Centennial Man: 2011-07-17

Saturday, July 23, 2011

Careers for my Ethical Hackers? Still looking for a co-author for “A Just Cyber War”...

"A story in Bloomberg Businessweek gives the first in-depth look at a wave of new start-ups selling cyber weaponry. The story describes this as the evolution of the defense industry in response to a wave of brazen attacks against Google, the Pentagon, the IMF and thousands of companies. It's pretty scary stuff, especially considering that these new weapons are not regulated at all."

[From the article:

Traditional military logic falls apart in the Code War. Deterrence and arms treaties are but philosophical concepts when invisible weapons are involved. Assigning certain blame for an attack may be impossible when it’s conducted through computers in dozens of countries. The fear of retaliation—which kept the Cold War from becoming hot—may not apply.

[Related stuff: (More at: http://www.technolytics.com/downloads.asp)

http://www.technolytics.com/Cyber_Commanders_Handbook_Preview.pdf

Cyber Commander's eHandbook

(Preface and TOC only)

http://www.technolytics.com/Right_to_bear_cyber_arms_CCH9-2.pdf

The Right to Bear Cyber Arms

Legal authorities agree there are gray areas and a fine line between activism on the one hand, and terrorism and hostile action against a government on the other. When you include the use of cyber attacks in the equation, the line quickly expands to an area of gray.

A new argument in the online banking area?

http://www.databreaches.net/?p=19786

How Fast Is Fast Enough to Tell Customers About Data Breaches?

July 22, 2011 by admin

Sue Reisinger writes on Corporate Counsel:

In financial data breaches, timing is almost everything. On June 13 a federal court held Comerica Bank liable for data breach losses even though it notified the customer and stopped all account activity within six hours. Two days later Citigroup Inc. was explaining why it took nearly a month to start notifying 360,000 customers of a breach. While Comerica didn’t act fast enough for the court, experts say Citi’s delay may have been justified.

Confusing? Such disparities can baffle not only companies and consumers, but also lawmakers trying to create a uniform standard for handling breaches.

Friday, July 22, 2011

Oh, the horror! My favorite anchovy/sausage pizza at risk! Well, maybe not...

http://www.databreaches.net/?p=19722

Franchises from at least three national pizza chains hacked

July 21, 2011 by admin

Scott Thomas Anderson reports:

The rampant hacking of credit cards and ATM accounts that has hit Amador County is partly the result of “malicious software” installed at a Martell business, according to investigators from Amador County Sheriff’s office. Worse yet, six months of online victimization may not be over for some locals, particularly for those who entered Mountain Mike’s Pizza last winter without cash in their hands.

Sheriff’s officials updated reporters yesterday afternoon about a lengthy investigation into more than 70 cases of ATM/credit card fraud inundating its investigations bureau. Additional cases have also been reported to the Jackson Police Department. Undersheriff Jim Wegner said his detectives had been working closely with fraud units from several banks affected by the string of crimes, which began at the end of 2010 and gained an almost overwhelming momentum by February of this year.

Read more on Ledger Dispatch.

So far, only that one Mountain Mike’s Pizza store in California has been identified as having been breached from that chain, but other national chains have not been so fortunate, it seems.

In March, Extreme Pizza disclosed that the point of sale (POS) systems at a number of its west coast franchises had been compromised beginning in August 2010. Customers’ credit and debit card numbers were reportedly misused between then and January 2011. In an FAQ on its site, the chain said it was first made aware of the breach on February 28, 2011. Sixteen stores in California as well as stores in Colorado and Oregon were affected.

Both the Extreme Pizza and Mountain Mike’s Pizza breaches were on the west coast, where a third national pizza chain, zpizza, is also headquartered. zpizza provided DataBreaches.net with the following statement:

Zpizza was affected by malware on our point of sales system used to process credit and debit card transactions at 12 of our locations. These incidents did not involve an internal security issue within zpizza, and based on investigation, we have sufficient reasons to believe that zpizza is one of many small businesses across the nation that was affected by a computer hacker. Additional details about the issue is on store websites.

Zpizza is working with the Secret Service to address and resolve this issue as quickly as possible. Additionally, we have hired an outside consultant to ensure that our point of sale systems are secure and protected from any further intrusion.

[...]

The notice posted on individual stores’ web sites in mid-May read:

An Important Notice to our Customers

This notice pertains to any customer who used a credit card or debit card at the (LOCATION) zpizza location from September 2010 through and including January 2011. In advance, zpizza apologizes for any inconvenience that you may experience from the circumstances described below.

Zpizza recently discovered that an unauthorized person wrongfully accessed certain point of sale systems that zpizza uses to process credit and debit card transactions. Based upon its investigation to date, zpizza reasonably believes that a computer hacker improperly acquired credit and debit card information. This incident did not involve an internal security issue within zpizza. [Except that it was their “internal security that was breached? Bob] In fact, zpizza has learned that it is one of many small businesses across the nation that has been affected by this computer hacker.

Zpizza has moved swiftly to address this unfortunate incident and is working with the Secret Service to investigate it. zpizza is also working with an outside consultant to ensure that its point of sale systems are secure and protected from any further intrusion.

If you have used your credit card or debit card at this zpizza location from September 2010 through and including January 2011, please consider taking the following immediate steps in order to prevent the unauthorized and unlawful use of your personal information:

[...]

Some of the locations of affected zpizza stores include California, Montana, and Virginia.

Elsewhere, a breach involving a national pizza chain was also rumored to be the source of card fraud reports in the Ohio area, but whether that will pan out (no pun intended) and whether it’s yet another national pizza chain remains to be seen.

Firefly POS Implicated?

At least a few people involved with the situation have been pointing fingers at the Firefly POS software. Over on PMQ.com, a forum for the pizza industry, one owner wrote:

We had a breach of our credit card system. Talked to the bank fraud unit, the local authorities and forensic audit companies. The indication is that the majority of credit card breaches have been with the Firefly/Granbury system from what the people we contacted have said.

Other sources with knowledge of the situation also allege that the breached units of Extreme Pizza and zpizza were all, or almost all, using Firefly. A spokesperson for zpizza confirmed to DataBreaches.net that their breached units were using Firefly.

Whether the Firefly allegations are also correct for Extreme Pizza and other pizza stores could not be confirmed at the time of this posting. Granbury was contacted several times over the past two weeks and asked to respond to the allegations but did not provide answers to questions posed or any statement specifically addressing a number of allegations that have been made.

Charles Hoff, an attorney who has been involved in a number of high-profile cases where restaurants have sued POS vendors and/or their installers replied “No comment” when asked whether he has been asked to file any lawsuits against Firefly, its parent company, Granbury, or any of their authorized installers.

Deja Vu All Over Again?

The breach description for Mountain Mike’s Pizza sounds somewhat like a number of restaurant breaches in 2008 that occurred when login credentials to remote access to the desktop were left in a default state and were exploited by hackers. [Let's hope that isn't the case again! Bob] At least one commenter on PMQ.com indicates that his system was breached by a remote-access account that had been enabled to allow support.

As of 2006, Visa had issued warnings about the risks of enabling remote access software – warnings that it has repeated numerous times since. Despite Visa’s repeated warnings, remote access compromise accounted for 41% of attacks in the merchant category during the period January 2009 – June 2010. As recently as April 19, Visa issued an alert, “Remote Access Vulnerabilities—Most Frequent Attack Method Used by Intruders,” and asked acquirers and processors to share the alert with merchants as soon as possible. But despite repeated warnings, either Level 4 merchants have not gotten the message or they have not understood how to ensure they comply with industry standards on firewalls and the need to change default configurations.

Ultimately, of course, it is the stores that are responsible for the security of customers’ credit card and debit card data, and it is the stores that suffer if customers stop using cards or stop frequenting a store if they’ve suffered fraud as a result of transactions with a merchant. But are the processors, acquirers, vendors, and installers doing enough to help the merchants who pay large fees to get a system that they believe is compliant? It doesn’t seem so if four years later, we are still talking about a lot of POS hacks in the restaurant sector.

In the meantime, if these breaches occurred in August and September of 2010 and there was a rash of fraud, how many other national pizza chains were also affected that we haven’t yet found out about in the media? Hopefully, some of the mainstream journalists will start digging into this a bit more.

I suspect (hope!) they used very weak encryption. I'd hate to think serious encrypting could be easily broken.

http://www.databreaches.net/?p=19760

StudentCity.com hacked; hackers decode encrypted credit card data

July 21, 2011 by admin

I just read a breach disclosure to the New Hampshire Attorney General’s Office with accompanying notification letters to those affected that impressed me favorably. But first, to the breach itself:

StudentCity.com, a site that allows students to book trips for school vacation breaks, suffered a breach in their system that they learned about on June 9 after they started getting reports of credit card fraud from customers. An FAQ about the breach, posted on www.myidexperts.com explains:

StudentCity first became concerned there could be an issue on June 9, 2011, when we received reports of customers travelling together who had reported issues with their credit and debit cards. Because this seemed to be with 2011 groups, we initially thought it was a hotel or vendor used in conjunction with 2011 tours. We then became aware of an account that was 2012 passengers on the same day who were all impacted. This is when we became highly concerned. Although our processing company could find no issue, we immediately notified customers about the incident via email, contacted federal authorities and immediately began a forensic investigation.

According to the report to New Hampshire, where 266 residents were affected, the compromised data included students’ credit card numbers, passport numbers, and names. The FAQ, however, indicates that dates of birth were also involved.

Frustratingly for StudentCity, the credit card data had been encrypted but their investigation revealed that the encryption had broken in some cases. In the FAQ, they explain:

The credit card information was encrypted, but the encryption appears to have been decoded by the hackers. It appears they were able to write a script to decode some information for some customers and most or all for others.

The letter to the NH AG’s office, written by their lawyers on July 1, is wonderfully plain and clear in terms of what happened and what steps StudentCity promptly took to address the breach and prevent future breaches, but it was the tailored letters sent to those affected on July 8 that really impressed me for their plain language, recognition of concerns, active encouragement of the recipients to take immediate steps to protect themselves, and for the utterly human tone of the correspondence.

Kudos to StudentCity.com and their law firm, Nelson Mullins Riley & Scarborough, LLP, for providing an exemplar of a good notification. [About time someone figured it out... Bob]

I thought their security sounded a bit weak... What does this do to the case if everything is already available on the Internet?

http://www.wired.com/threatlevel/2011/07/science-pirate-bay/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Huge Trove of Academic Docs Posted Online in Response to Activist Arrest

Just two days after activist hacker Aaron Swartz was charged with hacking for downloading too many academic articles, a giant collection of articles from the same service has been posted to the notorious file sharing search engine, The Pirate Bay.

The documents are allegedly 18,952 scientific articles from the Philosophical Transactions of the Royal Society that were downloaded at some point from the scholarly archive service JSTOR. JSTOR is the same service that Swartz is accused of stealing from for downloading 4 million articles via a guest account at MIT.

But according to the note accompanying the huge download, these are not the files that Swartz is accused of downloading (and returning). Instead, the manifesto says the documents came from another source, and the manifesto is signed by a person identifying himself as Greg Maxwell. The manifesto says the documents date back before 1923, making them public domain — though that contention might not be the case, given the difference between U.S. and U.K. copyright laws.

Stephen Rynerson points me to a service for those of us who don't want to play in TSA's Security Theater. Flying in a small plane means you can't possibly be a terrorist and therefore don't need to go through security. I think this may even be cheaper than Stephen's private jet!

http://blogs.forbes.com/edzitron/2011/06/29/planered/

PlaneRed To Taunt Airlines, TSA

PlaneRed is an all-you-can-eat flight subscription launching around September 1st 2011 that will fly just below the TSA’s radar – using 9-person planes to dodge under their screening of any plane carrying over 10 passengers. The subscriptions will work as such – passengers will pay around $150 a month for access to a booking system much like a city bus, able to book on popular routes on the east coast, serving Atlantic City, New York, Philadelphia, Washington D.C.. They hope to expand quickly to Boston, and then open up new runs in Texas, California, and the Midwest.

… They’re seeking VC investment, but only from those who understand what they’re going for and share the pain of the average airline passenger. “Anything that lets us fly faster, better, and simpler is welcomed around here.”

The first 10,000 signups to PlaneRed’s website will have access to the initial subscription packages.

Still early days, but worth looking at (and trying to educate your Congressman?)

http://www.pogowasright.org/?p=23791

The SAFE Data Act: An admirable attempt that needs expansion

I wonder why they don't already spell this out in their policy... Bad security and bad insurance choices?

http://www.databreaches.net/?p=19747

Sony insurer sues to deny data breach coverage

July 21, 2011 by admin

Ben Berkowitz reports:

One of Sony Corp’s insurers has asked a court to declare that it does not have to pay to defend the media and electronics conglomerate from mounting legal claims related to a massive data breach earlier this year.

Zurich American Insurance Co asked a New York state court in documents filed late on Wednesday to rule it does not have to defend or indemnify Sony against any claims “asserted in the class-action lawsuits, miscellaneous claims, or potential future actions instituted by any state attorney general.”

Read more on Reuters. Chris Dolmetsch of Bloomberg also covers the lawsuit.

I’ve uploaded a copy of the complaint and summons as well as the exhibits.

[From the Reuters article:

Zurich American, in its court papers, said 55 purported class-action complaints have been filed in the United States against Sony.

… Zurich American said its policy only covers the Sony unit for "bodily injury, property damage or personal and advertising injury." It said no such claims have been made in any of the class-action lawsuits.

Some may even be worth watching...

Videos from Health Privacy Summit Now Available

By Dissent, July 22, 2011

Organizers of the June 13th, D.C. Health Privacy Summit, “Getting IT Right: Protecting Patient Privacy in a Wired World” [http://www.healthprivacysummit.org], today announced the release of all videos from the Summit.

… For the full agenda, more information on the panels, and links to each video, see: http://www.healthprivacysummit.org/agenda. [http://www.healthprivacysummit.org/agenda]

Yes. The actual question is “By whom?” and under what circumstances?

http://www.pogowasright.org/?p=23809

Are Student Cell Phone Records Discoverable?

July 21, 2011 by Dissent

Joshua A. Engel reports:

The debate over when officials can search a student’s cell phone is an emerging e-discovery issue. This is illustrated in the recent case N.N. v. Tunkhannock Area School District, Civil Action No. 3:10-CV-1080, U.S. District Court for the Middle District of Pennsylvania.

In this case, a student at Tunkhannock Area High School in Tunkhannock, Pa., violated a school policy requiring cell phones to be turned off and stored in lockers during the school day by placing a call from her cell phone while on school property. A teacher confiscated the phone. School officials then examined the contents of the cell phone and discovered what appeared to be inappropriate photographs stored in the phone’s memory. [Why would they do that? Bob]

Thursday, July 21, 2011

Gary Alexander provides an article that just makes me giggle... I will definitely be using this one in my classes. (Note that studying ethics does not make you ethical...)

http://www.mail.com/scitech/news/571686-feds-harvard-fellow-hacked-millions-papers.html#.571348-stage-related1-3

Feds: Harvard fellow hacked millions of papers

A Harvard University fellow who was studying ethics was charged with hacking into the Massachusetts Institute of Technology's computer network to steal nearly 5 million academic articles.

… In an indictment released Tuesday, prosecutors say Swartz stole 4.8 million articles between September 2010 and January after breaking into a computer wiring closet on MIT's campus. Swartz, a student at the Edmond J. Safra Center for Ethics, downloaded so many documents during one October day that some of JSTOR's computer servers crashed, according to the indictment.

… A spokeswoman for JSTOR said Tuesday that Swartz had agreed to return all the articles so the company can ensure they aren't distributed. [How could either side prove that this happened? Bob]

… Demand Progress's executive director David Segal said on the website that the charges against Swartz don't make sense.

"It's like trying to put someone in jail for allegedly checking too many books out of the library," he said.

… Swartz had legitimate access to JSTOR through Harvard, but the company has usage restrictions that would have prevented such colossal downloads.

… According to the indictment, Swartz connected a laptop to MIT's system in September 2010 through a basement network wiring closet and registered as a guest under the fictitious name, Gary Host, in which the first initial and last name spell "ghost." [Apparently there was no restriction if you registered as “Guest?” Bob] He then used a software program to "rapidly download at extraordinary volume of articles from JSTOR," according to the indictment.

In the following months, MIT and JSTOR tried to block the recurring and massive downloads, on occasion denying all MIT users access to JSTOR. But Swartz allegedly got around it, in part, by disguising the computer source of the demands for data.

In November and December, Swartz allegedly made 2 million downloads from JSTOR, 100 times the number made during the same period by all legitimate JSTOR users at MIT.

Banks can't control how you build and maintain your end of the “secure transaction” link. But should they assume you didn't do it correctly?

http://www.databreaches.net/?p=19738

IL: Crystal Lake District 47 sues Home State Bank to recover hacking losses

July 21, 2011 by admin

Sarah Sutschek reports on another interesting case to follow in the courts:

About two years after losing more than $300,000 when its computer system was hacked, Crystal Lake District 47 is suing Home State Bank.

The lawsuit, filed in McHenry County, seeks $306,014 and “whatever other relief this court deems appropriate.”

According to the lawsuit, filed this week, unknown individuals hacked into the District 47 computer system in June 2009 through a “Clampi virus” and gained access to user names and passwords.

That information then was used to access the online banking system of Home State Bank, where the district had an account used to make direct deposit payroll payments for employees. A total of 46 fraudulent transfers were made.

Wednesday, July 20, 2011

Maybe not so anonymous? Ah relief. No Ethical Hacking students. (Do we train then well or what?)

http://www.wired.com/threatlevel/2011/07/paypal-hack-arrests/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Feds Arrest 14 ‘Anonymous’ Suspects Over PayPal Attack, Raid Dozens More

… In the attacks on the financial-service companies — dubbed Operation Payback — thousands downloaded a tool called the Low Orbit Ion Cannon that joined their computers to the group attack on the target of the moment. However, the tool did nothing to hide a user’s IP address, making it possible for the target website to hand its server logs over to the authorities to track users down by their IP addresses.

Apparently you don't actually need to have evidence before you falsify it...

NH Man Arrested For Videotaping Police.. Again

"Back in 2006, a resident of New Hampshire's second largest city was arrested while at the police station attempting to file a complaint against officers. His crime? He had video tape evidence of the officers' wrongdoings. According to the police, that's wiretapping. After world wide attention, the police dropped the charges. His complaint was found to be valid, but the evidence never saw the light of day. Well, guess what? Round two. There are differing reports, but again the police arrested Mr. Gannon and again, they seized his video camera. This time it's 'falsifying evidence' because he tried to hand off the camera, most likely to protect its contents. If there's the potential of police wrongdoing, how is it that the law permits the police to seize the evidence?"

Intent has no bearing?

Court Allows Webcam Spying On Rental Laptops

"Back in May there was a class action lawsuit filed against the rental company Aaron's, which had secretly installed spying software that would turn on a laptop's webcam, take pictures and then send them back to the company. Overall it seemed like a large invasion of privacy, which should at least warrant an injunction to stop use of the software until the case is settled, right? Not to the judge, who refused to order an injunction on the grounds that the family was no longer in possession of the laptop. As for everyone else still using their Aaron's laptops, the judge had this to say to them (PDF): 'Moreover, it is purely conjecture that the other members of the putative class will be subjected to remote access of personal information.'"

This is the top of that slippery slope that includes: “I won't vote for the guy.”. (Just don't say that with a gun in your hand.)

http://www.wired.com/threatlevel/2011/07/obama-assassination-speech/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29

Urging Obama’s Assassination Is Lawful Online Speech, Divided Appeals Court Says

Who is responsible for protecting your money?

http://www.databreaches.net/?p=19694

Yet Another Bank Sued By A Small Business For Fraudulent Hacker Transfers

July 20, 2011 by admin

Ericka Chickowski reports:

A new court case brought to bear against Professional Business Bank by Village View Escrow Inc. continued the battle waged over who’s to blame for hacking attacks that leave small business accounts drained following online password theft. Filed in late June in the California Superior Court in Los Angeles, the case is the latest in a string of suits filed in U.S .courts by small businesses who believe their banks are to blame for failing to properly protect their accounts from predatory hackers.

Village View’s lawyers say the bank should be on the hook for $465,000 siphoned off by hackers in March 2010, plus bank fees and damages incurred by the loss. Village View told the court that Professional Business Bank led it to believe that the institution employed safe online banking practices when signed with the bank in 2008.

Tuesday, July 19, 2011

I'm thinking this won't stand. If it is illegal to look at things in (electronic) plain sight, wouldn't that make what the police want to do illegal too?

http://www.pogowasright.org/?p=23758

Judge Grants Google ‘Street View’ Wiretap Appeal

July 18, 2011 by Dissent

David Kravets reports:

A federal judge sided with Google on Monday, granting the search giant the right to appeal his ruling that packet-sniffing on non-password-protected Wi-Fi networks is illegal wiretapping.

The decision by U.S. District Judge James Ware tentatively sets aside his June 29 ruling in nearly a dozen combined lawsuits seeking damages from Google for eavesdropping on open, unencrypted Wi-Fi networks from its Street View mapping cars. The vehicles, which rolled through neighborhoods across the country, were equipped with Wi-Fi–sniffing hardware to record the names and MAC addresses of routers to improve Google location-specific services. But the cars also secretly gathered snippets of Americans’ data. [If you are looking for the return address on a postcard (i.e. an unencrypted communication) it is unlikely that you would start your recording at the exact bit at which the return address begins. Recording more data is therefore inevitable, even if not intentional. Bob]

Monday, July 18, 2011

For my Intro to IT students

http://mashable.com/guidebook/

Guide Books

The Twitter Guide Book

The Facebook Guide Book

(Related) There is a downside...

NCAA to Tighten Twitter Rules

"Facebook and Twitter have made student athletes more accessible than ever, but Tweets that catch the watchful eye of the NCAA could be all that's needed to bring down a successful college athletic program. Among the allegations leveled against the Univ. of North Carolina by the NCAA is a failure to 'adequately and consistently monitor social networking activity,' which the NCAA argues would have caused the school to detect other violations sooner than they did. To cope with the daunting task of monitoring hundreds of accounts on a daily basis, some sports programs are turning to software like UDiligence, while others are opting for a simpler approach, such as having a coach frequently check on posts from the team's players."

Richard Nixon called it his “Enemies List” but the concept is the same. “Fail to bow to my authority and you are forever doomed to feel my wrath!”

http://www.pogowasright.org/?p=23754

UK: Councils compile databases of over 9,000 ‘troublemaking’ residents

July 18, 2011 by Dissent

Frank Manning writes:

It has been revealed that council bureaucrats have been keeping secret databases of residents who have been involved in disputes with them.

At least 9,000 people are on the lists, kept by more than 40 councils around England. The reasons for placing people on the databases vary from council to council but many of them are exceedingly trivial, such as arguing with a council official or a dustman.

Centennial Man

Saturday, July 23, 2011

Friday, July 22, 2011

Thursday, July 21, 2011

Wednesday, July 20, 2011

Tuesday, July 19, 2011

Monday, July 18, 2011

Search This Blog

Followers

Blog Archive

Links

About Me