Tuesday, September 29, 2009

Introducing new avenues of attack before the old ones are secure?

http://news.slashdot.org/article.pl?sid=09/09/28/1646257

Banking Via Twitter?

Posted by ScuttleMonkey on Monday September 28, @03:16PM from the what-not-to-do dept.

In the latest example of how just because you can do something doesn't mean you should, one credit union has decided to offer a new feature, dubbed "tweetMyMoney," that allows members to interact with their accounts via Twitter. Can't wait for the next version, "tweetSomeoneElsesMoney."

"tweetMyMoney, available exclusively to Vantage members! With tweetMyMoney, you can monitor your account balance, deposits, withdrawals, holds and cleared checks with simple commands. And, you can even transfer funds within your account. It's all available on Twitter, 24/7!"



What is Apples definition of malware? My definition is “unauthorized/unwanted software” If I charge for testing/evaluating software on my system, can I bill Apple? If I'm running a system as part of my dissertation research and Apple screws thing up, can I sue? What is the threshold that must be crossed to make a Class Action likely?

http://apple.slashdot.org/story/09/09/28/2330229/Apple-Pushes-Unwanted-Software-To-PCs-Again?from=rss

Apple Pushes Unwanted Software To PCs, Again

Posted by kdawson on Monday September 28, @08:10PM from the just-updates-please dept.

itwbennett writes

"Blogger Steven J. Vaughan-Nichols wags his finger at Apple for indiscriminately pushing the iPhone Configuration Utility 2.1 update out to Windows users, since it is a tool for business system administrators to set up and administer corporate iPhones — the blogger himself (and practically every other iPhone user) not being of the corporate iPhone user persuasion. But more than just unnecessary, the update actually puts him and millions of other iPhone owners/Windows PC users at increased risk by installing 'not just a configuration program, but the Apache Web server as well,' says Vaughan-Nichols. 'A Web server like the one Apple [is] adding to your PC... [is] a gateway just asking to be hammered on by an attacker. Managed properly Apache is as safe a Web server as you'll ever find, but ordinary PC users shouldn't try to manage it, and even an expert can't do anything with it if they don't know it's there.'"

Reader CWMike notes that Apple pulled the iPhone Configuration Utility from the update list after a few hours.


(Related) A survey of the Blogs and a new term of art...

http://blogs.computerworld.com/14808/apple_shovelware_problems_again_iphone_configuration_utility

September 28, 2009 - 5:45 A.M.

Apple shovelware problems again (iPhone Configuration Utility 2.1)



A cautionary tale as my schools start into e-textbooks

http://news.slashdot.org/article.pl?sid=09/09/29/0133221

In Trial, Kindles Disappointing University Users

Posted by kdawson on Tuesday September 29, @12:11AM from the write-on dept.

Phurge writes

"When Princeton announced its Kindle e-reader pilot program last May, administrators seemed cautiously optimistic that the e-readers would both be sustainable and serve as a valuable academic tool. But less than two weeks after 50 students received the free Kindle DX e-readers, many of them said they were dissatisfied and uncomfortable with the devices. 'I hate to sound like a Luddite, but this technology is a poor excuse of an academic tool,' said Aaron Horvath, a student in Civil Society and Public Policy. 'It's clunky, slow and a real pain to operate.' 'Much of my learning comes from a physical interaction with the text: bookmarks, highlights, page-tearing, sticky notes and other marks representing the importance of certain passages — not to mention margin notes, where most of my paper ideas come from and interaction with the material occurs,' he explained. 'All these things have been lost, and if not lost they're too slow to keep up with my thinking, and the "features" have been rendered useless.'"



Worth a few minutes to browse?

http://www.bespacific.com/mt/archives/022426.html

September 28, 2009

Deloitte: Cloud computing - A collection of working paper

Deloitte: Cloud computing - A collection of working papers, released September 17, 2009 and published on July 31, 2009.

  • "Cloud Computing frequently is taken to be a term that simply renames common technologies and techniques that we have come to know in IT. It may be interpreted to mean data center hosting and then subsequently dismissed without catching the improvements to hosting called utility computing that permit near realtime, policy-based control of computing resources. Or it may be interpreted to mean only data center hosting rather than understood to be the significant shift in Internet application architecture that it is... Cloud computing represents a different way to architect and remotely manage computing resources. One has only to establish an account with Microsoft or Amazon or Google to begin building and deploying application systems into a cloud. These systems can be, but certainly are not restricted to being, simplistic. They can be web applications that require only http services. They might require a relational database. They might require web service infrastructure and message queues. There might be need to interoperate with CRM or e-commerce application services, necessitating construction of a custom technology stack to deploy into the cloud if these services are not already provided there."



Tools & Techniques What works

http://arstechnica.com/security/news/2009/09/av-comparatives-picks-seven-anti-malware-winners.ars

AV-Comparatives picks seven on-demand antimalware winners

AV-Comparatives' August 2009 report has been released and there are seven winners.

By Emil Protalinski Last updated September 28, 2009 11:59 AM CT

AV-Comparatives is known for the thorough tests it does on security software. Following its May 2009 retrospective/proactive report, the company has released its August 2009 on-demand comparative. Sixteen products, last updated on August 10, were set on the same highest detection settings (except for Sophos and F-Secure) and put to the test.



Tools & Techniques I wonder if they would allow me to search for vulnerabilities? (Would they know if I was?)

http://tech.slashdot.org/story/09/09/28/190259/Company-Offers-Customizable-Web-Spidering?from=rss

Company Offers Customizable Web Spidering

Posted by ScuttleMonkey on Monday September 28, @05:41PM from the my-legs-are-longer-than-yours dept.

TechReviewAl writes

"A company called 80legs has come up with an interesting new web business model: customized, on-demand web spidering. The company sells access to its spidering system, charging $2 for every million pages crawled, plus a fee of three cents per hour of processing used. The idea is to offer Web startups a way to build their own web indexes without requiring huge server farms. 'Many startups struggle to find the funding needed to build large data centers, but that's not the approach 80legs took to construct its Web crawling infrastructure. The company instead runs its software on a distributed network of personal computers, much like the ones used for projects such as SETI@home. The distributed computing network is put together by Plura Processing, which rents it to 80legs. Plura gets computer users to supply unused processing power in exchange for access to games, donations to charities, and other rewards.'"



Something else for my students to be watching when they should be listening to my lectures...

http://www.makeuseof.com/tag/watch-free-tv-channels-on-the-go-with-kiteplayer/

Watch Free TV Channels On The Go With KitePlayer

Sep. 29th, 2009 By Karl L. Gechlik

Have you ever wanted to watch free TV on your laptop on the go? You say, sure there is Hulu (which we have covered extensively here) and other sites that let me do that.

But how about one site that aggregates all the others and lets you watch them via one program interface that you could run on say your media center station showing on your TV or your laptop on the bus?

… Kiteplayer software is free to download and you can always get the latest version by clicking here.



Interesting. I suspect the first one is congress asking “What are my colleges doing that I should be doing to look smart?”

http://www.bespacific.com/mt/archives/022430.html

September 28, 2009

Recent CRS Reports: Congress and Twitter, Wildfire Fuels, F-35 Joint Strike Fighter, Older Workers, Climate Change

Monday, September 28, 2009

Security has not risen to the level of 'competitive advantage' quite yet, but perhaps there are indications that it will.

http://news.slashdot.org/story/09/09/27/1636254/Cyber-Gangs-Raise-Profile-of-Commercial-Online-Bank-Security?from=rss

Cyber Gangs Raise Profile of Commercial Online Bank Security

Posted by Soulskill on Sunday September 27, @01:26PM from the only-you-can-prevent-identity-theft dept.

tsu doh nimh writes

"The Washington Post's Security Fix blog has published a rapid-fire succession of investigative stories on the theft of hundreds of thousands of dollars from companies, schools, and public institutions at the hands of organized cyber thieves and 'money mules,' willing or unwitting people recruited via online job scams. Some businesses are starting to challenge the financial industry's position that they are not responsible for online banking losses from things like keystroke logging malware that attacks customer PCs. Last week, a Maine firm sued its bank, saying the institution's lax approach to so-called multi-factor authentication failed after thieves stole $588,000 from the company, sending the money to dozens of money mules. The same group is thought to have taken $447,000 from a California wrecking company, whose bank also is playing hardball. Most recently, the Post's series outlined a sophisticated online system used by criminals to recruit, track and manage money mules."


(Related)

http://www.databreaches.net/?p=7531

FBI: Virus suspected in school thefts

September 28, 2009 by admin Filed under Breach Incidents, Education Sector, Malware, U.S.

Brett Rowland and Kate Schott report:

As much as $350,000 reported stolen from Crystal Lake District 47 bank accounts earlier this summer could be linked to cyberthefts at other suburban schools.

The FBI’s Chicago office is investigating the cases, at least one of which involves a hard-to-detect computer virus. No arrests have been made or charges filed, said Cynthia Yates, a spokeswoman for the Chicago office of the FBI. She said Crystal Lake School District 47 and Sycamore School District 427 were part of their investigation, but she declined to identify any other organizations involved in the case.

Read more on Northwest Herald. Thanks to Brian Honan for this link.



Why does this sound all too familiar? Why does Charlie Brown trust Lucy to hold the football? Thank god stupid isn't a capital offense.

http://www.databreaches.net/?p=7533

Jail chaos as lag hacker is left in charge of computer system

September 28, 2009 by admin Filed under Breach Incidents, Government Sector, Non-U.S., Of Note, Other

Justin Penrose reports:

A jailed hacker shut down a prison’s entire computer system – after bosses gave him the job of programming it.

Douglas Havard, 27, serving six years for stealing up to £6.5million using forged credit cards over the internet, was approached after governors wanted to create an internal TV station but needed a special computer program written.

He was left unguarded and hacked into the system’s hard drive at Ranby Prison, near Retford, Notts. Then he set up a series of passwords so no one else could get into the system.

Read more on Mirror. Thanks to Brian Honan for this link.

[From the article:

The blunder emerged a week after the Sunday Mirror revealed how an inmate at the same jail managed to get a key cut that opened every door.



What is it with governments passing laws restricting a very limited range of devices, and not addressing the problem they are trying to solve?

http://yro.slashdot.org/story/09/09/28/0252203/For-New-Zealanders-No-More-Phones-As-Sat-Nav-Devices?from=rss

For New Zealanders, No More Phones As Sat-Nav Devices

Posted by timothy on Monday September 28, @04:16AM from the fine-distinctions dept.

rixth writes

"From the 1st of November, it will be illegal to use cell phones while driving in New Zealand. Today, the Government clarified that you can't use your mobile phone as a navigational device, even if it is mounted on the dash board."

[From the article:

The restriction does not apply to navigation systems that do not have a mobile phone function, he says.



I was going to suggest that the 'unhackable' would be hacked quickly, but the comments report that these computers have already been hacked. That's what happens when you challenge hackers.

http://news.slashdot.org/story/09/09/27/0252235/AU-Government-To-Build-Unhackable-Netbooks?from=rss

AU Government To Build "Unhackable" Netbooks

Posted by kdawson on Sunday September 27, @08:09AM from the smells-like-a-challenge dept.

bennyboy64 writes

"In what may be one of the largest roll-outs yet of Microsoft's new Windows 7 Operating System, Australia's Federal Government decided to give 240,000 Lenovo IdeaPad S10e netbooks to Year 9-12 students. Officials are calling them 'unhackable.' iTnews reports that the laptops come armed with an enterprise version of the Windows 7 OS, Microsoft Office, the Adobe CS4 creative suite, Apple iTunes, and content geared specifically to students. New South Wales Department of Education CIO Stephen Wilson said that schools were 'the most hostile environment you can roll computers into.' While the netbooks are loaded with many hundreds of dollars worth of software, 2GB of RAM, and a 6-hour battery, the cost to the NSW Department of Education is under $435 (US) a unit. Wilson praised Windows' new OS: 'There was no way we could do any of this on XP,' he said. 'Windows 7 nailed it for us.' At the physical layer, each netbook is password-protected and embedded with tracking software that is embedded at the BIOS level of the machine. If a netbook were to be stolen or sold, the Department of Education is able to remotely disable the device over the network. Each netbook is also fitted with a passive RFID chip which will enable the netbooks to be identified 'even if they were dropped in a bathtub.' The Department of Education also uses the AppLocker functionality within Windows 7 to dictate which applications can be installed."



A case to follow. (Even if they're ALL douchebags.)

http://www.rep-am.com/News/438521.txt

Blogger to be back in court Former Mills High student's suit before U.S. appeals panel

BY JIM MOORE REPUBLICAN-AMERICAN

Avery Doninger will soon return to the 2nd U.S. Circuit Court of Appeals with the right of students across the country to speak their minds in blogs and text messages at stake.

… Her federal lawsuit against former Region 10 Superintendent Paula Schwartz and Lewis S. Mills High School Principal Karissa L. Niehoff, who disqualified Doninger from election as senior class secretary when the infamous blog post came to their attention, is expected to be heard, perhaps for the final time, later this year

… According to the argument presented by the Virginia-based Student Press Law Center in a "friend of the court" brief, Doninger's post — which urged readers to contact administrators in support of the endangered concert — is especially deserving of protection.

"The lower court's decision would send the wrong message to civics classes, for it unmistakably says that a student may not exercise her First Amendment rights to encourage others to challenge a governmental decision," wrote SPLC attorney Joseph P. Esposito.

… For the plaintiffs, and their legal supporters, the issue boils down to a comparatively simple question: whether school officials have the right to discipline students for off-campus speech.



Anti-Trust in the 21st Century! “If theys big, theys musts be evil!” “They're not out-competing, they must be cheating.” “It's not fair!”

http://news.cnet.com/8301-30684_3-10362108-265.html?part=rss&subj=news&tag=2547-1_3-0-20

Google adjusts to life with trustbusters

by Tom Krazit September 28, 2009 4:00 AM PDT

Google's greatest challenge as it heads into its second decade may very well be innovating without ticking off Uncle Sam.

The position taken by the Department of Justice two weeks ago on the Google Books search settlement marked the second time in about a year the U.S. government has taken an active step to rein in one of the tech industry's signature companies. Google now is in the process of renegotiating a deal it once called "a historic settlement," one that gave it sweeping and exclusive rights to digitize certain kinds of books that competitors and activists feared would allow Google to gain more control of access to digital information.

Unlike the famous technology antitrust cases of the last century [Boy, does that make me feel old... Bob]--IBM, AT&T, Intel, and Microsoft--Google has not drawn government scrutiny based on allegations of past conduct. Rather, the focus is on what the company might do or is about to do, which should be both comforting and troubling for Google executives.


(Related)

http://webanalytics.globalthoughtz.com/index.php/google-announce-two-new-search-features/

Google announce two new search features

On 09.27.09, In Basics, by rohit

Google has been facing stiff competition from Microsoft Bing, which has come out a slew of new search features. Though Google still dominates the search result but it needs to make things better, if it wants to remain at the top. And Google is doing just that, Google has now come out with two more features in its search result to help users search better.


(Related)

http://www.techcrunch.com/2009/09/27/with-google-places-concerns-rise-that-google-just-wants-to-link-to-its-own-content/

With Google Places, Concerns Rise That Google Just Wants To Link To Its Own Content

by Erick Schonfeld on September 27, 2009



Play time for geeks?

http://www.makeuseof.com/tag/how-to-try-out-the-microsoft-office-web-apps-technical-preview/

How To Try Out The Microsoft Office Web Apps Technical Preview

Sep. 27th, 2009 By Varun Kashyap

… Microsoft has been working on a free version of its popular Office franchise as well. The free version would be available via the cloud. Microsoft recently launched a tech preview. It is an invite-only preview, however you just need a Skydrive account and some URL tweaking to try out the Office Web Apps Preview. Here is how:



For my Business Continuity class, because noting disrupts your business operations like killing off your employees.

http://www.bespacific.com/mt/archives/022425.html

September 27, 2009

CDC Weekly Influenza Surveillance Report

"Each week CDC analyzes information about influenza disease activity in the United States and publishes findings of key flu indicators in a report called FluView. During the week of September 13-19, 2009, a review of the key indictors found that influenza activity continued to increase in the United States compared to the prior weeks."



Because I show (or at least point to) many videos in my classes, it's good to have some tools to control things.

http://www.safeshare.tv/

SafeShare

Not only does SafeShare.TV remove distracting and offensive elements around YouTube videos, but it also allows you to crop videos before sharing them.

Sunday, September 27, 2009

Who was it in “Dr. Strangelove” that was concerned with “our precious bodily fluids?”

http://www.pogowasright.org/?p=4169

Sweat Becomes Offenders’ New Snitch

September 26, 2009 by Dissent Filed under Featured Headlines, Surveillance

Fredrick Kunkle and Derek Kravitz report:

The government has buried its nose in Bari Lynne Williams’s personal business.

Almost literally.

Twenty-four hours a day, whether she’s jogging, sleeping or managing a pool hall, Williams wears a high-tech sensor on her ankle that can detect the faintest whiff of alcohol in her perspiration. If she sneaks a drink, the device will know it — and so will a judge, who could put her behind bars for violating a court order to avoid alcoholic beverages.

[...]

While law enforcement has been using satellite-based GPS to track offenders’ whereabouts for some time, privacy advocates say the alcohol-monitoring device — known as Secure Continuous Remote Alcohol Monitor, or SCRAM — has taken law enforcement into the realm of continuously and remotely monitoring people’s physical condition.

Read the full article on The Washington Post.


(Related) “It's for their own good!”

http://www.pogowasright.org/?p=4176

UK drugs test for claimants sparks row over unemployment benefits

September 27, 2009 by Dissent Filed under Govt, Non-U.S., Surveillance

Controversial government plans to allow Jobcentre staff to “order” benefit claimants to undergo tests for drug and alcohol dependency are in breach of European law and unlikely to work, according to leading addiction charities.

The proposals, outlined in the welfare reform bill, which is due before the House of Lords next month, are part of a major government drive to reform Britain’s benefits culture and save taxpayers hundreds of millions of pounds a year.

Read more on UTV

[From the article:

"Potentially, anyone could be required to answer questions about their drug or alcohol use as the bill includes no test or threshold which staff must first satisfy," he said. "Do we really want to see Jobcentres given the power to drug test, share information about claimants with the police and, for the first time, require vulnerable people to undergo medical treatment by waving the stick of benefit sanctions?"



What does the US have on Switzerland? First, access to banking records, now arresting an “artist”

http://www.cnn.com/2009/SHOWBIZ/Movies/09/27/zurich.roman.polanski.arrested/

Polanski arrested in connection with sex charge

... He was taken into custody trying to enter Switzerland on Saturday, Zurich police said.



'cause sometimes it helps to have a simple explanation you can point to.

http://www.makeuseof.com/tag/technology-explained-how-do-rfid-tags-work/

Technology Explained: How Do RFID Tags Work?

Sep. 26th, 2009 By Guy McDowell

Saturday, September 26, 2009

This is heading off in strange directions. I could lose my email (without notice!) because someone I have no dealings with screws up? Did they at least send this poor guy an email asking him to contact them?

http://www.pogowasright.org/?p=4155

Judge orders Google to deactivate user’s Gmail account, but wait, there’s more…

September 26, 2009 by Dissent Filed under Breaches, Court, Featured Headlines, U.S.

Wendy Davis reports that in the Rocky Mountain Bank case previously covered here:

In a highly unusual move, a federal judge has ordered Google to deactivate the email account of a user who was mistakenly sent confidential financial information by a bank.

The order, issued Wednesday by U.S. District Court Judge James Ware in the northern district of California, also requires Google to disclose the Gmail account holder’s identity and contact information. The Gmail user hasn’t been accused of any wrongdoing.

[...]

Some lawyers say the Ware’s order is problematic because it affects the Gmail account holder’s First Amendment rights to communicate online, as well as his or her privacy rights.

“It’s outrageous that the bank asked for this, and it’s outrageous that the court granted it,” says John Morris, general counsel at the Center for Democracy & Technology. “What right does the bank have and go suspend the email account of a completely innocent person?”

He adds: “At the end of the day, the bank obviously screwed up. But it should not be bringing a lawsuit against two completely innocent parties and disrupting one of the innocent party’s email contact to the world.”

Read the full story on MediaPost. One of the provisions in the order was that:

Google shall immediately disclose to Plaintiff and the Court the status of the Gmail Account, specifically, whether the Gmail Account is dormant or active, whether the Inadvertent Email was opened or otherwise manipulated, and in the event that the Gmail Account is not dormant, the identity and contact information for the Gmail account holder. [But first, let's screw this guy by cutting him off! Bob]

The temporary restraining order is available here, courtesy of the How Appealing blog.

But that’s not the end of the story. Google and Rocky Mountain Bank subsequently filed a joint motion stating that the case is now moot and asking the federal district court to vacate the temporary restraining order so that Google could reactivate the email account in question.

The joint motion does not unring the privacy bell on this case, however. Should the court have complied with the bank’s request to invade a Gmail user’s privacy because the bank screwed up?



This is worth a read.

http://www.pogowasright.org/?p=4153

Social Network Site Privacy: A Comparative Analysis of Six Sites

September 26, 2009 by Dissent Filed under Internet, Non-U.S.

Research by Jennifer Barrigar for the Office of the Privacy Commissioner of Canada compares Facebook, Hi5, LinkedIn, LiveJournal, MySpace, and Skyrock.

This report was prepared for the Office of the Privacy Commissioner by Jennifer Barrigar, a consultant and researcher with experience in both privacy law and developments in internet technology. It was originally commissioned in late 2008, and a final report was delivered to the Office in February 2009.

Social networks frequently make amendments or additions to their privacy policies and protections. As a result, some of the observations made in this report may appear outdated or even incorrect. This is certainly the case with Facebook, one social network that has undertaken successive rounds of privacy amendments in 2009.

This is not the case with many of the other social networking sites identified by Ms. Barrigar. They are among the most popular sites with Canadians, but are largely developed and headquartered outside Canada. As a result, they offer significantly different levels of privacy protection for their users. This report identifies areas where these sites need to improve their policies and take steps to effectively protect the personal information of their users.

Colin McKay
Director of Research, Education and Outreach

PDF version of report HTML version of report



Don't ya just love these...

http://www.pogowasright.org/?p=4137

Photojournalist sues government over raid

September 25, 2009 by Dissent Filed under Court, Surveillance, U.S.

Laura Sennett is a photojournalist who covers political demonstrations and protests and often publishes her photographs under the alias of “Isis.”

On April 12,2008, Sennett was photographing protests in Washington, D.C. related to the spring meeting of the International Monetary Fund (IMF). The protests became violent, and Sennett claims that like others, she ran away after smoke-generating devices went off.

What happened next is the subject of a lawsuit Sennett has filed against the U.S. Department of Justice, Attorney General Eric Holder, the FBI Joint Terrorism Task Force, Prince William County Police Department, Arlington County Police Department, and two individual detectives who allegedly acted at the direction of these federal entities and under color of federal authority.

Sennett claims that although she was not a target of any criminal investigation and there was never anything connecting her to causing or participating in any violence at the demonstration, the defendants subsequently ordered or conducted a general search of her home and seized and kept Sennett’s work-related equipment, including computer hardware and data, digital cameras and memory cards, a still camera, digital storage devices, and a digital voice recorder. They also allegedly seized and retained work product and documentary materials directly related to Sennett’s profession as a photojournalist, including photographs, other work products, and personal belongings.

Sennett claims that their actions violated the Privacy Protection Act of 1980, and the First and Fourth Amendments to the United States Constitution.

According to the complaint, the authorities did have a search warrant, but the warrant was issued on the basis of false and misleading information purposefully provided by the defendants. Specifically, the affidavit in support of the warrant signed by one of the detectives allegedly failed to state that Sennett was a photojournalist, even though Sennett cites other statements by the defendants that demonstrate that they knew she was a photojournalist engaged in photojournalism at the time they applied for the warrant.

Sennett was never charged criminally nor arrested in connection with either the protest nor any materials obtained via the search or seizure.

The entire complaint can be found here.

Hat-tip, Courthouse News.



http://www.darkreading.com/insiderthreat/security/client/showArticle.jhtml?articleID=220200118

Up To 9 Percent Of Machines In An Enterprise Are Bot-Infected

Most are members of tiny, unknown botnets built for targeting victim organizations

Sep 24, 2009 | 03:59 PM By Kelly Jackson Higgins DarkReading

Bot infections are on the rise in the enterprise, and most come from botnets you've never heard of nor ever will.

In a three-month study of more than 600 different botnets found having infiltrated enterprise networks, researchers from Damballa discovered nearly 60 percent are botnets that contain only a handful to a few hundred bots built to target a particular organization.

… The bad guys are also finding that deploying a small botnet inside a targeted organization is a more efficient way of stealing information than deploying a traditional exploit on a specific machine. And Ollmann says many of the smaller botnets appear to have more knowledge of the targeted organization as well. "They are very strongly associated with a lot of insider knowledge...and we see a lot of hands-on command and control with these small botnets," he says.



Another “term of art” for my Computer Security students. Sounds like they detect malware and precipitate a denial of service attack at the same time.

http://it.slashdot.org/story/09/09/26/0228253/Ants-Vs-Worms-mdash-Computer-Security-Mimics-Nature?from=rss

Ants Vs. Worms — Computer Security Mimics Nature

Posted by Soulskill on Saturday September 26, @05:14AM from the incompatible-with-raid dept

An anonymous reader writes with this excerpt from Help Net Security:

"In the never-ending battle to protect computer networks from intruders, security experts are deploying a new defense modeled after one of nature's hardiest creatures — the ant. Unlike traditional security devices, which are static, these 'digital ants' wander through computer networks looking for threats ... When a digital ant detects a threat, it doesn't take long for an army of ants to converge at that location, drawing the attention of human operators who step in to investigate. 'Our idea is to deploy 3,000 different types of digital ants, each looking for evidence of a threat,' [says Wake Forest Professor of Computer Science Errin Fulp.] 'As they move about the network, they leave digital trails modeled after the scent trails ants in nature use to guide other ants. Each time a digital ant identifies some evidence, it is programmed to leave behind a stronger scent. Stronger scent trails attract more ants, producing the swarm that marks a potential computer infection.'"



Scraping the bottom of the barrel? (Probably won't make it into those “I'm a Mac. I'm a PC” ads.

http://www.computerworld.com/s/article/9138517/Hackers_pay_43_cents_per_hijacked_Mac?source=rss_news

Hackers pay 43 cents per hijacked Mac

Russian cyber crime gangs after Apple's Macs, too, says researcher

By Gregg Keizer September 25, 2009 01:58 PM ET

… Mac OS X's security has been roundly criticized by vulnerability researchers, but even the most critical have acknowledged that the Mac's low market share -- it accounted for just 5% of all operating systems running machines that connected to the Internet last month -- is probably enough protection from cyber criminals for the moment.

Samosseiko's paper on Partnerka can be downloaded from Sophos' site (download PDF).


(Related) In fact, from the same paper as the previous article. e-Crime pays!

http://arstechnica.com/security/news/2009/09/viagra-spam-brings-bulging-returns-of-more-than-4000day.ars

Viagra spam brings bulging returns of more than $4,000/day

A peek into the world of spam affiliate networks has revealed that there is indeed a lot of money to be made by pushing all those Viagra and Cialis e-mails. Even if only a few people make purchases, it's enough to make spamming worthwhile and guarantee that the rest of our inboxes will remain crowded.

By Jacqui Cheng Last updated September 25, 2009 1:06 PM CT



Why?

http://mashable.com/2009/09/25/social-networking-triple/

STUDY: Time Spent on Social Networks Has Tripled

September 25th, 2009 | by Christina Warren

Social networking usage by Americans continues to soar. According to a new report from The Nielsen Company, Americans spent 17% of all their Internet time using social networking sites. This was nearly triple the time spent a year ago.



Sharp lawyering? No one will invoke: “to have compulsory process for obtaining witnesses in his favor” will they?

http://yro.slashdot.org/story/09/09/24/238251/CA-City-Mulls-Evading-the-Law-On-Red-Light-Cameras?from=rss

CA City Mulls Evading the Law On Red-Light Cameras

Posted by kdawson on Friday September 25, @11:32AM from the wrong-on-so-many-levels dept.

TechDirt is running a piece on Corona, CA, where officials are considering ignoring a California law that authorizes red-light cameras — cutting the state and the county out of their portion of the take — in order to increase the city's revenue. The story was first reported a week ago. The majority of tickets are being (automatically) issued for "California stops" before a right turn on red, which studies have shown rarely contribute to an accident. TechDirt notes the apparent unconstitutionality of what Corona proposes to do:

"The problem here is that Corona is shredding the Sixth Amendment of the US Constitution, the right to a trial by jury. By reclassifying a moving violation... to an administrative violation... Corona is doing something really nefarious. In order to appeal an administrative citation you have to admit guilt, pay the full fine, and then apply for a hearing in front of an administrative official, not a judge in a court. The city could simply deny all hearings for administrative violations or schedule them far out in advance knowing full well that they have your money, which you had to pay before you could appeal."

[From the article:

Since May, the red light cameras in the city of Corona, California have issued a total of 6511 citations worth $2,903,906. [I make that $446 per ticket! And these guys want more? Bob]

… Currently Corona only collects $133.80 out of each $446 ticket.



Lawyers as lobbyists.

http://tech.slashdot.org/story/09/09/26/0130238/Legal-Group-Says-Unlimited-Broadband-Promotes-Piracy?from=rss

Legal Group Says Unlimited Broadband Promotes Piracy

Posted by Soulskill on Saturday September 26, @02:15AM from the not-to-mention-unrestrained-tweeting dept.

bennyboy64 writes

"Unlimited broadband plans are all too familiar in many countries; in Australia they're scarce. One ISP offering such a plan between the hours of 8pm and 8am, AAPT, is being looked at as a matter of high interest by a legal group representing the interests of the global film industry, AFACT (the Australian Federation Against Copyright Theft). It said AAPT was encouraging users to download copyrighted material. AAPT's advertising states: 'If you want unlimited music, unlimited games and unlimited movies — get unlimited off-peak broadband downloads from AAPT.' AFACT executive director Adrianne Pecotic said: 'In the context of the AAPT promotion, we have a concern that it could be misconstrued to promote illegal downloads [Apparently, it has – but only by lawyers. Bob] and that's something that we'd like clarified.' AFACT is currently involved in what will be a landmark court case with Australian ISP iiNet. It recently claimed in court proceedings that there was a link between iiNet upgrading the service plans of heavy-internet users and the proliferation of film piracy."



Expect straight A's. How could I not? My computer writes my papers. (Note: This only works in English. It will take years to translate it to “Amurikin”)

http://tech.slashdot.org/article.pl?sid=09/09/26/0119230

Computers To Mark English Essays

Posted by Soulskill on Saturday September 26, @12:19AM from the i-fear-the-day-scantron-wakes-up dept.

digitig writes

"According to The Guardian, computers are to be used in the UK to mark English examination essays. 'Pearson, the American-based parent company of Edexcel, is to use computers to "read" and assess essays for international English tests in a move that has fueled speculation that GCSEs and A-levels will be next. ... Pearson claims this will be more accurate than human marking. 'Can computers now understand all the subtle nuances of language, or are people going to have to learn an especially bland form of English to pass exams?"



For my Forensics students

http://www.cbsnews.com/stories/2009/09/25/tech/main5339112.shtml

Sept. 25, 2009

Digital Fingerprints Led Feds to Zazi

Investigators Followed a Digital Path to Track Down the Incriminating Evidence on Suspected Terrorist

… As you read the indictment and order for permanent detention you can almost picture the various connected databases and monitoring techniques at work. Simply put, Internet surveillance and information technology sleuthing played a big role in the Zazi case. FBI agents arrested Zazi in Colorado.

Jeffrey Knox, an assistant U.S. attorney, tells the tale in the permanent detention document.



For my statistics students. NOW do you see why I used that test question? (and yes, it is the auditor in me!)

http://news.slashdot.org/story/09/09/26/0021250/Math-Indicates-Pollster-Is-Forging-Results?from=rss

Math Indicates Pollster Is Forging Results

Posted by Soulskill on Friday September 25, @08:25PM from the lies-damned-lies-and-statistics dept.

An anonymous reader writes

"Nate Silver suggests the political pollster Strategic Vision is 'cooking the books. And whoever is doing so is doing a pretty sloppy job.' Silver crunched five years worth of their polling data, and found their reported results followed a suspicious pattern which traditionally suggests fraud. The five-year distribution of the numbers 'is not random. It's not close to random.' The polling firm had already been reprimanded by the American Association for Public Opinion Research for failing to disclose their methodology, though the firm argues they did comply with the organization's request. Their response to Silver's accusation? ' We have a call in to our attorney on this and fully intend to take action that will vindicate us.'"

[From the article:

Blogger Nate Silver crunched over four years of data from the firm's polls -- and says he's discovered the pollster's most-commonly reported numbers end in either a seven or an eight. "Over a sample of more than 5,000 data points, such an outcome occurring by chance alone would be an incredible fluke," Silver argues, "millions to one against."



It's not all free, but any site with 152 listings for “covert surveillance” has to be worth a look.

http://www.killerstartups.com/Web20/getabest-com-find-download-software-online

GetABest.com - Find & Download Software Online

http://www.getabest.com/

Are you looking for free Web 2.0 software downloads and don’t know exactly where to head to in order to achieve that aim? If that is so, then this site will most likely point you in the right direction. In principle, it acts as a directory of such software, split into a wealth of categories including “Business”, “Home & Hobby”, “Education” and so forth.



Most interesting. I'd like to see this applied to our online class “Forums” to organize the comments. Be sure to watch the video!

http://www.poynter.org/column.asp?id=101&aid=169103

Washington Post Develops Visual, Web-like Commenting System

Posted by Patrick Thornton at 6:15 AM on Sep. 1, 2009

Washingtonpost.com has developed a new commenting interface dubbed "WebCom" that arranges comments in a web based on which ones are most-liked by readers and spur the most discussion.



I need to work with this, but if it will allow me to store cites in APA Style, I'm hooked!

http://www.makeuseof.com/tag/icyte-capture-web-pages-and-highlight-text-in-a-flash/

iCyte: Capture Web Pages And Highlight Text In A Flash

Sep. 25th, 2009 By Dean Sherwin

… iCyte is a browser add-on that allows you to capture web pages, highlight text and save it to your account.

… Go to the web page you would like to save. If there is text on the page of particular relevant to you then highlight it using the mouse as you would if your were going to Copy & Paste. While the text is highlighted, click the iCyte button along the top of the browser in the iCyte toolbar. A window will open.



He invented global warming, no reason he shouldn't make a buck on it... (...and no doubt the Fins can develop a car easier and better than Detroit.) Anyone want to “develop” a golf cart for commuting?

http://tech.slashdot.org/story/09/09/26/1323214/529M-Govt-Loan-To-Develop-89000-Hybrid-Sports-Car?from=rss

$529M Gov't Loan To Develop $89,000 Hybrid Sports Car

Posted by Soulskill on Saturday September 26, @10:16AM from the please-tell-me-it-has-lasers dept.

theodp writes

"The WSJ reports that a tiny car company backed by former VP Al Gore has just gotten a $529M US government loan to help build an $89,000 hybrid sports car in Finland. The award this week to California startup Fisker Automotive follows an earlier $465M government loan to Tesla Motors, purveyors of a $109,000 British-built electric Roadster. Fisker's other investors (PDF) include the Al Gharaffa Investment Co., a Cayman Islands corporation."

Friday, September 25, 2009

Another case of hackers getting through “all required security measures.” Another question: Why is the identifying data online? Is there a scientific connection between your Social Security number and breast cancer? (HIPAA violation as well?)

http://www.databreaches.net/?p=7511

Hacker hits UNC-Chapel Hill study data

September 25, 2009 by admin Filed under Breach Incidents, Breach Types, Education Sector, Hack, Of Note, U.S.

From McClatchy Newspapers:

A hacker has infiltrated a computer server housing the personal data of 236,000 women enrolled in a UNC-Chapel Hill research study.

Among the information exposed: the Social Security numbers of 163,000 study participants.

Though the intrusion was detected in late July, computer forensics experts say it may have happened two years ago, said Matthew Mauro, chairman of the UNC-CH Department of Radiology.

And though UNC-CH officials and a private computer forensic expert have spent two months investigating, they still don’t know who did the hacking, where the attack originated, or even whether data was downloaded.

”There’s no direct evidence that any information has been removed,” Mauro said. “But we can’t say for sure.”

The compromised server had all required security measures, Mauro said. It was one of two servers housing data on more than 662,000 women. The data are part of the Carolina Mammography Registry, a 14-year-old project that compiles and analyzes mammography results submitted by radiologists across the state.

Read more in News-Record.comr.



Mostly extreme back-patting, but I'll have to read it more carefully to see what they aren't saying.

http://www.pogowasright.org/?p=4115

DHS issues annual privacy report to Congress

September 24, 2009 by Dissent Filed under Featured Headlines, Govt, Other, U.S.

The Department of Homeland Security Privacy Office has released its privacy report [pdf] for the period July 2008 – June 2009.



Another perspective.

http://www.thetechherald.com/article.php/200939/4504/Cyveillance-More-than-half-of-the-active-threats-online-go-undetected

Cyveillance: More than half of the active threats online go undetected

by Steve Ragan - Sep 24 2009, 17:00

Cyber intelligence-based security vendor Cyveillance recently released the results of an internal study that says, even with the latest anti-Virus protection, users have a 1-in-2 chance of being infected by Malware. In short, the report says traditional Malware protections are failing you.

… If you want to read the report, you can view it online here.



Help Google spend its money.

http://news.cnet.com/8301-30684_3-10360903-265.html?part=rss&subj=news&tag=2547-1_3-0-20

Google announces Project 10^100 themes

by Tom Krazit September 24, 2009 1:17 PM PDT

Google has finally whittled down the more than 150,000 ideas submitted as part of its Project 10^100 to 16 themes that will compete for $10 million in funding.

It's taken far longer than Google had originally anticipated, but the results of the company's 10th anniversary project to solicit ideas that could change the world are ready for inspection. Google is asking the public to vote on the most worthy of the 16 "idea themes" that it has identified from the submissions it has received over the past year.



For my Forensic students? In any case, my local library has it on order, so now I'm HOLD number 1 of 1. Simple.

http://news.cnet.com/8301-13860_3-10361244-56.html?part=rss&subj=news&tag=2547-1_3-0-20

Microsoft Office plays detective in new novel

by Ina Fried September 25, 2009 4:00 AM PDT

Like many who spend their days trapped inside a cubicle, Microsoft Office probably dreams of living a more exciting life. Perhaps, when it was just a beta, it thought maybe it would grow up to be a policeman.

Well, in "Crush," a new crime novel, the mundane piece of software gets its chance. Office, or at least one key Office document, ends up playing a central role in the pursuit of a serial killer.

Without giving away too much of the plot, it's fair to say that a certain PowerPoint file becomes a key piece of evidence, with a worker at Microsoft finding central clues within the document's metadata.

… Gadgetry infuses the pages of Crush. While Office has the starring role, a number of products make cameos, including Windows Live, Surface, Outlook and even RoundTable, which Microsoft handed off last year to Polycom. In fact, there were so many Microsoft products, I thought perhaps it was some sort of paid placement.



I've had some interesting results playing with this. Give it a try yourself.

http://www.killerstartups.com/Search/bigola-com-search-everywhere-by-searching-just-once

Bigola.com - Search Everywhere By Searching Just Once

http://www.bigola.com/index.php

Bigola is a new portal that will enable you to combine the results from Twitter, Youtube, Digg, Friendfeed and Technorati when executing a single search. That is, you supply the query that represents your interests and then proceed to filter the results by clicking on the corresponding logo from the ones grouped on the right-hand side of the screen , underneath the “Filter by site” banner.

In this way, you can jump from results within one site to the other and have a very good overview of the way things are shaping up socially. If you have just launched a product, for example, you will be able to realize the impact it is having so far and take any corrective measures that might be necessary while there is still time.

Social media is not huge – it is actually immense, and it escalates by the second. to discover who is talking about what, and find exactly the kind of talk that is taking place have a definitive niche



For my website students

http://www.insidecrm.com/features/101-web-site-fixes-031808/

101 Five-Minute Fixes to Incrementally Improve Your Web Site

These quick tweaks will help you keep visitors engaged.

By Inside CRM Editors



Global Warming! Global Warming!

http://www.wired.com/wiredscience/2009/09/sunspots/

Photo: The Sun Gets Its Spots (Back)

By Alexis Madrigal September 24, 2009 6:27 pm

Two sunspots are visible on our star’s face for the first time in more than a year, possibly ending an unexpected lull in solar activity.

[Why does Al Gore care, you ask?

http://features.csmonitor.com/environment/2009/08/27/one-sunspot-mystery-solved-researchers-say/

Here’s the mystery when it comes to sunspots:

The small increase in energy emitted by the sun during solar maximums (the peak of sunspot activity) doesn’t seem to match the higher temperatures observed on earth. During sunspot years, the sun’s total energy output rises by just one-tenth of one percent. During those years, average sea surface temperatures increase by about 0.1 degrees C. But scientists calculate that, to get those higher temperatures, the amount of solar energy reaching earth would have to increase by about 0.5 Watts per square meter. And that’s where observed reality refuses to align with scientists’ number-crunching. During the peak of the sunspot cycle, the energy reaching Earth only increases by about 0.2 Watts per square meter – less than half what scientists think is necessary.

In short, Earth seems to warm up too much during solar maximums. Where is that extra energy coming from? [My guess? Congressional hot air! Bob]

Thursday, September 24, 2009

Definitely something to watch. If I read this correctly, I can annotate your website. Will you like what I say? Can you do anything about it?

http://www.google.com/sidewiki/intl/en/learnmore.html

Google Sidewiki

Google Sidewiki is a browser sidebar that lets you contribute and read information alongside any web page.



Perhaps not the best strategy.

http://www.pogowasright.org/?p=4108

Acorn sues filmmakers, cites privacy law

September 24, 2009 by Dissent Filed under Breaches, Court

Ben Nuckols of Associated Press reports:

Acorn and two former employees of its Baltimore office filed a multimillion-dollar lawsuit Wednesday against the makers of a hidden-camera video that showed the employees giving tax advice to a man posing as a pimp and a woman posing as a prostitute.

[...]

The lawsuit names James O’Keefe III and Hannah Giles, who played the pimp and prostitute in the video, as defendants. It also names conservative columnist and blogger Andrew Breitbart of Los Angeles, who posted it on his Web site, biggovernment.com.

Read the full story on Delaware Online. The lawsuit alleges that the defendants violated Maryland Wiretap Law.

Related: Complaint (pdf)



Factual but ultimately futile? “We're your bank, our money is safe with us!”

http://www.databreaches.net/?p=7505

Construction firm sues after $588,000 online theft

September 24, 2009 by admin Filed under Breach Incidents, Business Sector

Jeremy Kirk reports:

A construction company in Maine is suing its bank after about $588,000 disappeared from its accounts, alleging the bank failed to spot suspicious account activity before it was too late.

Over a week-long period in May, fraudsters made six transfers from the online bank accounts of Patco Construction Company, a family-owned developer in Sanford, Maine, according a copy of the lawsuit on the Washington Post’s Web site.

[...]

Patco argues that Ocean Bank did not offer two-factor authentication, which often involves the use of a token that displays a one-time password or a verification telephone call.

Patco also said the transfers were initiated from IP (Internet Protocol) addresses that had never been used by Patco, the transfers far exceeded what the company normally performed and were on days other than Friday, when the company paid its employees by direct deposit.

“None of these transactions triggered any suspicious activity alerts on the part of Ocean Bank,” the lawsuit alleges.

Read more in The Standard.



Can politicians be that ignorant? How does this protect anything?

http://www.databreaches.net/?p=7489

Ohio Officials, Insurers Look to Protect Policyholder Data

September 23, 2009 by admin Filed under Legislation, State/Local

Starting Nov. 2, 2009, Ohio regulators and all insurance companies that do business in the state will begin new procedures designed to protect policyholders’ personal information.

Insurance companies will be required to report any loss of policyholder information within their possession to the Department of Insurance within 15 days of the discovery that the information has been lost or stolen, according to Insurance Director Mary Jo Hudson.

Read more on Insurance Journal.

[Here is the actual “Bulletin”:

http://www.insurance.ohio.gov/Legal/Bulletins/Documents/2009-12.pdf



Well, here's a shocker.

http://www.pogowasright.org/?p=4088

‘Sneak-and-peek’ searches being used for regular crimes

September 23, 2009 by Dissent Filed under Featured Headlines, Govt, Surveillance, U.S.

Raw Story reports:

The Justice Department made 763 requests for “sneak-and-peek” warrants in 2008, but only three of those had to with terrorism investigations, Sen. Russ Feingold told a Senate Judiciary Committee hearing on Wednesday.

“Sneak-and-peek” warrants allow law enforcement officials to break into homes and businesses and search the premises without the investigated party knowing. The authority for them was passed as part of the USA Patriot Act in late 2001, ostensibly as a counter-terrorism measure.

Read the full article on Raw Story.

Video of some of Assistant Attorney General Dave Kris’s testimony and interaction with Senator Feingold:

http://www.youtube.com/watch?v=r0E9iX2ivd0&feature=player_embedded#t=55



...and we thought texting while driving was dangerous!

http://news.cnet.com/8301-13515_3-10359425-26.html

12mail: Short video messaging arrives on iPhone

by Harrison Hoffman September 23, 2009 7:28 AM PDT

12seconds.tv, a micro video messaging service dubbed by some as "Twitter for video," is bringing the same short format to private video messaging in its second iPhone app, 12mail.

The basic gist of the app, released this week, is that you can record a video, up to 12 seconds, and send it off to one of your friends. Your friend then gets a push notification and can watch it.



For my Business Continuity students. Can you say “Clogged filters?”

http://tech.slashdot.org/story/09/09/23/222208/Aussie-Data-Centres-Brace-For-Dust-Storm-Barrage?from=rss

Aussie Data Centres Brace For Dust Storm Barrage

Posted by samzenpus on Thursday September 24, @12:48AM from the sand-gets-in-your-tubes dept.

An anonymous reader writes

"Data centers and telcos in the Australian cities of Sydney and Brisbane have shut off external ventilation systems, restricted loading dock access and attended false alarms after a major dust storm choked the cities today. The storm is said to be the worst of its type ever recorded in Australia. Macquarie Telecom disengaged automatic deployment of fire-prevention gas from the fire alarm to prevent gas being released on a false alarm. Other major data center operators reported clogged air filters and heat exchangers and said they would be performing cleaning and maintenance operations this week."



Seven e-book sites.

http://news.cnet.com/8301-17939_109-10358046-2.html?part=rss&subj=news&tag=2547-1_3-0-20

Find a great e-book to read online with these sites

by Don Reisinger September 23, 2009 1:24 PM PDT



Tools & Techniques: Forensics

http://www.makeuseof.com/tag/how-to-recover-data-from-a-corrupt-memory-card-or-usb-drive/

How to Recover Data From a Corrupt Memory Card or USB Drive

Sep. 24th, 2009 By Karl L. Gechlik