Security Management Weekly - March 22, 2013

Learn more! ->     March 22, 2013     Corporate Security Sponsored By: "Militant Tied to Pearl Death is Arrested" "Thieves in Half-Billion Dollar Art Heist Identified by FBI" "Hollywood-Style Caper in $80M Theft Obtained Security Plans to Get Inside" 2010 Pharmaceutical Heist at Connecticut Warehouse "'Everything's Got to Be Integrated? No, It Doesn't'" Security Systems Integration "Minimize Risk, Maximize Your Protection" Security Communication Plans Homeland Security "Drone Base in Niger Gives U.S. a Strategic Foothold in West Africa" "Three Marines Die in Shootings at Quantico" Virginia "Secret Report Raises Alarms on Intelligence Blind Spots Because of AQ Focus" Al-Qaida "Police: Fla. College Student Plotted an Attack" "Canada Confirms Canadian Aided Algeria Attack" Cyber Security "Hackers Use Legit Remote IT Support Tool in Spy Attack" "Computer Networks Crash at South Korean Banks, Media Companies; North Korea Attack Suspected" "South Korea Cyberattacks Hold Lessons for U.S." "Cybersecurity Experts Warn Many Cos May Have Had IP Stolen" Intellectual Property "HTTPS Security Encryption Flaws Found"             Militant Tied to Pearl Death is Arrested Wall Street Journal (03/20/13) Wright, Tom The Pakistani paramilitary organization known as the Pakistan Rangers has announced that it has arrested a suspect in the 2002 death of Wall Street Journal reporter Daniel Pearl. The suspect, Qari Abdul Hayyee, was arrested in a covert operation near the airport in Karachi, Pakistan, on March 16 or 17. A Pakistani security official said that Hayyee was linked to Pearl's killing because he was a leader of the Pakistani militant group Lashkar-e-Jhangvi at the time, though officials say that he is no longer a leader of the group. However, Pakistani officials say they are not sure whether Hayyee played a direct role in Pearl's kidnapping and death. An investigation by Georgetown University and the Center for Public Integrity in 2011 found that Hayyee was one of the men who guarded Pearl after he was kidnapped. That kidnapping took place while Pearl was in Karachi researching an article on shoe bomber Richard Reid. Pearl was ultimately beheaded by Khalid Sheikh Mohammed, the alleged mastermind of the Sept. 11 attacks. Pearl's parents issued a statement following the announcement by the Pakistan Rangers, saying that they were happy that someone had been arrested in their son's kidnapping and death and that they hoped justice would be served. Web Link | Return to Headlines Thieves in Half-Billion Dollar Art Heist Identified by FBI ABC News (03/18/13) Newcomb, Alyssa The FBI announced on Monday that it had made a major break in the case of the theft of $500 million worth of art from the Isabella Stewart Gardner Museum in Boston in 1990. Richard DesLauriers, the special agent in charge of the FBI's Boston office, said the alleged thieves are members of a criminal organization based in the mid-Atlantic and New England. DesLauriers did not name the thieves, who are believed to have taken the 13 masterpieces from the art museum, saying that doing so would not be prudent. He added that authorities are primarily focused on finding the art work, which the thieves are believed to have attempted to sell 10 years ago. The FBI has no knowledge of the whereabouts of the artwork after that, DesLauriers said. Authorities are calling on anyone who is in possession of the stolen artwork to turn it in, as they could be held criminally liable. Web Link | Return to Headlines Hollywood-Style Caper in $80M Theft Obtained Security Plans to Get Inside NJ.com (03/18/13) Sharman, Ted Thieves who pulled off the largest pharmaceutical heist in U.S. history in 2010 without tripping the alarm system or being caught on surveillance recordings might have had the help of a document that laid out all of the security vulnerabilities of the Connecticut warehouse where drugs for pharmaceutical company Eli Lilly were kept. According to a recent lawsuit filed by National Union Fire Insurance Co. of Pittsburgh, which insured some of the losses and is seeking $42 million in damages, security assessments made by ADT Security Systems for the warehouse that pointed out security flaws--like the locations of closed-circuit TV (CCTV) blind spots and areas without motion sensor coverage--were somehow procured by the thieves prior to their break-in. This allowed the thieves to drop in from the roof onto the precise location of the security control center for the warehouse, disable the security systems, and make off with about $80 million in pharmaceuticals using a tractor trailer truck parked at the only loading dock without adequate CCTV coverage. "Either they were given access to this data, or there was a weak link that allowed ADT to be hacked," said Elisa Gilbert, the New York attorney representing the insurance company. Web Link | Return to Headlines 'Everything's Got to Be Integrated? No, It Doesn't' Security Director News (02/14/13) Canfield, Amy Security experts speaking on a panel during the recent TechSec 2013 conference said it is a mistake to believe they need to "embrace everything that has a power supply," in the words of George Booth, Senior Manager of Global Security Operations for eBay Corp. Booth joined Pierre Trapanese, Owner of Northland Control Systems, Booth's system integrator, and Joe Kirmser, President and General Manager of Lenel Systems International, the access control manufacturer that worked on eBay's physical security system, for the panel, "Systems Integration: A Contrarian's View." Kirmser defined systems integration as "when everything works together and information is shared from different systems," leading to lower costs and greater efficiency. Booth emphasized that before installing the latest technology, organizations should improve their policies and procedures. This often underrated steps "can have a profound impact," he said. Physical security can be as simple as firing employees who prop the door open multiple times or who let other people follow them through a door without using their smart cards, Booth noted. He and Trapanese both agreed that everything within an organization does not have to be integrated. "If you do a really good job at the front door, too much integration is not always a good thing," Trapanese said. Booth lamented what he calls the dearth of innovation in security technology today, saying there is a need for something beyond "acres and acres of video." Web Link | Return to Headlines Minimize Risk, Maximize Your Protection Security Magazine (02/13) Vol. 50, No. 2, P. 28 Clark, Shawn C. Corporate security investigations can uncover millions of dollars in fraud and poor business practices, and result in employee terminations, the end of business relationships, civil suits or criminal prosecution. However, an investigation that is handled independently or by a manager who is not qualified can dramatically increase the litigation risk to the company. A security communication plan could help ensure that employees understand the role of the security department. A company-wide plan could serve as a critical, proactive tool for promoting the security department as an objective body that determines whether an investigation is warranted. The security team should meet regularly with co-workers, labor representatives and other stakeholders, offer training based on its case work and do it in person. Fraud analytics can be used to generate objective, non-biased and non-discriminatory tips on fraudulent and speculative activity. The profiles have no sex, age, race, religious, sexual, seniority or performance orientation. Web Link | Return to Headlines Drone Base in Niger Gives U.S. a Strategic Foothold in West Africa Washington Post (03/22/13) Whitlock, Craig The drone base that the U.S. Air Force opened in the African nation of Niger last month could help give the Pentagon a strategic foothold in West Africa, a region that is quickly becoming a new front in the fight against terrorists. The drone base is shrouded in secrecy, though it is known that the facility is located just outside the Nigerien capital of Niamey and that it is home to a small number of unarmed Predator drones. The aircraft are flown over Niger and Mali in an effort to collect video and other intelligence that will allow U.S. officials to track broad patterns of militant activity, rather than hunting down specific terrorist suspects. The intelligence collected by the drones is then given to French and African forces who are fighting militants in Mali. U.S. officials say that the drones could someday be armed with Hellfire missiles so that they could be used to kill terrorist suspects. Although the base outside Niamey is one of several U.S. drone bases in Africa, it is arguably one of the more important facilities on the continent given its location. That is because Niger borders Mali, which has become a refuge for al-Qaida in the Islamic Maghreb and other Islamist groups. Also nearby are Libya and Nigeria, both of which are also fighting armed extremists. Web Link | Return to Headlines Three Marines Die in Shootings at Quantico Washington Post (03/22/13) Williams, Clarence A marine at the Officer Candidate School at the Marine Corps Base Quantico in Virginia allegedly shot two fellow marines before taking his own life on March 21. Marines from the Provost Marshal's office and officers from the Prince William County Police Department responded to the school and found one marine dead and the suspect barricaded inside of a building, according to Marine Sgt. Christopher Zahn. At 2:45 a.m. March 22, investigators entered the building and found the shooter as well as a second marine dead. The shooting prompted the school to enact Force Protection Delta status, which shuts down all traffic on the base and closes the gates to any traffic coming in or going out. The status was lifted when investigators found the shooter dead. Authorities identified the shooter as a staff member at the school but declined to give any more details. The victims' identities will be released pending notification of their next of kin. Web Link | Return to Headlines Secret Report Raises Alarms on Intelligence Blind Spots Because of AQ Focus Washington Post (03/21/13) Miller, Greg The President's Intelligence Advisory Board has given President Obama a secret report warning him about an imbalance in the allocation of the nation's intelligence assets. The intelligence board is made up of 14 experts--some of whom formerly held high-ranking government posts--who have a great deal of access to intelligence officials and records. Although they refused to discuss the contents of the report, one of the panelists, former Rep. Lee Hamilton (D-Ind.) said that the increasing focus on counterterrorism at the CIA has hurt traditional espionage. Another panelist, former Sen. David L. Boren (D-Okla.), said that the nation's intelligence community has become a "military support operation" and that the deployment of intelligence personnel and resources has become highly imbalanced in the nearly 12 years since the Sept. 11 attacks. These imbalances mean that the U.S. has not been paying sufficient attention to China, the Middle East, and other areas of concern, officials say. Hamilton went on to note that the intelligence community now needs to shift its focus toward its traditional function of gathering and analyzing intelligence. But U.S. intelligence officials say that any changes that take place are likely to be small, given the continued threat from al-Qaida and the entrenched interests of counterterrrorism agencies like the CIA's Counterterrorism Center. Web Link | Return to Headlines Police: Fla. College Student Plotted an Attack Associated Press (03/19/13) Hightower, Kyle; Schneider, Mike Authorities in Florida believe that a student at the University of Central Florida who committed suicide and had explosive devices in his dorm room was planning an attack on the campus early Monday morning. Police were alerted to a potential problem after the student who is believed to have been planning the attack, James O. Seevakumaran, pulled a gun on one of his roommates at UCF's Tower 1 dorm. The roommate then hid in the bathroom and called police. Meanwhile, Seevakumaran pulled a fire alarm in the building shortly after midnight on Monday, sending the roughly 500 students who live in the building outside. Several minutes after the fire alarm went off, campus police responded to the scene and urged students to get out of the building as quickly as possible. Seevakumaran was found dead in his dorm room after having shot himself in the head. After searching the room, detectives found notes and other writings that suggested that Seevakumaran pulled the fire alarm at the Tower 1 dorm because he wanted to get students out in the open so that he could carry out his attack. Police also found four improvised explosive devices, a .45-caliber handgun, a .22-caliber tactical rifle, and several hundred rounds of ammunition in Seevakumaran's room. It remains unclear what Seevakumaran's motive may have been in planning the attack. Web Link | Return to Headlines Canada Confirms Canadian Aided Algeria Attack Wall Street Journal (03/18/13) MacDonald, Alistair The Royal Canadian Mounted Police (RCMP) confirmed Monday that one of the hostage takers behind the January attack on the Amenas natural-gas plant in Algeria was Canadian. A spokesman for the RCMP declined to offer any further information about the citizen whose remains were just recently identified. The Canadian militant was part of a group of extremists that included members from Algeria, Egypt, Tunisia, Mauritania, Libya, Niger, and Mali, according to Algerian officials. This identification goes along with accounts from plant workers that a bearded, blond militant who spoke unaccented English assisted the group's leader, Mohamed Lamine Bencheneb. While there has yet to be a fatal Islamic-linked terrorist attack on Canadian soil, Canadian residents and citizens have in the past taken part in terrorist acts abroad. The Canadian Security Intelligence Service (CSIS) is currently investigating about 50 Canadians it says have traveled or attempted to travel to countries including Somalia, Pakistan, Syria, and Yemen to take part in terrorism. Canadian officials are concerned about these individuals returning to Canada after obtaining combat experience and developing radical ideologies while overseas. Web Link | Return to Headlines Hackers Use Legit Remote IT Support Tool in Spy Attack ZDNet (03/21/13) Tung, Liam A Hungarian security firm recently discovered that hackers have been using a legitimate remote access tool to target activists, industrial, research, and diplomatic targets in a variety of different countries. The firm, CrySys Lab, uncovered an attack on diplomatic targets in Hungary that installed legitimate software from a German firm that includes remote control, file transfer, and other administrative tools for various operating systems, and then later altered that software to allow hackers to spy on victims. The anti-virus company Kaspersky Lab recently provided its own report of the so-called "TeamSpy crew" hacking group that is believed to be behind the attack, saying the group has been active since 2008 and has went after targets ranging from activists to national information agencies. "This application is signed with legitimate digital certificates and is used by more than 100 million users around the world," Kaspersky explained. "To avoid alerting the user that somebody is spying on him, the attackers dynamically patch [the program] in memory to remove all signs of its presence." The malware looks for multiple document formats, disk images, and file names that hint those files might contain sensitive data like passwords and encryption keys. Kaspersky conducted an analysis of TeamSpy's command and control servers and found the hackers were likely Russian-speaking. Web Link | Return to Headlines Computer Networks Crash at South Korean Banks, Media Companies; North Korea Attack Suspected Associated Press (NY) (03/20/13) In what some believe is a cyber attack by North Korea, computer networks at major South Korean banks and top T.V. broadcasters crashed March 20 at around 2 p.m. local time. South Korean media reported skulls popped up on some computer screens, which they said was a strong indication that hackers had planted surreptitious and malicious code into the South Korean systems. No immediate reports of stolen customer information surfaced, leading experts to believe the attack was meant to be more of an inconvenience than a serious threat. There were also no reports that the attacks had damaged more critical areas of the country's infrastructure such as power plants or transportation systems. Some of the affected systems came back online within two and a half hours of the incident. North Korea has become increasingly irate since the imposition of U.N. punishment and new U.S. sanctions following the country's nuclear test last month. The country has promised revenge for those sanctions and for U.S.-South Korea joint military drills that it considers training for the invasion of its territory. Web Link | Return to Headlines South Korea Cyberattacks Hold Lessons for U.S. Computerworld (03/20/13) Vijayan, Jaikumar Even as security researchers continue to uncover the details of the cyberattacks that hit South Korean banks and media outlets between March 19 and March 20, some say the attacks carry a simple lesson for U.S. organizations. Although researchers still do not agree on who was responsible for the cyberattacks that hit at least four banks and three broadcast networks, they concur the attacks were not cutting-edge technology. Sophos says the malware used in the attack, DarkSeoul, was neither new nor very sophisticated. Although the Wiper-style malware was very destructive, destroying the master boot records of infected computers and wiping data, it exploited known vulnerabilities that theoretically should have been defended against. The SANS Institute's John Pescatore says the attacks should remind organizations to "make sure you are at least at the due-diligence level for the well-known critical security controls." Web Link | Return to Headlines Cybersecurity Experts Warn Many Cos May Have Had IP Stolen Wall Street Journal (03/19/13) Ensign, Rachel L. Experts who testified at a U.S. Senate Armed Services subcommittee hearing on March 19 warned that thousands of U.S. and Western European firms had their intellectual property stolen by hackers believed to be linked to the Chinese military. Mandiant CEO Kevin Mandia and CSO Richard Bejtlich, spoke about how the corporate espionage they had witnessed while researching a report on alleged Chinese hacking could impact U.S. business. The men said the goal of the hackers was not to shut down a business but rather to steal documents related to product development and business plans. Mandia said this information theft could be linked to the surge in Chinese knock-off stores replicating products made by Western chains. Bejtlich, meanwhile, said the cost of defending against such cyber espionage attacks can be too high for smaller companies. "Unless you are a top company who can hire top talent and scale it out … you cannot afford defenses that will stop a Chinese military unit or a Russian unit or anyone else," he said. Web Link | Return to Headlines HTTPS Security Encryption Flaws Found InformationWeek (03/19/13) Schwartz, Mathew J. Security researchers have uncovered weaknesses that could be exploited in certain types of encrypted Web communications. The weaknesses can be found in the RC4 encryption algorithm that is frequently used to secure SSL/TLS communications within secure Web pages. The flaw was recently disclosed by University of Illinois at Chicago professor Dan Bernstein at the Fast Software Encryption conference. His presentation was based on his research conducted with researchers at the University of London and the Eindhoven University of Technology. The researchers found that RC4 is not sufficiently random, so an attacker could recover some plaintext from a communication secured using TLS and RC4. Such attacks could occur "from statistical flaws in the keystream generated by the RC4 algorithm, which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions," the researchers said. They also noted that about "50 percent of all TLS traffic is currently protected using the RC4 algorithm. It has become increasingly popular because of recent attacks on CBC-mode encryption on TLS, and is now recommended by many commentators." Web Link | Return to Headlines Abstracts Copyright © 2013 Information, Inc. Bethesda, MD   ASIS also offers a daily and a non-sponsored, special-content Professional Edition of Security Newsbriefs. Please click to see a sample or to contact us for more information. Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online