Hacking Expose!: 2011-05-01

Domestic Surveillance Court Approved All 1,506 Warrant Applications in 2010

Saturday, May 7, 2011

The secretive Foreign Intelligence Surveillance Court approved all 1,506 government requests to electronically monitor suspected “agents” of a foreign power or terrorists on U.S. soil last year, according to a Justice Department report released under the Freedom of Information Act.

The two-page report, which shows about a 13 percent increase in the number of applications for electronic surveillance between 2009 and 2010, was obtained by the Federation of American Scientists and published Friday.

“The FISC did not deny any applications in whole, or in part,” according to the April 19 report to Sen. Majority Leader Harry Reid (D-Nevada).

The 11-member court denied two of 1,329 applications for domestic-intelligence surveillance in 2009. The FBI is the primary agency making those requests.

Whether the FISA court, whose business is conducted behind closed doors, is rubber-stamping the requests is a matter of debate.

“That’s been a traditional concern that the court might have become a rubber stamp and that it’s approval is only a formality,” Steven Aftergood, the director of the Project on Government Secrecy for the Federation of American Scientists, said by telephone. “The government’s argument, and it’s also an argument that has been made occasionally by the judges, is in fact the Justice Department has grasped the court’s expectations so well that the only applications they submit to the court are ones that are likely to meet its approval.”

The court, set up in 1978, issues warrants for domestic surveillance that are unlike the warrants issued in criminal investigations. The secret court warrants, under the authority of the Foreign Intelligence Surveillance Act, grant the government broad authority to secretly monitor the electronic communications of persons in the United States, generally for intelligence purposes only.

The targets of a FISA warrant may never learn of the surveillance. Whereas subjects of non-FISA warrants may challenge the warrants and the evidence gathered if it is used in a criminal prosecution.

Aftergood notes that the figures, whether they amount to rubber-stamping or not, do not account for the warrantless monitoring program President George W. Bush adopted in the wake of the 2001 terror attacks. Under the Terror Surveillance Program, exposed in 2005 by The New York Times, the government conceded it was eavesdropping — without warrants — on the electronic communications of Americans if they were communicating with somebody overseas believed linked to terrorism.

The Justice Department report, meanwhile, said the FBI issued 24,287 “national security letter” requests last year on 14,212 people, “a substantial increase from the 2009 level of 14,788 NSL requests concerning 6,114 U.S. persons,” Aftergood wrote in a blog post. In 2008, there were 24,744 requests regarding 7,225 people.

National security letters are written demands from the FBI that compel internet service providers, credit companies, financial institutions and others to hand over confidential records about their customers, such as subscriber information, phone numbers and e-mail addresses, websites visited and more.

They do not require court approval, and the FBI need merely assert that the information is “relevant” to an investigation, and anyone who gets a national security letter is prohibited from even disclosing that they’ve received one.

Here is a link to all 32 Foreign Intelligence Surveillance Court annual reports to Congress made available by the Federation of American Scientists.

Photo: urban don/Flickr

See Also:

Appeals Court Revives Lawsuit Challenging NSA Surveillance
ACLU Study Highlights U.S. Surveillance Society
School District Halts Webcam Surveillance
DoJ Faulted for Failing to Follow Surveillance Reporting Requirements
Obama Sides With Bush in Spy Case
Court Kills ‘Round-The-Clock’ Surveillance Case
President Ford Approved Warrantless Domestic Surveillance

Java-based malware tries Mac-smacking cross-platform attack

Malware-writers have developed a Java-based, equal-opportunity botnet Trojan in an apparent bid to infect more machines outside the Windows ecosystem.

IncognitoRAT uses source code and libraries that allow it to attack both Windows and Mac machines, at least in theory. Only the Windows version of the malicious downloader has been spotted actually spreading, McAfee reports.

"The original propagation vector of IncognitoRAT is a Windows executable, but apparently it was created using the tool JarToExe, which includes, among other features, the ability to convert .jar files into .exe files, to add program icons and version information, and protect and encrypt Java programs," explains McAfee researcher Carlos Castillo. "The victim's machine has to have the Java Runtime Environment installed and must be online. As soon as the file is executed, it starts downloading a ZIP file with a pack of Java-based libraries to perform several remote activities."

Once successfully executed, the malware establishes remote control of compromised systems, allowing criminal hackers to either control or extract and upload private information from compromised devices.

Cross-platform malware is rare but not unprecedented. The more widespread use of Mac machines is bound to make the platform a more attractive target for virus writers and other miscreants. Whether they will succeed is another question, but several vulnerabilities in Apple's software have been revealed through various editions of the annual CanSecWest Pwn2Own hacking competition, so it's certainly possible.

Sony, Epsilon scolded for ducking probe

Sony PlayStation Network was unpatched, lacked firewall.

Sony and marketing company Epsilon have been chastised in a US House hearing overnight for shirking a committee hearing on the high-profile breaches which exposed millions of personal records.

Congresswoman Mary Bono Mack said it was “unacceptable” that representatives from the two companies did not front up to questions about how the companies were breached.

Mack said Sony’s decision to notify customers via a corporate blog was a “half-hearted, half-baked” decision.

“Sony put the burden on consumers to search for information instead of accepting the burden of notifying them,” Mack said. “If I have anything to do with it, that kind of half-hearted, half-baked response is not going to fly in the future.”

Mack said while the companies are victims, they must take responsibility for the attacks.

“According to Epsilon, the company did not have time to prepare for our hearing, even though its data breach occurred more than a month ago. Sony, meanwhile, says it’s too busy with its ongoing investigation to appear. Well, what about the millions of American consumers who are still twisting in the wind because of these breaches? They deserve some straight answers, and I am determined to get them.”

US Senator Richard Blumenthal sent a letter to Sony’s Hazai and CEO Jack Tretton attacking the “egregious inadequacy” of Sony’s efforts.

“I am deeply concerned about the egregious inadequacy of Sony’s efforts thus far to notify its customers of these breaches or to provide adequate protections for users whose personal and financial information may have been compromised,” he said. “Sony’s failure to adequately warn its customers about serious security risks is simply unconscionable and unacceptable.”

Sony had blamed the breach of its PlayStation Network - which exposed up to 77 million personal records - on internet activist collective Anonymous. The hacktevist group had previously denied involvement.

Sony consumer chief Kazuo Hazai said in a letter that the company found an Anonymous calling card (PDF) which said “we are legion”, but the company did not elaborate on the validity of the discovery.

SC Magazine Australia has sought confirmation from a liaison from Anonymous.

Dr Gene Spafford of the US-based Purdue University said the servers behind the Sony PlayStation Network were unpatched and did not have a firewall. He said the details were noted in a mailing list months before the breach occurred.

Feds Demand Firefox Remove Add-On That Redirects Seized Domains

The Department of Homeland Security has requested that Mozilla, the maker of the Firefox browser, remove an add-on that allows web surfers to access websites whose domain names were seized by the government for copyright infringement, Mozilla’s lawyer said Thursday.

But Mozilla did not remove the MafiaaFire add-on, and instead has demanded the government explain why it should. Two weeks have passed, and the government has not responded to Mozilla’s questions, including whether the government considers the add-on unlawful and whether Mozilla is “legally obligated” to remove it. The DHS has also not provided the organization with a court order requiring its removal, the lawyer said.

“One of the fundamental issues here is under what conditions do intermediaries accede to government requests that have a censorship effect and which may threaten the open internet,” Harvey Anderson, Mozilla’s lawyer, wrote Thursday on his blog.

Neither Homeland Security nor Anderson immediately responded for comment.

The add-on in question redirects traffic from seized domains to other domains outside the United States’ reach. Since last year, the U.S. government has seized at least 120 domains in an antipiracy assault known as “Operation in Our Sites.” The domains are taken under the same federal statute used to seize drug houses.

Many of the seized sites have been redirected by their owners to domains being hosted where the United States cannot legally touch them The United States controls so-called top-level domains like .com, .net and .org.

The add-on has been downloaded more than 6,400 times.

See Also:

Feds Seize 18 More Domains in Piracy Crackdown
U.S. Shutters 82 Sites in Crackdown on Downloads, Counterfeit Goods
ICE Uses Seized Domains for Best Anti-Piracy Video Ever
Senate Committee OKs Domain-Name Seizure for Pirate Websites
U.S. Shuttering Online Gambling Sites
FBI vs. Coreflood Botnet: Round 1 Goes to the Feds

Skype bug gives attackers access to Mac OS X machines

Mac users running Skype are vulnerable to self-propagating exploits that allow an attacker to gain unfettered system access by sending a specially manipulated attachment in an instant message, a hacker said.

The long and the short of it is that an attacker needs only to send a victim a message and they can gain remote control of the victim's Mac, Gordon Maddern of Australian security consultancy Pure Hacking blogged on Friday. It is extremely wormable and dangerous.

The vulnerability, which Maddern said isn't present in the Windows or Linux versions of the popular VoIP program, was confirmed by Skype spokeswoman Brianna Reynaud, who said a fix will be rolled out next week. Its disclosure comes the same week that researchers discovered a new crimekit that streamlines the production of Mac-based malware. It also comes as new malware surfaced for Apple's OS X that masquerades as a legitimate antivirus program.

Reynaud said there are no reports that the Skype vulnerability is being actively exploited.

Maddern said he stumbled on the critical flaw by accident.

About a month ago I was chatting on skype to a colleague about a payload for one of our clients, he wrote. Completely by accident, my payload executed in my colleagues skype client. So I decided to test another mac and sent the payload to my girlfriend. She wasn't too happy with me as it also left the her skype unusable for several days.

He then set out to write proof-of-concept attack code that used payloads borrowed from the Metasploit exploit framework. The result: a Skype exploit that allows him to remotely gain shell access on a targeted Mac. Because it's sent by instant messages, it might be possible to force each infected machines to send the malicious payload to a whole new set of Macs, causing the attack to grow exponentially.

Maddern didn't say what interaction is required on the part of the victim, and he didn't immediately respond to an email seeking clarification. His blog post says he notified Skype of the vulnerability more than a month ago, and that he will withhold specific details until a patch is released to prevent malicious attacks.

Microsoft ID guru quietly skips away from Redmond

Updated Microsoft's top identity architect Kim Cameron, who was last seen on these pages bemoaning Apple's "duplicitous" privacy policies, reportedly quit Redmond earlier this week.

According to ZDNet's Mary-Jo Foley, who cites anonymous sources, Cameron had a leaving do at Microsoft on Wednesday.

However, both Cameron and Microsoft have so far remained silent about his decision to move on from the company.

The Register has asked Microsoft to confirm Cameron's resignation, but we've yet to hear back.

The digital ID expert hasn't updated his blog since 21 April, and is yet to announce his departure on LinkedIn, Twitter or via any of the other Web2.0 ways adopted by many tech stars to reveal their break-ups.

As noted by Foley, Cameron appears to have quit on the same day that Microsoft's Windows Live division confirmed plans to support OAuth 2.0 in the next version of its Messenger Connect developer platform.

France-based Cameron joined Microsoft in 1999 when it acquired ZOOMIT, where he had worked as that's company's technology veep.

"Kim plays a leading role in the evolution of Active Directory, Federation Services, Forefront Identity Manager, CardSpace and Microsofts other Identity Metasystem products," his biog notes.

Cameron's apparent exit follows Dick Hardt's decision to leave the firm in early 2010, after joining Microsoft as a partner architect working on consumer, enterprise, and government identity problems in December 2008.

Microsoft, meanwhile, is presumably feverishly searching for Cameron's replacement and perhaps more ominously, according to our sources, is undertaking a big shake-up of the identity access group with at least two important men, Lee Nackman and Craig Wittenberg, said to have been sidelined. It's also unclear who will now steer development of Redmond's U-Prove cryptology technology, which the company bought in March 2008.

Chat Log: What It Looks Like When Hackers Sell Your Credit Card Online

With the number of people exposed in breaches at Sony now topping 100 million, its natural to wonder what happens next if your data winds up in the hands of for-profit cybercriminals. The answer is, it probably gets sold for less than the price of first-person-shooter.

Sony this week announced a second breach of its systems, this one targeting Sony Online Entertainment, the companys game development and distribution arm. Sony uncovered the hack while investigating last months intrusion into the PlayStation Network that compromised personal information on 77 million users, included the encrypted credit card data belonging to 12 million of them. The new attack adds another 24.6 million users, with 20,000 credit card and bank account numbers.

In a letter to a House committee investigating the privacy implications of the breaches, Sony on Wednesday pointed the finger at the hacktivist collective Anonymous for the first time. The SOE attacker, the company said, left a file behind named Anomymous, containing the familiar tagline, We Are Legion.

If Anonymous was really behind both intrusions, that could be good news for consumers: The group isnt known for identity theft or credit card fraud. But the Sony letter also describes the PlayStation Network hackers zeroing in on the customer database. Could for-profit intruders have dropped Anonymous calling card as misdirection, like storm troopers leaving gaffi sticks and bantha tracks outside a smoking sandcrawler?

Sony said that so far, credit card companies havent seen any fraudulent activity linked to the breach. But if profit, not lulz, was the motive in the attack, then the stolen data will almost certainly be sold eventually, and a global underworld exists just for that purpose.

Vendors advertise their stolen data on web-based carder forums, and sometimes operate their own virtual storefronts. But the detailed negotiations over price and quantity often take place in private chats, away from the prying eyes of law enforcement and the public.

The seller: Max 'Generous' Butler

You can see how all that unfolds in the chat that follows: a 2005 conversation between two carders that I used in researching my book, Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground.

The seller in this deal is Max Butler, the subject of the book. A white hat hacker gone bad, Butler at this time was still finding his legs as a stolen credit card vendor, using the handle “Generous.”

Hed recently cracked the point-of-sale system at a pizza restaurant in Vancouver, Washington, and he was looking for someone to buy the credit card dumps - magnetic stripe data, including account numbers - that he was stealing from customers. (Note that dumps are more valuable than the credit card numbers involved in the Sony breach, which would likely sell for less than 50 cents each.)

The buyer: Brett 'Gollumfun' Johnson

The buyer here is Brett “Gollumfun” Johnson, a veteran fraudster who was,unbeknownto Butler, working as a Secret Service informant from the agencys Columbia, South Carolina field office. That, of course, is why we have logs of what would normally be a very private conversation.

(Some helpful terms: IAACA is the International Association for the Advancement of Criminal Activity, a now defunct carder forum where Butler was trying to get approval to sell his data. Track2 refers to the second of two tracks on a credit card magstripe — it contains everything but the customer name. And to throw off law enforcement, Butler liked to style his dumps as skims, implying falsely that they were stolen by a retail or restaurant worker using a hidden handheld skimmer. Dumps are redacted, and the formatting and avatars added for readability.)

06/11/05 GReetingshiour mutual friend mentioned you might be interested in track2 skims?indeed. skims, eh? VERY interestedcool here hang on a secGReatcan i ask you a quick question first.. how do you feel about being picky regading type/bin versus if they are fresh? advantage i have is i have very very fresh stuff but most are classics.. each batch/day has a mix with a few business, signature, platinum, gold/premier, and then mostly classics. here is a batch from a few days ago should get no cfa/pickup at all – all should work as cardholders used them very recently. = credit CLASSIC United States of America U.S. Bank National Association ND = debit CLASSIC United States of America Washington Mutual Bank = debit CLASSIC United $tates of America Washington Mutual Bank = debit CLASSIC United States of America Marion & Polk Schools Credit Union = debit CLASSIC United States of America Cutting Edge Federal Credit Union = debit CLASSIC United States of America Providence Health System Federal Credit Union = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America US. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America Bank of America, National Association = debit CLASSIC United States of America Bank of America, National Association = , debit CLASSIC United States of America Bank of America, National Association = debit CLASSIC United States of America U.S. Bank National Association = debit GOLDPREMIER United States of America Wells Fargo Bank Iowa, National Association = debit GOLDPREMIER Unitead States of America Bank of America, National Association = debit GOLDPREMIER United States of America Washington Mutual Bankand of unknown type: = United States of America Clark County School Employees Credit Union = United States of America KEYBANK NATIONAL ASSOCIATIONand = = = this batch is typical exceptthat i pulled the 1 business, 1 signature, and 2 platinum out for our friend about an hour agoother batches will of course be completeDamn. VERY impressive. Are these good to use now?Yepexclusive direct skimsi only capture track2 so you’d have to make tr1 of courseso how much you charge?customers used these approval in past week (though i get these every day i’m backlogged going from oldest->new)thats goddamn impressivehaven’t been approved to vend anywhere so haven’t made prices, i figure whatever is fair, something below market rate and i’ll be very happy just try i guess and pay what you think is fair – i can give you another batch that includes the nicer cards tooThats a deal.oh, these are ones the cardholder swiped on .. june 2nd (in case it mattersIt will take a few days to run these, but Im sure our mutual friend has told you im good for the money–hehyeah if you need some of the other types (platinum etc) to do a valid and normal testing, let me know i can do that tooAnd will also lend to the review on iaaca when you start to sell thereI cold use a couple plats. might be fun. hehhere you know what, kid says you’re good for it lemme give you another batch, this will include all types, hang a secgood dealok hopefully these pastes are coming through ok = United States of America FIRST PREMIER BANK = United States of America KEYBANK NATIONAL ASSOCIATION = debit BUSINESS United States of America U.S. Bank National Association = credit CLASSIC United States of America Billings Federal Credit Union = credit CLASSIC United States of America U.S. Bank National Association ND = credit CLASSIC United States of America Retailers National Bank = credit CLASSIC United States of America U.S. Bank National Association ND = credit CLASSIC United States of America Consolidated Federal Credit Union = credit CLASSIC United States of America Providian National Bank = credit CLASSIC United States of America Bank of America, N.A. (USA) = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America U.S. Bank National Association = debit CLASSIC United States of America US. Bank National Association = debit CLASSIC United States of America Electra Central Credit Union = debit CLASSIC United States of America Bank of America, National Association = debit CLASSIC United States of America Bank of America, National Association = debit CLASSIC United States of America Bank of America, National Associationgood deal. can you email as well? gollumfun@mailvault.com = debit CLASSIC United States of America Wells Fargo Bank Iowa, National Association = credit GOLDIPREMIER United States of America First USA Bank, National Association = i credit GOLDiPREMIER United States of America First USA Bank, National Association = debit GOLDPREMIER United States of America Bank of America, National Association = credit PLATNUM United States of America Bank of America, N.A. (USA) = credit SIGNATURE United States of America Capital One Bank = credit SIGNATURE United States of America First USA Bank, National Association = = = = = np will dothanks much. I appreciate it. Will make you happy with payment also, no problem
generous:please email as well. in case something happens to my cut and paste. hehok might want to just wait for email its much better formattedi’ve got it sending ..good deal. Again–I appreciate it. will put these to good useack need to resend hit wrong button hanglol. ok. mailvault takes a little while with their servers anyway. Ill receive the list about 2 hours after you send it. so no hurryok lemme know if it comes through okhehokthanks again. I can see that you and I are going to be doing some good business in the future.should be 63 in a txt file attachmentexcellentgood deal. that include both sets you sent or just the last one?i included both with small footnote labeling themEXCELLENT. Just received via email.Thats damn impressive. I think you now have a steady customer. heh. will advise on how they turn out. and will e more than fair with payment. GOllumlook forward to hearing happy shoppinghow old is the second set of skims you sent my way?ran by customers ~7 days agogood deal. Ill use the june 2nd ones firsthope you don’t mind. i could send from today but thought this would be a good sampleno–this is more than fine. Im sure Ill get a lot of use from them. how are the debits going for you on average?i have heard keep all classics under 1k/800 per swipe dont try to get big electronics etc.. seems that credit/debit doesn’t matter as much as typegood deal. that is my expoerience as wellso for example i’ve heard platinum debits are rocking in most cases even thouhg debitheh. indeed. just wanted to compare. So–thanks again. will keep you updated on progress. when are you going to be reviewed on iaaca?no idea .. asked a long long time ago and no one ever got back to me. also just got into a spat with unauthorized (or some dude who stole his account i can’t tell yet) so who knows how that will shake outwell–Ill update Imperium on how these are going as well. we will get you on there asap. Id say you will get a TON of salesawesome thank youno prob, and thank you. Gollum06/13/05 hi how are things?Hello hello. Was just signing in to picpay. zero balance. very sadyou had a full account?lol–oh no. CIA intel said he was gonna send me $50k this morning. I was looking forward to shopping. oh well … Hes a damn criminalahhow is picpay funded?i can control pips funds (like probably a shitload of other people), that are supposedly can be withdrawn to picpaynot a fucking clue on how funded. Pitboss persuaded me in to opening a account yesterdayi have to leave in the next few min to airport..the picpay thing is reali’ve got all the password hashes for pips userslike millions in credits therebut i just don’t know how to pull it outanyway thats not my thingi just have accessanyway how have the dumps been?i’m still trying to get reviewslol. wel–how can i get in on that? would like some funds to withdraw or at least use to urchaseer, i mean reviewedwill notify on dumps starting tomorrow.i can’t do anything until tomorrow i am literally packing and getting on the way out the doorLOL. ok–have a safe flight, ok?kget up with me when you are rested and such. Take care. GOllum06/17/05 hi just checking in on the status with the dumps i sent, hoping you have some feedback for me pleaseyep. Got some guys out using them today. Will have payment for you in the next couple days–ok? Im having some trouble with some idiots on iaaca right now. they hijacked my accountugh, sucksok no problem i’ll be patientthough don’t let the stupid boards distract you from good business i learned awhile back to not let them get to me6/20/05 hello hellohihey hows it going, hoping i’d hear backok. Im ready to pay, but i am unable to find out fair pricing for dumps until I get back on iaaca. Ill ask you again–what were you going to charge for them?i have always maintained “below market rates” and i think thats the fairest approach, if you want i can name some specifics right now but the only thing i have to go by is something like http://dumpvendor.com/ok. hold a minute and lemme look at the pricing and such. also–that doesnt appear to handle debit. just hold and lemme look a secok. this is fidels ricing from carderportal: visa Gold/Platinum/Signature/Purchasing/Busines/Corporate -30$
classic/MC-20$
amex/discover-30$as you can see–a much biggerr price differenceright. i’ve seen a huge range of priceswhich is why i don’t have a set price yetand just said “whatever is fair, i’ll beat market rates”so what do you think of the ablove prices?looks fine to me, probably cheap end but i don’t care thats fineI would go higher, but cant log on to iaaca right now to determine their prices. SO–I can pay those rates tomorrow or can wait and log on to iaaca and determine prices thereeither way i’m happyare you ready to do egoldok. into the bank of america account?like funded account ,or did you want to use our friend as intermediaryok thats fine toocoolour friend is fine with me if ok by you. do you have the account info? I dont keep shit like that laying aroundi don’t sorry, he’ll have to mesg youill get it from him today. funds deposited tomorrow, ok?sounds goodand are you happy with this transaction?I’ll have more batches ready tomorrow then and we can go forward as much as you wantYesgood deal. Ill also notify Imp when Im back on iaaca of the success rate ad thazt I feel you are a good vendorthanks i appreciate it seems very difficult to actually get a review around thereheh. it CAN be. Im surprised its taken this long to just get me back on board after I was hacked. That tells me the admins are pretty damn busytrue, they must be doing good business well patience is a virtueheh. amenok i’ll ttyl i gotta go afk errandsgood deal. take care. GOllumhi i have the account number its BOA 950555i didn’t realize fleet and boa had merged.good deal. Ill deposit tomorrow. (Message was sent. User is Offline.The message will be delivered when user goes Online.)06/21/05 35–tested
24 classic 16 good
10 gold or plat– 6 good
320 for the classic.
180 for the plats
500 total. $800 deposited

Top image courtesy California State Controllers Office.

Sophos buys security appliance firm Astaro

UK-based net security firm Sophos is getting into the hardware game with the purchase of all-in-one security appliance firm Astaro. Terms of the deal to acquire privately held Astaro, announced Friday, were not disclosed.

Astaro, with $56m in billings during 2010, is the fourth largest dedicated unified threat management (UTM) provider.

UTM technology offers firewall, intrusion prevention, URL blocking and other functions all in one network security appliance. The approach is designed to make security easier to manage and is typically targeted towards the needs of SMEs and the branch offices of larger corporates.

Sophos said it wanted to offer its existing anti-malware and data protection software alongside Astaro's appliances. Around 220 people work in Astaro's offices in Wilmington, Massachusetts, USA and Karlsruhe, Germany. The Massachusetts office is close to Sophos's US office in Boston, which these days acts as the marketing hub for the firm, which specialises in delivering security products to business.

Web privacy Do-Not-Track laws gain US momentum

A national law limiting the information businesses can gather on consumers online is looking increasingly likely after the chairman of the powerful US senate commerce committee became the latest politician to jump on a growing bandwagon for do-not-track legislation.

Senator John Rockefeller is reported to have said he plans to introduce a bill next week that will require companies give online shoppers the opportunity to opt out of online tracking and empower the Federal Trade Commission to take action against organizations that don't.

AdAge reports that while the bill - called the Do-Not-Track Online Act of 2011 - has not yet been published, so the details aren't known, Rockefeller has taken onboard do-not-track features being added to Mozilla's Firefox and Microsoft's Internet Explorer.

Rockerfeller said in a statement:

Consumers have a right to know when and how their personal and sensitive information is being used online and most importantly to be able to say 'no thanks' when companies seek to gather that information without their approval... This bill will offer a simple, straightforward way for people to stop companies from tracking their every move on the Internet.

Rockerfeller's bill would become the second piece of Do-Not-Track legislation on the table in the US Congress and the third piece tackling the subject of consumers' data online.

It follows the Do Not Track Me Online Act introduced to the US House of Representatives in Washington DC in February by Democrat Jackie Speier. Meanwhile, Senators and former US presidential candidates John McCain and John Kerry in April submitted their Commercial Privacy Bill of Rights Act (here; PDF) that requires companies trading online to provide clear notice about what information is being collected and for what purposes.

However, the McCain-Kerry bill simply codifies much of what's already going on online while it also allows organizations that have an "established business relationship" with the individual to continue collecting data. AdAge reports that Mark Zuckerberg's Facebook sent an "army" of lawyers to the offices of McCain and Kerry to argue for terms that would exempt the site.

It also reported that the wording of the McCain-Kerry bill was changed from requiring consumers to opt-in before data could be collected in a concession to the industry.

It seems the Rockerfeller bill could have been introduced to put a do-not-track provision into the mix of discussions at the Senate, and it's very possible the two bills could be merged rather than have separate and overlapping laws once the debate is done.

It is also probably that what does emerge would be merged with Speier's Commercial Privacy Bill of Rights Act. It typically happens in the US legislative process that bills on the same subjects from both houses are merged before being sent to the President to be signed.

This week, state politicians in California began debating their own do-not-track legislation, a piece of work that's being opposed by Google, AOL, and Yahoo! in addition to two technology trade associations to which the companies belong: TechNet and CTIA.

Google is the only browser manufacture to have individually come out against California's proposed law, signing it's corporate name to a letter to state politicians claiming the bill "gratuitously" singles out advertising companies for special regulation.

Consumer Watchdog - a consumer rights group supporting the passage of the Californian bill - welcomed news of Rockerfeller's bill. "This is an idea whose time has come and I believe people will finally get the protection they are demanding. Sen. Rockefeller should be commended for pushing the issue," Consumer Watchdog said in a statement.

Web privacy Do-Not-Track laws gain US momentum

Rockerfeller said in a statement:

Rockerfeller's bill would become the second piece of Do-Not-Track legislation on the table in the US Congress and the third piece tackling the subject of consumers' data online.

It also reported that the wording of the McCain-Kerry bill was changed from requiring consumers to opt-in before data could be collected in a concession to the industry.

Domestic Surveillance Court Approved All 1,506 Warrant Applications in 2010

The secretive Foreign Intelligence Surveillance Court approved all 1,506 government requests to electronically monitor suspected “agents” of a foreign power or terrorists on U.S. soil last year, according to Justice Department report released via the Freedom of Information Act.

“The FISC did not deny any applications in whole, or in part,” according to the April 19 report to Sen. Majority Leader Harry Reid, (D-Nevada.)

In 2009, the 11-member court denied two of 1,329 applications for domestic-intelligence surveillance. The FBI is the primary agency making those requests.

Whether the court, whose business is conducted behind closed doors, is rubber stamping the requests is a matter of debate.

“That’s been a traditional concern that the court might have become a rubber stamp and that it’s approval is only a formality,” Steven Aftergood, the director of the Project on Government Secrecy for the Federation of American Scientists, said in a telephone interview. “The government’s argument, and it’s also an argument that has been made occasionally by the judges, is in fact the Justice Department has grasped the court’s expectations so well that the only applications they submit to the court are ones that are likely to meet its approval.”

The targets of a FISA warrant may never learn of the surveillance. Whereas subjects of non-FISA warrants may challenge the warrants and evidence gathered if it is used in a criminal prosecution.

Aftergood notes that the figures, whether they amount to rubberstamping or not, do not account for the warrantless monitoring program President George W. Bush adopted in the wake of the 2001 terror attacks. Under the Terror Surveillance Program, exposed in 2005 by The New York Times, the government conceded it was eavesdropping, without warrants, on the electronic communications of Americans if they were communicating with somebody overseas believed linked to terrorism.

Here is a link to all 32 annual Foreign Intelligence Surveillance Court reports to Congress made available by the Federation of American Scientists.

Photo: urban don/Flickr

See Also:

Appeals Court Revives Lawsuit Challenging NSA Surveillance
ACLU Study Highlights U.S. Surveillance Society
School District Halts Webcam Surveillance
DoJ Faulted for Failing to Follow Surveillance Reporting …
Obama Sides With Bush in Spy Case
Court Kills ‘Round-The-Clock’ Surveillance Case
President Ford Approved Warrantless Domestic Surveillance

Skype bug gives attackers root access to Mac OS X

Reynaud said there are no reports that the Skype vulnerability is being actively exploited.

Maddern said he stumbled on the critical flaw by accident.

Microsoft ID guru quietly skips away from Redmond

Updated Microsoft's top identity architect Kim Cameron, who was last seen on these pages bemoaning Apple's "duplicitous" privacy policies, reportedly quit Redmond earlier this week.

According to ZDNet's Mary-Jo Foley, who cites anonymous sources, Cameron had a leaving do at Microsoft on Wednesday.

However, both Cameron and Microsoft have so far remained silent about his decision to move on from the company.

The Register has asked Microsoft to confirm Cameron's resignation, but we've yet to hear back.

France-based Cameron joined Microsoft in 1999 when it acquired ZOOMIT, where he had worked as that's company's technology veep.

"Kim plays a leading role in the evolution of Active Directory, Federation Services, Forefront Identity Manager, CardSpace and Microsofts other Identity Metasystem products," his biog notes.

Java-based malware tries Mac-smacking cross-platform attack

Friday, May 6, 2011

Malware-writers have developed a Java-based, equal-opportunity botnet Trojan in an apparent bid to infect more machines outside the Windows ecosystem.

Fake certificate attack targets Facebook users in Syria

A man-in-the-middle attack is being run against users of the secure version of Facebook in Syria, the Electronic Frontier Foundation (EFF) warns.

The semi-professional attack against the HTTPS version of the Facebook site relies on a digital certificate unsigned by any Certificate Authority and probable re-routing of traffic by the Syrian Telecom Ministry. The ongoing attack has been detected against multiple Syrian ISPs.

The EFF doesn't name the perpetrators of the attack, but the ruse bears the hallmarks of an operation by the Syrian government, which is in the midst of cracking down on a popular uprising against the autocratic rule of the al-Assad dynasty. It amounts to an unsubtle attempt to snoop on Facebook posts and updates.

The use of an unsigned certificate as part of the attack means that the certificate is treated as invalid by modern browsers, raising a security warning. Unfortunately many users ignore such warnings, which can be generated for a variety of reason, such as attempting to visit a secure site via a Wi-Fi hotspot connection that requires an initial log-in.

Surfers in Syria are advised to use either Tor or proxies outside the country in order to access Facebook. The EFF has obtained a copy of the unsigned certificate used in the ruse via contacts in Syria, which it has published in an alert here.

The Facebook fake certificate ruse follows a problem that prevented Syrian surfers from accessing the encrypted version of Hotmail. Microsoft blamed a bug for what it characterised as a glitch, which it said had been limited to first-time users of the encrypted Hotmail who signed in from several countries. Webmail users in the Bahamas, Cayman Islands, and Fiji were also affected by the snafu.

Sophos buys security appliance firm Astaro

Astaro, with $56m in billings during 2010, is the fourth largest dedicated unified threat management (UTM) provider.

Quiet May Patch Tuesday follows record April

Microsoft is giving hard-pressed sysadmins a bit of a breather this month with plans to release only two updates during the May edition of its regular Patch Tuesday monthly update cycle.

Just one of the two bulletins due to be published next Tuesday covers a critical update, in sharp contrast to the record-breaking crop of 17 bulletins addressing 64 vulnerabilities that arrived in April.

The critical update in May's batch involves an unspecified flaw in Windows, but only affects Windows Server 2003 and Server 2008. The second bulletin rated important means that Office XP, 2003, 2007 and 2004 for Mac will need patching.

The latest version of Microsoft's application suite is not affected by the flaw.

Despite the light patch load, security experts urge sysadmins not to dismiss the updates as unimportant. "Both bulletins are for remote code-execution vulnerabilities, so IT administrators should track them closely and address them quickly," said Wolfgang Kandek, CTO at vulnerability scanning services firm Qualys.

PC rental store hid secret spy hardware in laptop, suit says

A Wyoming couple has filed a federal lawsuit claiming a computer they purchased came with secret spying hardware that allowed the seller to monitor their every move.

According to the complaint, Brian and Crystal Byrd first learned of the snoop device when they received a visit at home from a manager of the local Aaron's rent-to-own store falsely claiming they hadn't made required payments on their Dell Inspiron laptop. During the conversation, manager Christopher Mendoza said he had a photo of Mr. Byrd using the computer and as proof showed a picture that had been taken remotely using an off-the-shelf device called PC Rental Agent.

When Brian Byrd demanded that Mendoza explain how Mendoza had obtained an unauthorized photograph, Mendoza responded that he was not supposed to disclose that Aaron's had the photograph, the complaint, filed on Tuesday in US District Court in Pittsburgh, Pennsylvania, alleged.

The suit, which seeks class-action status so other Aaron's customers may also be represented, names parent company Aaron's Inc. of Atlanta, the independently owned Casper Wyoming, Aaron's franchise, and DesignerWare, the North East, Pennsylvania company alleged to have made and sold PC Rental Agent.

Unbeknownst to Plaintiffs and the members of the class, and without their authorization, defendants have been spying on the activities of plaintiffs and class members through the use of the PC Rental Agent device and/or similar software and/or devices which were designed to, and in fact did, access, intercept, transmit, use and/or disclose electronic communication, the complaint stated. These spying devices and/or spying software were installed and enabled surreptitiously without the consent of plaintiffs or class members.

In a press release, Aaron's rejected the allegations.

The Company believes that none of its over 1,140 company-operated stores have used the product developed or provided by PC Rental Agent or DesignerWare LLC, the two vendors named in the lawsuit, and neither vendor is approved or have done any business with Aaron's, Inc., the company said. Aaron's, Inc. respects its customers' privacy and has not authorized any of its corporate stores to install software that can activate a customer's webcam, capture screenshots, or track keystrokes.

DesignerWare representatives didn't respond to an email and phone call seeking comment for this article. Representatives of the franchise couldn't be reached.

According to the suit, the PC Rental Agent device can't easily be removed from computers because it is soldered into the motherboard and/or is part of the Intel chipset. It can be deactivated only with the wave of a wand that isn't available to the public.

After the Byrd's complained to police, investigators spoke with a DesignerWare employee, who allegedly said the device allowed store employees to capture screen shots, keystrokes, and webcam pictures without the customer's knowledge. According to the suit, PC Rental Agent transmitted the data to systems operated by DesignerWare, which in turn made it available to Aaron's representatives throughout the country.

While law enforcement was conducting its investigation at the Casper Aaron's store, it is further believed that a law enforcement officer observed an unauthorized photograph of another Aaron's customer, and was told that Aaron's regularly received emails from DesignerWare with unauthorized photographs and other communications taken of customers and authorized users through the use of the PC Rental Agent, the complaint alleged.

The allegations in many ways resemble claims made last year that laptops issued by a suburban Philadelphia school secretly snapped thousands of pictures students in their homes, sometimes while they were sleeping or only partially clothed. The images, estimated to be 58,000, were captured by administrative software called LANrev, which was installed on the MacBooks that the Lower Merion School District gave to its students.

More than 400 images were secretly taken of a single high school student named Blake Robbins, who sued for invasion of privacy.

Tuesday's complaint against Aaron's and DesignerWare seeks damages under the Electronic Communications Privacy Act and the Computer Fraud and Abuse Act. The 19-page complaint is here.

New York attorney general escalates Sony attack probe

New York Attorney General Eric Schneiderman has put Sony Computer Entertainment America, Sony Network Entertainment and Sony Online Entertainment on the rack over the data breach.

The New York Times is reporting that Schneidermans office has issued a subpoena to Sony to explain the PlayStation Network data breach.

The subpoena is part of a consumer protection inquiry, and asks Sony to explain what it told its customers about security on its networks.

Sony has also suffered criticism from various members of Congress over both the attack and its response to it. California representative Mary Bono Mack, who chaired a congressional subcommittee hearing into the events, accused the company of putting the burden on consumers to search for information about the breaches, rather than accepting the burden of notifying them.

If I have anything to do with it, that kind of half-hearted, half-baked response is not going to fly in future, she said. Bono Mack was particularly unimpressed that Sonys first announcement about the attacks was made on the companys blog.

While Sony has accused online hacktivist group Anonymous of being responsible for the attacks, Anonymous or at least people claiming to speak for the group has denied that the we are legion note left inside Sonys systems meant they were the perpetrators.

The vigorous response from Congress and now the NY Attorney General contrasts sharply with how the attacks have been treated in Australia, where the Privacy Commissioner has just sent a please explain letter, and the minister responsible for privacy has foreshadowed new legislation that was already both in the pipeline and overdue.

Wall Street Journal launches own WikiLeaks

A new chapter has started in the long and complex story of Julian Assanges relationship with mainstream media, with the Wall Street Journal launching a competitor whistleblower site.

SafeHouse is soliciting whistleblower documents covering politics, government, banking, Wall Street, deals and finance, corporations, labor, law, national security and foreign affairs.

It promises a system built to be secure (but demonstrates its first security fail by presenting a certificate error; its a trivial error, but one which could frighten someone with secret documents and not much technical know-how).

The WSJ joins Al Jazeera in offering a whistleblower site. According to The Atlantic, WSJ.com managing editor Kevin Delaney said: Clearly there is a digital context for reporting and that means we need a modern infrastructure so that sources can send documents to us."

Delaney also says he wants to project the same sense of security and anonymity for leakers as WikiLeaks, but warns that such claims cant be treated as absolute because its a technical product. A Bradley Manning would, however, be a disaster for an organization like the Wall Street Journal, since it would probably bring with legal jeopardy and the risk of lawsuit if a whistleblower was unmasked.

Delaney also said data uploaded to the site will be discarded as quickly as possible.

Sony continues slog from pit of shame

It is now day 15 of The Great Sony Cock-Up of 2011, and the Japanese giant finally has some good news. No, not that their PSN and PC gaming networks are up and running again, but that they should be soon.

"Today our global network and security teams at Sony Network Entertainment and Sony Computer Entertainment began the final stages of internal testing of the new system," the PlayStation Blog reported on Thursday, calling this testing "an important step towards restoring PlayStation Network and Qriocity services."

Sony's woes began on April 21 when its PSN Network went dark amid rumors of DDoS attacks and PSN-hacker revenge. First, the data of 70 million users was possibly compromised, then it was compromised, then Sony was sued, then Sony shut its PC-gaming site, then it admitted that personal data of another 25 million users was compromised, then...

That's enough. You get the picture. But Sony says it's sorry.

"We've been working around the clock to rebuild the network and enhance protections of your personal data," the company says. "It's our top priority to ensure your data is safe when you begin using the services again."

Call us weary cynics, but mightn't it have been nice to have the safety of user data a top priority in the first place?

Australian Privacy Act feels revamp pressure

The Australian government may consider expediting significant reforms to the Privacy Act as a result of the Sony data breaches.

The Australian Privacy Commissioner, Timothy Pilgrim has already opened an investigation into the Sony Playstation Network security breach where 77 million users of the network have had their personal data compromised. Pilgrim issued an additional statement in response to the subsequent news this week relating to a breach relating to Sony Online Entertainment in which an additional 24.6 million users including 12,700 non-US customer credit or debit card numbers had been affected.

In what is essentially a pro-forma response from the office, Pilgrim has have asked SOE for information about this incident," and promised an "own motion investigation" of the attack (that is, an investigation launched without waiting for specific complaints to arrive at the office).

"This latest incident is extremely worrying," said Pilgrim. "I am particularly concerned that it involves information stored on an out of date database.

"It reinforces my view that organisations need to consider further limiting the amount of information they collect and store about people. They should also make sure that information is destroyed when it is no longer needed as is required under the Privacy Act, Pilgrim said.

While the commissioner has asked what information was compromised and what network security was in place at the time of the breach, he has not asked Sony to explain what vulnerabilities were exploited, nor to detail what new security measures it might apply to defend against future attacks.

There is currently no mandatory data breach notification obligation in Australia. The Australian Law Reform Commission recommended that consideration should also be given to the introduction of mandatory data breach notification laws.

Pilgrim said that there are a number of significant reforms to the Privacy Act currently being considered by the government including increased powers for the Commissioner to impose penalties following an own motion investigation, such as enforceable undertakings and civil penalties for serious breaches of privacy.

Domain security comes to .co.uk

Nominet plans to bring a higher level of security to UK domain names within the next two weeks.

The .uk registry manager said on Thursday that it has implemented the new DNSSEC protocol in the .co.uk zone. Companies could be able to cryptographically sign their internet addresses as early as May 18.

"The signing of .co.uk was an important step in securing the .uk zone and continues the deployment of DNSSEC across all .uk zones managed by Nominet," the organisation said.

DNSSEC (domain name system security extensions) is an IETF standard that makes it harder for attackers to steal traffic by spoofing domain-name routing information.

If you own a domain name, DNSSEC means you can cryptographically sign your DNS records and therefore enable resolvers, such as ISPs, to automatically authenticate your servers' IP addresses.

Whenever a user tries to find your web site, they can be assured they're looking at the genuine article rather than an attack site as long as their ISP and/or browser also supports the technology.

The security extensions are designed to prevent man-in-the-middle attacks, in which attackers intercept and rewrite DNS traffic in order to, for example, spoof online banking sites or steal email.

The .uk domain has been signed for months, but because the UK uses second-level domains such as .co.uk and .org.uk, DNSSEC has not yet been made available to everyday domain-name owners.

With .me.uk and .co.uk now signed, Nominet's plan calls for the rest of the namespace to come online with DNSSEC support within the next two weeks. Shortly thereafter, domain registrars will be able to start offering DNSSEC services to UK businesses.

The security upgrade has also recently been rolled out in .com and .net, as well dozens of other country-code and generic top-level domains.

But DNSSEC has a chicken-and-egg problem. The kind of attacks it is designed to prevent are not particularly prevalent or well publicised, and many web folks don't see the point of upgrading, despite a few low-profile campaigns to convince people that DNSSEC is "sexy".

A signed domain is of little value unless ISPs and applications are able to validate the signatures, and few developers or ISPs have shown much interest to date. The upgrade is perceived as complex, sometimes prone to configuration errors, and potentially costly.

In March, Mozilla executives said they were reluctant to put DNSSEC into Firefox natively until they were convinced it would not cause complicated error messages for end users, causing them to switch browsers. Plug-ins do currently offer DNSSEC support, however.

A handful of early adopters have announced implementation plans. Comcast is in the process of adopting DNSSEC in all of its resolvers in the US, and Paypal said it plans to sign its domain names this year, which may be the kind of high-profile support the standard needs.

Due to its complexity, Nominet plans to launch an automated DNSSECsigning service in July. This will enable .uk registrars to offer relatively simple signing tools to their customers. Similar "one-click" services are already available in domains such as .com and .net, usually at a premium price.

Court Says Porn on Work Computer Is Grounds for Firing

A federal appeals court is issuing a clear warning to employees: Violate your employer’s computer-use policy and be fired.

With that in mind, the 7th U.S. Circuit Court of Appeals upheld the firing of a Wisconsin high school biology teacher and union president for viewing thumbnail images of porn for one minute. Robert Zellner, an 11-year teacher, claimed his 2006 termination for typing “blonde” in the Google search bar was in retaliation for his constitutionally protected criticism of his employer.

The ruling is the second in as many weeks granting employers boundless power over their employees’ computer use. A different federal appeals court said employees could be prosecuted under a federal hacking law if they access information on a work computer that they were entitled to, and use that data in a manner violating company policy — such as to set up a competing business.

In the teacher case, the Chicago-based appeals court said Thursday that the Cedarburg School District suspected the Cedarburg Education Association president might have porn on his computer after the biology teacher reported his computer had “gone crazy” in 2005. So the district installed monitoring software on the computer, and found that Zellner had searched “blonde” on Google and terminated him.

“While it is abundantly clear that the relationship between the union and the district was contentious, combative and miserable, and that Zellner and the district played a central role in the relationship, Zellner ignores the discovery of his Nov. 6 Google image search,” the appeals court ruled. “It is undisputed that the search violated the districts policy, that Zellner admitted that he performed the search, and that he knew he violated the policy. Accordingly, the school board had a legitimate,nondiscriminatory reason to terminate Zellner’s employment” (.pdf).

Here’s how the court described Zellner’s computer-use violation of November 2005:

First, Zellner disengaged the “safe search” filter. He then typed blonde into the Google search box. The search produced 20 thumbnail images, all of them pornographic, with links to more images within and outside the Google website. He then clicked to display the next 20 images. Zellner then clicked a link entitled “more of these” adjacent to images from www.ardentes.free.frblonde.com. When Zellner did so, another 20 pornographic “thumbnail” images were displayed on his monitor for a total of 17 seconds. Zellner did not click on any of the photographs displayed in his search. The entire incident took 67 seconds.

The appeals court said that 67 seconds was all that was necessary to be fired. It was unrelated to him being a vocal opponent of the district and making comments in the local press, the court said.

“Zellner violated the district’s policy by viewing pornographic images on his school computer, the violation had nothing to do with his union activities, and the school board found that his violation should result in termination,” a unanimous three-judge panel wrote.

See Also:

Porn Stars Decry Piracy in New Video (SFW)
Free Internet Porn Isnt Unfair Competition To Pay Sites: Appeals Court
Porn Industry Knows Its Worth
Collector Porn: King of Pinball Machines Shares His Loot
High Court Upholds Porn Filters

X Factor hack exposes personal data of fame-seeking contestants

The personal information of more than 250,000 would-be X-Factor contestants may have been exposed after hackers broke into systems maintained by producers of the US edition of the TV talent show.

X Factor applicants' names, email addresses, dates of birth and phone numbers were swiped in the course of a hack attack against US TV network Fox. The data, affecting contestants as young as 12, would be useful for running identity theft and other scams.

In a statement apologising for the breach, Fox Broadcast said it was "working with federal law enforcement authorities to investigate this illegal action". The statement goes on to warn about the possible risk of phishing attacks against X-Factor contestants based of information disclosed by the breach.

Slack bank practice creates opportunity for phone phishing scams

Opinion There is a scene during the underrated '70s conspiracy thriller Three Days of the Condor when Robert Redford's bookish spy is asked to verify his identity when calling into base. He resists, insisting that the person who took his call needs to verify their own identity before he gives anything away.

Authentication ought to work both ways, a point that applies just as much to banking in everyday life as it does to spies and spymasters in the world of fiction. However this point is somewhat lost on some banks, whose employees sometimes call consumers out of the blue and go through a list of security questions without verifying beforehand their own bona fides. This is a problem, because fraudsters might use much the same approach to extract sensitive information.

This principle is well understood in theory but often overlooked in practice, as the experience of one of our readers (who wishes to remain unnamed) illustrates.

"I have been contacted twice recently by companies [E.On and Moneyway] who called my phone, and then asked me to provide "security details". Now in my book, if YOU call ME, then YOU need to prove who YOU are, not vice versa. And this is something that people need to be aware of, because it's the classic prelude to a phone-phishing scam," he writes.

"Clearly these companies feel it is acceptable to call people up and ask for security details. My concern is that if it becomes widespread, then vulnerable people particularly elderly folk, who like a chat could fall prey to organised tricksters who elicit enough detail to perpetrate a fraud."

Our correspondent suggests that Ofcom might want to draft a code of conduct about this. However this is somewhat outside the remit of the telecoms regulator, especially when it comes to enforcing the code.

Reg staffers have had mixed experience in this area. At least one has had similar experiences to our anonymous correspondent.

However another, when he challenged the representative of his bank to authenticate themselves, was given a reference number and asked to call back at a number available on his bank's website, a good practice many other financial institutions would do well to adopt.

Sony, Epsilon scolded for ducking probe

Sony PlayStation Network was unpatched, lacked firewall.

Sony and marketing company Epsilon have been chastised in a US House hearing overnight for shirking a committee hearing on the high-profile breaches which exposed millions of personal records.

Congresswoman Mary Bono Mack said it was “unacceptable” that representatives from the two companies did not front up to questions about how the companies were breached.

Mack said Sony’s decision to notify customers via a corporate blog was a “half-hearted, half-baked” decision.

Mack said while the companies are victims, they must take responsibility for the attacks.

US Senator Richard Blumenthal sent a letter to Sony’s Hazai and CEO Jack Tretton attacking the “egregious inadequacy” of Sony’s efforts.

SC Magazine Australia has sought confirmation from a liaison from Anonymous.

LastPass resets passwords following possible hack

Password management system LastPass has reset users' master passwords as a precaution following the discovery of a possible hack attack against its systems.

The move follows the detection of two anomalies one affecting a database server on LastPass's network on Tuesday that could be the result of a possible hack attack. LastPass detected that more traffic had been sent from the database than had been received by a server, an event that might be explained by hackers extracting sensitive login credentials, stored in an obfuscated (hashed) format.

The worst case scenario is that miscreants might have swiped password hashes, a development that leaves users who selected easier-to-guess passphrases at risk of brute-force dictionary attacks. Once uncovered, these login credentials might be used to obtain access to all the login credentials stored through the service, as LastPass explains in a blog post (extract below).

If you have a strong, non-dictionary-based password or pass phrase, this shouldn't impact you the potential threat here is brute-forcing your master password using dictionary words, then going to LastPass with that password to get your data. Unfortunately not everyone picks a master password that's immune to brute-forcing.

To counter that potential threat, we're going to force everyone to change their master passwords. Additionally, we're going to want an indication that you're you, by either ensuring that you're coming from an IP block you've used before or by validating your email address...

We realise this may be an overreaction and we apologise for the disruption this will cause, but we'd rather be paranoid and slightly inconvenience you than to be even more sorry later.

LastPass's decision to reset passwords as a precaution has made it difficult for some legitimate users to log onto the service again. Tips on re-enabling accounts can be found in a blog post by Chris Boyd, a security researcher at GFI Software, here.

The password-management outfit has taken the possible attack and resulting service disruption as the opportunity to introduce a stronger password hashing system. Although LastPass isn't sure how hackers might have entered its network if indeed that's what happened an assault based on an initial break-in via its Voice over IP system is the company's best initial guess as to what might have gone wrong.

This week's security flap at LastPass.com follows a security breach just six weeks ago that created a means to extract the email addresses though not the passwords of enrolled users. The two incidents are not thought to be related.

Feds Demand Firefox Remove Add-On That Redirects Seized Domains

But Mozilla did not remove the MafiaaFire add-on, and instead has demanded the government explain why it should. Two weeks have passed, and the government has not responded to Mozilla’s questions, such as whether the government considers the add-on unlawful and whether Mozilla is “legally obligated” to remove it. The DHS has also not provided the organization with a court order requiring its removal, the lawyer said.

Neither Homeland Security nor Anderson immediately responded for comment.

The add-on in question redirects traffic from seized domains to other domains outside the United States’ reach. Since last year, the U.S. government has seized at least 120 domains in an anti-piracy assault known as “Operation in Our Sites.” The domains are taken under the same federal statute used to seize drug houses.

Many of the seized sites have been redirected by their owners to domains being hosted where the U.S. cannot legally touch them The U.S. controls so-called top-level domains like .com, .net and .org.

The add-on has been downloaded more than 6,400 times.

See Also:

Feds Seize 18 More Domains in Piracy Crackdown
U.S. Shutters 82 Sites in Crackdown on Downloads, Counterfeit …
ICE Uses Seized Domains for Best Anti-Piracy Video Ever
Senate Committee OKs Domain-Name Seizure for Pirate Websites
U.S. Shuttering Online Gambling Sites
FBI vs. Coreflood Botnet: Round 1 Goes to the Feds

Court Says Porn on Work Computer is Grounds for Firing

A federal appeals court is issuing a clear warning to employees: violate your employer’s computer-use policy and be fired.

In the teacher case, the Chicago-based appeals court said Thursday the Cedarburg School District suspected the Cedarburg Education Association president might have porn on his computer after the biology teacher reported his computer had “gone crazy” in 2005. So the district installed monitoring software on the computer, and found that Zellner had searched “blonde” on Google and terminated him.

“While it is abundantly clear that the relationship between the union and the district was contentious, combative, and miserable, and that Zellner and the district played a central role in the relationship, Zellner ignores the discovery of his November 6 Google image search,” the appeals court ruled. “It is undisputed that the search violated the districts policy, that Zellner admitted that he performed the search, and that he knew he violated the policy. Accordingly, the school board had a legitimate,non-discriminatory reason to terminate Zellner’s employment.” (.pdf)

Here’s how the court described Zellner’s computer-use violation of November, 2005:

The appeals court said that 67 seconds was all that was necessary to be fired. It was unrelated to him being a vocal opponent of the district and making comments in the local press, the court said.

See Also:

Porn Stars Decry Piracy in New Video (SFW)
Free Internet Porn Isnt Unfair Competition To Pay Sites: Appeals Court
Porn Industry Knows Its Worth
Collector Porn: King of Pinball Machines Shares His Loot
High Court Upholds Porn Filters