Archive for the ‘Security’ Category
Darko on June 19th, 2008
CHENNAI: Police on Tuesday arrested a college student for purchasing electronic goods online using credit card details of card holders from across the world.
T Bharathwaj Purohit (20), a resident of MKB Nagar and a member of a community of hackers, had been buying electronic goods online using other people’s credit cards since April.
Police recovered an electric guitar, a printer, an LCD TV, a digital camera, a weighing scale, a mobile and a laptop all worth Rs 3 lakh, and Rs 38,500 in cash from him. Purohit met Charu Sharma of Mumbai and Hathi Gogaiyan of Ahmedabad online a few months ago. They introduced him to an online hackers’ community on the net and gave him credit card details to make purchases.
“Following Sharma and Gogaiyan’s advice, Purohit tried to book an expensive mobile and i-pod using the data they provided. To his surprise, he received the items within a week. He also couriered the valuables to them as gifts. He started buying more goods online on eBay, an online auction website,” deputy commissioner of police B Vijayakumari said.
Sharma and Gogaiyan had given Purohit details of US credit card holders. Following complaints from an eBay investigation officer, the city police arrested Purohit. He had made his purchases from his personal computer. The police, with the help of the cyber crime wing, tracked down his IP address. Preliminary inquires revealed that this group of hackers got bank accounts and credit card details of people for a price.
“We have received information that the Mumbai police cornered Sharma and Gogaiyan a few days ago for another credit card cheating case in Mumbai. We have taken Purohit into custody to get more details,” a senior police officer said.
Police booked Purohit under several sections of the IPC, including 420 (cheating). He was remanded in judicial custody after being produced before the magistrate court on Tuesday.
Darko on June 18th, 2008
WASHINGTON — The government does not have adequate privacy protections for the personal information it collects, shares and stores as part of the effort to fight terrorism, according to a new report by a U.S. watchdog agency.
The Government Accountability Office (GAO) says that new laws are needed to safeguard people’s personal information. Decades-old laws no longer cover the “increasingly sophisticated ways” that the government collects information, such as through biometric scans of fingerprints, the report said.
“In today’s highly interconnected environment, information can be gathered from many different sources, analyzed and redistributed in very dynamic, unstructured ways,” the GAO’s Linda Koontz says in testimony prepared for a hearing today by the Senate Homeland Security Committee.
Much of the way personal information is handled today, including being sifted through data-mining systems that search for patterns, is not covered by the Privacy Act of 1974, she says.
As states begin collecting information in coming years to produce new secure drivers’ licenses, government databases will get even larger. “The government has no business collecting our personal information if it cannot ensure the American public it will be protected from identity thieves and other prying eyes,” says Caroline Fredrickson of the American Civil Liberties Union.
Committee Chairman Joe Lieberman, I-Conn., says citizens can be left vulnerable to identity theft, stalking, discrimination, unwarranted surveillance or loss of employment if their personal information isn’t properly secured. “It is essential for the government to collect and use personal information,” he says. But the government must “properly balance our many policy goals against potential incursions on privacy.”
The GAO report suggests that Congress update the Privacy Act to reflect the changing times and technologies.
Sen. Susan Collins, R-Maine, agrees: “In the digital age … we must be even more vigilant to ensure that rapid technological change does not undermine the privacy rights that Americans treasure.”
Bruce Schneier, chief security technology officer at the British telecommunications company BT, says it will be difficult for Congress to pass a law that could really protect the vast amounts of information the government holds.
The underlying problem, he says, is that “massive, massive data collections” are kept by private industry and the government, a proliferation of data he calls the “pollution problem of the information age.” He says that it’s difficult to safeguard it all.
Darko on June 17th, 2008
A Department of Industrial Accidents investigator has been cleared of child porn possession charges after a forensic investigation revealed that malware was to blame for depraved smut on his company laptop.
Michael Fiola, 53, of Rhode Island, went through a massive ordeal after images of child abuse were discovered on a replacement machine he received in November 2006, following a laptop theft. He lost his job in March 2007 after an internal investigation, prompted by a Verizon wireless bill four times higher than his colleague, unearthed the suspicious content. Fiola had worked for the agency investigating workers’ compensation fraud for seven years prior to his dismissal.
The case was forwarded onto the authorities who filed a criminal complaint in August 2007.
But subsequent forensic investigation discovered that malware was responsible for silently downloading images of pre-pubescent kids onto the machine. Computer experts hired by both the defence and prosecution agreed with this analysis.
Computer forensic analyst Tami Loehrs said that malware surreptitiously served up pre-teen pornographic images onto the machine without the awareness of its user. Loehrs described the case as “one of the most horrific” she’d ever dealt with.
In her report to the court, Loehrs said “the laptop was compromised by numerous viruses and trojans, and may have been hacked by outside sources.”
All the offending images were loaded into locations reserved for cached web pages. Crucially there was no sign that any user had viewed or attempted to access this content.
“There is no evidence to support the claim that Michael Fiola was responsible for any of the pornographic activity,” Loehrs wrote.
Two computer forensic experts hired by the prosecution came back with the same conclusion.
“The overall forensics of the laptop suggest that it had been compromised by a virus,” said Jake Wark, spokesman for Suffolk District Attorney Daniel Conley.
The case against Fiola has been dropped, but he still wants his day in court following months of hell when friends turned against him, leaving his faithful wife Robin as his only supporter. Fiola, described by his wife as “computer-illiterate”, intends to sue his former employers over their actions in the case, the Boston Herald reports.
DIA spokeswoman Linnea Walsh said that the agency stood by its handling of the case.
Fiola’s lawyer Timothy Bradl criticised this stance: “Imagine this scenario: Your employer gives you a ticking time bomb full of child porn, and then you get fired, and then you get prosecuted as some kind of freak,” he said.
Darko on June 17th, 2008
SAN DIEGO — A disgruntled worker is paying the price for deleting medical records, 10News reported.
Jon Paul Oson, of Chula Vista, was sentenced to more than 5 years in prison for hacking into the database of a local health clinic.
It was the very person trusted to protect the Council of Community Health Clinics who went on a hacking rampage.
Click here to find out more!
“The doctors did not have available … knowledge of the other drugs the patients needed and there were treatment complications in the records in the computer that weren’t available to the doctors,” said Assistant U.S. Attorney Mitch Dembin.
Oson worked as the clinic’s technical services manager. He resigned after an unfavorable job evaluation.
That is when investigators said Oson started deleting patient files.
“About a week before the most devastating of his attacks, he broke into the system and deleted the program that would have caused the data to be backed up,” said Dembin.
Dembin said Oson’s actions affected thousands of patients’ records. That is because the organization provides various services to 17 regional health clinics in Southern California, including the North County Health Services Clinic in San Marcos.
Oson’s crime caught up with him, and he has been sentenced to more than 5 years in prison.
“This case, as best as we can tell, was one of the longest, if not the longest, sentence imposed involving straight computer hacking,” said Pam Dixon of the World Privacy Forum.
Dixon said the case was a perfect example of why patients should keep track of their medical records.
“In this electronic world, sometimes paper is the best backup, and it’s really great to have a copy of your records in paper form,” said Dixon.
Dixon said requesting your patient records every year is ideal.
Oson has also been ordered to pay more than $409,000 in restitution.
Darko on June 17th, 2008
Australia has the highest incidence of cyber crime in the world, according to a global survey of nine countries by software security vendor, AVG.
The study, which canvassed 1000 users each in Australia, the US, France, Germany, Italy, Spain, Sweden, Brazil, and the Czech Republic, found that more than 39 per cent of Australians had been the victim of cyber crime, compared to 32 per cent in Italy, 28 per cent of Americans, and just 14 per cent in Sweden and Spain.
The most common forms of cyber theft experienced by Australians were:
Not receiving goods paid for at an online auction (16 per cent);
Fraudulent e-mails that resulted in financial damage (14 per cent);
Phishing (10 per cent);
Not receiving goods ordered online (eight per cent);
Credit card fraud (five per cent); and
Unauthorised bank transfers (three per cent).
Lloyd Borrett, marketing manager of AVG (AU/NZ), said the fact that Australia experienced more cyber crime was a little surprising, although it might have been impacted by the fact that Australians are more active online users than most other nations.
“While we don’t know whether Australians are actually targeted more heavily than other countries, these results highlight the importance of comprehensive security solutions to protect users from obvious threats like phishing and e-mail scams, as well as good education to warn people of the danger,” Borrett said.
Forty-seven per cent of Australians said they were more likely to experience cyber crime than to experience burglary, assault, or robbery, and 37 cent of said that cyber crime was a strong concern.
The AVG survey found that Australians had relatively high awareness of Internet security and demonstrated the second highest level of confidence (70.5 per cent after the US’s 73.3 per cent) in the protection provided by their software security vendor.
Darko on June 16th, 2008
A security feature which gave punters total privacy has been dumped from the final version of Firefox 3.
Private Browsing would have disabled all caching, cookie downloads, history records, and form data during the session.
If it worked it would have meant you could surf the Web and leave nothing sticky on your computer.
Mozzarella Fountain’s big cheese in security Johnathan Nightingale, said that Private Browsing was, in principle, pretty cool. It would mean that what you were about to do would not be logged anywhere.
You hit a button and everything past that point isn’t logged. Then you hit the button again and you were visible again.
It would be handy while you were borrowing a computer and didn’t want your mates to see you had been checking out porn, violence, or Apple’s product pages.
Nightingale said, however, that the main problem with the button is that it touched a lot of code. It was likely to interact with Web sites and mashups and things like that and was just a crash waiting to happen
Darko on June 13th, 2008
Attackers could gain control of water treatment plants, natural gas pipelines and other critical utilities because of a vulnerability in the software that runs some of those facilities, security researchers reported Wednesday.
Experts with Boston’s Core Security Technologies, who discovered the deficiency and described it to the Associated Press before they issued a security advisory, said there’s no evidence anyone else found or exploited the flaw.
Citect Pty. Ltd., which makes the program called CitectSCADA, patched the hole last week, five months after Core Security first notified Citect of the problem.
But the vulnerability could have counterparts in other supervisory control and data acquisition, or SCADA, systems. And it’s not clear whether all Citect clients have installed the patch.
SCADA systems remotely manage computers that control machinery, including water supply valves, industrial baking equipment and security systems at nuclear power plants.
Customers that use CitectSCADA include natural gas pipelines in Chile, major copper and diamond mines in Australia and Botswana, a large pharmaceutical plant in Germany, and water treatment plants in Louisiana and North Carolina.
For an attack involving this vulnerability that Core Security revealed Wednesday to occur, the target network would have to be connected to the Internet. That goes against industry policy but can happen when companies have lax security measures, such as connecting control systems’ computers and computers with Internet access to the same routers.
A rogue employee could also access the system internally.
Security experts say the finding highlights the possibility that hackers could cut the power to entire cities, poison a water supply by disrupting water treatment equipment or cause a nuclear power plant to malfunction by attacking the utility’s controls.
That possibility has grown in recent years as more of those systems are connected to the Internet.
The Citect vulnerability is of a common type. Called a buffer overflow, it allows a hacker to gain control of a program by sending a computer too much data.
“It’s not a very elaborate problem,” said Ivan Arce, Core Security’s chief technology officer. “If we found this thing - and this was not that hard - it would be easy for someone else to do it.”
Darko on April 24th, 2008
Spammers will use the upcoming US elections as a means to increase spam volumes, security firm BitDefender has warned.
Election motivated content and the names of popular candidates including Barak Obama, Hilary Clinton and John McCain are set to be exploited.
“As we move forward towards the election we’re going to see an increase volume of spam with this sort of content,” Mihai Rusescu, business unit manager EMEA & APAC Business Unit at BitDefender told SC.
Mihai added that image spam volumes will continue to grow while text based spam, often fought off by spam filters, will reduce.
Meanwhile, we’re going to see new viruses aimed at mobile computing as usage of Windows Mobile increases.
“Most manufacturers are embracing the new Windows Mobile operating system, which is using the same core technology as Windows,” said Rusescu.
“Unfortunately it has some gaps and security holes that bad people are trying to take advantage of,” he added.
In terms of PC malware, new aggressive strains will continue coming into the market and cybercriminals will also try to exploit the browser, said Rusescu.
Darko on April 17th, 2008
Ethical hacking group GNUCitizen.org has warned that the default settings on one of the UK’s most widely used wireless routers is leaving customers open to attack.
The group showed in a blog posting that the BT Home Hub, the wireless router supplied to BT Broadband customers, uses algorithms that make the device easy to crack when in default mode.
Using reverse-engineering techniques the group said that the hub’s Wired Equivalent Privacy (WEP) keys can be predicted in just 80 guesses, but had decided against making its automated guessing program publicly available.
GNUCitizen’s findings appear to confirm long-term concerns about the security of the WEP encryption protocol.
“It is quite likely that the bad guys can break into your network if you are using the default encryption key. Our advice is to use WPA rather than WEP and change the default encryption key now,” GNUCitizen said.
Responding to the criticisms, BT denied that real-life users of the device were in any serious danger of hack attacks.
“It is important to realise that, although it has been possible to demonstrate a scenario where the hub may be vulnerable, we do not believe it is something that should affect the majority of BT customers in real life,” the company said in a statement.
BT, which has published details on how to more effectively secure the router, said that other operators supplying the Thomson-manufactured device were also affected by the issue.
Darko on April 17th, 2008
New figures suggest that 92.3 per cent of all email sent globally during the first three months of 2008 was spam.
The data from Sophos also indicated that 23,300 new spam-related web pages were created every day during the period, or one about every three seconds.
For the first time Turkey’s contribution to the global spam problem puts it in the top three offending countries.
Compromised computers in Turkey are now responsible for relaying 5.9 per cent of the world’s junk email, compared to 3.8 per cent in the final quarter of 2007.
The US and Russia maintained first and second place respectively, but both countries managed to reduce their contribution to the worldwide spam problem compared to the final three months of 2007.
However, the number of spam messages sent from compromised Russian computers has more than doubled over the past year.
In the first quarter of 2007, Russia was in tenth position in the chart, relaying just three per cent of the world’s spam. Today this figure stands at 7.4 per cent.
Elsewhere in the chart, the UK is at number 10 with 3.4 per cent of all spam, up from 2.5 per cent and 12th place in the final quarter of 2007.
“Turkey’s appearance in the top three makes for an interesting realignment so early in the year,” said Carole Theriault, senior security consultant at Sophos.
“But this does not mean that other countries can give up the fight. Spam is a global problem and must be tackled as such.”
The US continues to relay far more spam than any other country, but the gap is closing, suggesting that users may be receiving more education on safe computing and becoming more security savvy than before.
