Centennial Man: 2011-05-15

Saturday, May 21, 2011

If at first you don’t succeed, fail, fail again.
http://www.databreaches.net/?p=18368
Hackers hit Sony sites raising more security issues
May 20, 2011 by admin
It’s getting so that I need a scorecard to keep track of all of the recent Sony breaches. These would appear to be #’s 3 and 4….
Reuters reports:
Sony Corp has been hacked again, exposing more security issues for the company less than a month after intruders stole personal information from more than 100 million online user accounts.
A hacked page on a Sony website in Thailand directed users to a fake site posing as an Italian credit card company. The site was designed to steal information from customers, Internet security firm F-Secure disclosed on Friday.
[...]
The latest hacking, which the security company said occurred separately from the April attack, was reported just hours after Sony told customers of another breach on one of its units.
So-Net, the Internet service provider unit of Sony, alerted customers on Thursday that an intruder had broken into its system and stolen virtual points worth $1,225 from account holders.
Read more on Thomson Reuters.

(Related)
Phishing Site Discovered On Sony Thailand Servers
mcgrew tips news that security firm F-secure has found a live phishing site running on Sony's Thailand servers. "Basically this means that Sony has been hacked, again. Although in this case the server is probably not very important." This comes alongside news that a point service run by So-net, a Sony subsidiary, was accessed by an unknown intruder, who stole about $1,200 worth of virtual tokens. "The intrusions are believed to have taken place on May 16 and 17. So-net discovered the breach on May 18, after receiving consumer complaints. So-net halted the point redemption service following the discovery of the breach. The latest breaches are relatively minor in scale compared to the massive breach at PSN and Sony Entertainment Online. Even so, it only adds to the company's embarrassment."

“Thanks for letting us know. Be careful.” That’s it?
http://www.databreaches.net/?p=18371
Information and Privacy Commissioner issues his decisions about the Epsilon data breach that affected Best Buy and Air Miles
May 20, 2011 by admin
From the press release:
The Information and Privacy Commissioner of Alberta, Frank Work issued his decisions today in regard to Best Buy Canada Ltd., and Air Miles Reward Program’s breach incident reports involving unauthorized access to personal information.
… Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.
The Commissioner stated that the number of affected individuals increases the likelihood that spear phishing attempts will be successful and significant harm to individuals could occur as a result of the breach.
What’s significant about this finding is that the Commissioner says that even (just) name and email addresses in the context of a large breach of this kind indicates a “real risk of significant harm.”

It’s one thing to enjoin news services (who are used to complying with the Official Secrets Act) but quite another to expect individuals to stop tweeting the latest gossip.
http://www.pogowasright.org/?p=22994
Twitter and “unknown persons” sued by UK athlete who had secured superinjunction
May 20, 2011 by Dissent
Josh Halliday reports:
A footballer has sued Twitter after a number of the microblogging site’s users purported to reveal the name of the player who allegedly had an affair with model Imogen Thomas.
The footballer’s legal team began the legal action at the high court in London on Wednesday, in what is thought to be the first action against the US social media firm and its users.
The lawsuit lists the defendants as “Twitter Inc and persons unknown”. The latter are described as those “responsible for the publication of information on the Twitter accounts” in the court document, according to reports.
Read more in The Guardian.
James Lumley and Lindsay Fortado of Bloomberg also report on the lawsuit:
Twitter Inc. and some of its users were sued by an entity known as “CTB” in London, according to a court filing.
While the document gave no details, CTB are the initials used by the court in a separate lawsuit to refer to an athlete who won an anonymity order banning the media from publishing stories about his alleged affair with a reality-television star.
[...]
The case is: CTB v. Twitter Inc., Persons Unknown, High Court of Justice (Queens Bench Division), HQ11X01814.
Read more on Bloomberg Businessweek.

Who said, “War is an economic event?”
A New Approach To Reducing Spam: Go After Credit Processors
WrongSizeGlass writes
"A team of computer scientists at two University of California campuses has been looking deeply into the nature of spam, and they think found a 'choke point' [PDF] that could greatly reduce the flow of spam. It turned out that 95 percent of the credit card transactions for the spam-advertised drugs and herbal remedies they bought were handled by just three financial companies — one based in Azerbaijan, one in Denmark and one in Nevis, in the West Indies. If a handful of companies like these refused to authorize online credit card payments to the merchants, 'you'd cut off the money that supports the entire spam enterprise,' said one of the scientists."
Frequent Slashdot contributor (and author of a book on Digital Cash) Peter Wayner wonders if "the way to get a business shut down is to send out a couple billion spam messages in its name."

Shocker! Could we be looking at a “Korean Summer?” (a la “Arab Spring”) Or are these half-million phones just issued to the Army? (Over 1 million active, 7 million reserve)
North Korean 3G Mobile Subscriptions Hit Half a Million
"The number of 3G cellular subscriptions in North Korea passed half a million during the first quarter, according to the country's only 3G cellular operator. The Koryolink network had 535,133 subscriptions at the end of March, an increase of just over 100,000 on the end of December 2010."
[From the article:
The company's network now covers 92 percent of the population.
North Korea is one of the world's most heavily controlled countries and communication is severely restricted. Most cell phones don't have the ability to make or receive international calls.

Friday, May 20, 2011

Inevitable…

http://www.databreaches.net/?p=18335

Federal lawsuit blames Michaels for PIN thefts

May 19, 2011 by admin

Josh Stockinger reports:

A West Chicago woman has filed a federal lawsuit against Michaels, claiming the arts-and-crafts giant failed to protect customers from “cyber-pickpockets” who stole sensitive banking information from checkout keypads at stores in 20 states.

The suit filed this week in Illinois’ northern district seeks class-action status and more than $5 million in damages for Brandi Ramundo and others whose credit and debit accounts were compromised. It comes in the wake of revelations by Michaels earlier this month that checkout PIN pads were tampered with at 80 of its stores across the country.

Thursday, May 19, 2011

In an effort to demonstrate their Hacking skills, Sony takes their own network offline! Way to go Sony!

http://news.cnet.com/8301-27080_3-20064084-245.html

How to stay safe on Sony's PlayStation Network

If you are a Sony PlayStation Network (PSN) customer you are probably getting a little paranoid. First there was the data breach from last month that exposed customer data and forced Sony to take the network down.

And now, just days after Sony got the service back up and running, it has taken the PSN password reset service offline because it was allowing people to change other customers' passwords if they knew their e-mail address and birth date--information that was stolen in the attack.

Sony says the hole in the PSN password reset site was not exploited in active attacks, although there are reports that the information was circling in the underground and being used prior to Sony taking the site down.

(Related) Even playing games is dangerous?

http://www.thetechherald.com/article.php/201120/7179/Rockstar-blames-Sony-firmware-for-overheating-PS3s

Rockstar blames Sony firmware for overheating PS3s

Even my Math students know that “Greater than: 200,000” does not mean “Only” 200,000…

http://www.databreaches.net/?p=18311

(update) Massachusetts breach affected over 200,000

May 18, 2011 by admin

As a quick update: Matt Liebowitz of SecurityNewsDaily.com reports that the Massachusetts data breach disclosed yesterday may have impacted 210,000.

The NBC is in Denver…

http://www.databreaches.net/?p=18315

Email exposed 4,000 Securities and Exchange Commission employees

May 18, 2011 by admin

Shan Li reports:

The Securities and Exchange Commission is having some security problems.

About 4,000 agency employees, including several in Los Angeles, have been notified that their social security numbers and other payroll information were included accidentally in an unencrypted email, said Drew Malcomb, an Interior Department spokesman.

The May 4 email was sent by a contractor at the Interior Department’s National Business Center, a service center in charge of payroll, human resources and financial reporting for dozens of federal agencies, Malcomb said.

The contractor forgot to encrypt the email, and the software in place to catch such errors also failed and let the email through, he said.

Read more in the Los Angeles Times.

Gee, you would think this is easy, but “I know it when I see it” makes a poor legal definition.

http://www.pogowasright.org/?p=22948

Trying to define “sensitive” data

May 19, 2011 by Dissent

Peter Fleischer compares the EU definition of “sensitive personal data” to the definition in India’s new law and finds the EU definition lacking:

The European Data Protection Directive defines them as:

“personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life.”

[...]

Now, for comparison, here is India’s just revised categories of “sensitive” data:

“unless freely available in the public domain or otherwise available under law, SPDI under the Rules is personal information which consists of information relating to:

password,

financial information such as bank account, credit or debit card details as well as other payment instrument details,

physical, physiological and mental health condition,

sexual orientation,

medical records and history,

Biometric information (a defined term including fingerprints, eye retinas and irises, voice and facial patterns, hand measurements and DNA),

Any detail relating to the above when supplied for providing service, and

Any of the information described above received by an organization for processing, stored or processed under lawful contract or otherwise. “

Read more on Peter Fleischer: Privacy…?

(Related) It’s the Policy that’s difficult.

http://www.guardian.co.uk/technology/2011/may/18/google-eric-schmidt-piracy

Google boss: anti-piracy laws would be disaster for free speech

Google's executive chairman, Eric Schmidt, warned on Wednesday that government plans to block access to illicit filesharing websites could set a "disastrous precedent" for freedom of speech.

Speaking to journalists after his keynote speech at Google's Big Tent conference in London, Schmidt said the online search giant would challenge attempts to restrict access to the Pirate Bay and other so-called "cyberlocker" sites that encourage illegal downloading – part of government plans to fight online piracy through controversial measures included in the Digital Economy Act.

… "I would be very, very careful if I were a government about arbitrarily [implementing] simple solutions to complex problems," he said. "So, 'let's whack off the DNS'. Okay, that seems like an appealing solution but it sets a very bad precedent because now another country will say 'I don't like free speech so I'll whack off all those DNSs' – that country would be China.

"It doesn't seem right. I would be very, very careful about that stuff. If [the UK government] do it the wrong way it could have disastrous precedent setting in other areas."

Speaking at the same conference, the culture minister, Jeremy Hunt, said plans to block access to illicit filesharing websites were on schedule. He admitted that a "challenge" of the controversial measure is deciding which sites get blocked.

For my Security students: Think of this as an almost complete list of “Things that could go wrong”

http://www.bespacific.com/mt/archives/027300.html

May 18, 2011

Report: Push for Electronic Medical Records Overlooks Security Gaps

PBS Newshour: 'As the Obama administration pushes ahead with plans to increase the use of electronic medical records, two internal reports released Tuesday by the Department of Health and Human Services revealed "significant concerns" about security gaps in the system. The Office of the Inspector General found "a lack of general [information technology] security controls during prior audits at Medicare contractors, State Medicaid agencies, and hospitals." The investigation audited computer security at seven large hospitals in different states, and found 151 major vulnerabilities, including unencrypted wireless connections, easy passwords, and even a taped-over door lock on a room used for data storage. The auditors classified 124 of the breeches were "high impact" - resulting in costly losses, injury or death. According to the report, "outsiders or employees at some hospitals could have accessed, and at one of the seven hospitals did access, systems and beneficiaries' personal data."

Ask for everything, then negotiate down? Maybe you’ll wind up with ,ore than you ever thought possible.

http://news.slashdot.org/story/11/05/19/0248238/Academic-Publishers-Ask-The-Impossible-In-GSU-Copyright-Suit?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Slashdot%2Fslashdot+%28Slashdot%29

Academic Publishers Ask The Impossible In GSU Copyright Suit

"A Duke University blog covers the possible ramifications of a motion in the copyright case against Georgia State University. Cambrigde, Oxford, and Sage have proposed an injunction that would first enjoin GSU to include all faculty, employees, students. All copying would have to be monitored and limited to 10% of a work or 1000 words, whichever is less. No two classes would be allowed to use the same copied work unless they paid for it, essentially taking fair use out of the classroom. [And for those of us who teach in colleges with campuses nationwide, this would be nearly impossible to monitor. Bob] Along with this, courses would be allowed to be made up of only 10% copied material, the other 90% must be either purchased works or copies that have been paid for by permission fees. And, if this isn't enough, the publishers also want access to all computer systems on the campus network, to monitor compliance and copying. 'This proposed order, in short, represents a nightmare, a true dystopia, for higher education.... Yet you can be sure that if [these] things happen, all of our campuses would be pressured to adopt the "Georgia State model" in order to avoid litigation.' Disclosure: I am currently a graduate student at Georgia State University."

For my Ethical Hackers – guess we’ll have to hold off too.

http://news.cnet.com/8301-27080_3-20064112-245.html

SCADA hack talk canceled after U.S., Siemens request

Two researchers say they canceled a talk at a security conference today on how to attack critical infrastructure systems, after U.S. cybersecurity and Siemens representatives asked them not to discuss their work publicly.

"We were asked very nicely if we could refrain from providing that information at this time," Dillon Beresford, an independent security researcher and a security analyst at NSS Labs, told CNET today. "I decided on my own that it would be in the best interest of security...to not release the information."

Beresford said he and independent researcher Brian Meixell planned on doing a physical demonstration at the TakeDown Conference and shared their slides and other information on vulnerabilities and exploits with Siemens, ICS-CERT (Industrial Control Systems Cyber Emergency Response Team), and the Idaho National Lab on Monday.

The Clouds are rolling in…

http://news.cnet.com/8301-10805_3-20064085-75.html

City of San Francisco's e-mail heads to Microsoft cloud

San Francisco is upgrading its e-mail system to a Microsoft cloud-based service to reduce IT costs and improve the city's response to disasters.

The switch to Microsoft Exchange Online will occur over 12 months within 60 departments--starting with smaller departments before rolling out to departments dealing with public safety and eventually reaching the city's 23,000 employees.

Jon Walton, chief information officer for the City and County of San Francisco, made the Microsoft contract announcement during a press conference today.

First, the city will upgrade its e-mail system from seven different systems, including Lotus Notes, into one cloud-based system. In the future, there are other Microsoft options Walton would like to explore such as SharePoint, videoconferencing, and instant messaging--features that are available through Microsoft's Business Productivity Online Services. However, the initial contract with Microsoft includes only cloud-based e-mail and archiving.

Recently, Microsoft's cloud-based customers suffered an e-mail outage. E-mail outages have happened before, but this time the outage affected the city for only four hours, Walton said. "The Microsoft outage showed us we made the right decision" in picking Microsoft after considering using competitors such as Google and Lotus Notes, Walton said.

… As far as security, "we were impressed by [Microsoft's] security solutions," Walton said. "Microsoft has clients that require more security than the city does." The cloud-based initiative will cost the city $1.2 million per year.

Suddenly Apple is the “good competitor?”

http://techcrunch.com/2011/05/18/apple-cloud-music/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29

Google And Amazon May Have Just Handed Apple The Keys To The Cloud Music Kingdom

With regard to their cloud music offering, it looks like Apple is now just about ready to rock and roll. It would seem that this is now coming together even faster than they anticipated. And that may be thanks to two unlikely sources: Google and Amazon.

CNet’s Greg Sandoval is reporting tonight that Apple has signed an agreement with music label EMI to offer its music through Apple’s upcoming new cloud music service. This means that Apple now has agreements in place with two of the four major labels (Warner signed last month). And Sandoval believes that deals with the remaining two, Sony and Universal, could be wrapped up as early as next week.

… You see, while Apple is believed to have had the infrastructure work done for a while for their cloud music offering, the hold up was these label deals. Negotiations have been ongoing for months, and given the stakes, it seems likely that they could have gone on for many more months. Then Amazon decided to get ballsy.

They launched their own cloud music service in March without any of the labels signed on, surprising everyone. Legally, they said they had the right to do this since customers are placing this music in digital vaults in the cloud in the same way they might put music on an MP3 player. The labels, not surprisingly, disagree.

When Amazon did that, Google, which had also been negotiating with the music labels for at least a year, also decided they needed to get their offering out there. Last week at Google I/O, they launched Google Music in beta. Again, the labels were pissed off.

And guess who they ran to?

… So the labels, which for the better part of a decade now have been looking for someone, anyone to help counter Apple’s power in their business, is turning right back to Apple when they need help. And Apple will obviously gladly welcome them with open arms. After all, with these licenses, Apple will have secured the cloud music high ground despite being the last to launch.

Think about it. With these agreements, Apple is likely going to be able to do the one thing that is absolutely crucial for cloud music to take off: offer library syncing without uploading. In other words, Apple now likely be able to do what Lala (the company Apple bought in late 2009 and subsequently shut down) was able to do: scan your hard drive for songs and let you play those songs from their servers without having to upload them yourself. [No Privacy concerns here. Move along. Bob]

I like to use MindMaps in my “Intro to…” classes, so I’ll be evaluating this one…

http://www.freetech4teachers.com/2011/05/spider-scribe-mind-mapping-with-images.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+freetech4teachers%2FcGEY+%28Free+Technology+for+Teachers%29

Wednesday, May 18, 2011

Spider Scribe - Mind Mapping with Images, Maps, and More

Spider Scribe is an online mind map creation service. Spider Scribe can be used individually or be used collaboratively. I've reviewed a lot of mind mapping tools over the years. What jumps out about Spider Scribe is that users can add images, maps, calendars, text notes, and uploaded text files to their mind maps. Users can connect the elements on their mind maps or let them each stand on their own.

Toys for Geeks

http://www.makeuseof.com/tag/7-web-browsers-chance-chrome-firefox/

7 Best “New” Web Browsers With A Chance Against Chrome & Firefox

Wednesday, May 18, 2011

How big? They don’t know?

http://www.databreaches.net/?p=18305

Massachusetts Executive Office of Labor and Workforce Development Reports a Virus Infiltrated the Computer Systems of Agencies tied to Employers, Unemployed Claimants and Career Center Customers

May 17, 2011 by admin

The Executive Office of Labor and Workforce Development (EOLWD) today reported that the Departments of Unemployment Assistance (DUA) and Career Services (DCS) network, individual computer terminals as well as individual computers at the One Stop Career Centers were infected with the W32.QAKBOT virus, a new strain of a computer virus, beginning on April 20, 2011. Steps were taken immediately with the assistance of EOLWD’s security provider Symantec to eliminate the virus.

EOLWD learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach. Once it was discovered, the system was shut down and the breach is no longer active. W32.QAKBOT may have impacted as many as 1500 computers housed in DUA and DCS including the computers at the One-Stop Career Centers.

There is a possibility that as a result of the infection, the virus collected confidential claimant or employer information. This information may include names, Social Security Numbers, Employer Identification Numbers, email addresses and residential or business addresses. It is possible that bank information of employers was also transmitted through the virus. Only the 1200 employers that manually file could be impacted by the possible data breach.

“I apologize to our customers and recognize that this is an unwanted problem. [Interesting phrase… Bob] We are hopeful that the actual impact on residents and businesses is minimal. The breach is no longer active. We are in the process of individually notifying all residents whom we think could be impacted and have advised all relevant and necessary state and federal agencies of the situation.

… We are coordinating with the Attorney General to identify the perpetrators of this crime and to take the next steps to address their actions.

There is no mechanism available to EOLWD to assess the actual number of individuals affected [‘cause we don’t keep no logs? Bob] but any claimant who had their UI file manually accessed by could be affected. Additionally, businesses that file their quarterly statements manually (about 1,200 of 180,000) may have had identifying information transmitted through the virus. For a claimant to have been impacted, a staff person would have had to key in sensitive information at an infected work station.

Source: mass.gov

Probably nothing, but it needs following…

http://www.databreaches.net/?p=18308

France’s official P2P monitoring firm hacked

May 17, 2011 by admin

Dan Goodin reports:

The French government has temporarily suspended its reliance on the company designated to monitor file-sharing networks for copyright scofflaws following reports that a hack on its servers may have leaked sensitive information.

Eric Walter, France’s secretary general of internet piracy, made the announcement over Twitter on Tuesday, saying that Hadopi, short for the High Authority for the dissemination of works and the protection of rights, was taking control of Trident Media Guard “following the leak of IP addresses.”

Centennial Man

Saturday, May 21, 2011

Friday, May 20, 2011

Thursday, May 19, 2011

Wednesday, May 18, 2011

Search This Blog

Followers

Blog Archive

Links

About Me