Group items tagged

According to Mandiant's Kevin Mandia, retailers are being compromised by one attack in particular: SQL injection. In this keynote speech from Information Security Decisions 2008, Mandia takes you through a common retail hack and points out the attack tools being used to gain domain credentials and credit card numbers.

It's funny. Was it just a month ago that we were enjoying the holiday respite, wondering what 2009 would have in store for us? Mind you, I didn't have any delusions. After the breaches, news events and regulatory issues of 2008, I didn't think we were going to turn the calendar page and emerge in a new world of a healthy economy and soaring consumer confidence. But neither did I think, four weeks later, we'd already have our first major security breach of the year - Heartland Payment Systems (HPY) and that it would so dominate our industry's attention. I get it, though, why we're so enamored of this case. It speaks to our biggest fears, first of all, that unknown electronic assailants can sneak into our systems and pry away our customers' names and critical information. Then there's the unknown enormity - we truly don't know how big this breach was. And, finally, it hits home. For you, the banking institution, you're the one left replacing your customers' cards and explaining why. For me, the banking customer ... well, mine is one of the banks doing the explaining. Needless to say, we're monitoring accounts closely. So, we were among the first to break the Heartland story when it first broke last Tuesday, and we've continued to follow it closely. After the initial media surge, where we saw news outlets and solutions providers tripping over one another to opine over what they think happened to Heartland and what it all means, here is what I believe we've learned so far from the case: 1) The Damage Goes Far Beyond the Breach. Heartland execs absolutely did the right thing by stepping forward last week and saying "We were breached," but the company has suffered for it ever since. The market responded to the news by gutting the company's value from over $14 per share last Tuesday to a low of just under $8 this week. Reputationally, you just can't measure the damage - Heartland is now synonymous with "breach," and that's a tough tag to shake. Unable to answer quest

The private correspondence of millions of people who use social networking sites could be tracked and saved on a "big brother" database, under new plans being drawn up by the UK government. Ministers revealed yesterday that they were considering policing messages sent via sites such as MySpace and Facebook, alongside plans to store information about every phone call, e-mail and internet visit made by everyone in the United Kingdom. There was immediate uproar from opposition parties, privacy campaigners and security experts who said the plans were over-the-top and unworkable. There have long been proposals, following an European Union directive in the wake of the July 2005 bombings in London, for emails and internet usage to be tracked in order to guard against future terrorist attacks.

Names, credit card numbers, Social Security numbers: information Daron Breinholt did not go looking for, but found Thursday morning. He took out the trash from the shoe distribution center, where he works, in the warehouse section on Salt Lake's west side. "I was just throwing away some stuff (in a dumpster) , and it was chock full of medical records," said Breinholt. "There's everything in there from canceled checks to routing numbers. They could steal a lot identities. A lot of identities were in there." At least some of the records appeared to come from Mountain Medical Center, a chiropractic office that had been in the Murray area until some months ago. Dr. Randall Malin said through his lawyer that he did not throw away records. "It's news to him," said Attorney Robert Harrison. Salt Lake Police packed away perhaps twenty boxes of papers, and said they would protect the documents, as they dug into the matter. Surveillance video, which 2News has not been able to see, reportedly showed two people who drove up in a red pickup truck Wednesday afternoon, and unloaded the materials from a trailer.

Network Solutions Hack Compromises 573,000 Credit, Debit Accounts Hackers have broken into Web servers owned by domain registrar and hosting provider Network Solutions, planting rogue code that resulted in the compromise of more than 573,000 debit and credit card accounts over the past three months, Security Fix has learned. Herndon, Va. based Network Solutions discovered in early June that attackers had hacked into Web servers the company uses to provide e-commerce services - a package that includes everything from Web hosting to payment processing -- to at least 4,343 customers, mostly mom-and-pop online stores. The malicious code left behind by the attackers allowed them to intercept personal and financial information for customers who purchased from those stores, Network Solutions spokeswoman Susan Wade said.

Social networkig may seed malware spread. Education is still one of the most successful computer security tools

Websense CTO Dan Hubbard outlines four ways companies can protect their information from threats and compromise on the social Web. 1) Most Web Posts on Blogs and Forums are Actually Unwanted Content (Spam and Malware) As more and more people interact with each other on sites allowing user-generated content, such as blogs, forums and chat rooms, spammers and cybercriminals have taken note and abuse this ability to spread spam, post links back to their wares and direct users to malicious sites. Websense research shows that 85 percent of all Web posts on blogs and forums are unwanted content - spam and malware - and five percent are actually malware, fraud and phishing attacks. An average active blog gets between 8,000 and 10,000 links posted per month; so users must be wary of clicking on links in these sites. Click here to find out more! Additionally, just because a site is reputable, doesn't mean its safe. Blogs and message boards belonging to Sony Pictures, Digg, Google, YouTube and Washington State University have all hosted malicious comment spam recently, and My.BarackObama.com was infected with malicious comment spam.

Cybercriminals are improving a malicious software program that can be installed on ATMs running Microsoft's Windows XP operating system that records sensitive card details, according to security vendor Trustwave. The malware has been found on ATMs in Eastern European countries, according to a Trustwave report. The malware records the magnetic stripe information on the back of a card as well as the PIN (Personal Identification Number), which would potentially allow criminals to clone the card in order to withdraw cash.

Windows XP is an obvious choice to run ATMs! Sigh!

How will Barack Obama's administration affect IT spending in the trenches, where technology decision makers are dealing with strapped budgets and a shaky economy? President Barack Obama's official campaign Web site is a model of how 21st century technology tools can boost a candidate's popularity, building significant buzz via blogs, IM applications and e-merchandising. And Obama's campaign wasn't confined to his own site either, because he chose to expand his presence on social networking sites like Facebook, MySpace, Eons and BlackPlanet. His images and words also constantly popped up at outlets such as Flickr, Digg and YouTube. All these efforts made Obama an accessible, immediate and appealing figure to both younger voters and older ones who regularly connect to the Internet. Ultimately, they energized his campaign and helped secure a decisive victory for the nation's first African-American president. Certainly, Obama enters the White House with a reputation as one of the most-if not the most-tech-savvy chief executives ever. For starters, he's created the position of a federal chief technology officer to oversee the future of information technology for government agencies.

Travelers arriving at U.S. borders may soon be confronted with their laptops, PDAs, and other digital devices being searched , copied and even held by customs agents -- all without need to show suspicion for cause. Notices are being proposed by the Privacy Office at the U.S. Department of Homeland Security (DHS), which last week released a report approving the suspicionless searches of electronic devices at U.S. borders. The 51-page Privacy Impact Assessment also supported the right of U.S. Immigration and Customs Enforcement agents to copy, download, retain or seize any content from these devices, or the devices themselves, without assigning any specific reason for doing so. Also, while in many cases searches would be done with the knowledge of the traveler in some situations, the report says, "it is not practicable for law enforcement reasons to inform the traveler that his electronic device has been searched." In arriving at the assessment, the Privacy Office argued that such searches of electronic devices were really no different from searches of briefcases and backpacks. They are needed to interdict and investigate violations of federal law at U.S. borders and have been supported by courts in the past, the assessment said.

"Malicious hackers are using fake alerts around H1N1 (Swine Flu) vaccines to trick end users into installing malware on Windows computers, according to warnings issued by computer security firms. The latest malware campaign begins with e-mail messages offering information regarding the H1N1 vaccination. The e-mail messages contain a link to a bogus Centers for Disease Control and Prevention site with prompts to create a user profile. During this process, a malware file gets planted on the user's machine."

Be careful what information you give to recruiters!

Insurance company Aetna has contacted 65,000 current and former employees whose Social Security numbers (SSNs) may have been compromised in a Web site data breach. The job application Web site also held names, phone numbers, e-mail and mailing addresses for up to 450,000 applicants, Aetna spokeswoman Cynthia Michener said. SSNs for those people were not stored on the site, which was maintained by an external vendor. The company found out about the breach earlier this month when people began receiving spam messages that appeared to come from Aetna and complained to the company, Michener said. The spam purported to be a response to a job inquiry and requested more personal information. The spam campaign showed the intruders successfully harvested e-mail addresses from the Web site, although Michener said it's not clear if SSNs were also obtained. Nonetheless, Aetna sent letters last week notifying the 65,000 people whose SSNs were on the site of the breach. The company is offering them one year of free credit monitoring, as SSNs are often used by identity thieves. "We wanted to err on the side of caution," Michener said. Aetna hired an IT forensics company to investigate how the Web site had been compromised. "At this point despite a thorough review, they've not been able to pinpoint the precise breach," Michener said. Aetna posted alerts on the job site, its main Web site and its internal intranet about the spam campaign, Michener said.

"A New York computer technician has been charged with stealing the identities of more than 150 Bank of New York Mellon employees and using them to orchestrate a scheme that netted him more than $1.1 million, prosecutors said this week. Adeniyi Adeyemi, 27, of Brooklyn was indicted Wednesday on charges of grand larceny, identity theft and money laundering for crimes allegedly committed between Nov. 1, 2001 and April 30, 2009, according to a news release from Manhattan District Attorney Robert Morgenthau. According to prosecutors, Adeyemi, who was employed as a computer technician working at the headquarters of Bank of New York, stole the personal information of dozens of bank employees, primarily from individuals in the information technology department. He then used the identities to open bank and brokerage accounts, which served as "dummy accounts" to receive stolen funds. Adeyemi then stole money from the bank accounts of numerous charities and nonprofit organizations, and transferred the funds into the dummy accounts, which he later withdrew or transferred to other accounts, prosecutors said."

Six out of every 10 employees stole company data when they left their job last year, said a study of US workers. The survey, conducted by the Ponemon Institute, said that so-called malicious insiders use the information to get a new job, start their own business or for revenge. "They are making these judgements based out of fear and anxiety," the Institute's Mike Spinney told BBC News. "People are worried about their jobs and want to hedge their bets," he said. "Our study showed that 59% of people will say 'I'm going to take something of value with me when I go'." The Ponemon Institute, a privacy and management research firm, surveyed 945 adults in the United States who were laid-off, fired or changed jobs in the last 12 months. Everyone that took part had access to proprietary information such as customer data, contact lists, employee records, financial reports, confidential business documents, software tools or other intellectual property.

A New Zealand man has found confidential United States military files on an MP3 player he bought at an op shop in the US. Chris Ogle, 29, from Whangarei, bought the player from an Oklahoma thrift shop for $NZ18 ($A14.50), and found the files when he hooked it up to his computer, TV One News reported on Monday night. The 60 files on the player contained the names and personal details of American soldiers, including ones who served in Afghanistan and Iraq. There was also information about equipment deployed to bases and a mission briefing. "The more I look at it, the more I see and the less I think I should be," Ogle said. Victoria University strategic studies director Peter Cozens said one of the first rules of military endeavour was to not give the opposition information that could compromise your position. "This is just slack administrative procedures which are indeed a cause of embarrassment. It's the sort of thing which ought not really be in the public domain, he said. Ogle said the player never worked as a music player and he would hand it over to the US Defence Department if asked.

Enterprise employees frequently use social networking tools, most notably Web-based applications. It's no surprise more organizations are wondering what happens if social networking data becomes relevant to an e-discovery investigation. How does an enterprise go about discovering and assessing Web 2.0 data? How responsible is an organization, legally speaking, for the information that's out there in the Web 2.0 world? What risks arise from e-discovery as it relates to Web 2.0 data, and how can you mitigate them? In this tip, we will look at e-discovery as it relates to Web 2.0 and consider the strongest options for minimizing risks to the organization. E-discovery basics We begin with a quick look at what e-discovery is and how it can create risk. Essentially, e-discovery is the electronic extension of the legal process of discovery, which Wikipedia defines as "the pre-trial phase in a lawsuit in which each party through the law of civil procedure can request documents and other evidence from other parties or can compel the production of evidence by using a subpoena or through other discovery devices, such as requests for production and depositions." If you're an IT person, not a lawyer, it's important to note that the rules governing the discovery process now require plaintiffs to address all electronically stored information or ESI. In other words, if your organization faces litigation, it will have to deal with the issue of e-discovery, which will entail a whole lot more than turning over some old emails. Depending upon your role in the organization, the first you may hear of this is a "notice of litigation" with perhaps a "litigation hold directive" containing a "preservation directive." Here is a generic e-discovery request below. Apart from a few limiting factors, such as subject matter, named persons and a specified time period, the scope of such a notice is likely to be broad; blame standard procedure, not some high-powered attorney pushing his or her lu

Jan. 27 /PRNewswire-USNewswire/ -- Consumer Policy Solutions today released a new survey examining consumer awareness and understanding of online privacy. With Data Privacy Day tomorrow, this is an especially timely survey intended to help raise consumer awareness of privacy issues and give consumers the knowledge and tools needed for the privacy they desire online. Many consumers are not fully aware of the implications of their online activity and the "virtual breadcrumbs" they inadvertently leave behind when roaming from site to site. This survey, which follows closely on the heels of a Consumer Policy Solutions survey released in May that revealed protecting personal privacy is a top consumer concern, takes a closer look at consumers understanding of online privacy. Many respondents were unaware of the tracking, collecting and sharing of information that occurs as a result of online activities. "Consumers care about protecting their privacy on the Internet, but they do not necessarily know how to protect themselves nor do they understand how the process works," said Debra Berlyn, president of Consumer Policy Solutions. "Today is a great day to raise awareness of what the issues are for consumers. I think our survey serves as a good gauge of how consumers view their privacy online." In response to the findings of the survey, Consumer Policy Solutions is launching a website www.ConsumerPrivacyAwareness.org dedicated to educating and informing consumers about online privacy issues. The survey found that: * Consumers think they are knowledgeable about online privacy, but many are unaware of how their activity and behaviors can be followed and collected online. o 70% of Internet users say they are very or fairly knowledgeable about how to protect their personal privacy online o 42% are unsure whether their online activity is tracked and recorded by companies for commercial purposes o 12% believe that tracking by companies for co

A list of user names and passwords for customers of Comcast, one of the nation's largest Internet service providers, sat unprotected on the Web for the last two months. The list was 8,000 lines long, but Comcast said late Monday that just 700 of those lines contained information for active customer accounts. Kevin Andreyo, an educational technology specialist in Reading, Pa., and a professor at Wilkes University, came across the list Monday on Scribd, a document-sharing Web site. Mr. Andreyo was reading a recent article in PC World entitled "People Search Engines: They Know Your Dark Secrets… And Tell Anyone," when he was inspired to find out what information about him was online. He searched for his own e-mail address on the search engine Pipl. The list on Scribd was one of four results, and it also included his password, which was a riff on his love for a local sports team. Statistics on Scribd indicated that the list, which was uploaded by someone with the user name vuthanhan2004, had been viewed over 345 times and had been downloaded 27 times.

A 10-month cyberespionage investigation has found that 1,295 computers in 103 countries and belonging to international institutions have been spied on, with some circumstantial evidence suggesting China may be to blame. The 53-page report, released on Sunday, provides some of the most compelling evidence and detail of the efforts of politically-motivated hackers while raising questions about their ties with government-sanctioned cyberspying operations. It describes a network which researchers have called GhostNet, which primarily uses a malicious software program called gh0st RAT (Remote Access Tool) to steal sensitive documents, control Web cams and completely control infected computers. "GhostNet represents a network of compromised computers resident in high-value political, economic and media locations spread across numerous countries worldwide," said the report, written by analysts with the Information Warfare Monitor, a research project of the SecDev Group, a think tank, and the Munk Center for International Studies at the University of Toronto. "At the time of writing, these organizations are almost certainly oblivious to the compromised situation in which they find themselves." The analysts did say, however, they have no confirmation if the information obtained has ended up being valuable to the hackers or whether it has been commercially sold or passed on as intelligence. Although evidence shows that servers in China were collecting some of the sensitive data, the analysts were cautious about linking the spying to the Chinese government. Rather, China has a fifth of the world's Internet users, which may include hackers that have goals aligning with official Chinese political positions.

Privacy has been so poorly defined by opponents and proponents alike, that people have yet to realize its value.

While concerns about Internet privacy grab headlines, not everyone is bothered, or even aware, of how their online activities are being tracked. "On one extreme, there are Web cams in bedrooms, and the other extreme are people who won't wear a nametag at a conference," said Anne Toth, Yahoo's chief privacy officer. "Most people are in the middle. What's interesting is that consumers need to better understand how [privacy options] operate and where they can exercise their choices." Toth spoke at a consumer privacy panel here yesterday at the Tech Policy Summit. In general terms, she said "clear notice and robust choice is the right standard" for consumer privacy. But others in the audience and on the panel took issue with whether things like opt-in choices to receive information from e-tailers provide enough information or easily convey to consumers what they're agreeing to.

Social networking sites are often used by government ministers as an example of the profound way attitudes to privacy have changed. They argue that the young generation invade their own privacy to a far greater extent than the government ever would. The implication is that the older people who object to government intrusion are living in the past. The response to this is that people who use social networking sites voluntarily reveal things about themselves and have a degree of control of over how long information and photographs stay in the public domain, while the government collects and stores information without permission and allows the subject no access to the data held. There is no obvious comparison between the two activities. But this doesn't let the social networking sites off the hook. Most internet companies claim a kind of morality free status when it comes to such issues as privacy and copyright, and Web 2.0 sites are no different. A study published this week by Cambridge PhD students shows that nearly half of all social networking sites retain copies of photographs after being "deleted" by users. The study examined 16 popular websites that host user-uploaded photos, including social networking sites, blogging sites and dedicated-photo-sharing sites. Seven of the 16 sites surveyed were still maintaining copies of users' photos after they had been deleted by the user. The researchers - Jonathan Anderson, Andrew Lewis, Joseph Bonneau and lecturer Frank Stajano - found that by keeping a note of the URL where the photo is actually stored in a content delivery network, it was possible for them to access the photo even after it had been deleted.