Search This Blog

Friday, June 07, 2013

Security Management Weekly - June 7, 2013

header

  Learn more! ->   sm professional  

June 7, 2013
 
 
Corporate Security
Sponsored By:
  1. "Selfridges Robbery: 'Men in Burkas' in 'Smash and Grab'" London
  2. "China Seen in Push to Gain Technology Insights"
  3. "Sales of Older iPhones, iPads Banned as Agency Says Apple Infringed Samsung Patent"
  4. "Bank Manager Arrested on Suspicion of Theft" Washington State
  5. "ASIS Branches Out" Partnership with Building Industry Consulting Service International and International Association for Healthcare Security & Safety

Homeland Security
  1. "Documents: U.S. Mining Data From 9 Leading Internet Firms; Companies Deny Knowledge"
  2. "NSA Surveillance Pits Liberty Against Security"
  3. "Report: Verizon Providing All Call Records to U.S. Under Court Order"
  4. "Argentina Formally Accuses Iran of Terrorism"
  5. "Bulger Drama Heads to Court"

Cyber Security
  1. "U.K. Raises Cybersecurity Concerns Over Huawei"
  2. "Official Describes Rampant Computer Hacking at VA" Department of Veterans Affairs
  3. "Hackers With Different Agendas Target Turkish Government"
  4. "Oracle Promises Enterprise Java Security Tweaks"
  5. "Support Grows to Let Cybertheft Victims 'Hack Back'"

   

 
 
 

 


Selfridges Robbery: 'Men in Burkas' in 'Smash and Grab'
BBC News (06/07/13)

London police say six men armed with axes and reportedly dressed in burkas smashed glass cabinets to steal expensive watches from Selfridges department store about 30 minutes before the store was scheduled to close on June 4. The police said that the robbers fled on mopeds and motorbikes driven by associates, adding that two were later arrested when they fell off a moped and members of the public stepped in to prevent them from fleeing. A witness to the public's intervention said that several individuals stepped in when a bag that fell off the moped opened and spilled out watches. Detective Chief Inspector Andy Noyes thanked "those members of the public who stepped in and detained our two suspects," noting that their efforts have helped the police investigation. One of the two men arrested is in the hospital with a broken leg and the other remains in police custody. No one was hurt during the robbery. The value of the stolen watches has not been calculated.


China Seen in Push to Gain Technology Insights
New York Times (06/06/13) Wong, Edward; Tatlow, Didi Kirsten

The authors of a new book say that the Chinese government is conducting a broad campaign of industrial espionage against companies in the U.S. and other developed countries, and that these efforts go well beyond the cyberespionage efforts by the Chinese that have garnered so much attention as of late. According to the authors of the book, "Chinese Industrial Espionage," the transfer of technologies from foreign companies is an official policy at all levels of the Chinese Communist Party as well as the country's government. The book says that the Chinese are carrying out industrial espionage by recruiting Chinese scientists who work in the U.S. and other developed nations to acquire technologies from their employers and return to China, or to remain in their jobs and pass along information to Chinese contacts. In addition, the authors say that Beijing is attempting to obtain technologies from foreign companies by establishing science parks for the Chinese scientists it convinces to return to China from overseas and by convincing foreign companies to open research centers in China. The stolen technology is then used to make products and equipment in China. The authors conclude that these efforts threaten the competitiveness of American companies, though some foreign economists say that Beijing has not been able to fully take advantage of the technical knowledge that has been passed along by Chinese scientists working overseas.


Sales of Older iPhones, iPads Banned as Agency Says Apple Infringed Samsung Patent
Washington Post (06/05/13) Kang, Cecilia

The U.S. International Trade Commission (ITC) issued an order on June 4 that would block sales of several older iPhone and iPad models, including the iPhone 4, the iPhone 3GS and the iPad 2 3G, for infringing a Samsung patent. The ITC said that it made the ruling because Apple did not "prove an affirmative defense" against Samsung's claims that it infringed on its patents. If the ruling is upheld, it would show that at least some of Apples' iconic technology was duplicated by its primary competitor. Apple has said that it will appeal the ruling. The ruling will take effect in 60 days, unless a veto is issued by President Obama. However, it is rare for a president to veto an ITC ruling. The last president who issued a veto of an ITC ruling was Ronald Reagan.


Bank Manager Arrested on Suspicion of Theft
Columbian (Washington) (06/04/13) Hastings, Patty

According to Gresham (Ore.) Police Department Detective Brandon Crate, a former bank branch manager at Washington Federal in Vancouver, Wash., was arrested on May 24 after allegedly emptying a dead customer's bank account of $35,000 in October 2012. Pa Houa Vue faces felony charges of aggravated theft, aggravated identity theft, and identity theft, and is being held without bail. According to police, the day before her six-month review at Washington Federal's Gresham branch, Vue told bank employees that she forgot to close a client's account in Vancouver. She allegedly faked a telephone conversation with the client and had the employees cash out the account and write a $35,079.44 check to Hai Lo, which is similar to the name of Vue's husband. Vue then allegedly deposited the check at Clackamas County Bank in Gresham, and is believed to have withdrawn $5,000 in cash and a $13,000 cashier's check at the bank's branch in Boring, Ore., the following day. A co-worker in Vancouver, when tracking down the next of kin for the deceased account holder, found that the account was closed, notified the police, and had a stop payment put on the cashier's check. Crate also discovered the August 2012 disappearance of $12,000 cash from the Vancouver branch's vault, and the November 2011 disappearance of $2,000 from Bank of the West in Southeast Portland. Vue was the manager of that Bank of the West branch at the time the money disappeared.


ASIS Branches Out
Security Director News (05/31/13) Canfield, Amy

ASIS International has partnered with Building Industry Consulting Service International (BICSI) and the International Association for Healthcare Security & Safety (IAHSS), as part of an effort that ASIS President Geoffrey Craighead said will provide "greater vertical depth" throughout the industry while simultaneously allowing ASIS to expand its educational offerings. The partnership between ASIS and BICSI is detailed in a memorandum of understanding in which the two organizations agreed to work together to foster the growth of the security and information technology systems industries, promote public safety, and safeguard critical infrastructure around the world. Meanwhile, ASIS International's Healthcare Council will work with IAHSS to develop healthcare security educational sessions that will be presented at an ASIS event in Chicago this September. In addition, IAHSS will provide training and exams for its CHPA certification before the event. Craighead says the two partnerships will help physical security professionals and IT professionals become more familiar with one another, which he said is important given that the roles and responsibilities of physical security professionals are changing and increasingly converging with those of IT professionals.




Documents: U.S. Mining Data From 9 Leading Internet Firms; Companies Deny Knowledge
Washington Post (06/07/13) Gellman, Barton; Poitras, Laura

A career intelligence officer has provided the Washington Post with PowerPoint slides and other documents about a surveillance program code named PRISM, whose existence has not been made public until now. The program, which may be the first of its kind, reportedly involves the National Security Agency (NSA) and the FBI accessing the central servers of nine major U.S.-based Internet companies: Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, and Apple. NSA and the FBI use their access to these servers to examine foreign communications traffic, particularly audio and video chats and e-mails. The two agencies also reportedly extract photographs, documents, and connection logs from the servers. All of this is done to allow analysts at NSA and the FBI to track foreign targets. Documents obtained by the Post indicate that NSA does not use PRISM to collect any and all data from a company's servers, but rather uses search terms to focus on data that is believed to be related only to a foreign target. Meanwhile, a number of companies that reportedly participate in PRISM--including Facebook, Apple, Google, and Yahoo--all denied having knowledge of the program or giving the federal government direct access to their servers. Director of National Intelligence James R. Clapper also responded to the Post's report, saying that PRISM is completely legal and that the information collected under the program has helped protect the nation from a number of different threats.


NSA Surveillance Pits Liberty Against Security
USA Today (06/07/13) Jackson, David; Johnson, Kevin; Davis, Susan

In the wake of several recent reports on the National Security Agency's (NSA) surveillance programs, intense debate has begun on the constitutionality of the agency's efforts to collect data on U.S. citizen's Internet activity and phone calls. Both the Obama administration and former Bush administration officials have defended the surveillance program, which includes the tracking of tens of millions of American phone calls back to 2006. Data collected on those calls includes phone numbers involved, the length of the call, and other identifying information, though not the call content. For six years, it appears the NSA and the FBI have also been tracking user activity information from Internet companies including Google, Microsoft, Facebook, and Yahoo. Some in Congress have supported the administration's viewpoint, while others have condemned the surveillance. A number of civil liberty groups and privacy advocates say the NSA has gone too far by maintaining such secret programs in the 12 years after the 9/11 attacks. Both sides are likely to have their say in congressional hearings, even if they are held behind closed doors. The Senate Intelligence Committee has already convened a classified briefing on NSA phone surveillance and data mining.


Report: Verizon Providing All Call Records to U.S. Under Court Order
Washington Post (06/06/13) Nakashima, Ellen

A British newspaper has published a copy of an order from the Foreign Intelligence Surveillance Court that requires Verizon to provide the National Security Agency (NSA) with data on tens of millions of its customers in the U.S. The so-called "business records" order, which two former U.S. officials said appears to be authentic, was issued in April and requires Verizon to provide NSA with information such as the phone numbers its customers dialed and the numbers of incoming calls. Verizon was also required to provide NSA with information about the length of its customers' calls, their names and addresses, or financial information. Information about the content of calls was not provided under the order, which was apparently sought by the FBI and seems to be a routine renewal of a similar order that was issued by the court in 2006. Such orders do not require probable cause that the targets of the surveillance are foreign agents, and simply requires the government agency asking for the order to show that it has "reasonable grounds to believe" that the information sought is "relevant to an authorized investigation... to obtain foreign intelligence information... or to protect against international terrorism or clandestine intelligence activities." Orders like the one that was recently published have been criticized by civil libertarians because they allow the government to obtain information about law-abiding citizens, though government officials say that the information they obtain under the orders is needed to uncover and foil terrorist plots.


Argentina Formally Accuses Iran of Terrorism
Jewish Voice (06/05/2013) Benari, Elad

Argentine prosecutor Alberto Nisman filed an indictment in a federal court in Argentina on May 30 that accused Iran of taking steps to carry out terrorist attacks in several South American countries. According to the indictment, Tehran has been using diplomatic agencies and cultural and charitable associations in Brazil, Chile, Colombia, Guyana, Paraguay, Suriname, and Trinidad and Tobago to hide its terrorist activities on the continent. Nisman also noted in the indictment that these facilities have essentially become intelligence stations that Iran is using to provide logistical, financial, and operative support for possible terrorist attacks in those countries. Such attacks could be similar to the 1994 bombing of the Argentine Jewish Charities Foundation (AMIA) building in Buenos Aires, which has been blamed on Iran, Nisman said. Tehran has denied that the eight current and former Iranian officials who have been charged in the bombing were involved in the attack. In addition to describing a potential new threat of Iranian terrorism in South America, Nisman also called on Interpol to issue an international arrest warrant to round up the eight Iranian officials who were allegedly involved in the AMIA bombing. Among those who are believed to have been involved in the attack is former Iranian President Ali Rafsanjani.


Bulger Drama Heads to Court
Wall Street Journal (06/04/13) Levitz, Jennifer

The trial of James "Whitey" Bulger is expected to once again draw attention to the FBI's purported relationship with Bulger as well as allegations of corruption at the bureau's office in Boston. Prosecutors say that Bulger, who was arrested in California in 2011 after spending 16 years on the run, was an FBI informant who was helping the bureau in its investigations of suspected members of the Italian mafia. However, Bulger's attorneys maintain that their client was never an FBI informant and that John Connolly, who prosecutors say was Bulger's handler at the bureau, wrote reports that included information from other informants but was falsely attributed to Bulger. Connolly was convicted for warning Bulger in 1994 that he was about to be indicted on murder and other charges, prompting Bulger to go on the run. Connolly has said that he did not provide Bulger with such a warning, and has also said that there was more pervasive corruption among law-enforcement officials and prosecutors. Among the officials that Bulger is known to have corrupted is Connolly's former supervisor, John Morris, who admitted to taking $7,000 in bribes from Bulger and an associate. Bulger's corruption of the FBI in Boston allowed him to have "pretty pervasive influence for a long time," said Michael Kendall, a former assistant U.S. attorney in Massachusetts who investigated several of Bulger's suspected associates.




U.K. Raises Cybersecurity Concerns Over Huawei
Wall Street Journal (06/07/13) Thomson, Ainsley

A report released by the British Parliament's Intelligence and Security Committee on Thursday says that the U.K. is vulnerable to cyberspying carried out by China-based Huawei Technologies, which has become a major power in its telecom industry. The report says the government has failed to carry out adequate security checks on Huawei, calling the current monitoring for cyberattacks on Huawei networks or software "feeble at best." For example, the 2010 cybersecurity monitoring program put in place for the company is funded by Huawei itself. China's cyberspying apparatus has come under severe criticism from U.S., European Union, and U.K. officials in recent years, and the committee is concerned that Huawei, with its ties to the Chinese government, may be a covert part of that apparatus. "In this context, the alleged links between Huawei and the Chinese State are concerning, as they generate suspicion as to whether Huawei's intentions are strictly commercial or are more political," the report explained. Both the United States and Australia have prevented the company from selling its products due to national security concerns. Whether the U.K. will take similar actions remains to be seen, but the report does call for all Huawei employees at the testing system designed to monitor security threats posed by the company to be replaced by government security staff.


Official Describes Rampant Computer Hacking at VA
Associated Press (06/05/13) Freking, Kevin

Former Veterans Affairs (VA) Department computer security chief Jerry Davis testified at a House subcommittee hearing on June 4 that at least eight foreign-sponsored organizations have hacked into computer networks at the department since the VA became aware of the hacking in March 2010, adding that the attacks continue "to this very day." Though Davis commented that the hacking "successfully compromised VA networks and data," he did not say how the information may have been used. He did note that the attackers were based in China and possibly Russia as well. Officials with the VA's inspector general's office noted that the main threat from the breach would appear to be credit card theft, since the attackers were able to access an unencrypted database containing personally identifiable information on about 20 million veterans. However, they could not cite any specific instances where such fraud had occurred. Assistant Inspector General Linda Halliday also testified at the hearing and mentioned that while investigators had started seeing fewer weaknesses in the department's computer security, there were still 4,000 weakness and vulnerabilities that need to be addressed. Investigators also said hackers had obtained access to the e-mails of senior VA managers, but did not know what had been done with the messages. Stephen Warren, the acting assistant secretary for information and technology at the VA, also testified and told lawmakers that he only knew of one instance where the department's computer systems had been compromised. He added that he would prefer to discuss which country was involved in that hacking during a closed session.


Hackers With Different Agendas Target Turkish Government
Wall Street Journal (06/05/13) Malas, Nour

Two hacking groups attacked Turkish government servers on June 5, one in support of the ongoing protests there and the other in retaliation for the government's support of Syrian rebels. The hacktivist group Anonymous reportedly broke into the Turkish prime ministry's network and published dozens of e-mail addresses and passwords. The group said that it carried out this attack to support the ongoing protests in Turkey, which it says are part of "one of the most noble uprisings in recent history." The pro-Syrian government Syrian Electronic Army (SEA), meanwhile, also broke into the same network and released lists of contact information, which it said was punishment for "supporting and arming the terrorists." Whether the SEA also acted in support of Turkish protesters is unclear, although the Syrian government has said the crackdown by the Turkish government has been "oppressive." Cybersecurity analysts say the SEA is a loosely organized group with some links to the Syrian government, with many members also hailing from the Syrian Computer Society, which was led by embattled Syrian President Bashar al-Assad before he took office in 2000.


Oracle Promises Enterprise Java Security Tweaks
InformationWeek (06/03/13) Schwartz, Mathew J.

Oracle has announced several new security fixes for the Java software. Oracle's Nandini Ramani notes Java developers are using better secure development practices, including the use of more automated security-testing tools, better source code-analysis tools, and homegrown analysis-tools meant to ferret out vulnerabilities related to code-fuzzing techniques. Ramani highlights three up-coming security changes. First, the distribution of better client management controls for enterprise, allowing administrators additional control over security policy settings during installation and deployment. Second, Java servers will become more locked-down, building on the April release of a new Server Java Runtime Environment, which was designed to reduce attack surface area and customer confusion. Finally, Ramani says Oracle is continuing to build up the security of Java application (JAR) files signed with digital certificates by introducing a new dynamic blacklisting mechanism for both JAR files and certificates.


Support Grows to Let Cybertheft Victims 'Hack Back'
Wall Street Journal (06/03/13) Matthews, Christopher M.

Private companies have been targeted by a growing number of cyberattacks in recent months, but current laws prevent them from openly retaliating. However, a commission led by a former U.S. ambassador to China and a former director of national intelligence have called for legal changes that would let companies "hack back" to retrieve stolen information. The American Bar Association (ABA) is also expected to release a report on "active defense" options for the private sector as well as potential legal changes that would expand these options. Legal experts say that these options may include tracking data to the server where stolen data is being stored and stealing it back, which some say could be legal as long the server is not damaged. One potential tactic the ABA's Cybersecurity Legal Task Force report is expected to focus on is "beaconing." This practice uses code in sensitive data to ensure the company can track it if it is stolen. Legal experts say such actions might be attractive but are a short step away from taking more damaging action, including inserting code that would cause the data to self destruct or code that would take over the servers for the stolen data. For this reason, the Justice Department currently discourages all active defense practices. In addition, active defense tactics are largely forbidden under the Computer Fraud and Abuse Act of 1984. Whether the law changes as cyberattacks become more common remains to be seen.


Abstracts Copyright © 2013 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

1 comment:

Anonymous said...

Tοdaу this brаnd iѕ noω
κnown to be ρerfect right down to their footwear.
The faѕhion іcon is often ѕeen wearing
some οf todays hottest Asian faѕhion.
Smith's responsibilities will involve interviewing designers -- including Hilfiger -- trying on clothes, you can make your diet spicy and nourishing. Marketing apparel from Asia internationally the wholesale shops offer to countries like: Thailand, Singapore, and Malaysia also have the option to take their pictures.

Also visit my site ... Thoi trang nam