Hacker steal logins...Nahhhh

September 2007

Hackers steal server log-ins from hosting vendor. Server hosting vendor Layered Technologies Inc. admitted this week that hackers broke into its support database and made off with as many as 6,000 client records, including log-in information that could give criminals access to clients' servers. The Plano, Texas-based company, which operates a pair of data centers that hold the physical servers it manages for clients, said the break-in happened sometime Monday night. “The Layered Technologies support database was a target of malicious activity on the evening of 9/17/2007 that may have involved the illegal downloading of information such as names, addresses, phone numbers, e-mail addresses and server log-in details for [5,000] to 6,000 of our clients,” the firm's CEO wrote on the company blog Tuesday. According to other information posted on the blog, the database was reached through a vulnerability in a Web-based application used by Layered’s help desk. After hacking the Web application, the criminals next accessed the support database. “This allowed them to then view tickets and their contents,” said a blogger. “This attack was done using an open protocol (HTTP), which allowed them to then get into the database," he added.

Unix admin plants logic bomb

September 2007

Unix admin pleads guilty to planting logic bomb at Medco Health. On Wednesday a former Unix system administrator at Medco Health Solutions Inc.’s Fair Lawn, N.J. office pleaded guilty in federal court to attempting to sabotage critical data -- including individual prescription drug data -- on more than 70 servers. The man, 51, is scheduled to be sentenced on January 8, and faces a maximum sentence of 10 years and a fine of $250,000. He was one of several systems administrators at Medco who feared they would get laid off when their company was being spun off from drug-maker Merck & Co. in 2003, according to a statement released by federal law enforcement authorities. Apparently angered by the prospect of losing his job, he created a “logic bomb” by modifying existing computer code and inserting new code into Medco's servers. The bomb was originally set to go off on April 23, 2004, the man’s birthday. When it failed to deploy because of a programming error, he reset the logic bomb to deploy on April 23, 2005, despite the fact that he had not been laid off as feared. The bomb was discovered and neutralized in early January 2005, after it was discovered by a Medco computer systems administrator investigating a system error. Had it gone off as scheduled, the malicious code would have wiped out data stored on 70 servers, including one critical server that maintained patient-specific drug interaction information that pharmacists use to determine whether conflicts exist among an individual's prescribed drugs. Also affected would have been information on clinical analyses, rebate applications, billing, new prescription call-ins from doctors, coverage determination applications and employee payroll data.

Hackers leak emails...Nahhh, not hackers...

September 2007

Hackers leak antipiracy vendor's e-mails to Net. Thousands of e-mails detailing the operations of MediaDefender Inc., a company hired by movie studios and record labels to flood file-sharing networks with fake files of pirated films and albums, have leaked to the Internet. A group calling itself “MediaDefender-Defenders” claimed responsibility for posting more 6,000 messages purportedly from MediaDefender. “By releasing these e-mails we hope to secure the privacy and personal integrity of all peer-to-peer users," MediaDefender-Defenders said in a text file bundled with the compressed messages. “The e-mails contains [sic] information about the various tactics and technical solutions for tracking p2p users, and disrupt [sic] p2p services.” The group said it hacked the Gmail account of a MediaDefender employee who had forwarded his work mail to his personal Google email service address. A file containing the e-mail messages quickly spread via BitTorrent, and its contents have also been extracted and converted into HTML, then published on at least one Web site. In the e-mails, which covered a period from mid-December 2006 to September. 10, company executives discussed a planned Web site, dubbed WiiVii.com that would pose as a pirate site that offered downloads of copyrighted movies and music but would actually track users who accessed it, then report their IP addresses back to MediaDefender.

Facebook & MySpace

September 2007

Facebook, MySpace users will trade privacy for features. Facebook and MySpace users are willing to let the sites sell their personal data in return for access to the sites' social networking features, according to new research from Pace University. Researchers at the university queried users of Facebook and MySpace in August, asking for their views of the privacy protections offered by the sites and their feelings about how much personal information they are willing to post on social networking sites. A professor at Pace who worked on the study noted that most Facebook and MySpace users said that they're willing to develop online relationships even though they believe that trust and privacy safeguards are weak. Users seem to view the social networking sites as a way to obtain online profiles, photos and the like for free while the sites “can take all their data and do whatever they want with it,” she noted. “Both sites are really interested in monetizing this information as much as possible,” according to the professor. “They don't exist to give people ways to upload photos.” Of those surveyed, less than 5 percent of MySpace users, and slightly more than 5 percent of Facebook users said they believe that the personal information they put on the sites is strongly protected. Still, the respondents told researchers that they are willing to share personal details with others on the sites. More than 85 percent of respondents in both groups reported that they would share a photo of themselves on a social networking site, and 91 percent of Facebook users and 62 percent of MySpace users said they use their real name on such sites, according to the study. In addition, 87 percent of Facebook users and 41 percent of MySpace users post their personal e-mail addresses on the sites.

Microsoft speaks on software piracy

September 2007

Microsoft on Friday said it may take decades to tackle software piracy in large emerging economies, despite some recent progress, and called on Asian governments to invest more in policing the practice. “We are realistic in recognizing that we have to work diligently over periods, that are really a decade or two, to make real progress in a number of these environments,” said Microsoft’s chief research and strategy officer. He also noted that progress had been made in countries like China and Vietnam in recent years to tackle software pirates, which cost the company billions of dollars each year. However, he said more needed to be done to police the problem, especially from the side of enforcement. “Most of the Asian countries have the laws, some of the regulations – they probably need tuning up – but the biggest weakness is, very few of them have made the necessary investment on the enforcement side.” Microsoft has made progress in China, where the piracy rate has dropped to 82 percent this year from 94 percent four years ago, he said. The piracy rate is a measure of the level of pirated software in the country. China President Hu Jintao last year pledged to crack down on software piracy.

Cybercrime committed 'every 10 seconds

September 2007

A cybercrime is committed every 10 seconds in Britain, criminals abusing the anonymity of the online world to carry out offences from unwanted sexual approaches to online fraud, according to a study published Thursday. The UK Cybercrime report, commissioned by online criminology firm 1871 Ltd, suggested that more than three million offences were committed online last year. The author of the report said, “Although measuring cybercrime is difficult, it is clear that in many instances it is outstripping 'traditional' crime.” Online security firm Garlik compiled the figures and found that individuals and not organizations were the intended target of more than 60 percent of the online offences. Topping the list of offences was online harassment, including abusive e-mails and offensive allegations posted on websites and chatrooms. There were also 850,000 instances of sex crimes, where individuals were ‘cyberstalked’ or received unwanted sexual approaches, for example. Garlik also found that there were 207,000 financial frauds committed last year – up more than 30 percent on a similar study in 2005. There were 92,000 cases of identity theft and 144,500 cases of hacking into another PC. Experts also warned that not enough is being done to tackle the problem.

Offshore worker breaks into Caterpillar server

September 2007

An offshore worker breaks into Caterpillar server in U.S, steals 4,000 documents. An IT engineer working for Caterpillar Inc.’s engineering design center in India allegedly used another employee's username and password to access and steal about 4,000 confidential documents from a company server in the U.S. The individual behind the attack was arrested by the Cyber Crime Cell of India's Criminal Investigations Department in late July. He was charged with hacking into a server and stealing confidential data under the country's Information Technology Act of 2000. A Caterpillar spokeswoman confirmed the incident and said that a former Caterpillar employee had been arrested by local authorities.

Hacker or Computer Expert?

September 2007

A California man who served jail time for hacking hundreds of military and government computers nine years ago was charged yesterday with new computer crimes: stealing tens of thousands of credit card accounts by breaking into bank and card processing networks. Known by his alias Max Vision and by his online nicknames of Iceman, Digits and Aphex, the man was indicted Tuesday by a federal grand jury in Pittsburgh on three counts of wire fraud and two counts of transferring stolen identity information. Arrested last week in California, where he remains, he could face up to 40 years in prison and a $1.5 million fine if he is convicted on all five counts. According to the indictment, he hacked multiple computer networks of financial institutions and card processing firms, sold the account and identity information he stole from those systems, and even received a percentage of the money that others made selling merchandise they'd purchased with the stolen card numbers. The U.S. Secret Service ran the investigation into the hacks and resulting scams, which took place between June 2005 and September of this year. The man was charged in Pittsburgh because he'd sold data on 103 credit card accounts to a Pennsylvanian who was cooperating with authorities. He and others also operated a Web site used as a meeting place for criminals who bought and sold credit card and personal identity information.

Keyloggers fight terrorist in cybercafes

September 2007

Keyloggers proposed to fight terrorist use of cybercafés. A nonprofit organization in Mumbai, India has proposed that police use keylogging software at cybercafés to keep track of communications between terrorists. Public computers at cybercafés offer terrorists the anonymity they require, said the president of the Foundation for Information Security and Technology (FIST) in Mumbai in an interview Tuesday. Terrorists are known to use instant messaging (IM) services from companies like Microsoft Corp. and Yahoo Inc., and these companies do not share information from IM chats with the police, he added. Keyloggers are software on a computer that record a user's key strokes—whatever the user types—on a computer keyboard. Data from keyloggers would be uploaded to centralized servers where it would be available to the police for scrutiny. Mumbai police have yet to give their approval. The keyloggers would be activated centrally when a suspect walks into a cybercafé or when suspicious activity is noted, though it is unclear who would determine activity to be suspicious. Though some have criticized the proposal, fearing that it will endanger the privacy of ordinary citizens, the nonprofit and others say it is a small price to pay to protect against loss of life from terrorism. In July last year, seven bombs planted in Mumbai's suburban trains killed over 200 people and injured another 700. Terrorists are increasingly using the Internet to communicate with one another as they are aware that telephone and mobile phones connections are under Indian government surveillance, according to the nonprofit’s president.

Hackers update malware tool

September 2007

Hackers update malware tool kit, add first zero-day attack code. A new version of the IcePack hacker exploit tool kit has been released, security researchers warned today, and for the first time it includes attack code designed to exploit an unpatched, or zero-day, Microsoft vulnerability. Three of IcePack's eight exploit tools are new, said the chief technology officer at Exploit Prevention Labs Inc. That alone is noteworthy, he said. “The mix of old and new exploits is to be expected, but three new ones in one update is pretty impressive,” he noted. But the new tool kit also sports a first. "The latest iteration has done something original,” he said, pointing to an exploit that attacks a zero-day vulnerability in Microsoft's DirectX software development kit (SDK). “The closest to a tool-kit zero-day exploit [before] was for the ANI [animated cursor] vulnerability,” he said, referring to a Windows bug that surfaced in early April.

Data explosion shakes up IT

September 2007

In just three years, the bytes of data generated by digital cameras, mobile phones, business IT systems and other tech devices will equal the number of grains of sand on the world's beaches. It's a mind-boggling estimation from market analysis company IDC. But it reflects the proliferation of devices and systems used by consumers and businesses, IDC's vice president of worldwide IT markets and strategies said today. Over the next few years, corporations will face tough decisions on how to store data, find information and comply with regulations, he said. It won't be an easy task. While 85% of that data is predicted to come from consumers snapping photos, surfing Web pages and sending e-mail, about 60% of that consumer data will still cross corporate networks, he said. Much of the data is unstructured, meaning it's not clearly labeled as to its content, such as photos, video and perhaps phone recordings, which makes it more difficult to use. But technologies that enable deep analysis of the data are emerging, and could help businesses unlock what's important and improve their operations. But the security concerns still abound, as well as regulatory compliance and liability worries. According to data from the U.S. Computer Emergency Readiness Team, the number of reported software vulnerabilities declined in 2003 and 2004 but surged in 2005 to around 6,000, an all-time high.

Microsoft Updates

September 2007

Microsoft downplays stealth update concerns. Microsoft Corp. today downplayed the concerns over undercover updates to Windows XP and Windows Vista, saying that silent modifications to the Windows Update (WU) software have been a longtime practice and are needed to keep users patched. “Windows Update is a service that primarily delivers updates to Windows,” said the WU group program manager the team’s blog today. “To ensure ongoing service reliability and operation, we must also update and enhance the Windows Update service itself, including its client-side software.” Microsoft was moved to respond after the popular “Windows Secrets” newsletter looked into complaints that WU had modified numerous files in both XP and Vista, even though users had set the operating system to not install updates without their permission. In many cases, users who dug into Windows’ event logs found that the updates had been done in the middle of the night. Windows gives users some flexibility in how their PCs retrieve and install updates and patches from the company's servers. But some users have filed accounts of stealth updates to WU even when they had completely disabled the automatic update feature in the operating system. The program manager disputed those claims, saying, “WU does not automatically update itself when Automatic Updates is turned off, this only happens when the customer is using WU to automatically install upgrades or to be notified of updates.”

Mr. Anderson..Sophisticated thieves selling code to criminals

September 2007

Online crooks are quickly enlarging an already vast sales and distribution network to propagate spam and send malicious software in hopes of infecting millions of computers worldwide, according to a new report. The Internet Security Threat Report, covering the first half of 2007 and released Monday by security software maker Symnatec, says sophisticated thieves sell code to criminal middlemen for as much as $1,000 per program. The middlemen then push the code to consumers, who may be duped into participating in a scam, or who may have their passwords, financial data and other personal data stolen and used by identity theft rings. The savviest hackers lock middlemen into long-term service contracts so they can automatically push the newest exploits on unwitting consumers and compensate for patches developed by legitimate programmers. The agreements — not unlike contracts between software powerhouses such as Oracle Corp. or Microsoft Corp. and their corporate clients — leave a trail of code that, in principal, makes it easier for authorities to catch both the hacker and the person who is buying the program. However, researchers who worked on Symantec's newest said the amount of money to be made from computer attacks still outweighs the danger. The report also found that the U.S. is the top country for so-called underground economy servers. It is home to 64 percent of the computers known to Symantec to be places where thieves barter over the sale of verified credit card numbers, government-issued identification numbers and other data.

Not All bullies are on the playground...

September 2007

Cyberbullying is a growing problem among children and teenagers on the Internet. The anonymity and ease of communication the Internet provides can create a vehicle for bullying, harassment and defamation, making the Internet a hostile and dangerous place. Cyberbullying is a problem that you, as a filmmaker, can help address and solve.

Help end cyberbullying by creating a Public Service Announcement on the issue. Sony Creative Software, the National Crime Prevention Council and the Ad Council are seeking entries from independent producers and academic institutions (K - 12). The top submissions may be eligible for national broadcast, and their producer or sponsoring academic institution will receive a complete multimedia editing suite for their facility or school valued at over $18,000. Prize sponsors include Sony Creative Software, Sony Electronics, and Sony VAIO.

Judges to include: Barry Sonnenfeld, director/producer (Men in Black, Addams Family, and others); Steve Oedekerk, producer/writer (Bruce Almighty, Barnyard, and others); Justin W. Patchin, Ph.D., noted authority on social networking and cyberbullying; and members of the Ad Council's Campaign Review Committee.

The call for entries period opened September 11, 2007, and closes January 11, 2008. All entries must be received by January 11, 2008 to be eligible.