Search This Blog

Friday, April 03, 2009

Security Management Weekly - April 3, 2009

header

  Learn more! ->   sm professional  

April 3, 2009
 
 
CORPORATE SECURITY  
  1. " In France, the Bosses Can Become Hostages" Workers in France Increasingly Holding Managers Captive to Protest Layoffs
  2. " Piracy Puts Film Online One Month Before Open"
  3. " Congress Presses Credit Card Companies on PCI Failures"
  4. " Guns Could Be Legal in Workplace" Texas
  5. " Violence, Vacancies Trouble Md. Mall"

HOMELAND SECURITY  
  6. " Al Qaeda Seen Behind Pakistani Taliban Threat"
  7. " U.S. and Mexico Meet on Border Issues"
  8. " Militants Vow More Attacks in Pakistan"
  9. " U.S. Drops 'War on Terror' Phrase, Clinton Says"
  10. " Detainee's Harsh Treatment Foiled No Plots"

CYBER SECURITY  
  11. " Conficker May Be More Widespread Than Previously Thought"
  12. " Experts See Early Activity From the Conficker Worm"
  13. " New Cloud Security Alliance Forms"
  14. " Spam Is Making a Comeback, Google Finds"
  15. " China Accused Over Global Computer Spy Ring"


   






 

"In France, the Bosses Can Become Hostages"
Wall Street Journal (04/03/09) ; Gauthier-Villars, David; Abboud, Leila

As the global economic crisis forces multinationals to eliminate jobs, some have discovered the perils of laying off their French population of workers. Managers at Caterpillar Inc.'s plant in France were taken hostage in the wake of the company's announcement that it planned to reduce its global work force by 22,000. The workers did not release the director of the plant and four other managers until the company agreed to reopen discussions with unions and a government mediator to secure better compensation benefits for employees whose jobs are terminated. The incident marked the third time in two weeks that French workers took executives hostage over compensation issues. The trend, which observers say is part of the French culture, has inspired other corporations to take preemptive security steps. Ahead of the shuttering of its French factory, German tire maker Continental AG has relocated the site of a meeting with unions to avoid clashing with protesters.
(go to web site)

"Piracy Puts Film Online One Month Before Open"
New York Times (04/02/09) P. B3 ; Stelter, Brian

An unfinished version of the upcoming movie "X-Men Origins: Wolverine" was leaked online Wednesday, a full month before it is scheduled to hit theaters. According to the file-sharing monitoring firm BigChampagne, the copy of the film--which was missing a number of special effects and included temporary sound and music--was downloaded several hundred thousand times in the first 24 hours after it was posted on the Internet. The movie's distributor, 20th Century Fox, said it was unsure of how the unfinished version of the film ended up on the Internet. The company also said that it would prosecute the initial leak and any subsequent postings of the film "to the fullest extent of the law." The FBI and the Motion Picture Association are conducting an investigation into how the film was leaked.
(go to web site)

"Congress Presses Credit Card Companies on PCI Failures"
Dark Reading (04/01/09) ; Higgins, Kelly Jackson

An overhaul or enhancement of the PCI standard with federal laws was urged by the U.S. House Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology at a March 31 hearing. "I do want to dispel the myth once and for all that PCI compliance is enough to keep a company secure," said subcommittee chair Rep. Yvette D. Clarke (D-N.Y.). She noted that large merchants spend up to $18 million annually to cover PCI costs, but compliance with the security standard does not ensure that the retailer will not be hacked. Visa's Joseph Majka said that no fully PCI-compliant organization has been hit by a data breach, but acknowledged that there is no standard that guarantees security. Majka said that securing customer data is a shared responsibility. "Visa recognizes that no set of standards can provide an absolute guarantee of security in a changing world, and PCI DSS is not an exhaustive list of all the security practices that may be effective to safeguard card data," he said.
(go to web site)

"Guns Could Be Legal in Workplace"
Lubbock Online (03/30/09) ; Rangel, Enrique

The Texas state legislature is considering several bills that would ease some of the restrictions on firearms. Among the bills is a measure that would allow Texans to bring guns and ammunition to work and store them in their car. In addition, the measure would give Texans the right to have firearms and ammunition at work even if their employers have policies that forbid workers from having weapons. The bill has been approved by the Texas state Senate and is now being considered by the House. Another bill being considered by the state Legislature is a measure that would allow individuals with concealed weapons licenses to carry firearms on college campuses. Although Texas is considered to be a gun-friendly state, the legislation faces some opposition from some in the legislature. For example, state Rep. Lon Burnam (D-Fort Worth) has said he would oppose the bill that would allow firearms on college campuses.
(go to web site)

"Violence, Vacancies Trouble Md. Mall"
Washington Post (03/29/09) P. A1 ; Wiggins, Ovetta

The Boulevard at the Capital Centre, a Main Street-style mall in Landover, Md., has been struggling to hold on to customers in the wake of a number of violent crimes. In the latest incident, a person was killed outside a sports bar owned by former Washington Redskin LaVar Arrington earlier this month. Last year, three men were shot and killed after a fight broke out at Uno Chicago Grille during the Super Bowl. Car break-ins are also a problem, Prince George's County Police say. There were 101 thefts from automobiles at the mall last year, up from 40 in 2007. Meanwhile, some local residents say they are afraid to go to the mall at night because of the large number of teenagers who hang out there. Despite the crime, Inland Management, the company that runs the mall, says it is safe. According to Bill Parks, the vice president of property management at Inland Management, the mall has security guards and a complete security surveillance system to ensure the safety of customers. Parks added that the mall has is working with county police to "coordinate any issues," and that it has implemented policies to cut down on loitering by teenagers.
(go to web site)

"Al Qaeda Seen Behind Pakistani Taliban Threat"
Reuters (India) (04/02/09) ; Birsel, Robert

Analysts said Thursday that Pakistani Taliban leader Baitullah Mehsud does not have the capability to launch an attack on Washington, D.C., as he threatened to do earlier this week. However, analysts also say that Mehsud was likely speaking for al-Qaida when he said the nation's capital would be attacked in retaliation for the $5 million reward the U.S. has offered for information leading to his location and arrest. According to retired Brigadier Mehmood Shah, a former chief of security in northwest Pakistan, al-Qaida is increasingly working with Mehsud because of his leadership qualities and the attacks he has allegedly orchestrated, including the 2007 assassination of former Pakistani Prime Minister Benazir Bhutto. "He seems to have convinced al-Qaida he's a useful man… When he speaks of a threat to Washington, he means al-Qaida," Shah said. "By himself, he doesn’t have the capacity to carry out an operation so far away. He's talking for al-Qaida." In addition to determining whether Mehsud's organization could carry out an attack, experts have also tried to figure out why Mehsud issued a threat against Washington, D.C. Some analysts that the threat may have been aimed at trying to drive a wedge between the Pakistan and the U.S., which is growing increasingly frustrated with Islamabad's inability to prevent militants from crossing into Afghanistan.
(go to web site)

"U.S. and Mexico Meet on Border Issues"
Wall Street Journal (04/02/09) ; Perez, Evan

U.S. Attorney General Eric Holder and Homeland Security Secretary Janet Napolitano met with Mexican Attorney General Eduardo Medina Mora and other top security officials at a conference in Jiutepec, Mexico, on Thursday to discuss ways to beef up security along the U.S.-Mexico border. Among the topics the officials discussed were ways the two countries can work together to better block the flow of weapons and cash moving from the U.S. to Mexico and the drugs coming from Mexico to the U.S. Holder said efforts to stem the flow of weapons from the U.S. have already begun and will be expanded upon. He added that the Second Amendment will not likely present an obstacle to those expansion efforts. In addition, the officials agreed to share more intelligence and increase prosecutions of members of Mexican drug cartels. Meanwhile, Holder said in an interview on the sidelines of the conference that the Justice Department is planning to take steps to bring federal and state prosecutors together to fight financial fraud and white-collar crime. That effort could include a task force on financial crime similar to the one set up by the Bush administration after the collapse of Enron.
(go to web site)

"Militants Vow More Attacks in Pakistan"
Associated Press (03/31/09)

The militant group Fedayeen al-Islam, which claimed responsibility for the attack on the Pakistani police academy in Lahore on Tuesday, said it would launch more attacks if its demands are not met. Omar Farooq, a spokesman for Fedayeen al-Islam, said his group is demanding that Pakistani troops withdraw from tribal areas near the Afghan border and that the U.S. halt drone attacks against militants in the country. Farooq also said that Fedayeen al-Islam is demanding that the Pakistani government release Maulana Abdul Aziz, the chief cleric at Islamabad's Red Mosque, which was the site of a 2007 battle between militants and security forces. Aziz, who has links to the Pakistan Taliban, was arrested after he fled from security forces trying to retake the mosque. Meanwhile, authorities in Pakistan are continuing to investigate the attack, which killed at least six police officer trainees and injured more than 90 officers. Investigators say the attack may have been planned along the Pakistan-Afghanistan border, and may be the work of a Sunni extremist group. Authorities have also refused to rule out an Indian role in the attack.
(go to web site)

"U.S. Drops 'War on Terror' Phrase, Clinton Says"
Wall Street Journal (03/31/09) ; Solomon, Jay

Secretary of State Hillary Clinton told reporters traveling with her to the United Nations-led conference on Afghanistan in the Netherlands that the Obama administration is no longer using the term "war on terror" to describe its anti-terrorism efforts. The phrase, which was coined by the administration of former President George W. Bush to describe the conflict with al-Qaida and other militant Islamic groups, has been criticized by some who say it inflames anti-U.S. sentiment in the Muslim world. Others say that it would be better if the administration used language that is more specific about who the U.S. is fighting. Clinton's remarks came ahead of a one-day conference in The Hague on Tuesday in which the U.S. will seek more support in fighting al-Qaida and the Taliban. Clinton noted that the U.S. will not seek formal troop or funding commitments from the countries sending delegates to the conference, and will instead work to "raise the international commitment to Afghanistan."
(go to web site)

"Detainee's Harsh Treatment Foiled No Plots"
Washington Post (03/29/09) P. A1 ; Finn, Peter; Warrick, Joby

Former senior government officials say the torture of reputed al-Qaida leader Abu Zubaida yielded no credible leads into the daily operations of the terrorist organization. Sources with personal knowledge of Zubaida's interrogation claim information considered most useful to the CIA was provided before waterboarding was employed, while practically all of the leads obtained through harsh interrogation methods later proved less substantive. Zubaida was described by then-President George W. Bush as "al-Qaida's chief of operation," but court records and subsequent interviews with current and retired intelligence, military and law enforcement sources suggest he was only a minor player in the terrorist organization. The conflicting portrait presents a dilemma for the Obama administration as it contemplates what to do with Zubaida and 241 other detainees at Guantanamo Bay. Though Zubaida was never charged in a military commission at the detention center, some U.S. officials now want to charge him with conspiracy.
(go to web site)

"Conficker May Be More Widespread Than Previously Thought"
Network World (04/02/09) ; McMillan, Robert

The number of Conficker.c infections could be higher than previously thought, concludes an OpenDNS study. The study, which consisted of an analysis of the Domain Name System requests made on OpenDNS' network, found that 500,000 of the company's more than 10 million users have been infected with Conficker.c. That number was much higher than the company expected, says OpenDNS founder David Ulevitch. As a result, the number of infections of all three variants of the Conficker worm is likely higher than previous estimates, which have ranged from a few million to 10 million PCs worldwide, Ulevitch says. The study also looked at what countries have been most affected by the Conficker worm. According to OpenDNS, 13 percent of the infections it tracked were in Vietnam, making the southeast Asian nation the hardest hit by the worm. The company found that Brazil, the Philippines, Indonesia, and Algeria had the next highest number of infections.
(go to web site)

"Experts See Early Activity From the Conficker Worm"
New York Times (04/01/09) P. A14 ; Markoff, John

An informal group of computer security experts said they have observed early attempts by the Conficker virus to communicate with a control server, but they are unsure if the attempts were successful. The Conficker malware, which has aggressively spread since October, is designed to unite infected machines into a botnet. Security researchers who have examined the most recent version of the malware, Conficker C, said it was ready to try to download commands from an unknown Internet location on April 1. Although the choice of April Fool's Day has led some experts to speculate that the program may be a hoax, others warn that Conficker, which has infected at least 12 million computers, could cause serious harm. Nevertheless, security specialists agree that it will most likely take several days before the purpose of the program can be determined. The program was intended to start contacting 50,000 Internet domains on April 1st. In a global effort, researchers created a system that will trap all of the attempted botnet communications, which involves monitoring the domains of 110 countries. A spokesperson for the Conficker Cabal, a security working group organized by computer security companies, says as of March 31st the group has no new information on the activity of Conficker. IBM says company researcher Mark Yason has decoded Conficker's internal communication protocol, which will make it easier for security teams to detect and interrupt the program's activities.
(go to web site)

"New Cloud Security Alliance Forms"
eWeek (04/01/09) ; Taft, Darryl K.

Several security firms have formed the Cloud Security Alliance (CSA), a new cloud computing security effort that aims to promote the use of best practices for assuring the security of cloud computing. The CSA also will work to promote research into cloud computing security best practices. The alliance, which will be made up of industry, providers, and consumers of cloud computing services, will work to achieve understanding between cloud computing consumers and providers about the necessary security requirements and attestation of assurance, improve awareness of the appropriate use of cloud computing and cloud security solutions, and create consensus lists of issues and guidance related to cloud security assurance. Although the group shares some similar goals with the recently-launched Open Cloud Manifesto, the two are actually quite different, says CSA founding member Christopher Hoff. He says the main difference is that CSA is a nonprofit and its membership consists of both providers and consumers of cloud services.
(go to web site)

"Spam Is Making a Comeback, Google Finds"
InformationWeek (03/31/09) ; Claburn, Thomas

Botnet proprietors who saw their networks wiped out by authorities in late 2008 are replenishing their botnets, according to a member of Google's security team, who says spam levels had rebounded to their previous levels by mid March. Google's Adam Swidler says that spam volume in Google's Postini email platform fell by 70 percent after McColo, a botnet hosting firm, was shut down in November. Since then, spammers have been replacing their lost networks at a rate of about 1.2 percent each day. Links to malicious Web URLs and misleading news stories are among the most popular forms of bait in spam email messages. Swindler says that one of the newest spammer schemes is using location data to tailor spam messages to news events happening in the user's area. Between February and March, the frequency of email payload attacks, in which a virus is attached to a spam email message, increased exponentially several times over, Swidler says.
(go to web site)

"China Accused Over Global Computer Spy Ring"
Guardian Unlimited (UK) (03/30/09) ; Glaister, Dan

Researchers at Cambridge University and the University of Toronto have found that servers in China have been used to hack nearly 1,300 computers in more than 100 countries. According to two reports issued by the universities over the weekend, the servers sent infected e-mails containing attachments or links to Web sites to individual users as well as users in private organizations and government agencies. Among the victims were the office of the Dalai Lama, the foreign ministries of Iran and Indonesia, and the embassies of Germany, India, and Pakistan. Once the users opened the e-mail, a virus was launched that allowed hackers to perform a variety of functions on their computers, including moving files, sending and receiving data, and turning on the camera and microphone. The Cambridge University report has blamed the Chinese government for the attacks, while the University of Toronto report said that the CIA or the Russians could be responsible. The Cambridge University report also said that such attacks are likely to be more common in the future, since the techniques used are available to anyone and are highly effective. In addition, the report noted that it is virtually impossible to defend against such attacks.
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: