this equipment before, but this presentation adds quite a bit of detail, and highlights the FBI's concern of Chinese government involvement.

Close to home...

http://www.pogowasright.org/article.php?story=20080422082903928

Boulder district OKs cell phone search limits

Tuesday, April 22 2008 @ 08:29 AM EDT Contributed by: PrivacyNews News Section: Minors & Students

The Boulder Valley School District won't search a student's cell phone without the permission of the student or parent under an agreement reached with the American Civil Liberties Union.

The only exception is an emergency in which there is an imminent threat to public safety, said district spokesman Briggs Gamblin.

The agreement came out of talks between the district and the American Civil Liberties Union, which sent a letter to the district in October objecting to the actions of officials at Monarch High School in Louisville.

Source - Rocky Mountain News

Hillary is a hacker!

http://news.netcraft.com/archives/2008/04/21/hacker_redirects_barack_obamas_site_to_hillaryclintoncom.html

Hacker Redirects Barack Obama's site to hillaryclinton.com

A security weakness in Barack Obama's website has been exploited to redirect visitors to Hillary Clinton's website. Visitors who viewed the Community Blogs section of the site were instead presented with Clinton's website as a result of a cross-site scripting vulnerability.

More fun election news! Can you say, “E-chad?” (Is this practice for November?)

http://arstechnica.com/news.ars/post/20080421-pa-primary-will-be-unauditable-gop-blocks-e-voting-reform.html

PA primary will be unauditable; GOP blocks e-voting reform

By Jon Stokes Published: April 21, 2008 - 02:30PM CT

On the eve of tomorrow's hotly contested and relatively close Democratic presidential primary in Pennsylvania, a number of voting activists are sounding the alarm one last time about the state's election systems. Over 85 percent of PA voters will vote on paperless touchscreen machines that are hackable, failure-prone, and fundamentally unauditable.

[During prohibition, Malt came in a package printed with the recipe for beer along with the warning that “accidentally” mixing the ingredients listed would make an illegal beverage. In that same vein, this from the article:

Sixteen counties will use the Diebold Accuvote TS touchscreen model. Regular Ars readers will recall that my 2006 article, "How to steal an election by hacking the vote," described in some detail how to steal an election using this machine. (I hope that nobody from PA decides that it would be a good idea to print copies of the free PDF of this how-to article to bring to the polls with them as a form of protest, because you would probably get in trouble. So don't do that.)

For my Computer Security (Forensics) class

http://www.bespacific.com/mt/archives/018157.html

April 21, 2008

Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition

Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition, April 2008: "Computers and other electronic devices are being used increasingly to commit, enable, or support crimes against persons, organizations, or property. This National Institute of Justice guide is intended for first responders to a variety of crime scenes who may have the responsibility of protecting, recognizing, collecting, and preserving electronic evidence at the scene." (NCJ 219941, 74 pages, PDF)

Amusing but too limited to be useful...

http://www.pogowasright.org/article.php?story=20080421172604770

NJ Supreme Court rules Internet user has right to privacy

Monday, April 21 2008 @ 05:26 PM EDT Contributed by: PrivacyNews News Section: In the Courts

The state Supreme Court ruled today that under the New Jersey Constitution an Internet user has the right to privacy in the subscriber information maintained by the individual's Internet service provider.

Ruling in the case of Shirley Reid, a Cape May County woman who was charged with hacking into her employer's computer system after police obtained her identity from Comcast by using a municipal court subpoena, the high court unanimously held law enforcement had the right to investigate her but should have, instead, used a grand jury subpoena.

The court upheld a state appeals court ruling that overturned the conviction for second-degree computer theft.

Source - NJ.com

[From the article:

Ruling in the case of Shirley Reid, a Cape May County woman who was charged with hacking into her employer's computer system after police obtained her identity from Comcast by using a municipal court subpoena, the high court unanimously held law enforcement had the right to investigate her but should have, instead, used a grand jury subpoena.

Summary of a warrantless wiretapping case, and a ethical dilemma for lawyers

http://www.pogowasright.org/article.php?story=20080422063733172

State Secrets: A government misstep in a wiretapping case.

Tuesday, April 22 2008 @ 06:37 AM EDT Contributed by: PrivacyNews News Section: Surveillance

One Friday afternoon in August, 2004, a Washington, D.C., attorney named Lynne Bernabei received a package from the Department of the Treasury. The government was investigating one of her clients, the American branch of a Saudi charity called the Al Haramain Islamic Foundation, which had been active in fifty countries. Al Haramain had come under scrutiny, as had many other Islamic charities, after the attacks of September 11, 2001, and Treasury Department investigators believed that Al Haramain’s American branch, which was based in Oregon, had connections to Al Qaeda. In response to a request from Bernabei for evidence against her client, the government had turned over two sets of documents, primarily media reports that referred to other branches of Al Haramain. None of the materials demonstrated a direct connection between the Oregon branch and Al Qaeda.

Source - Patrick Radden Keefe, in The New Yorker hat-tip, Cryptome

[From the article:

The attorneys representing Al Haramain had been dealing with a novel quandary of legal ethics. If they had a reasonable belief that any telephone conversation with Seda or Buthi might be monitored by the N.S.A., could they talk to their clients without violating attorney-client confidentiality?

For my Math students (I'm teaching linear algebra)

http://digg.com/software/25_000_000_000_Eigenvector_Linear_Algebra_Behind_Google

$25,000,000,000 Eigenvector: Linear Algebra Behind Google

rose-hulman.edu — The paper describing Google's $25 billion dollar equation.

Too strange to be true?

http://gizmodo.com/382026/a-cellphones-missing-dot-kills-two-people-puts-three-more-in-jail

A Cellphone's Missing Dot Kills Two People, Puts Three More in Jail

Do political campaigns have an exemption from notifying potential Identity Theft victims?

http://weblogs.baltimoresun.com/news/politics/blog/2008/04/obamas_allentowngate_laptops_m.html

Obama's Allentowngate? Laptops missing

Posted April 19, 2008 9:00 PM by Josh Drobnyk

Barack Obama's Allentown office was burglarized this week, and multiple laptops and cell phones were stolen, an Obama campaign aide said today. A police spokesman confirmed the incident, but couldn't provide details today because reports are kept in the department's records depository, which is closed weekends. [Sounds fishy to me... Bob]

An Obama aide, speaking on condition of anonymity, said "a couple" field laptops were taken out of the office at 1233 Linden St. The computers have demographic information that the campaign uses to target voters. [At minimum, voter registration information. Bob] "A couple" cell phones were also taken, the aide said.

Police spokesman Capt. James Stephens confirmed the break-in, but could not confirm details of what was taken because the records office is closed on weekends. When and how the break-in occurred also remained unclear. Stephens would only say that it happened "a couple days ago." The Obama campaign declined to comment officially on the incident.

Both campaigns have had their share of incidents at field offices during the race. Obama field offices in California and Iowa have also been broken into. And late last year, a man took campaign workers hostage at a Hillary Clinton field office in Rochester, N.H.

Is this merely Identity Theft, or a way to make CyberWar pay its own way?

http://www.pogowasright.org/article.php?story=20080420154901426

Kr: User Data Stolen From Top Auction Site and Sold (update)

Sunday, April 20 2008 @ 03:49 PM EDT Contributed by: PrivacyNews News Section: Breaches

User data leaked from Auction.co.kr has been put up for sale on Chinese Web sites, raising alarm over potential damage from voice phishing or spam e-mail.

The personal information of 10.81 million users was stolen from the popular online shopping site in Korea.

A posting titled, “Buy Naver, Auction IDs at a good price,” was found on the China-based Internet portal site O2SKY. The posting was put up April 11 before being deleted nine days later, offering the e-mail address and phone number of the seller.

Source - dongA.com

This is a slight twist on the replacement of card scanning devices in US supermarkets. (It might explain why no one seemed to notice.)

http://www.pogowasright.org/article.php?story=20080420182810757

UK: Police break £1m credit card fraud linked to terrorism

Sunday, April 20 2008 @ 06:28 PM EDT Contributed by: PrivacyNews News Section: Breaches

Police in Scotland have uncovered petrol station credit card frauds with a potential value of £1m, linked to international terrorism.

Banks, oil companies and police forces throughout the country are on alert after 5000 cards were copied and their details stolen at two Edinburgh filling stations. A further attempt on a filling station in Kilmarnock was discovered before card details were stolen.

Source - The Herald

[From the article:

The gang members approach petrol station employees, who often work alone on shift, and offer a large bribe to allow access to the station's card-reading terminal.

... A miniaturised interceptor inserted inside the terminal copies the information on the card's magnetic strip and picks up the pin.

... The Herald's investigations suggest that banks' early warning systems in place to protect customers do not work consistently - especially in Scotland.

One industry source said: "Some banks decide not to inform the customers until any attempts are made to actually use the compromised details."

While in England and Wales it is the banks' responsibility to notify the police of suspect locations, in Scotland the onus is on the customer to report a suspected fraud to the police.

...because...

http://www.pogowasright.org/article.php?story=20080421063954293

Data “Dysprotection:” breaches reported last week

Monday, April 21 2008 @ 06:39 AM EDT Contributed by: PrivacyNews News Section: Breaches

A recap of incidents or privacy breaches reported last week for those who enjoy shaking their head and muttering to themselves with their morning coffee.

Source - Chronicles of Dissent

Security as a commodity? (Remember, someone in the organization has to know what questions to ask the vendors.)

http://news.slashdot.org/article.pl?sid=08/04/20/1524246&from=rss

Information Security Is Becoming Infrastructure

Posted by Soulskill on Sunday April 20, @12:25PM from the time-to-pay-your-monthly-security-bill dept.

Bruce Schneier has a story at Wired about his observations from the recent RSA conference. He noticed that the 350+ vendors who attended the conference were having difficulties selling their products or even communicating with potential buyers. Schneier suggests that the complexity of the security industry is forcing it away from end-users and into the hands of companies who can bundle it with the products that need it. Quoting: "When something becomes infrastructure -- power, water, cleaning service, tax preparation -- customers care less about details and more about results. Technological innovations become something the infrastructure providers pay attention to, and they package it for their customers. No one wants to buy security. They want to buy something truly useful -- database management systems, Web 2.0 collaboration tools, a company-wide network -- and they want it to be secure. They don't want to have to become IT security experts. They don't want to have to go to the RSA Conference."

Inevitable

http://www.pogowasright.org/article.php?story=20080421063410632

From DNA of Family, a Tool to Make Arrests

Monday, April 21 2008 @ 06:34 AM EDT Contributed by: PrivacyNews News Section: Other Privacy News

He was a church-going father of two, and for more than 30 years Dennis Rader eluded police in the Wichita area, killing 10 people and signing taunting letters with a self-styled monogram: BTK, for Bind Torture Kill. In the end, it was a DNA sample that tied BTK to his crimes. Not his own DNA. But his daughter's.

Investigators obtained a court order without the daughter's knowledge for a Pap smear specimen she had given five years earlier at a university medical clinic in Kansas. A DNA profile of the specimen almost perfectly matched the DNA evidence taken from several BTK crime scenes, leading detectives to conclude she was the child of the killer. That allowed police to secure an arrest warrant in February 2005 and end BTK's murderous career.

The BTK case was an early use of an emerging tool in law enforcement: analyzing the DNA of a suspect's relatives. Source - Washington Post

Related?

http://science.slashdot.org/article.pl?sid=08/04/20/1640237&from=rss

Google Invests In Genetic Indexing

Posted by Soulskill on Sunday April 20, @01:24PM from the get-a-NDA-for-your-DNA dept.

Bibek Paudel point us to a BusinessWeek report on Google's interest in the cataloging and analyzing of people's DNA. Google has recently invested in DNA screening firms Navigenics and 23andMe, which test customers' DNA for characteristics such as ancestry and predisposition for certain diseases. The customers are then able to give the information to their doctors. This is not Google's first foray into the medical industry. "Google wants to plant an early stake in a potentially large new market around genetic data. 'We are interested in supporting companies and making investments in companies that [bolster] our mission statement, which is organizing the world's information and making it universally accessible and useful,' Google spokesman Andrew Pederson says. 'We felt it was important to get involved now, at the early stage, to better understand the information generated by this fast-moving field.'"

This works! I tested it on my favorite DU Law professor and found him (and some guy in St. Paul.)

http://www.bespacific.com/mt/archives/018148.html

April 20, 2008

Google News Adds New Quotes Feature

Google News Blog: "As part of Google's mission to organize the world's information, we've been hard at work making quotations in news articles easy to search and browse. You can now more easily keep track of what your favorite politician, actor or sports star is saying. You can even search within their quotes for specific topics. To access these new features, first search for a person's name on Google News. If we have a recent quote, we'll show it above the search results."

Pity the poor lawyers who must now un-learn all that stuff they paid big bucks to learn...

http://news.slashdot.org/article.pl?sid=08/04/20/2232220&from=rss

Court Finds Part of Copyright Act Unconstitutional

Posted by timothy on Sunday April 20, @09:14PM from the small-favors dept.

I Don't Believe in Imaginary Property writes

"A US District Court in the Southern District of California has found the Copyright Remedy Clarification Act to be unconstitutional. That act is what removes the sovereign immunity for infringement that state workers have in their official capacity, something many argued would jeopardize universities with liability for faculty infringement, not to mention other state agencies. In a rather dense legal ruling (PDF), the Court found that the Clarification Act was not a valid exercise of congressional power under the 14th Amendment. For those of you who have absolutely no idea what I just said, I recommend either being glad that a small piece of copyright law may soon bite the dust, or hoping that NYCL will explain this better."

This could be quite useful. (for my web site class)

http://www.killerstartups.com/Web-App-Tools/Feed2Mobilekaywacom---Making-Mobile-Feeds/

Feed2Mobile.kaywa.com - Making Mobile Feeds

... You can make your web content accessible on your mobile device by using Feed2Mobile’s converter to create a mobile feed. It is quite simple, copy and paste the URL of your RSS feed into the blank spot where stated and your mobile feed with be generated.

http://feed2mobile.kaywa.com/

A couple for the e-discovery wizards...

http://www.law.com/jsp/legaltechnology/pubArticleLT.jsp?id=1208169988197

Keeping Your Firm's E-Discovery In-House

There are arguments for managing e-discovery in-house instead of outsourcing it, but it takes a special breed of employee

By Dale Buss Corporate Counsel April 15, 2008

and this one.

http://www.strozllc.com/files/Publication/cb91edfe-09dd-495b-a475-038265b4b838/Presentation/PublicationAttachment/bbd40893-8e79-4f19-93d5-0d61c82756f1/NewElectronicDiscoveryTeamsRolesFunctions.pdf

NEW ELECTRONIC DISCOVERY TEAMS, ROLES, AND FUNCTIONS

Eric Friedberg

For my Statistics class

http://www.bespacific.com/mt/archives/018147.html

April 20, 2008

Households using the Internet in and outside the home, by selected characteristics

National Telecommunications and Information Administration (NTIA): Households using the Internet in and outside the home, by selected characteristics: Total, Urban, Rural, Principal City, October 2007

Ditto

http://www.bespacific.com/mt/archives/018141.html

April 20, 2008

Census Bureau - 2008 Elections

News release, 2008 Elections: "A look at the population, selected characteristics and 2004 voting percentage of each state as it approaches its 2008 primary or caucus."

I like lists (it's an addiction)

http://www.networkworld.com/community/node/27057

25 leading-edge IT research projects

Submitted by Alpha Doggs on Fri, 04/18/2008 – 4:51pm.

For my Computer Security students

http://cups.cs.cmu.edu/antiphishing_phil/

Anti-Phishing Phil

Once upon a time, this strategy may have worked. In the pre-blog world, a story in the local paper stayed local. Today there is no local, so one wonders why a company doesn't bite the bullet and announce the total extent of the damage in one “swell foop.” (Perhaps they have not read 'The Prince?”)

http://www.pogowasright.org/article.php?story=20080419095610235

Student data compromised (Sungard update)

Saturday, April 19 2008 @ 09:56 AM EDT Contributed by: PrivacyNews News Section: Breaches

More colleges named as being affected by the stolen laptop

Personal data about students from at least three area colleges was compromised after a laptop computer was stolen, officials said Friday.

... About 1,500 people who included Brockport in their financial aid application process were affected. The school is still determining the number of enrolled Brockport students whose information was compromised. A letter will be mailed to these students, according to the statement.

Twenty MCC students had information on the stolen laptop, spokeswoman Cynthia Cooper said. Those students have been notified.

Source - Democrat & Chronicle

PogoWasRight.org editor's note: this was not the first time a laptop containing sensitive data was stolen from an employee of Sungard. The company reported the theft of a laptop from an employee's vehicle in February 2007; that laptop contained financial details. Sungard has not yet responded to questions concerning whether the most recent laptop theft occurred from an employee's vehicle or from some other location, and whether the employee was following corporate policies.

Have you noticed that the reports are moving east to west? Can Denver be far behind?

http://www.pogowasright.org/article.php?story=20080419212738616

Northwestern Michigan College reports data risk (Sungard update)

Saturday, April 19 2008 @ 09:27 PM EDT Contributed by: PrivacyNews News Section: Breaches

Northwestern Michigan College says a laptop computer that was stolen from a company that works with the school may have put the personal information of 1,600 students from 2003 at risk.

The school says Friday that the laptop belonged to a consultant at SunGard Higher Education, which provides NMC's core data management systems.

Source - mlive.com

Another self-serving announcement.

http://www.pogowasright.org/article.php?story=20080419103026287

NY: Retirees' information disappears

Saturday, April 19 2008 @ 10:30 AM EDT Contributed by: PrivacyNews News Section: Breaches

A portable storage device containing sensitive information about 600 Penfield Central School District retirees and retirees' spouses has disappeared from Monroe 1 BOCES.

The Monroe County Sheriff's Office is investigating the disappearance and the people affected have been notified and offered credit monitoring services.

The Penfield district contracts with Monroe 1 BOCES for certain record-keeping services and the missing storage device contains information about 360 retirees' health plans, including names, birthdates and Social Security numbers. Officials noticed that the device was missing on Thursday.

Source - Democrat & Chronicle

[From the article:

So far, BOCES has not heard of any complaints from retirees about their identities being stolen.

"To our knowledge, there has been no unauthorized use of the information," said Walker. [Apparently the PR flacks have no idea how ignorant this kind of statement makes them seem. Bob]

Oh boy, thanks Carnegie Mellon Research guys... (Automation takes all the fun out of hacking.)

http://www.cs.cmu.edu/~dbrumley/pubs/apeg.html

Automatic Patch-Based Exploit Generation

David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng

... What does this mean?

Attackers can simply wait for a patch to be released, use these techniques, and with reasonable chance, produce a working exploit within seconds. Coupled with a worm, all vulnerable hosts could be compromised before most are even aware a patch is available, let alone download it.

All terrorists breathe. You are breathing. You must be a terrorist!

http://blog.aclu.org/index.php?/archives/628-You,-With-the-Camera!-Stop-Acting-Suspicious!.html#comments

Friday, April 18, 2008

You, With the Camera! Stop Acting Suspicious!

Mike German, a former FBI agent who currently works as policy counsel for our Washington, D.C. office, wrote in our DailyKos Diary about how local law enforcement agencies across the country are gathering a curious kind of domestic intelligence on citizens, all in the name of, you guessed it, national security:

The Wall Street Journal and the Los Angeles Times both reported on the Los Angeles Police Department’s extensive list of "criminal and non-criminal" behaviors, which LAPD officers are instructed to report as "suspicious activities." The list includes such innocuous, clearly subjective and First Amendment protected activities as "taking pictures or video footage with no apparent esthetic value," "drawing diagrams and taking notes," "espousing extremist views," and "engaging in suspected coded conversations or transmissions."

That which is technically true is not always strategically wise.

http://www.pogowasright.org/article.php?story=20080419214504745

AU: Approval not needed for cancer data: Qld

Saturday, April 19 2008 @ 09:45 PM EDT Contributed by: PrivacyNews News Section: Non-U.S. News

Queensland's Health Minister Stephen Robertson says his department has found a way avoid a court battle [I wonder what odds they're giving in Vegas? Bob] with the cancer council over access to data.

Mr Robertson on Sunday said the Cancer Council Queensland would be able to get data from the state's cancer registry to researchers without the approval of the health authority and without breaching patient confidentiality.

The Cancer Council on Friday launched legal action in the Supreme Court against Queensland Health seeking routine access to cancer statistics from the registry.

Source - The Daily

[From the article:

Mr Robertson on Sunday said he was advised the council could share registry data with researchers with only minor changes to the current contract between the council and Queensland Health. [But no details were given Bob]

For my Computer Security students. The opposite of e-discovery?

http://www.bespacific.com/mt/archives/018137.html

April 18, 2008

Computerworld Guide to Removing Data From Your Hard Drive

"With stories surfacing on news channels regularly about lost or stolen data or the ability to recover data from discarded or resold computers and their hard drives, Computerworld decided to look at some cheap methods of removing that sensitive data from your hard drive permanently. And, what better place to look than YouTube?"

• Related postings on PC hard drives

Using technology. Sounds good to me. (Has policy kept pace with this reality?)

http://yro.slashdot.org/article.pl?sid=08/04/19/2343210&from=rss

British Police Use Facebook to Gather Evidence

Posted by timothy on Sunday April 20, @03:39AM from the nothing-at-all-creepy-about-that dept. Privacy Social Networks

Amy Bennett writes

"Move over police scanner and most-wanted poster. The Greater Manchester Police force has created a Facebook application to collect leads for investigations. The application delivers a real-time feed of police news and appeals for information. A 'Submit Intelligence' link takes a Facebook user to the police Web site where they can anonymously submit tips. Another link leads to the videos on YouTube featuring information on the police force, ongoing investigations and other advisories."

As reader groschke writes, though,

"Their access to user data raises significant civil liberties problems. They may be able to see more of your data than your friends or network members can — and you also expose your friends' data when you add the application. All without needing a subpoena or warrant."

As goes computers, so goes DNA? (see next article)

http://www.pogowasright.org/article.php?story=20080419214912380

Computer searches as 21st Century general warrants

Saturday, April 19 2008 @ 09:49 PM EDT Contributed by: PrivacyNews News Section: Internet & Computers

I was reading a child porn computer search case today, posted elsewhere, that again made me think about how easy it is for police to put in a search warrant application that they want to search for a computer. So, let me go on a little about the need for computer searches just because there is a computer in the placed to be searched:

What is the "nexus" of the computer to the evidence to be sought, practically, realistically, and actually? Is it hypothetical or real? Even if it is hypothetical, is that enough to get over the good faith exception? The case law is not all that helpful. Basic search principles lead to one result, but computer searches almost seem to be in the process of subconsciously trying to divide off into their own little world so they become subject to different rules. If it happens, it is result oriented jurisprudence that fails to adhere to basic Fourth Amendment principles. If Kyllo’s thermal imaging is governed by basic Fourth Amendment rules applied to new technology, then why are not computer searched governed the same way? There is no way that they should not be. (The DOJ computer search manual is listed on the right margin.)

Source - FourthAmendment.com blog

Here comes a battle... Interesting article.

http://www.pogowasright.org/article.php?story=20080420062336881

DNA Tests Offer Deeper Examination Of Accused

Sunday, April 20 2008 @ 06:23 AM EDT Contributed by: PrivacyNews News Section: In the Courts

Twenty years after DNA fingerprints were first admitted by American courts as a way to link suspects to crime scenes, a new and very different class of genetic test is approaching the bench.

Rather than simply proving, for example, that the blood on a suspect's clothes does or does not match that of a murder victim, these "second generation" DNA tests seek to shed light on the biological traits and psychological states of the accused. In effect, they allow genes to "testify" in ways never before possible, in some cases resolving long-standing legal tangles but in others raising new ones.

Source - Washington Post

[From the article:

Already, chemical companies facing "toxic tort" claims have persuaded courts to order DNA tests on the people suing them, part of an attempt to show that the plaintiffs' own genes made them sick -- not the companies' products.

In other cases, defense attorneys are asking judges to admit test results suggesting that their clients have a genetic predisposition for violent or impulsive behavior, adding a potential "DNA defense" to a legal system that until now has held virtually everyone accountable for their actions except the insane or mentally retarded.

Some gene tests are even being touted for their capacity to help judges predict the likelihood that a convict, if released, will break the law again -- a measure of "future dangerousness" that raises questions about how far courts can go to abort crimes that have not yet been committed.

For the medicos

http://dsc.discovery.com/tv/human-body/explorer/explorer.html

Human Body Explorer

Well, it is a change. All change evokes resistance (fear)

http://entertainment.slashdot.org/article.pl?sid=08/04/19/1842208&from=rss

Dilbert Goes Flash, Readers Revolt

Posted by timothy on Saturday April 19, @04:06PM from the please-please-please-mr.-adams-pleeaaaase-no dept. It's funny. Laugh. The Internet The Media Entertainment

spagiola writes

"The Dilbert.com website just got an extreme makeover. Gone is the old, rather clunky but perfectly functional, website, replaced by a Flash-heavy website that only Mordac the Preventer of Information Services could love. Users have been pretty unanimous in condemning the changes. Among the politer comments: 'Congrats. Vista is no more lonely at the top in the Competition For The Worst Upgrade In Computing Industry, this web site upgrade being a serious contender.' You have to register to leave comments, but many seem to have registered for the express purpose of panning the new design."

I was once a Chemistry major so this caught my eye... Hope it is not too technical for you.

http://www.writeidea.org/2008/04/governmentium-described-as-element-on.html

Saturday, April 19, 2008

Governmentium - Described as an Element on Periodic Table

The element, Governmentium (Gv),

Research has led to the discovery of the heaviest element yet known to science. The new element, Governmentium (Gv), has one neutron, 25 assistant neutrons, 88 deputy neutrons, and 198 assistant deputy neutrons, giving it an atomic mass of 312.

These 312 particles are held together by forces called morons, which are surrounded by vast quantities of lepton-like particles called peons. Since Governmentium has no electrons, it is inert; however, it can be detected, because it impedes every reaction with which it comes into contact. A minute amount of Governmentium can cause a reaction that would normally take less than a second to take from four days to four years to complete.

Governmentium has a normal half-life of 2- 6 years; It does not decay, but instead undergoes a reorganization in which a portion of the assistant neutrons and deputy neutrons exchange places. In fact, Governmentium's mass will actually increase over time, since each reorganization will cause more morons to become neutrons, forming isodopes. This characteristic of moron promotion leads some scientists to believe that Governmentium is formed whenever morons reach a critical concentration. This hypothetical quantity is referred to as critical morass.

When catalyzed with money, Governmentium becomes Administratium, an element that radiates just as much energy as Governmentium since it has half as many peons but twice as many morons.

Looks like the SunGard breech jumped from colleges 3 to 15..

http://www.pogowasright.org/article.php?story=20080418155015382

NY: 12 SUNY colleges affected by stolen Sungard laptop

Friday, April 18 2008 @ 03:50 PM EDT Contributed by: PrivacyNews News Section: Breaches

It appears Buffalo State College isn't the only school affected by the theft of a laptop computer.

Officials at Fredonia State College say nearly one-thousand current and former students may be affected by the security breach. Fredonia uses the same computerized records system as Buffalo State College, which announced yesterday that the names and Socuial Security numbers of up to 16,000 students may be at risk after a laptop belonging to a company called SunGard was stolen.

Fredonia and Buffalo State are apparently among 12 SUNY colleges affected by the theft.

Source - WNED

[Details(?) on the SunGard site: http://www.sungardhe.com/laptoptheft ]

... The nature of that employee’s job included analysis of customer data as part of software implementation and upgrade projects.

... More than 1,600 institutions worldwide rely on us to help them measurably improve performance. [So this could be much bigger... Bob]

Related

http://www.pogowasright.org/article.php?story=20080419063001517

Security breach hits more area colleges (Sungard update)

Saturday, April 19 2008 @ 06:30 AM EDT Contributed by: PrivacyNews News Section: Breaches

The stolen laptop that contained Social Security numbers for 16,000 former and current students at Buffalo State College is causing problems for four other area colleges, as well.

Fredonia State, Niagara County Community, Genesee Community and Jamestown Community colleges are among 13 state schools that had private student information on that laptop.

... The theft may have affected as many as 1,202 at NCCC, 930 at JCC and 18 at GCC, although those schools are either still trying to figure out what data was on the laptop, or found the actual number of students affected to be much lower, officials from the State University of New York said Friday.

... Other SUNY schools involved are: Adirondack Community College, Brockport State College, Binghamton University, Downstate Medical Center, Dutchess Community College, Herkimer County Community College, Monroe Community College and Orange County Community College.

Source - The Buffalo News

[From the article:

Hefner, who is unhappy with how SunGard has handled the situation, wondered why Fredonia files had been left on the laptop.

“I’m also concerned I didn’t know that our campus might have been involved until this Monday,” Hefner said. “I understand why they might not be able to notify us the first day, but to find out four weeks later is very, very disappointing.”

Locked doors and passwords give the appearance of security.

http://www.pogowasright.org/article.php?story=20080418194446936

IN: 700,000 people could be affected by security breach

Friday, April 18 2008 @ 07:44 PM EDT Contributed by: PrivacyNews News Section: Breaches

A collection agency announced a security breach Friday that potentially compromises the personal information of 700,000 people.

The Central Collection Bureau said the breach happened on March 21, 2008. The company said thieves broke into its offices and stole eight computers, as well as one of its servers. The server, which was password protected and protected by three locked doors, contained the personal information. The eight computers did not contain personal information.

The company said the personal information potentially exposed includes names, contact information, Social Security numbers, dates of birth, dates of service, and medical procedure codes. The people whose data may have been exposed were referred to CCB for debt collection purposes by around 100 Indiana businesses on or before March 20, 2008.

Source - WTHR

[From the article:

The collection company was hired by hundreds of doctors and even utility companies to collect on delinquent bills. [Long list included Bob]

...Klene says all the computers need passwords to break in to the info. [or one of my hacking students Bob]

Attacks by methods other than war? At what point do hackers cross into cyberwar?

http://it.slashdot.org/article.pl?sid=08/04/19/1149219&from=rss

CNN Website Targeted by DoS

Posted by CmdrTaco on Saturday April 19, @08:37AM from the different-kind-of-d-o-s dept. Security The Internet

antifoidulus writes

"CNN is reporting that they were the target of a Denial of Service attack yesterday. According to the article, there have been reports on Asian tech sites that Chinese hackers were targeting CNN for their coverage of the unrest in Tibet. One has to wonder if this hacking attempt was government sponsored or not. The Chinese government hasn't been very happy with CNN, in fact Beijing Bureau Chief has been summoned about a day before this happened."

Follow-up

http://www.news.com/8301-10789_3-9923420-57.html?part=rss&subj=news&tag=2547-1_3-0-5

Cyberprotest of CNN called off (for now)

Posted by Robert Vamosi April 19, 2008 5:45 AM PDT

Late Friday, leaders of the Revenge of the Flame called off a planned denial-of-service attack on CNN.com, according to The Dark Vistor, a Web site that follows Chinese computer hacker activity.

"Our original plan for 19 April has been canceled because too many people are aware of it, [Huh? Isn't that the point? (and if not, what is?) Bob] and the situation is chaotic," cyberprotest organizers said in a statement. "At an unspecified date in the near future, we will launch the attack. We ask that everyone remain ready."

However, early Saturday morning, a post on The Dark Vistor contained detailed plans for various Revenge of the Flame participants, as though the attack were continuing.

Tools & Techniques: Perhaps a more carefully thought out method is in order?

http://www.pogowasright.org/article.php?story=20080419064715193

Tough cookies for Web surfers seeking privacy

Saturday, April 19 2008 @ 06:47 AM EDT Contributed by: PrivacyNews News Section: Internet & Computers

For consumers trying to protect their privacy on the Internet, it's a Catch-22.0.

Advertisers often track Web surfers' activities so they can deliver targeted ads. One of the best ways to avoid this is to install a tiny piece of software that lets computer users opt out of the practice.

But the trouble is that the digital stop sign is often wiped out by other programs designed to protect people's privacy and security.

This little-known flaw in the system highlights the increasing complexity of safeguarding personal data as companies collect more and more information about people's digital footprints: Even the solutions have problems.

Source - Los Angeles Times

For your Security Manager...

http://www.news.com/Security-Bites-Podcast-Whats-on-your-network/2324-12640_3-6237792.html?part=rss&tag=2547-1_3-0-5&subj=news

Security Bites Podcast: What's on your network?

By CNET News.com Staff Published: April 18, 2008 3:47 PM PDT

It may be that what you don't know won't hurt you, but in the case of enterprise networks, that simply isn't true. In a report (registration required), based on traffic from 350,000 users in 20 organizations, Palo Alto Networks found that 90 percent of the sites they looked at had peer-to-peer applications such as eMule and BitTorrent on individual desktops, while Web video and streaming content was present on 95 to 100 percent of the desktops, potentially draining network bandwidth.

... Palo Alto Networks also has an Applipedia where you can look up more than 500 desktop applications and learn what ports are used, if any malware's been associated with it, and how else it might otherwise affect your company.

[Listen to the podcast at Download mp3 Bob]

Debate starter or non-starter? How does one obtain 'freedom of the seas' on the Internet?

http://it.slashdot.org/article.pl?sid=08/04/18/1516234&from=rss

Cybersecurity and Piracy on the High Seas

Posted by ScuttleMonkey on Friday April 18, @02:37PM from the not-one-cent-in-tribute dept.

Schneier points out an interesting article comparing modern cybersecurity to piracy on the high seas in the early 1800s. The article extends the comparison into projected action based on historical context.

"Similarly, in many ways, current U.S. policy on the security of electronic commerce is similar to Adams' appeasement approach to the Barbary pirates. The U.S. government's inability to dictate a consistent cyber commerce protection policy is creating a financial burden on the U.S. private sector to maintain a status quo, when those resources could be used to mount a more-effective Internet-focused defense. In the case of financial fraud on the Internet, the costs associated with fraudulent transactions are currently borne by private companies, which then have to pass those costs on to their customers. This basically creates a system in which the financial institutions are paying a type of "tribute" to the cyber criminals, just as Adams did to the Barbary pirates."

Oh surprise, surprise! That never happens in the US... (Except by my hacking students.)

http://www.infoworld.com/article/08/04/18/Wi-Fi-users-to-be-monitored-in-Russia_1.html?source=rss&url=http://www.infoworld.com/article/08/04/18/Wi-Fi-users-to-be-monitored-in-Russia_1.html

Reports: Wi-Fi users to be monitored in Russia

Business travellers to Russia beware: A recently formed regulatory super-agency si requiring registration for every Wi-Fi device and hotspot

By Matthew Broersma, Techworld April 18, 2008

Business travellers to Russia might want to keep their laptops and iPhones well-concealed - not from muggers,necessarily, but from the country's recently formed regulatory super-agency, Rossvyazokhrankultura (short for the Russian Mass Media, Communications and Cultural Protection Service).

... Aside from public hotspots, the registration requirement also applies to home networks, laptops, smart phones and Wi-Fi-enabled PDAs, Karpov reportedly said. Registration only permits use by the owner.

Would they feel better if the League of Women Voters did the background check?

http://www.pogowasright.org/article.php?story=20080418113435868

Fresno chamber seeks data for candidate checks

Friday, April 18 2008 @ 11:34 AM EDT Contributed by: PrivacyNews News Section: Other Privacy News

The Fresno Chamber of Commerce is causing a stir -- and apparently plowing new political ground -- by asking candidates who want its support to reveal their Social Security and driver's license numbers.

Chamber officials asked for the information so they could conduct background checks on candidates.

[...]Fresno County Supervisor Susan B. Anderson, who is seeking re-election, provided the information sought by the chamber, "but it does make me feel a little bit uncomfortable. I don't think that people who are running for office should have to give their personal information for endorsements, [Cash should be sufficient Bob] and no other group has asked for that."

The chamber's request is not new. It has asked candidates for this information for at least the past four years, Smith said. But this is the first time anyone has objected, likely because of the increased attention being given to identity theft, he said.

Source - Fresno Bee hat-tip, The California Majority Report

Customer Service, DotCom style?

http://www.infoworld.com/article/08/04/18/Microsoft-to-halt-Hotmail-access-via-Outlook-Express_1.html?source=rss&url=http://www.infoworld.com/article/08/04/18/Microsoft-to-halt-Hotmail-access-via-Outlook-Express_1.html

Microsoft to halt Hotmail access via Outlook Express

Microsoft is ending Outlook Express access to Hotmail on June 30 and is urging [not the word I'd use Bob] Express users to switch to Windows Live Mail

By Eric Lai, Computerworld April 18, 2008

In the latest death knell for Outlook Express, Microsoft announced Thursday that it will turn off access to its Web-based Hotmail service from the desktop e-mail software at the end of June.

Now here is an action that may have potential – beyond the potential to cost them customers.

http://www.infoworld.com/article/08/04/18/PayPal-to-block-users-with-old-browsers_1.html?source=rss&url=http://www.infoworld.com/article/08/04/18/PayPal-to-block-users-with-old-browsers_1.html

PayPal to block users with old browsers to stem phishing attacks

eBay's electronic payment service will lock out people using versions of Web browsers with no phishing filters, which could mean trouble for users of Apple's Safari

By Jeremy Kirk, IDG News Service April 18, 2008

... PayPal said a "significant" group of people still use Microsoft's Internet Explorer 3, released in 1996, and IE 4, which debuted in 1997. Those browsers lack a phishing filter, which can block users from accessing a reported phishing Web site.

“Strategy is as strategy does” F. Gump

http://techdirt.com/articles/20080418/010122883.shtml

MPAA Decides Pullmylink.com Doesn't Have Enough Publicity

from the definition-of-insanity dept

The MPAA really is somewhat dense sometimes, isn't it? Despite the fact that every time it sues some website for linking to unauthorized content, that site ends up with a ton more traffic, the MPAA keeps on suing. These lawsuits don't slow the pace of unauthorized sharing one bit, but they do generate a ton of publicity for the activity the MPAA thinks it's "cracking down" on. The latest is Pullmylink.com. It's a site I've never heard of, but thanks to a brand new lawsuit from the MPAA, plenty of people are learning all about the site. Even worse, like some of its ilk, Pullmylink appears not to actually host any infringing content. It merely links to it -- which makes the claims of copyright infringement even more questionable. Surprisingly, even the Reuters report notes how questionable this is, quoting people pointing out that making linking illegal has all sorts of unintended consequences. In the meantime, the folks at Pullmylink should be happy. They're about to get a ton more traffic.

Open Source pharmaceuticals?

http://www.health.com/health/article/0,23414,1136070,00.html

Whiten Your Teeth the Natural Way

by Karina Timmel

White teeth and strawberries may not sound like they go hand in hand, but it turns out the berries can actually lighten your smile.

A niche for everything. (Didn't they used to call the California?)

http://www.killerstartups.com/Web20/Cultspaceorg---Create-and-Explore-Fictional-Cults/

Cultspace.org - Create and Explore Fictional Cults

At Cultspace.org, you can create your own parody religion, become a cult leader, and even blog “holy texts.” The site offers itself up as a forum to “share serious thoughts on religion, make a complete mockery of an existing religion, or do anything in between.” Most users seem to be going the parody route, with registered cult names like “First Church of Giving Me a Dollar,” “The Grand Circle of Eternal Bacon,” and “The Cool Pope’s Church of Some Ancient Dude.” Cult leaders can add photos or an anthem to their group, and Cultspace users can leave comments on these items or on the holy text blogs. There is a forum where Cultspace members can connect and converse. While you can subscribe to someone else’s cult if its content interests you, you cannot actually join other cults. However, each cult has a fictional population number based on its overall popularity and other factors. For instance, forming a political alliance with another cult will help your population grow, while waging a holy war will decrease the population on both sides of the conflict.

http://www.cultspace.org/login.php

This was on the blog yesterday. I wonder how many schools are impacted? This is #2

http://www.pogowasright.org/article.php?story=20080417150456840

Buffalo State College will notify students about security breach

Thursday, April 17 2008 @ 03:04 PM EDT Contributed by: PrivacyNews News Section: Breaches

Buffalo State College will be sending out notices to students about what could be a major security breach.

The school was notified on April 11, 2008, that a laptop containing about 16,000 Buffalo State current and former students' private information had been stolen.

The laptop was owned by a consultant from SunGard, the company that provides Banner®, the records system used at Buffalo State.

Source - WIVB

This is probably related to the breach reported here

Related #3

http://www.pogowasright.org/article.php?story=20080417200644154

MO: Laptop theft may have compromised student info

Thursday, April 17 2008 @ 08:06 PM EDT Contributed by: PrivacyNews News Section: Breaches

The theft of a laptop computer in New York could potentially put personal information about Northwest Missouri State University students and alumni in the wrong hands.

SunGard Higher Education has notified Northwest of the theft of a laptop computer owned by one of SunGard’s employees that may have put the personal information of students and former students at risk.

While it is not believed identity theft was the motive behind the incident, which occurred in March on a college campus in New York, Northwest moved immediately to inform those who might be affected.

Source - Maryville Daily Forum

Related - Laptop stolen with student data, contained personal information of 3,400 CSU System pupils
Related - Buffalo State College will notify students about security breach

Tools & Techniques A Halloween tale? “As soon as you die, cancel all your credit cards.”

http://www.pogowasright.org/article.php?story=20080417170459815

Feds Charge California Woman With Stealing IDs From the Dead

Thursday, April 17 2008 @ 05:04 PM EDT Contributed by: PrivacyNews News Section: Breaches

Federal prosecutors this week charged a Southern California woman with aggravated identity theft and other crimes for allegedly using a popular genealogy research website to locate people who had recently died, and then taking over their credit cards.

Tracy June Kirkland, 42, allegedly used Rootsweb.com to find the names, Social Security numbers and birth dates of people who, shall we say, had no further need for their consumer credit lines. She then "would randomly call various credit card companies to determine if the deceased individual had an … account," according to the 15-count indictment (.pdf) filed in federal court in Los Angeles Tuesday.

Source - Threat Level blog

How to convince your CEO that security education is worth while?

http://www.pogowasright.org/article.php?story=20080417144340634

Identity Theft Smash & Grab, CEO Style

Thursday, April 17 2008 @ 02:43 PM EDT Contributed by: PrivacyNews News Section: Breaches

Tens of thousands of corporate executives were the target of a series of identity-theft scams this week, e-mail-borne schemes that appear to have netted close to 2,000 victims so far. [10% is higher than the average phishing success rate. Interesting. Bob]

Early Monday morning, according to two security experts with firsthand knowledge of the attacks, nearly 20,000 executives received an e-mail purporting to be a subpoena ordering each recipient to appear in court for legal violations leveled against their company. The messages addressed each executive by name, and included their phone number and the name of their company.

Source - Security Fix blog

[From the article:

(the malicious add-on only installed for users visiting the site with Microsoft's Internet Explorer Web browser). Approximately half of the recipients of the e-mail messages were executives at major financial institutions.

... Richard said the group responsible for this attack is based in Romania and is thought to have masterminded nearly two dozen similar attacks over the past year that netted the group millions of dollars.

“We have the technical ability – all other considerations are unimportant” This is going to be controversial at best, and the opportunity for offense is staggering: “Welcome to (insert name of religious site here)' but first a word from our sponsor Hustler Magazine...” We already have cable systems doing it, but I suspect they have contracts specifying how it can be done.

http://yro.slashdot.org/article.pl?sid=08/04/18/0118256&from=rss

Study Confirms ISPs Meddle With Web Traffic

Posted by Soulskill on Friday April 18, @12:15AM from the you-wouldn't-like-me-when-i'm-angry dept

Last July, a research team from the University of Washington released an online tool to analyze whether web pages were being altered during the transit from web server to user. On Wednesday, the team released a paper at the Usenix conference analyzing the data collected from the tool. The found, unsurprisingly, that ISPs were indeed injecting ads into web pages viewed by a small number of users. The paper is available at the Usenix site. From PCWorld:

"To get their data, the team wrote software that would test whether or not someone visiting a test page on the University of Washington's Web site was viewing HTML that had been altered in transit. In 16 instances ads were injected into the Web page by the visitor's Internet Service provider. The service providers named by the researchers are generally small ISPs such as RedMoon, Mesa Networks and MetroFi, but the paper also named one of the largest ISPs in the U.S., XO Communications, as an ad injector."

No evidence, no crime.

http://techdirt.com/articles/20080417/041747875.shtml

Congress Won't Fund Paper Backups For E-Voting Machines

from the we-broke-it...-but-don't-expect-us-to-pay-you-to-fix-it dept

It was Congress that first mandated that polling places needed to start using e-voting machines a few years back, which has led to the ridiculously long trail of stories concerning buggy machines with questionable results and no way to go back and check to see how accurate the results are. It appears that politicians have finally been realizing that the lack of a paper trail (even if just to confirm the results) is problematic. So they're pushing states to make sure they use e-voting machines that also include a paper trail. But, when it comes to paying to make those changes, the states are apparently on their own. Congress has rejected a plan to fund the states in making sure a paper backup was available. Why? Well, as Rep. Vernon Ehlers says: "I think there are other methods of achieving redundancy" though he conveniently leaves those out. He then notes: "hand counting is not as accurate as almost any machine counting that I have seen." It's true that hand counting has its problems too. No one denies that. But the point isn't that hand counting is perfect, but that there's a way to go back and compare the results to make sure they're correct and accurate. Without that in place, we're simply relying on the machines to work perfectly, and we know that doesn't work.

Sometimes you can figure out what concerns governments by their (not so) subtle actions.

http://blog.wired.com/27bstroke6/2008/04/gsm-researcher.html

GSM Security Researcher Targeted in Airport Shakedown

By Kim Zetter April 17, 2008 | 2:45:00 PM

A security researcher on his way this week to speak at a conference about mobile phone security was stopped by British authorities at Heathrow Airport and questioned before being relieved of his Nokia phone, SIM card and USRP (Universal Software Radio Peripheral).

The researcher was on his way to Dubai to deliver a talk at the Hack-in-the-Box security conference about cracking GSM encryption to intercept mobile phone calls and text messages and track the location of users using less than $1,000 in equipment.

As a rule, if you make an “unbreakable system” someone will break it.

http://tech.slashdot.org/article.pl?sid=08/04/18/0436232&from=rss

NULL Pointer Exploit Excites Researchers

Posted by Soulskill on Friday April 18, @05:18AM from the ruh-roh-shaggy dept. Java Security

Da Massive writes

"Mark Dowd's paper "Application-Specific Attacks: Leveraging the ActionScript Virtual Machine" has alarmed researchers. It points out techniques that promise to open up a class of exploits and vulnerability research previously thought to be prohibitively difficult. Already, the small but growing group of Information Security experts who have had the chance to read and digest the contents of the paper are expressing an excited concern depending on how they are interpreting it. While the Flash vulnerability described in the paper[PDF] has been patched by Adobe, the presentation of a reliable exploit for NULL pointer dereferencing has the researchers who have read the paper fascinated. Thomas Ptacek has an explanation of Dowd's work, and Nathan McFeters at ZDNet is 'stunned by the technical details.'"

This might be fun to watch. It should give some advanced notice of the tools DHS plans to use.

http://www.bespacific.com/mt/archives/018124.html

April 17, 2008

House Homeland Security Committee Newsletter Focuses on Opportunities for Small Business Contractors

Chairman, Rep. Bennie G. Thompson: "I began this newsletter to alleviate the gap that exists between the need for information about opportunities available at the Department and the ability to locate and disseminate that information in a timely and user-friendly manner. Similarly, my experience has taught me that the gap between need and ability also affects businesses in their quest to interact with the Department. A small business owner may have a concept for a product that will address an important homeland security need, but lack the resources necessary to bring the product on-line. A large company may not have developed the original concept, but may possess the resources necessary to transform a prototype into an available product. The gap between concept and production can be bridged by providing each party with the type of information they need to create a product that fills a critical need. This newsletter is intended to bridge the gaps that keep information unavailable, sidelines worthwhile businesses, discourages full participation, and permits vulnerabilities to continue."

• Business Opportunities at DHS, March 2008

• Business Opportunities at DHS, April 2008

This could be useful, I'll have to play around with it some more...

http://www.killerstartups.com/Web20/Socratocom---Interactive-Test-Prep-and-Assessment/

Socrato.com - Interactive Test Prep and Assessment

Socrato.com is a web-based test preparation and assessment platform. Based in Boston, Socrato’s Beta version includes practice tests for Massachusetts state exams, as well as the U.S. citizenship exam. There are also vocabulary tests for the SAT and GRE, and users can upload their own practice tests or study materials to share publicly or amongst a private group. These ‘study groups’ can be set up by classmates or teachers, or even by school administrators for use across a district. Socrato also features tools for assessing a student’s learning styles, strengths and weaknesses, progress, etc., which can be used by the student or by their parents, teachers, and tutors. Currently, all tests on this site are multiple-choice, true or false, or fill in the blank – essays are not supported.

http://www.socrato.com/

I need this. I just found out that the big red “S” on my chest has already been copyrighted.

http://www.killerstartups.com/Web-App-Tools/LogoEasecom---Design-A-Unique-Logo/

LogoEase.com - Design A Unique Logo

Whether you are a company making a logo for your business or you are an individual who wants to make a symbol for your work, your brand image is your logo and that is important. You want a unique logo that represents your mark and your vision, something that stands out from the rest. There are many free logo design services available on the web and if you are very creative you can try to make a logo with those tools that is unique. Making a unique logo from the tools provided is a challenge because everyone is provided with the same shapes to choose and the same editing tools. Logo Ease provides users with two options. The first option is the free option where you can choose from an array of shapes which include categories such as: mountains, transport, eye, sports, religious, space, music, celebration, and more . You can then edit by adding up to five lines of text, choosing fonts, adjusting the scale, rotating, and changing the color. You then save your finished logo and you are done. Anyone can use the free logo editor and therefore you run the risk of creating a logo that is similar to someone else’s. Logo Ease gives users the opportunity to use professional logo design software so that you can make a unique logo. The software costs $149 and you can revise your logo as many times as you want. Logo Ease offers logo options for all the different needs users may have.

http://www.logoease.com/