Friday, May 07, 2010

Security Management Weekly - May 7, 2010

header

  Learn more! ->   sm professional  

May 7, 2010
 
 
Corporate Security

Sponsored By:
  1. "Russian Navy Frees Somali Pirates"
  2. "1 Suspect, 4 Targets, 11 Robberies" The Bronx
  3. "Police Use Taser on Fan on Field at Phillies Game"
  4. "Knife-Wielding Woman Stabs 4 in West Hollywood Target Store" California
  5. "Chat With NBC's Rick Cotton on Fighting Online Piracy"
Homeland Security

  1. "Times Sq. Bomb Suspect Is Linked to Militant Cleric"
  2. "Times Square Suspect's Movements Raise Questions About Holes in Antiterror System"
  3. "Few Legal Tools to Track Citizens"
  4. "Dent Pushes Anti-Terrorism Citizenship Bill"
  5. "Budget Cuts Prompted LAPD to Eliminate a Counter-Terrorism Task Force"
Cyber Security

  1. "Cloud Security: Feds on the Cusp of Change"
  2. "Cybersecurity Experts Share Their 'Nightmares'"
  3. "Facebook Fixes Bug That Exposed Private Chats"
  4. "US Treasury Web Sites Hacked, Serving Malware"
  5. "Foxit Reader Update Blocks PDF Attack"

   

 
 
 

 


Russian Navy Frees Somali Pirates
BBC News (05/07/10)

Russia has reportedly freed the 10 Somali pirates captured during a raid of the Russian oil tanker they had hijacked. Initially after the raid, Russian officials said that the pirates would be taken to Moscow to face criminal charges. Officials have now reversed that decision, citing "imperfections" in international law. The U.N. Convention on the Law of the Sea permits Russia to seize and prosecute pirates. A number of nations, including France, the United States, and the Netherlands, have already charged pirates under this convention. However, some countries have been reluctant to take custody of pirates because of concerns that they will stay on their soil after their jail terms are finished.


1 Suspect, 4 Targets, 11 Robberies
Wall Street Journal (05/06/10) Herring, Chris

Police in New York City are looking for a man who they believe has been behind 11 robberies in the Parkchester section of the Bronx since February. Nine of those robberies have taken place at four businesses in the neighborhood. Among the businesses that have been robbed multiple times is the Deshi Bazar Food Market, which has been held up twice for a total of $3,200. In addition, the Drug Mart pharmacy has been robbed three times for more than $700 since early March. The pharmacy's owner, Ali Tehse, said New York City police have not been much help when responding to the robberies, telling him simply to get a gun. Tehse recently hired a security to protect his store. He also noted that the lack of police presence has made the robber more brazen, robbing stores without a mask and during daylight hours when people are shopping.


Police Use Taser on Fan on Field at Phillies Game
Philadelphia Inquirer (05/04/10) Gregory, Kia; Gelb, Matt

A 17-year-old boy was Tasered by a Philadelphia police officer after he ran onto the field during a baseball game at Citizens Bank Park on May 3. During the incident, which took place during the eighth inning of a game between the Philadelphia Phillies and the St. Louis Cardinals, the boy jumped onto the field and ran around in circles several times before the officer fired his Taser at him. The officer missed several times, though he eventually struck the boy, causing him to fall to the ground. The officer and security personnel at the stadium then helped the boy off the field. The incident appears to be the first time that a Taser has ever been used to subdue someone who jumped onto the field during a Major League Baseball game. Such individuals are normally wrestled to the ground. The Philadelphia Police Department is investigating the incident and is promising to work with the Phillies to determine whether the officer's use of his Taser was an appropriate use of force under the circumstances. The boy, whose name has not been released because he is a juvenile, will be charged with criminal trespass.


Knife-Wielding Woman Stabs 4 in West Hollywood Target Store
Los Angeles Times (05/04/10) Blankstein, Andrew; Faturechi, Robert

Four people were wounded in what appears to have been a random knife attack in a Target store in West Hollywood, Calif., on Monday. The incident began around midday, when 34-year-old Layla Rosetta Trawick entered the store and picked up two knives that were on sale. Witnesses say that Trawick then began yelling "I'm bipolar. There's no witness protection program," and started stabbing shoppers. The attack, which set of a stampede in the store, was stopped when Trawick was confronted by an off-duty Los Angeles County Sheriff's deputy who pulled out his gun and ordered her to drop the knives. Trawick was then restrained and handcuffed by the sheriff's deputy and Target security officials. It remains unclear what the motive was for the attack, which was captured by the store's security cameras. Trawick is currently being held on $1 million bond.


Chat With NBC's Rick Cotton on Fighting Online Piracy
Washington Post (04/30/10) Kang, Cecilia

Rick Cotton, the chairman of the U.S. Chamber of Commerce’s coalition against counterfeiting and piracy and the general counsel of NBC Universal, has reported progress in the fight against digital piracy. According to Cotton, the Internet has been a playground for those who illegally purchase and copy music, movies, and software without paying the content's creators, but recent measures may alter this. For instance, President Obama has appointed a czar for intellectual property protection, and the U.S. Trade Representative has been negotiating with other nations to make a trade agreement against counterfeiting, Cotton said. Cotton, however, considers new technologies the possible solutions to piracy and counterfeiting. Internet service providers (ISPs) would require further technological development in areas such as addressing subscribers that frequently ignore notices that they have illegally uploaded or downloaded copyrighted content. Technology should be effective against piracy while fully respecting privacy rights and free access concerns.




Times Sq. Bomb Suspect Is Linked to Militant Cleric
New York Times (05/06/10) Shane, Scott; Mazzetti, Mark

Faisal Shahzad, the suspect in the attempted car bombing in Times Square on May 1, has told investigators that he drew inspiration for the attack from radical Muslim cleric Anwar al-Awlaki. Awlaki, who is currently in hiding in Yemen, has posted fiery sermons online and published a tract on the Internet entitled "44 Ways of Supporting Jihad" last year. In addition, counterterrorism experts believe Awlaki has ties to several recent terrorist attacks, including the November 2009 shootings at Fort Hood, Texas. Awlaki is believed to have exchanged roughly 18 e-mails with Army Maj. Nidal Malik Hasan, the suspect in the shooting. The cleric also posted a statement on his Web site after the shooting in which he called Hasan a hero. Awlaki is also believed to have met the suspect in the attempted bombing on board Northwest Airlines Flight 253, Umar Farouk Abdulmutallab, while he was being trained by al-Qaida in the Arabian Peninsula. But unlike Hasan and Abdulmutallab, it remains unclear whether Shahzad met or had any direct communications with Awlaki.


Times Square Suspect's Movements Raise Questions About Holes in Antiterror System
Washington Post (05/05/10) P. A01; DeYoung, Karen; Kornblut, Anne E.

The recent apprehension of attempted Times Square bombing suspect Faisal Shahzad shows that counterterrorism coordination has improved in recent months, but that there are still improvements to be made. Shahzad was allegedly able to train with terrorists in Pakistan, return to the United States, assemble a car bomb at his home in Connecticut, and park it in Times Square. He was then able to elude FBI surveillance and board a plane bound for Dubai. Federal agents only apprehended him after the plane's doors had closed. Obama administration officials point out two instances where the system could have been more effective: before and after the bombing attempt. Before the attempt, it is unlikely that Shahzad's trips to Pakistan would have raised red flags because he has parents and other family members there, even with the tighter screening regulations proposed following the attempted bombing of a Detroit-bound plane on Christmas Day. Shahzad was naturalized to the United States in April 2009. He lived with his family in Connecticut until 2009 and was an employed homeowner. He never broke any laws and did nothing to call attention to himself. He was only identified when calls made from a disposable telephone were traced to Pakistan- then to him- following the bombing. Federal officials were also able to gain more details from an unrelated airport screening conducted when he returned from Pakistan in February. At the time, that screening was mandatory for all passengers returning from certain countries. However, that requirement was lifted after targeted countries, including Pakistan, complained. Following his identification by federal officials, Shahzad's passport number was added to the National Counterterrorism Center Web board and no-fly list. Shahzad was not on the manifest at the time that the alert was issued because he did not purchase his ticket until several hours later. The Emirates airline says that it informed the government when a last-minute, one-way ticket was purchased and paid for in cash. Officials say they have no record of such a notification. After Shahzad slipped surveillance and arrived on the plane, Emirates sent a "last look" passenger manifest to Customs and Border Protection, which identified Shahzad as a possible match, allowing federal agents to apprehend him just prior to takeoff.


Few Legal Tools to Track Citizens
Wall Street Journal (05/07/10) P. A6

Lawmakers and federal officials are working to develop ways of legally monitoring U.S. citizens who may be potential terrorists but have not yet done anything to arouse the suspicion of law enforcement. Among the officials working on the issue is Homeland Security Secretary Janet Napolitano, who has been trying to improve the use of intelligence in screening airline passengers, including those who are Americans. Rep. Jane Harman (D-Calif.), the chairwoman of the Homeland Security subcommittee on intelligence, meanwhile, is also working to address the issue. The issue of how to monitor U.S. citizens who may pose a potential security threat has taken on greater importance in the wake of the arrest of Faisal Shahzad, the suspect in the attempted Times Square bombing who was an American citizen with no criminal record. Federal agencies are currently limited in how they can track U.S. citizens. The FBI, for example, is required to prove that it has probable cause to monitor U.S. citizens. The Homeland Security Department's Custom and Border Protection agency, however, has more authority to collect information about people whose names are not on terrorist watch lists. For example, the agency is allowed to question individuals entering the U.S. to determine if they are a possible terrorist threat. Officials say that this helped officials obtain a phone number that linked Shahzad to the attempted Times Square bombing.


Dent Pushes Anti-Terrorism Citizenship Bill
Morning Call (05/07/10) Itkowitz, Colby

Congress is considering a bill that would strip Americans of their citizenship if they are found to have supported terrorists or engaged in terrorist activities. Under the legislation, which is being sponsored by Sen. Joe Lieberman (I-Conn.) and Rep. Charlie Dent (R-Pa.), the State Department would be given the authority to determine whether an American citizen has done something that clearly indicates that he intends to renounce his citizenship, such as providing support to a terrorist group or participating in a terrorist attack against the U.S. or one of its allies. The bill requires the State Department to prove that a U.S. citizen has committed one of these acts, and also gives the suspect a right to appeal any decision to have his citizenship stripped. According to Lieberman, the bill would prevent U.S. citizens from traveling overseas to train with terrorist groups and re-enter the country with an American passport in order to launch a terrorist attack. But critics of the measure have rejected that argument, saying that if the government has enough evidence to prove that an individual has supported terrorist groups or has participated in a terrorist attack, it would take steps to closely monitor the individual and place his name on no-fly lists. However, critics concede that the bill is likely constitutional, since there is already a law on the books that would strip Americans of their citizenship for fighting in a war against the U.S.


Budget Cuts Prompted LAPD to Eliminate a Counter-Terrorism Task Force
Los Angeles Times (05/06/10) Rubin, Joel

The Los Angeles Police Department announced Wednesday that it has eliminated the Protective Security Task Force, a counterterrorism unit made up of roughly 24 plainclothes officers. According to Michael Downing, the deputy chief of the LAPD and the head of the department's Counter Terrorism and Criminal Intelligence Bureau, the officers who made up the task force were responsible for providing high-level security at buildings or events that were believed to be potential targets for terrorists. In addition, the members of the task force also tested the vulnerabilities of potential terrorist targets and worked with private security forces to improve security at those buildings or locations. However, the task force only comprised a small portion of the LAPD's counterterrorism efforts, which meant that it made sense for Chief Charlie Beck to eliminate it in order to put more patrol officers on the streets, Downing said. Despite the elimination of the task force, the LAPD's counterterrorism efforts will not be impacted in any way, Beck said. In addition, Downing noted that the Counter Terrorism and Criminal Intelligence Bureau will continue to perform its primary function of gathering intelligence.




Cloud Security: Feds on the Cusp of Change
Government Computer News (05/05/10) Kash, Wyatt

The public-sector cloud computing experts who gathered at the recent technology conference on cloud computing in Washington, D.C., said the federal government is on the verge of making significant changes in how it manages IT security risks. One of those changes is a new government program called FedRAMP, said Peter Mell, a computer scientist at the National Institute of Standards and Technology and the vice chair of the federal government's Interagency Cloud Computing Advisory Council. Mell says FedRAMP will make the process that agencies go through to certify the security of their information systems more efficient, and will provide oversight to ensure that cloud computing service providers are really following through on their promises to provide plans for how they will perform continuous monitoring of cloud computing security. Mell noted that this will help eliminate some of the obstacles to adopting cloud computing strategies. EMC's Bob Wambach noted that security has to be built throughout cloud computing services, and that it has to be consistent throughout the infrastructure. He said that this consistency can be achieved by using standardized security building blocks instead of layers of security services. However, Cisco's Chris Hoff noted that there are limitations to this approach, since federal agencies have specialized security needs.


Cybersecurity Experts Share Their 'Nightmares'
Agence France Presse (05/05/10) Lefkow, Chris

Cybersecurity experts, government officials, and business leaders met at the Worldwide Security Summit in Dallas, Texas, to discuss their biggest cybersecurity fears. Among those who attended the summit, which wrapped up on Wednesday, was Patrick Pailloux, the director general of France's Network and Information Security Agency. Pailloux, who is in charge of France's cybersecurity efforts, told attendees at the summit that his biggest fear is that cybersecurity officials do not have enough time to prepare for cyber attacks. Also appearing at the summit was White House cybersecurity coordinator Howard Schmidt, who said his biggest fear was a "cyber insecurity" that prevented the government from communicating or directing a response to an emergency such as a national disaster or terrorist attack. Meanwhile, Rep. Michael McCaul (R-Texas), and Melissa Hathaway, the former acting senior director for cyberspace for the U.S. National and Homeland Security Councils, said they worried about a denial of service attack against the nation's electric power grid. McCaul also said he was concerned about the possibility of an attack against the cables that carry Internet traffic, particularly an exposed cable off the Egyptian coast. Although they all cited different security concerns, all of the attendees agreed that countries around the world need to work together to protect computer networks from attacks.


Facebook Fixes Bug That Exposed Private Chats
PC World (05/05/10) Bertolucci, Jeff

Facebook has announced that it has patched a bug that allowed users to see their friends' private chats and their pending friend requests. According to the social networking site, the flaw was activated whenever a user manipulated the "preview my profile" feature of the privacy settings for their account. After learning of the problem, Facebook temporarily disabled its chat feature and sent out a fix to correct the problem. The chat feature was turned back on by Wednesday morning. The social networking site did not say how many of its users were affected by the flaw. Wednesday's security breach is just the latest to take place at Facebook over the last several months. In March, the social networking site was affected by five different attacks, including attacks that involved four fraudulent applications and a variant of the Koobface virus. In addition, the security breach comes as lawmakers are calling on the Federal Trade Commission to create privacy guidelines for social networking sites such as Facebook.


US Treasury Web Sites Hacked, Serving Malware
IDG News Service (05/04/10) McMillan, Robert

Three Web sites run by the U.S. Department of the Treasury recently were compromised to assault visitors with pernicious software, according to AVG's Roger Thompson, who discovered the vulnerabilities on three Web domains affiliated with the main site of the U.S. Bureau of Engraving and Printing. The department's IT staff moved all three sites offline and displayed a "page not found" error while they took steps to remove the malware. AVG's Thompson said hackers had injected a small clip of virtually undetectable iframe HTML code that redirected visitors to a Ukrainian Web site that then barraged them with a series of Web-based attacks.


Foxit Reader Update Blocks PDF Attack
CSO Online (05/04/10) Keizer, Gregg

Foxit Software has released an updated version of its PDF viewer that includes safeguards that can protect users from attacks. The updated version of the application includes a feature called "Trust Manager," which allows users to deny unauthorized actions and data transmissions such as URL connection, attachment PDF actions, and JavaScript functions, including one that allows a PDF to execute other files. That in turn will prevent hackers from taking advantage in vulnerabilities in PDF files or in a PDF-viewer application. However, the feature does not disable JavaScript entirely, said Foxit Software President Eugene Xiong. The release of the update comes in the wake of a recent warning from security companies that cyberattackers were trying to trick users into opening rigged PDF documents in order to infect their computers. Since that warning was issued, attacks that took advantage of the flaw in the PDF format have stopped, according to researchers at IBM Security Systems' X-Force team. Nevertheless, statistics show that PDF-based attacks continue to be a major problem. Attacks that took advantage of vulnerabilities in the PDF format increased eight fold last year, and are continuing to increase this year, McAfee says.


Abstracts Copyright © 2010 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments:

Post a Comment