Search This Blog

Friday, March 06, 2009

Security Management Weekly - March 6, 2009

header

  Learn more! ->   sm professional  

March 6, 2009
 
 
CORPORATE SECURITY  
  1. " In Mexico, Bulletproof Vehicles Becoming a Workplace Necessity"
  2. " France 'Holds Europe Jewel Thief'"
  3. " Crime Syndicates More Involved in Film Piracy: Report" RAND Corp.
  4. " Suit Over Niners' Pat-downs of Fans Is Revived" Sacramento
  5. " Nationals' GM Resigns as Scandal Deepens" Washington, D.C.

HOMELAND SECURITY  
  6. " Somali-Americans' Disappearances Raise Alarm of Terrorism Ties"
  7. " Pakistan Attack Prompts Federal Officials to Caution Indiana Officials"
  8. " N.J. Lawyer Urges Torture Investigation"
  9. " Obama Seeks Russian Help on Iran but Denies Deal"
  10. " Bush-era Memos Saw Rights Limits in U.S. Terror War"

CYBER SECURITY  
  11. " Virus Creators, ID Thieves, Spam Senders Hit Social Networks"
  12. " Hackers Break in to Spotify"
  13. " Guidelines for Securing DNS Being Updated"
  14. " Feds Look for Advanced Security Tools to Thwart Hackers"
  15. " How to Share Without Spilling the Beans" Bar-Ilan University Professor Develops Protocol That Allows Organizations to Share Information Without Compromising Privacy


   







 

"In Mexico, Bulletproof Vehicles Becoming a Workplace Necessity"
Associated Press (03/05/09) ; Roberts, Michelle

Once strictly the domain of movie stars, business moguls, and politicians, vehicles with armored plating and other security features are now increasingly being used by professionals in Mexico to protect themselves from the country's drug violence. In addition to having armor plating installed on their vehicles, professionals such as factory owners, doctors, newspaper owners, and others who are afraid of being killed by Mexico's drug cartels are also using tires that will run when flat and bulletproof glass that bursts into a spider web pattern when struck by a bullet but will not break. Other scared professionals are buying packages that equip a truck or SUV with smokescreens, spikes that can be deployed to flatten a pursuer's tires, and electrified door handles. The trend towards the use of highly-secured vehicles by Mexico's professional class comes amid ongoing violence between Mexico's drug cartels and law enforcement officials, which has claimed more than 1,000 lives so far this year.
(go to web site)

"France 'Holds Europe Jewel Thief'"
BBC News (03/05/09)

French police have arrested a woman and her son for allegedly stealing thousands of euros worth of jewelry in several European countries. According to police, the 55-year-old woman and her 40-year-old son went into a Cartier store in Paris last November and asked to see several rings, including a 5.5-carat diamond ring worth EU635,000. When the store's staff was distracted, the woman swapped the ring for a replica. The store's staff did not realize what had happened until after the woman and her son had left. Police also believe that the woman and her son used the same method to steal a EU210,000 ring from Tiffany's in Frankfurt, Germany, and a GBP120,000 ring in London. Police say that the woman and her son admitted to the thefts, and still had two of the rings that they stole in Paris in their possession when they were arrested Feb. 27. However, the suspects told police that the 5.5-carat diamond ring had been sold.
(go to web site)

"Crime Syndicates More Involved in Film Piracy: Report"
Reuters (UK) (03/03/09) ; Kilday, Gregg

A report from the RAND Corp. has found that organized crime syndicates are increasingly engaging in film piracy. According to the report, these crime syndicates have become involved in the entire process of pirating a film, beginning with manufacturing pirated DVDs and ending with selling them on the street. Greg Treverton, the lead author of the report and the director of RAND's Center for Global Risk and Security, noted that it should come as no surprise that organized crime syndicates are involved in film piracy, given the high profit margins and the relatively light penalties for being caught. The report noted that the mark up on a pirated DVD can be as much 1,000 percent--which is more than three times higher than the markup for Iranian heroin. In addition, the report noted that those convicted of selling counterfeit DVDs in France will only face a two-year prison term and a $190,000 fine, compared with a 10-year prison term and a $9.5 million fine for those convicted of selling drugs. Finally, the report noted that the sale of pirated films is sometimes used to finance terrorist activities. The report gave several examples, including the case of Assad Ahmad Barakat, who was labeled a "specially designated global terrorist" by the U.S. government in 2004 and is a known DVD pirate operating in the tri-border area of Brazil, Argentina, and Paraguay. The report noted that Barakat made at least one transfer of $3.5 million to Hezbollah.
(go to web site)

"Suit Over Niners' Pat-downs of Fans Is Revived"
San Francisco Chronicle (03/03/09) ; Egelko, Bob

The California Supreme Court on Monday reinstated a lawsuit brought by two San Francisco 49ers season ticket holders that challenged the NFL's policy of patting down fans before they enter stadiums. In its decision, the Supreme Court overturned a lower court judge's ruling that the lawsuit should be thrown out because it had been brought after the plaintiffs bought their season tickets, which contained a notice of the search policy. The lower court judge said that in buying the tickets, the plaintiffs implicitly agreed to be searched. In reinstating the lawsuit, the Supreme Court said a judge also needs to consider the 49ers' reasons for the pat-downs and examine whether the plaintiffs had actually consented to be searched. But a majority of the Supreme Court justices also said that the plaintiffs could find it difficult to convince a lower court that the pat-downs were an unreasonable invasion of privacy, noting that the courts should respect private businesses' determinations of their own security needs. The plaintiffs also face an uphill battle because other legal challenges to the policy have failed. For its part, the 49ers said they were confident the pat-down policy would be upheld in the courts.
(go to web site)

"Nationals' GM Resigns as Scandal Deepens"
New York Times (03/02/09) ; Robinson, Joshua

Jim Bowden has resigned as the general manager of the Washington Nationals baseball organization in the wake of investigations into the skimming of signing bonuses for prospects from the Dominican Republic. Bowden is a subject in a federal investigation over whether baseball scouts and executives accepted kickbacks from bonuses that were originally promised to Latin American signees. He has not been charged. The Nationals have already fired Jose Rijo, Bowden's special assistant, and Jose Baez, the club's director of operations in the Dominican Republic. Those dismissals were linked to the signing of a 16-year-old prospect known as Esmailyn Gonzalez, who was discovered to have understated his age by four years and used a fake name. Gonzalez, whose real name is Carlos Daniel Alvarez Lugo, had received a $1.4 million signing bonus. Baseball investigators have looked closely at six to eight teams, and in May 2008, the Chicago White Sox dismissed their director of player personnel, David Wilder, and two Dominican scouts after it was discovered that members of their front office were taking kickbacks from players in exchange for a contract. Last July, the Boston Red Sox fired their Dominican scouting supervisor, Pablo Lantigua, for what was presented as a violation of team policy, and a month later, the Yankees dismissed their director of Latin American scouting, Carlos Ríos, and their Dominican Republic scouting director, Ramón Valdivia, when similar accusations of bonus skimming surfaced. Baseball officials also made referrals to the FBI in those cases.
(go to web site)

"Somali-Americans' Disappearances Raise Alarm of Terrorism Ties"
Bloomberg (03/06/09) ; Blum, Justin

U.S. intelligence officials are concerned that Somali-Americans are being recruited to carry out terrorist attacks both in the United States and abroad. The Federal Bureau of Investigation first sounded the alarm after reports that a conspicuously large number of Somali-American youths had left their adopted homes in the U.S. without telling their parents to fight in Somalia's civil war. Missing person reports have been filed by the parents of these youths in Somali populations such as Seattle, Columbus, Ohio and Minneapolis, Minn. The concern now is whether these youths will return to the U.S. to carry out attacks here once they receive their training. FBI Director Robert Mueller raised this prospect after confirming that a Somali-American from Minneapolis became the first known U.S. citizen to carry out a suicide bombing. U.S. counter-terrorism officials believes the youths are being recruited by a militant group associated with al-Qaida called al-Shabaab. The U.S. Senate has scheduled hearings on recruitment efforts by Somali groups for this month.
(go to web site)

"Pakistan Attack Prompts Federal Officials to Caution Indiana Officials"
Associated Press (03/05/09)

The FBI and the Department of Homeland Security has released a bulletin warning law enforcement officials in Indiana that the Big Ten basketball tournaments that are taking place in Indianapolis this month could be targeted by terrorists. However, the two agencies said that they are unaware of any threats against the Big Ten women's and men's basketball tournaments. The women's tournament is already underway in Indianapolis, while the men's tournament is scheduled to begin next Thursday. For its part, the Big Ten says it has put security procedures in place to protect fans, student-athletes, and coaches. The release of the bulletin comes on the heels of an attack on the Sri Lankan cricket team in Pakistan earlier this week. Six police officers and a driver were killed in that attack, while nine others--including seven players--were injured.
(go to web site)

"N.J. Lawyer Urges Torture Investigation"
NorthJersey.com (03/05/09) ; Jackson, Herb

A senior attorney on the 9/11 Commission is recommending that Congress open an investigation into the Bush administration's detention and treatment of terrorist suspects. Testifying before the Senate Judiciary Committee on March 4, New Jersey attorney John Farmer said he realized a probe was warranted upon learning that charges were not brought against the alleged 20th hijacker on Sept. 11 because a senior Pentagon official presiding over military trials deduced that the suspect had been tortured at Guantanamo Bay. "We have now reached a point where the tactics we have adopted in the struggle against terrorism have compromised our ability to respond to the 9/11 conspiracy itself," Farmer said. In response to the testimony, committee chairman Patrick Leahy (D-Vt.) called for the creation of an independent "truth commission" to discover what decisions senior Bush administration officials made in relation to the arrest and management of suspected terrorists and if illegal torture was permitted. "If crimes were committed, I don't think we sweep them under the rug," Leahy said.
(go to web site)

"Obama Seeks Russian Help on Iran but Denies Deal"
Reuters (UK) (03/04/09) ; Colvin, Ross; Bohan, Caren

After a meeting with British Prime Minister Gordon Brown on Tuesday, President Obama told reporters that he had never offered to slow the deployment of the United States' planned European missile shield in exchange for Russia's help in stopping Iran's efforts to develop long-range weapons. The comments came in the wake of a New York Times report that claimed that the president sent a letter to his Russian counterpart, Dmitry Medvedev, that suggested he would not go ahead with the implementation of the system--which Russia sees as a threat--in exchange for his help on resolving the stand-off with Iran. "What I said in the letter is what I have said publicly, which is that the missile defense that we have talked about deploying is directed toward, not Russia, but Iran," Obama said. "And what I said… was that, obviously, to the extent that we are lessening Iran's commitment to nuclear weapons, then that reduces the pressure for, or the need for a missile defense system." Meanwhile, Medvedev held a news conference in Moscow in which he confirmed that the U.S. and Russia were not discussing any type of quid pro quo relating to the missile defense shield and Iran. Medvedev noted that such discussions would "not be productive."
(go to web site)

"Bush-era Memos Saw Rights Limits in U.S. Terror War"
Reuters (03/03/09) ; Mikkelsen, Randall

The Justice Department has released nine previously unreleased memos and legal opinions that outline the Bush administration's views on how to prosecute the war on terrorism. In one of those memos, which is dated October 23, 2001, Justice Department officials John Yoo and Robert Delahunty told White House counsel Alberto Gonzales that the war on terror required "broader exercises of federal power domestically," including the ability to raid a suspected terror cell in the U.S. without a search warrant. Yoo and Delahunty added that the Fourth Amendment, which ordinarily requires authorities to have probable cause and a warrant to execute a search, is "unsuited to the demands of wartime." In addition, Yoo and Delahunty wrote that the administration could suppress freedom of speech and press right in order to successfully wage war on Islamic terrorists. Other memos states that the president had the authority to detain U.S. citizens who were suspected of terrorism and to suspend treaty obligations on issues when necessary. Shortly before President Obama took office, the Bush Justice Department's Office of Legal Counsel disavowed the advice contained in the memos. President Obama has since declared all of the memos invalid. However, President Obama's invalidation of the memos may not close the matter. The release of the memos could increase calls from some Democrats to investigate the security practices used under former President Bush.
(go to web site)

"Virus Creators, ID Thieves, Spam Senders Hit Social Networks"
Investor's Business Daily (03/05/09) P. A4 ; Deagon, Brian

Cybercriminals are increasingly targeting users of social networking sites in an effort to steal their personal data and the passwords to their accounts. One of the tactics cybercriminals use to gain access to this information involves sending social networking users emails that appear to come from their online "friends." For instance, some Facebook users have been receiving emails from their social networking friends that claim to contain a video of them but actually downloads a virus that goes through their hard drives and installs malicious programs. The virus, known as the Koobface virus, then sends itself to all of the friends on the victim's Facebook profile. A new version of the virus also is affecting users of MySpace and other social networking sites. In addition, cybercriminals are tricking social networking users into downloading malicious software to their machines by creating fake profiles of friends, celebrities, and business associates. Security experts say that such attacks, which became widespread last year, are increasingly successful because more and more people are becoming comfortable with putting all kinds of personal information about themselves on social networking sites. Security experts warn that users need to be careful about what information they post because the data can be used to steal their identities or even claim money that the government owes them.
(go to web site)

"Hackers Break in to Spotify"
Guardian Unlimited (UK) (03/04/09) ; Johnson, Bobbie

The online music service Spotify has announced that a group of hackers found a bug in a computer program that gave them access to users' passwords and email addresses, birth dates, and other registration information. Credit card numbers were not at risk, as they are not stored by the service. The exposed passwords were encrypted, but Spotify said they could still be vulnerable to attempts to guess them. The system flaw was fixed after Dec. 19, and only users who signed up before that date could be affected by the security breach. The online service, which claims more than 1 million users worldwide, is based in Sweden and London.
(go to web site)

"Guidelines for Securing DNS Being Updated"
Government Computer News (03/03/09) ; Jackson, William

The National Institute of Standards and Technology (NIST) has released a draft of recommendations for the implementation of DNS Security Extensions (DNSSEC), the protocol that secures the DNS system by digitally signing and authenticating DNS query and response transactions. The document, Special Publication 800-81, "Secure Domain Name System Deployment Guide," outlines the basic steps that need to be taken when deploying DNSSEC for zone information. It also includes a number of revisions to previous documents that discussed the implementation of DNSSEC. For instance, the document contains updated recommendations for cryptographic parameters based on NIST Special Publication 800-57, as well as new discussions about NSEC3 Resource Record in DNSSEC and DNSSEC in split-view deployments. Finally, the document includes guidelines for configuring DNSSEC deployments to prevent denial-of-service attacks that target the DNS system. The release of the document comes in the wake of the announcement that federal agencies will not be able to implement DNSSEC in the .gov top-level domain this year as planned because they are waiting for improvements to the software. Second-level .gov domains, however, are still on track to be signed by the end of 2009.
(go to web site)

"Feds Look for Advanced Security Tools to Thwart Hackers"
NextGov.com (03/02/09) ; Nagesh, Gautham

The National Coordination Office for Networking Information Technology Research and Development (NITRD) has asked the IT industry to submit advanced research concepts that will help to improve the security of government IT systems and level the playing field between hackers and system administrators. One of the advanced ideas that could be submitted by the IT industry is the concept known as attribution, which is the ability to determine where a piece of data or activity that can open up a network to hackers came from. Another idea that could be submitted pertains to scalable data collection, which allow government agencies to perform a real-time analysis on terabytes of data in real time. Although this capability would improve the chances of identifying and responding to attacks on agency systems, it would also require an increase in bandwidth that could be as large as 1-gigabit-per-second, says consultant Greg Garcia. NITRD is planning to collect the ideas until April 15. A working group of six to eight high-level IT officials will then choose the best ideas among those submitted. After the best ideas are chosen, the federal government will hold workshops and work with academia and the industry to develop the ideas.
(go to web site)

"How to Share Without Spilling the Beans"
Technology Review (03/02/09) ; Naone, Erica

A new protocol designed to allow organizations to share important information without compromising privacy through the use of smart cards was recently unveiled by Bar-Ilan University professor Andrew Yehuda Lindell. The protocol's usage involves the first party's creation of a key with which both parties could encrypt their data. The key would be stored on a secure smart card to be given to the second party. Both parties would employ the key to encrypt their respective databases, and then the first party would send his or her encrypted database to the second party, who can see what information both parties have in common. In addition, the second party would only have a restricted window of time to use the secret key on the smart card because the first party deletes it remotely using a special messaging protocol. University of Haifa professor Benny Pinkas says that Lindell's system demands far fewer computing resources to shield private information. However, RSA Laboratories chief scientist Ari Juels says that because the smart card serves as a trusted third party, finding a manufacturer that both organizations trust completely could be problematic. "Assuming that a smart card is secure against an individual or modestly funded organization may be reasonable, but not that it's secure against a highly resourced one, like a national-intelligence agency," he notes. Lindell says that in the event the chip is compromised, high-end smart cards can be designed to self destruct.
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: