Centennial Man: 2009-10-18

Saturday, October 24, 2009

For your Computer Security manager. (This is why we want to bring back flogging)

http://www.wired.com/threatlevel/2009/10/vulnerable-devices

Scan of Internet Uncovers Thousands of Vulnerable Embedded Devices

By Kim Zetter October 23, 2009 4:25 pm

Researchers scanning the internet for vulnerable embedded devices have found nearly 21,000 routers, webcams and VoIP products open to remote attack. Their administrative interfaces are viewable from anywhere on the internet and their owners have failed to change the manufacturer’s default password. [Works with sites like this one: http://www.phenoelit-us.org/dpl/dpl.html Bob]

Linksys routers had the highest percent of vulnerable devices found in the United States — 45 percent of 2,729 routers that were publicly accessible still had a default password in place. Polycom VoIP units came in second, with default passwords lingering on about 29 percent of 585 devices accessible over the internet.

Maybe we just do this for fun...

http://news.cnet.com/8301-27080_3-10382519-245.html?part=rss&subj=news&tag=2547-1_3-0-20

Spying on a stolen laptop

by Elinor Mills October 23, 2009 5:32 PM PDT

… Someone broke into the car of an employee working for an InertLogic customer and stole the laptop, which had work and personal information on it.

Months went by [too often the case Bob] before anyone realized that technology InertLogic uses to help manage equipment remotely was sitting on the laptop and could be flipped on to monitor it. The technology, from Kaseya, captures screenshots from remote machines and can be used to install keyloggers, as well as record audio and images from a Webcam.

Fleener relied only on the screenshots that were taken captured every 5 or 10 seconds to see what the user of the laptop was up to. Within a short time, he learned the name, address, and other sensitive information about the man using the laptop. (Fleener is careful not to accuse the individual of being the thief because there is no proof of that.) [Is that why the keylogger wasn't turned on? Bob]

The man visited Facebook, MySpace, and other social networks, according to Fleener. He used Google to search for auto parts and did queries on how to remove security tags from merchandise. He looked at porn and made pirate copies of DVDs, including "Harry Potter and the Half-Blood Prince." Every time the laptop went online, typically on weekend nights and never on Tuesday, Fleener and others got paged.

Benjamin Lavalley, a senior engineer at Kaseya, figured out that by looking at the nearby Wi-Fi access points and doing an online map search, they could try to find out the exact location of the laptop.

Interesting, but if Congress investigated every government entity that failed to do their job they'd have no time to do anything they like (like fund raising)

http://www.pogowasright.org/?p=4740

Privacy Coalition Seeks Investigation of DHS Chief Privacy Office

October 24, 2009 by Dissent Filed under Govt, Surveillance, U.S.

From EPIC.org:

EPIC joined the Privacy Coalition letter sent to the House Committee on Homeland Security urging them to investigate the Department of Homeland Security’s (DHS) Chief Privacy Office. DHS is unrivaled in its authority to develop and deploy new systems of surveillance. The letter cited DHS use of Fusion Center, Whole Body Imaging, funding of CCTV Surveillance, and Suspicionless Electronic Border Searches as examples of where the agency is eroding privacy protections.

The Coalition’s letter argues, in part:

The primary statutory duty of the Chief Privacy Officer is to assure “that the use of technologies sustain, and do not erode, privacy protections.”⁵ The CPO has not done so, focusing instead almost exclusively on the fourth statutory duty, conducting a “privacy impact assessment”⁶ on each Department action. The structure of the annual report reveals the Office’s confusion of these two duties, to the detriment of the former. The report notes that the Office “is divided into two major functional units: Privacy Compliance; and Departmental Disclosure and FOIA.”⁷ The report claims that the Compliance Group “manages statutory and policy-based responsibilities by working with each component and program throughout the Department to ensure that privacy considerations are addressed when implementing a program, technology, or policy.”⁸ This description should encompass the fulfillment of the statutory responsibility to prevent erosion of privacy. Yet the section of the annual report entitled “Compliance” barely discusses ways in which the Office has done so; it focuses almost entirely on the conducting of assessments.⁹ In fact, the “Privacy Compliance Process” graphic describes the process as containing Review, Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA), and if necessary, a System of Records Notice (SORN), followed by a repetition of the cycle after three years for programs still in force.¹⁰

Looks like the school is screwed, unless “dropping” the phone is the same as “using” the phone and at the same time creates “reasonable suspicion”

http://www.pogowasright.org/?p=4729

School had no right to read messages on student’s cell phone, family say

October 23, 2009 by Dissent Filed under Breaches, Court, U.S., Youth

Eric Been reports:

Owensboro High School violated the Constitution by confiscating a student’s cell phone after it slipped from his pocket during class, and expelling him because of the text messages that school officials read on it, the student’s family claims in Federal Court.

The student, identified only as G.C., says his teacher confiscated his phone “pursuant to school policy,” on Sept. 2. The teacher, the principal and two assistant principals then performed a “warrantless and illegal search” by reading the text messages on the phone, the family says.

The family says G.C. was expelled “as a result of the warrantless and illegal search.”

Friday, October 23, 2009

Looks like someone is selling a “Small Crime Kit”

http://www.databreaches.net/?p=7952

McDonald’s Canada targeted by debit fraud

October 23, 2009 by admin Filed under Breach Incidents, Business Sector, ID Theft, Non-U.S., Skimmers

McDonald’s Canada is co-operating with Winnipeg police as they investigate allegations of debit card fraud targeting at least one of the fast-food chain’s local outlets and ranging as far as Quebec.

The news Thursday came one day after Winnipeg police said hundreds of people were victimized after debit card machines and PIN pads had been compromised by thieves at a few local restaurants.

Police would not comment on specific names or locations of the restaurants but said their investigation so far has revealed fewer than five establishments are involved.

Thursday, October 22, 2009

Not huge, but it allows me to continue my rant against “security” systems that don't detect breaches for months... (Also I wonder why customer data is stored with their website)

http://www.databreaches.net/?p=7894

The Vernon Company database accessed; customers notified

October 21, 2009 by admin Filed under Breach Incidents, Breach Types, Business Sector, Hack, U.S.

Iowa-based The Vernon Company recently discovered that its system had been accessed via its vernoncompany.com web site. The breach was discovered on October 6, and the company shut down the web site until it could patch the vulnerabilities were patched. Further investigation suggested that the breach originated in Singapore, and may have occurred as early as July 2009. The company notified the FBI of the incident and notified (pdf) the New Hampshire Attorney General’s Office on October 12 that 19 New Hampshire residents were affected by the incident.

The breach may have resulted in access to customers’ names, addresses, credit or debit card numbers, and card expiration dates. The company says it has no evidence that the data have been acquired or misused, and did not offer affected customers any free credit monitoring services.

Harassment on the face? Or is it a crime to get a “B” in a Journalism class?

http://www.pogowasright.org/?p=4684

Northwestern journalism students fight subpoenas

October 21, 2009 by Dissent Filed under Court, Featured Headlines, U.S., Youth

The Student Press Law Center reports:

Journalism students working on the Medill Innocence Project at Northwestern University’s Medill School of Journalism are fighting subpoenas requesting their grades, off-the-record interviews, electronic communications, notes, course syllabi, grading criteria for the course and receipts for expenses that students incurred for their investigation of the case of Anthony McKinney, who was convicted and jailed in 1978 for allegedly shooting a security guard in Harvey, Ill.

Illinois assistant state’s attorneys sent Medill professor David Protess, the instructor of the Innocence Project course, a subpoena May 20 to appear in Cook County’s Circuit Court on June 11 with the requested materials. Protess and his students retained the services of Richard J. O’Brien and Linda R. Friedlieb of Sidley Austin LLP, and they are attempting to quash the subpoena on the grounds that the students are protected by the Illinois Reporter’s Privilege Act and the Family Educational Rights and Privacy Act (FERPA), according to the Medill Innocence Project’s Web site.

Read more on The Student Press Law Center. Professor Protess provides the background and commentary on the McKinney case on the Medill Innocence Project web site.

I can't wait. Well, actually I can.

http://radar.oreilly.com/2009/10/why-google-and-bings-twitter-a.html

Why Google and Bing's Twitter Announcement is Big News

Tweets will finally become first class web citizens

by James Turner

Lurking innocently on Google's blog this afternoon, like many of their big announcements, was the bombshell that they have reached an agreement with Twitter to make all tweets searchable. This followed an earlier announcement at the Web 2.0 conference by Microsoft that Bing has also arranged to make tweets searchable.

This is not only a huge thing for Twitter, it is also well past due. Until now, Twitter really hasn't been a first class web citizen, because you're not really part of Web 2.0 until you're searchable by Google (and, I suppose, Bing).

… The Bing interface is interesting, it seems to be a hybrid of a web search engine and a twitter search.

Has the time for encryption finally come?

http://www.thetechherald.com/article.php/200943/4650/PCI-DSS-and-HIPAA-drive-encryption-projects

PCI DSS and HIPAA drive encryption projects

by Steve Ragan - Oct 21 2009, 16:30

Thales recently released their Key Management benchmark survey, reporting that of all the things that could drive an encryption project in IT, HIPAA and PCI DSS are the top two reasons companies are moving forward with encryption initiatives.

… Their findings show that in Europe, 52-percent of those who answered the survey are planning encryption projects so that they can comply with PCI DSS regulations. In the U.S., 53-percent said their encryption projects are based on compliance needs for HIPAA.

… Another issue with availability is key management, the central part to any encryption project, no matter what the solution is. The Thales survey showed that eight percent of those surveyed have had to deal with a lost encryption key in the last two years. [Compare with the percentage of drivers who lock their keys in the car? Bob] According to the survey report, these losses resulted in business disruptions or permanent data loss for 39-percent of those who’ve dealt with the issue.

… Moreover, when asked about their own company's plans for cloud computing, 47-percent said they would not move to the cloud unless data was encrypted, and another 43-percent said they have no cloud-based plans at all.

Should we wait for congress? (AKA: the next Ice Age)

http://www.eff.org/deeplinks/2009/09/net-neutrality-fcc-perils-and-promise

Is Net Neutrality a FCC Trojan Horse?

Commentary by Corynne McSherry October 21st, 2009

… But Congress has never given the FCC any authority to regulate the Internet for the purpose of ensuring net neutrality. In place of explicit congressional authority, we expect the FCC will rely on its "ancillary jurisdiction," a position that amounts to “we can regulate the Internet however we like without waiting for Congress to act.” (See, e.g., the FCC's brief to a court earlier this year). That’s a power grab that would leave the Internet subject to the regulatory whims of the FCC long after Chairman Genachowski leaves his post.

(Related) Does Canada get it right? I don't think so.

http://yro.slashdot.org/article.pl?sid=09/10/21/2223229

CRTC Issues Net Neutrality Rules

Posted by samzenpus on Wednesday October 21, @07:10PM from the play-fair-eh dept.

An anonymous reader writes

""The CRTC today introduced a new framework to guide Internet service providers in their use of Internet traffic management practices. ISPs will be required to inform retail customers at least 30 days, and wholesale customers at least 60 days, before an Internet traffic management practice takes effect. At that time, ISPs will need to describe how the practice will affect their customers' service. The Commission encourages ISPs to make investments to increase network capacity as much as possible. However, the Commission realizes that ISPs may need other measures to manage the traffic on their networks at certain times. Technical means to manage traffic, such as traffic shaping, should only be employed as a last resort.""

Should we offer classes in Twitter starting in grade school? Probably have replaced it by the time we work out a syllabus.

http://www.bespacific.com/mt/archives/022637.html

October 21, 2009

Pew Report: Twitter and Status Updating, Fall 2009

Twitter and Status Updating, Fall 2009, by Susannah Fox, Kathryn Zickuhr, Aaron Smith - Oct 21, 2009

"Some 19% of internet users now say they use Twitter or another service to share updates about themselves, or to see updates about others. This represents a significant increase over previous surveys in December 2008 and April 2009, when 11% of internet users said they use a status-update service. Three groups of internet users are mainly responsible for driving the growth of this activity: social network website users, those who connect to the internet via mobile devices, and younger internet users – those under age 44."

Pew study: Nearly 1 in 5 Net users is tweeting - Twitter’s growth partially due to those on the go who use mobile Internet

E-discovery in complex litigation. How long does it take to review 1,000,000,000 emails?

http://ralphlosey.wordpress.com/2009/10/18/jason-r-baron-the-movie/

Jason R. Baron – The Movie

Jason R. Baron is well known as a lawyer, writer, editor, and thought leader on e-discovery search. This blog is a 30 minute video excerpt of Jason teaching Bill Hamilton and my law school class this week at the University of Florida. Jason’s talk will give you a better understanding of the problem of search, why it is so difficult, and the latest research and trends in this area.

… Jason Baron’s efforts to bridge the disciplines of law and information science are driven by his desire to help the law cope with the sudden explosion in the volume of information. Jason is on the front line of this problem as the Director of Litigation of the National Archives and Records Administration. NARA, among other things, handles White House email litigation and other federal records disputes. He lives in a world where the management of billions of emails and government records are routine. He understand far better than most the need of law to work with science to cope with these issues.

Hacker news

http://news.slashdot.org/story/09/10/21/141206/Metasploit-Project-Sold-To-Rapid7?from=rss

Metasploit Project Sold To Rapid7

Posted by Soulskill on Wednesday October 21, @11:07AM from the onward-and-upward dept.

ancientribe writes

"The wildly popular, open-source Metasploit penetration testing tool project has been sold to Rapid7, a vulnerability management vendor, paving the way for a commercial version of Metasploit to eventually hit the market. HD Moore, creator of Metasploit, was hired by Rapid7 and will continue heading up the project. This is big news for the indie Metasploit Project, which now gets full-time resources. Moore says this will translate into faster turnaround for new features. Just what a commercial Metasploit product will look like is still in the works, but Rapid7 expects to keep the Metasploit penetration testing tool as a separate product with 'high integration' into Rapid7's vulnerability management products."

For those times you need to play “computer security guy” Lists 27 specific malware titles

http://www.makeuseof.com/tag/remove-a-plethora-of-fake-antivirus-software-with-this-free-app/

Remove A Plethora Of FAKE Antivirus Software With This Free App

Oct. 22nd, 2009 By Karl L. Gechlik

I love lists. This one has some boring sites, but a few Easter Eggs too

http://www.maximumpc.com/article/features/50_awesome_websites

50 Kick-Ass Websites You Need to Know About

Posted 10/21/09 at 11:00:00 AM by Alex Castle, Norman Chan, and Forence Ion

Wednesday, October 21, 2009

I'm not aware of anything like this before. Will they also fine TJX, et.al. For failure to encrypt their wireless connections?

http://www.databreaches.net/?p=7882

SEC fines broker-dealer $100,000 over computer security failures

October 21, 2009 by admin Filed under Of Note

Finextra reports:

US broker-dealer Commonwealth Financial Network has been fined $100,000 for failing to insist its registered representatives maintain anti-virus software on their computers. The failure led to an intruder gaining access to the firm’s Intranet, accessing customer accounts and entering unauthorised purchase orders worth over $523,000.

According to an SEC cease and desist order – first published by ZDNet – an intruder used a computer virus in November 2008 to obtain the login credentials of a Commonwealth registered representative.

Some time later that month, the intruder used the login credentials to enter Commonwealth’s Intranet site and view information on how to execute trades.

Tuesday, October 20, 2009

ChoicePoint was the first and remains a whipping boy in the Identity Theft field. You would think they would expend some resources to ensure they eventually get out of the headlines. My Disaster Recovery class will be discussing this tonight...

http://www.databreaches.net/?p=7870

FTC settles latest charges against ChoicePoint

October 19, 2009 by admin Filed under Breach Incidents, Business Sector, Of Note, U.S.

ChoicePoint, Inc., one of the nation’s largest data brokers, has agreed to strengthened data security requirements to settle Federal Trade Commission charges that the company failed to implement a comprehensive information security program protecting consumers’ sensitive information, as required by a previous court order. This failure left the door open to a data breach in 2008 that compromised the personal information of 13,750 people and put them at risk of identify theft. ChoicePoint has now agreed to a modified court order that expands its data security assessment and reporting duties and requires the company to pay $275,000.

In April 2008, ChoicePoint (now a subsidiary of Reed Elsevier, Inc.) turned off a key electronic security tool used to monitor access to one of its databases, and for four months failed to detect that the security tool was off, according to the FTC. During that period, an unknown person conducted unauthorized searches of a ChoicePoint database containing sensitive consumer information, including Social Security numbers. The searches continued for 30 days. After discovering the breach, the company brought the matter to the FTC’s attention.

The FTC alleged that if the security software tool had been working, ChoicePoint likely would have detected the intrusions much earlier and minimized the extent of the breach. The FTC also alleged that ChoicePoint’s conduct violated a 2006 court order mandating that the company institute a comprehensive information security program reasonably designed to protect consumers’ sensitive personal information.

Under the agreed-upon modified court order, filed on the FTC’s behalf by the Department of Justice, ChoicePoint is required to report to the FTC – every two months for two years – detailed information about how it is protecting the breached database and certain other databases and records containing personal information.

The FTC’s prior action against ChoicePoint involved a data breach in 2005, which compromised the personal information of more than 163,000 consumers and resulted in at least 800 cases of identity theft. The settlement and resulting 2006 court order in that case required the company to pay $10 million in civil penalties and $5 million in consumer redress. [What is it worth to the company to avoid that level of fine again? Bob] The company also agreed to maintain procedures to ensure that sensitive consumer reports were provided only to legitimate businesses for lawful purposes; to maintain a comprehensive data security program; and to obtain independent assessments of its data security program every other year until 2026. The new court order extends the record-keeping and monitoring requirements of the 2006 order, and gives the FTC the right to request up to two additional biennial assessments of ChoicePoint’s overall data security program.

The Commission vote to approve the modified stipulated order was 4-0. The order was filed in the U.S. District Court for the Northern District of Georgia, and entered by the court on October 14, 2009.

This article gets filed in our “Identity Thieves are getting more aggressive” folder. A wide variety of “petty” crimes are now tied to Identity theft, and whoever is organizing the crimes seems to be recruiting these little crooks for a small slice of the pie.

http://www.databreaches.net/?p=7875

ID theft ring traced to stolen MVD document

October 19, 2009 by admin Filed under Breach Incidents, Government Sector, ID Theft, Paper, Theft, U.S.

KOAT reports a breach out of New Mexico:

About a month ago, Target 7 reported that Rod White, of Los Ranchos, was indicted on charges of fraud, forgery and identity theft. White tried to pass off fake checks using the state Taxation and Revenue Department’s account number. Officials knew little then, but APD detectives said they have linked White to an organized crime ring that stole identities.

Investigators believe they used various methods to obtain personal information, including a stolen cache of state Motor Vehicle Division documents. One victim said a woman stole her purse right out of her hand in broad daylight at an Albertson’s in the Northeast Heights. Purse snatchings like that one led police to five more people who are also now accused in the theft ring. Those people told detectives that they worked with White. The six are accused of also stealing mail from neighborhoods all over the Duke City. Detectives said the six had a postmaster key they used to open up mail boxes and get information from hundreds of victims. A search of two of the alleged thieves’ homes uncovered more than 400 potential victims. A cache of state Motor Vehicle Division documents with names, Social Security numbers and addresses was also found. Detectives said that the documents were stolen from an MVD worker’s car, parked outside of his home. [Why paper records? Why take the records home? Bob] The documents were used to make fake IDs and fake checks. Police said more arrests are coming soon as the case unfolds..

So I checked this site and I don’t see where we knew about any breach involving the Motor Vehicle Division. Was that breach ever publicly reported? Second, why did the MVD worker have documents in a car? Was that consistent with MVD policy?

Updating the local story...

http://www.databreaches.net/?p=7877

UPDATE: Credit cards also involved in Cheers Liquor breach

October 19, 2009 by admin Filed under Breach Incidents, Business Sector, Hack, ID Theft, Of Note, U.S.

Wayne Heilman reports:

A security breach in the credit-card processing system at Cheers Liquor Mart involves both credit and debit cards and likely involves customers of dozens, if not hundreds, of financial institutions nationwide, the Colorado Springs-based retailer said today.

Cheers has shut down a wireless broadband system that was used to process credit-card transactions and replaced it with an older dial-up system that is more secure and difficult to hack, said James Wall, a Denver-based spokesman for Cheers. The wireless broadband system was first accessed illegally in mid-September, and was shut down last week and replaced with a paper-based system until the dial-up system was installed on Friday, he said.

Monday, October 19, 2009

I fear this is the only way Privacy will come to the land of Big Brother (and is likely to be the way we lose ours)

http://www.pogowasright.org/?p=4611

Privacy law established by stealth in Britain, report says

October 18, 2009 by Dissent Filed under Non-U.S.

Robert Verkaik reports:

Britain has established a privacy law by stealth which has made inroads into all parts of society, a leading human rights law review shows today.

The use of legal arguments based on the claimant’s right to a private life were once almost exclusively restricted to cases brought by celebrities against newspaper groups, but just two of the 28 privacy court cases reported in the last year had any connection with the traditional battle between high-profile individuals and the media.

[...]

Jonathan Cooper, barrister at London’s Doughty Street Chambers and the editor of Sweet & Maxwell’s European Human Rights Law Review, said the UK’s legal system was “playing catch-up with other countries where the concept of privacy has been taken more seriously”. He added: “The absence of privacy rights has been a defect of UK law.”

Centennial Man

Saturday, October 24, 2009

Friday, October 23, 2009

Thursday, October 22, 2009

Wednesday, October 21, 2009

Tuesday, October 20, 2009

Monday, October 19, 2009

Search This Blog

Followers

Blog Archive

Links

About Me