Search This Blog

Friday, August 21, 2009

Security Management Weekly - August 21, 2009

header

  Learn more! ->   sm professional  

August 21, 2009
 
 
Corporate Security

Sponsored By:
  1. "Arctic Sea Hijackers 'Threatened to Kill Crew,' Sink Ship"
  2. "Mexico Probe Over Kidnap Deaths"
  3. "Police: Slain Model's Fingers, Teeth Were Removed"
  4. "Two Arrested over GBP40m Gems Raid"
  5. "U.S. Government to Advise Businesses on Swine Flu"
Homeland Security

  1. "19 Killed by Bombing in Russia's Ingushetia"
  2. "CIA Said to Use Outsiders to Put Bombs on Drones"
  3. "Deadly Attacks Rock Kabul Pre-Vote"
  4. "Lockerbie Bomber Freed, Returns to Cheers in Libya"
  5. "Security Stepped Up After Baghdad Bombings"
Cyber Security

  1. "Card Data Exposed as Radisson Hotels Becomes Latest Breach Victim"
  2. "Hackers Put Social Networks Such as Twitter in Crosshairs"
  3. "Hackers Stole IDs for Attacks "
  4. "Identity Theft Malware Surges 600 Percent"
  5. "Miami Man Indicted in Largest-Ever Scheme to Steal Credit Card Numbers"

   

 
 
 

 


Arctic Sea Hijackers 'Threatened to Kill Crew,' Sink Ship
CNN International (08/18/09)

The vice president of Renaissance Insurance, the company that insured the Maltese-flagged cargo ship that went missing in late July and was discovered on Monday, said Tuesday that the hijackers that seized the vessel demanded a $1.5 million ransom earlier this month. According to the Renaissance Insurance official, an English-speaking individual claiming to be a go-between for the hijackers called the insurance company on Aug. 3 and demanded that it pay the ransom within five days. The individual, who tried to change his voice to avoid being recognized, said that the hijackers would kill the crew one by one and sink the ship if Renaissance Insurance failed to meet the deadline or if it told police about the ransom demand. Renaissance Insurance has turned over a recording of the phone call to Russian special services, which has launched an investigation into the incident. Russian Authorities are still questioning the eight hijacking suspects who were captured on Tuesday, as well as the 15 Russian sailors who served as crew members of the vessel. None of the crew members were harmed in the incident.


Mexico Probe Over Kidnap Deaths
BBC News (08/21/09) Gibbs, Stephen

The anti-kidnapping chief of Mexico City has been suspended from duty following a disastrous rescue attempt that left four people dead. Last month, police were alerted that a middle-aged woman from Mexico City had been kidnapped and was being held in a house in the capital. As the police approached the house, the kidnappers began shooting at them with AK47s. The police returned fire, killing two of their own men in the process. Inside the house, the hostage was murdered by her kidnapper, who then killed himself. It has also emerged that the woman's driver had earlier tipped police off about a probable kidnap attempt, raising suspicions of possible police complicity.


Police: Slain Model's Fingers, Teeth Were Removed
Associated Press (08/21/09) Flaccus, Gillian

Police on the hunt for a reality TV contestant charged with the gruesome murder of his ex-wife. Ryan Alexander Jenkins, a Calgary, Alberta, native, was a contestant on the VH1 series "Megan Wants a Millionaire." Police suspect him of killing his former wife, Jasmine Fiore, and removing her teeth and fingers, presumably to impede efforts to identify the body, which was found naked and stuffed in a suitcase in a California trash bin over the weekend. Fiore, a former swimsuit model, and Jenkins were briefly married after a quickie Las Vegas wedding this year.


Two Arrested over GBP40m Gems Raid
BBC News (08/19/09)

Two suspects have been arrested in connection with an armed robbery at a central London jewelry store in which goods worth GBP40 million were stolen by two men armed with handguns in the biggest jewelry robbery ever in the UK. A female worker was dragged outside the store by the men, who fired two shots as they made their escape. Police have been searching for two men who were captured on CCTV carrying out the robbery. A reward of GBP1 million has been offered to catch the culprits.


U.S. Government to Advise Businesses on Swine Flu
Reuters (08/18/09)

U.S. government officials have announced that they will issue guidance for businesses on how to handle the H1N1 pandemic. A joint news conference will be held to advise employers Aug. 18 with Commerce Secretary Gary Locke, Homeland Security Secretary Janet Napolitano, and Health and Human Services Secretary (HHS) Kathleen Sebelius. U.S. officials have also issued guidance for vaccinations and for schools. The government has said that healthcare workers, pregnant women, and people with chronic diseases such as asthma should be the first to be immunized against H1N1. The government estimates that it will need 600 million doses to vaccinate all essential groups a people will need two doses for full immunity. Additionally, guidance from HHS and the Department of Education advises that schools should not close unless staff and students become ill. However, it urges anyone with flu-like symptoms to stay home from school and not return until 24 hours after the fever subsides and they feel better.




19 Killed by Bombing in Russia's Ingushetia
CNN International (08/17/09) Tkachenko, Maxim

A suicide bomber driving a truck packed with explosives rammed into the gate of a police station in the Russian city of Nazran on Monday morning, killing at least 19 people and wounding 70. However, the death toll from the blast--which took place in the Russian republic of Ingushetia, which has experienced unrest spilling over its border with neighboring Chechnya--could rise higher once authorities begin searching under the rubble of the police station for survivors. The president of Ingushetia, Yunus-Bek Yevkurov, has blamed the attack on Islamist rebels who want to destabilize the republic and cause a panic among residents. Islamist militants have frequently attacked law enforcement officials and Russian servicemen in Ingushetia as part of the low-level insurgency they are fighting in the republic.


CIA Said to Use Outsiders to Put Bombs on Drones
New York Times (08/21/09) Risen, James; Mazzetti, Mark

The CIA contracted with security company Blackwater, now known as Xe Services, to assemble and load Hellfire missiles and other bombs on remotely piloted Predator aircraft designed to assassinate al-Qaida leaders in Pakistan and Afghanistan, according to government officials and Blackwater employees. The company's association with the assassination program reportedly began in 2004. At that time, contractors were ordered by the CIA to collect information regarding the whereabouts of al-Qaida leaders, carry out surveillance, and train for possible missions. Any operation to capture or kill militants would still have had to be approved by the CIA director, said current director, Leon E. Panetta, who canceled the program and notified Congress of its existence in June 2009. The division of Blackwater carrying out the intelligence contracts, known as Blackwater Select, signed its first major agreement with the CIA in 2002. At that time, the contract was to provide security for the agency's new station in Kabul, Afghanistan. Blackwater employees were also assigned to the Predator bases and received training at Nellis Air Force Base in Nevada to learn how to load the missiles and bombs needed. Reports indicate that Blackwater employees were not involved in selecting targets or actual strikes. All targets were selected by the CIA and agency employees pulled the trigger remotely.


Deadly Attacks Rock Kabul Pre-Vote
AFP Business News (08/18/09) Roberts, Bronwen

A suspected car bomb killed five people and a rocket hit the presidential compound in Kabul on August 18, two days before the country's elections that the Taliban has promised to disrupt by attacking polling stations. The bomb reportedly also wounded 30 people while 10 more were injured as the Taliban fired two to three rockets into the capital, including the one that struck the presidential compound. In light of this violence, officials are increasingly concerned that voters will be driven away from voting in only their second election in the country's history. Thousands of U.S. and NATO troops have taken control of militant strongholds in an effort to secure the country, but at least eight districts remain outside their control and up to 12 percent of polling centers may not open on election day. The NATO-led force said that it will suspend all offensive operations on election day and focus on protecting the public. U.S. defense officials have also indicated that General Stanley McChrystal, is considering cutting back desk jobs in order to free up more troops for combat. All in all, approximately 300,000 Afghan and foreign troops will be deployed to guard between 6,200 and 7,000 polling places. Despite these efforts, security efforts are worried the elections could be plagued by low turnout as well as violence, fraud, and intimidation. Between April 25 and August 1, there were 13 political killings and at least 10 abductions of elected officials in Afghanistan, according to New York-based organization, Human Rights Watch.


Lockerbie Bomber Freed, Returns to Cheers in Libya
Associated Press (08/21/09) El-Tablawy, Tarek

Scotland has released Abdel Baset al-Megrahi, the only man convicted in connection to the bombing of Pan Am Flight 103 over the town of Lockerbie. Al-Megrahi landed in his home country of Libya, where he was met by thousands of cheering young men. He was accompanied by Libyan leader Mommar Gadhafi's son, Saif al-Islam Gadhafi, who vowed last year to secure al-Megrahi's release. Scottish officials elected to grant the request for release on compassionate grounds, as al-Megrahi is terminally ill. President Obama responded to the release by saying it was a mistake and that al-Megrahi should have been placed on house arrest. He warned Libya not to treat al-Megrahi as a returning hero, a warning that was clearly unheeded by those who celebrated at the airport. Obama's objection to the release was echoed by many of the families of the 270 people killed in the Lockerbie bombing. Al-Megrahi was convicted for his participation in the 1988 bombing in 2001. At that time he was sentenced to 27 years in Scottish prison, but in 2007 a review of his case found grounds for an appeal, and many in Britain believe he may be innocent. In a statement following his release, al-Megrahi reiterated his insistence that he was wrongfully accused.


Security Stepped Up After Baghdad Bombings
CNN (08/19/09)

The Iraqi government has instituted a series of new security measures after a string of bombings made August 19 the deadliest day in Baghdad since the withdrawal of American troops from the city on June 30. These security measures include additional security checkpoints, stricter vehicle searches, and random security stops. Thus far officials have determined that the bombings, which included attacks on the Ministry of Foreign Affairs and the Ministry of Finance, killed at lead 100 people and wounded more than 500. Security forces have arrested two people believed to be connected to the bombings. The two suspects, who are believed to be senior al-Qaida leaders, were stopped by Iraqi security forces while driving a car rigged with explosives.




Card Data Exposed as Radisson Hotels Becomes Latest Breach Victim
Finextra (08/19/09)

Radisson Hotels & Resorts has revealed that the credit card details of some its customers were compromised in a data breach that took place at several of its hotels in the U.S. and Canada between November 2008 and May. The company said that the names of an unknown number of its customers, as well as their credit and debit card numbers and expiration dates, were exposed when someone illegally accessed its computer systems. However, no Social Security numbers were stolen in the incident. Radisson says it is working with law enforcement and forensic investigators to look into the breach, which was discovered by Visa, MasterCard, and several payment processors. Radisson has also launched a review of the affected computer systems and has implemented several security measures to ensure that a similar breach does not take place again.


Hackers Put Social Networks Such as Twitter in Crosshairs
IDG News Service (08/17/09) Kirk, Jeremy

Social networking sites such as Twitter were the most commonly targeted vertical market during the first half of 2009, according to the Web Hacking Incidents Database report, sponsored by Breach Security and the Web Application Security Consortium. The finding marks a change from last year, when government and law enforcement sites were the most attacked vertical market. Breach Security's Ryan Barnett says social networking sites are increasingly being targeted because they have a large number of users. The report says the most common type of attack is an SQL injection attack, in which hackers try to enter code into Web-based forms or URLs in the hopes of getting back-end systems to execute it. The technique can result in a data breach if the code the attacker tries to enter is not properly validated. The report also says the most common reason why hackers attack a Web site is because they want to deface it. But financial motivations can sometimes be at work as well, since Web site defacement also can include planting malware on a site. "Ultimately, [the hackers] want to make money," Barnett says.


Hackers Stole IDs for Attacks
Wall Street Journal (08/17/09) Gorman, Siobhan

Russian hackers stole U.S. identities and software tools for use in a cyberattack against Georgian government Web sites during the war between Russia and Georgia in 2008, according to a new report by the U.S. Cyber Consequences Unit. The report says that Russian hackers converted Microsoft software into a cyberweapon and collaborated on popular U.S.-based social-networking sites, including Facebook and Twitter, to coordinate attacks against Georgian sites. Although the cyberattacks were closely examined following the war, the connections to the United States had remained hidden until this year. Personal and credit card information stolen from U.S. citizens was used to register Web sites that launched the botnet attacks, and once the attacks started, Facebook and Twitter were used to exchange attack code and encourage others to join the attack. Experts say the study shows how cyberwarfare has outpaced military and international agreements, which do not account for the possibility of using U.S. resources and civilian technology as weapons. Identity theft, social networking, and modifying commercial software are all common attack strategies, but combining these strategies raises the attack to a new level, says former U.S. Department of Homeland Security cybersecurity chief Amit Yoran. White House officials are now studying how laws of war and international obligations need to be adjusted to account for cyberattacks. The U.S. Cyber Consequences Unit says the Georgian attacks were perpetrated by Russian criminal groups, and had no clear link to the Russian government, but the time of attacks, which started only hours after the military invasion started, suggests the Russian government may have at least indirectly coordinated with the cyberattackers.


Identity Theft Malware Surges 600 Percent
InformationWeek (08/19/09) Claburn, Thomas

The number of computer users affected by malware engineered to steal personal information has risen by 600 percent in the first half of the year compared to the first half of last year, according to PandaLabs, which identified 391,406 computers infected with identity-theft malware in the first six months of the year. Luis Corrons, technical director of PandaLabs, believes the global economic downturn and the thriving black market for credit and debit card numbers and online account information is driving the proliferation of identity stealing malware. He says the distribution of identity-theft malware through social networks and services such as Facebook and Twitter is on the rise. Financial data thieves also are targeting more diverse services, recently going after giants such as PayPal, Amazon, eBay, and various charity sites, whereas before they focused on spoofing online banks sites. The methods of attacks also have gotten more diverse.


Miami Man Indicted in Largest-Ever Scheme to Steal Credit Card Numbers
Miami Herald (08/17/09) Barry, Rob; Sallah, Michael; Shah, Nirvi

A Miami man and two unnamed defendants were indicted in New Jersey on Monday for allegedly stealing more than 130 million credit cards and reselling them on the black market. Prosecutors say the Miami man, 28-year-old Albert Gonzalez, and his two co-defendants stole credit card information from customers who shopped at 7-Eleven and the supermarket chain Hannaford Brothers. Prosecutors also say that the three defendants also used an SQL injection attack to break into the computer systems of a national credit card processing company and steal card data. The three then allegedly sent the data to California, Illinois, Latvia, the Netherlands, and Ukraine. From there the data would be used to create counterfeit cards, which would be sold to buyers in cafes and nightclubs across the globe. The case is the largest credit and debit card data breach in the U.S. for which charges have been brought, prosecutors say. The case broke the previous record of more than 40 million cards--a breach that was also perpetrated by Gonzalez and 10 others in Miami in 2007. Gonzalez is currently in jail awaiting trial on that case as well.


Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: