Search This Blog

Friday, December 17, 2010

Security Management Weekly - December 17, 2010

header

  Learn more! ->   sm professional  

December 17, 2010
 
 
Corporate Security
  1. "Companies Shun Violent Mexico"
  2. "Las Vegas Robber Loses Gamble"
  3. "CIO Gets Six Years for Embezzlement Scheme"
  4. "Google, Microsoft Helping White House to Combat Illegal Online Pharmacies"
  5. "Judge Dismisses Paul Allen's Patent Suit Against Apple, Google, Others"

Homeland Security
  1. "Metro to Conduct Random Bag Checks" Washington, D.C.
  2. "Christmas Terror Threat Eyed"
  3. "Arlington Man Charged With Terror Threat" Virginia
  4. "Gunman Opens Fire at School Board, Kills Self" Panama City, Fla.
  5. "Police Say Early Detonation of Bomb Averted Disaster in Sweden"

Cyber Security
  1. "Server Breach at Ohio State Exposes Data of 760,000"
  2. "Online Access With a Fingerprint"
  3. "Internet Hit by Wave of Fake PC 'Defrag' Tools"
  4. "Start-Up Uses 'Virtualization' to Defend Against Cyber Attacks"
  5. "Senator Proposes Cybersecurity Standards"

   

 
 
 

 


Companies Shun Violent Mexico
Wall Street Journal (12/17/10) Casey, Nicholas; Hagerty, James R.

The rising rate of drug-related violence in Mexico, as well as increases in crimes such as robberies, extortions, and kidnappings, have made a number of companies hesitant to invest in the country. Among the companies that have shied away from opening factories in Mexico is the Swedish appliance maker Electrolux, which announced Dec. 16 that it would open a new appliance factory in Memphis, Tenn., rather than Mexico because of security concerns. Whirlpool also said that security was a factor in its decision earlier this year to not build a factory in Mexico and instead build the facility in Cleveland, Tenn. The growing rate of crime in Mexico has also made some executives hesitant to take jobs in the country. However, some companies are continuing to do business in Mexico, albeit after making some adaptations. Ryder System, for example, tightened its travel restrictions and began requiring employees to perform shift changes during daylight hours in response to the hijacking of trucks carrying consumer electronics earlier this year. Snowmobile and all-terrain vehicle-maker Polaris Industries, meanwhile, has attached tracking devices to company cars and is hiring armed guards to protect its facility in Monterrey.


Las Vegas Robber Loses Gamble
Los Angeles Times (12/15/10) Powers, Ashley; Rojas, Rick

An armed motorcycle bandit stole approximately $1.5 million in chips from the Bellagio hotel in Las Vegas around 3:50 AM on Dec. 9. After drawing a gun, the suspect forced gamblers to step back from a craps table and took chips ranging from $100 to $25,000 in value. Casino guards did not pursue as he fled--with good reason, said David Schwartz, director of the Center for Gaming Research at the University of Nevada, Las Vegas. "Which is a worse headline?" asked Schwartz, a former casino security guard. "'$1.5 million stolen from the Bellagio in chips'? Or 'Three innocent bystanders dead in gun battle'?" And it is not likely that the robber will make off with much in the end. The chips will be difficult to exchange for any significant amount of cash because casinos often tag chips with larger denominations so they can be tracked. A chip from most hotels can't be exchanged at another; and police easily monitor the Internet for any sellers looking to pass off the chips online. For additional information about this story, please click here.


CIO Gets Six Years for Embezzlement Scheme
IDG News Service (12/14/10) McMillan, Robert

Dale Frantz, the former chief information officer of Auto Warehousing Company, has been sentenced to nearly six years in prison for embezzling more than $500,000 from his company between 2007 and 2009. The sentence was handed down after Frantz pleaded guilty to using a number of different strategies to steal the funds, including writing up fraudulent invoices for expense reports and changing legitimate reports to maximize his reimbursements. Frantz also admitted to using company funds to purchase computer equipment that he re-sold on the Internet, as well as working with a co-conspirator to set up a company called Asyncritus Technology that he used to generate invoices for services that did not exist so that he could take some of the profits. Frantz has been ordered to repay AWC the funds he embezzled.


Google, Microsoft Helping White House to Combat Illegal Online Pharmacies
Bloomberg (12/14/10) McQuillen, William

Visa, MasterCard, PayPal, Google, Microsoft, GoDaddy.com, eNom, and Neustar are among the companies that are working to set up a nonprofit organization that takes aim at unlawful online pharmacies as an aid to White House initiatives, says the U.S. Office of Management and Budget. The companies, many of which function as Internet choke points, are forming the organization in response to a call from the Obama administration for private efforts to police such businesses, says White House intellectual property enforcement coordinator Victoria Espinel. Part of the initiative involved the United States contacting credit card payment networks, advertisers, and firms that authorize the assignment of domain names that illegal pharmacies can use. "No one company can solve this problem, so this new cross-industry group is a welcome step forward that we are pleased to support," says Google's Hilary Ware. Counterfeit drug sales make up roughly $75 billion in global sales, and approximately 1 percent to 2 percent of drugs in North America are counterfeit. "The scope of counterfeiting today is such that much of what you and I take for granted as secure and healthy may not be," says the Department of Homeland Security's John Morton.


Judge Dismisses Paul Allen's Patent Suit Against Apple, Google, Others
Computerworld (12/13/10) Keizer, Gregg

District Court Judge Marsha Pechman has dismissed a patent infringement suit brought by Microsoft co-founder Paul Allen against Apple, Facebook, Google, YouTube, AOL, eBay, Netflix, Office Depot, OfficeMax, Staples, and Yahoo. The suit says that the companies violated four patents developed by Internal Research, a now-defunct lab funded by Allen. The two patents that made up most of the claims were "Browser for Use in Navigating a Body of Information, With Particular Application to Browsing Information Represented By Audiovisual Data," and "Alerting Users to Items of Current Interest." Allen's lawsuit says that all but Facebook violated the first patent, and all 11 companies infringed the on the second patent. AOL, Apple, Google and Yahoo were the only companies said to have allegedly violated all four patents. However, Pechman said that none of the alleged violations could be pursued further in their current form because Allen needed to identify the devices infringing on the noted patents. Pechman has given him until Dec. 28 to amend his complaint. For additional information about this story, please click here.




Metro to Conduct Random Bag Checks
Washington Post (12/17/10) P. A01 Tyson, Ann Scott; Kravitz, Derek

Washington, D.C.'s Metro transit system has announced that it will immediately begin conducting random inspections of bus and rail passengers' bags and packages as part of an effort to protect the system from a terrorist attack. The inspections will be performed on roughly every third person carrying a bag, and will be conducted by members of Metro's anti-terrorism police unit, its special operations unit, several teams of explosive-detecting dogs and handlers, and personnel from the Transportation Security Administration. The searches will be carried out before riders pay to enter the Metrorail system or board a bus and will involve the swabbing of bags with a special type of paper that will then be analyzed to determine whether explosives are present. Should a bag or package test positive, it will be checked by a bomb-sniffing dog. Bags or packages that test positive again will be opened. Riders will be allowed to refuse the inspections, though they will not be allowed to board their train or bus and could be questioned by authorities. Metro says the searches, which will only take one or two minutes and are not expected to bog down the transit system, are not being implemented in response to a particular threat.


Christmas Terror Threat Eyed
Associated Press (12/16/10)

A group of insurgents that was recently captured by Iraqi authorities have said that al-Qaida is planning to carry out suicide attacks in the U.S. and Europe during the Christmas season. Iraqi Interior Minister Jawad al-Bolani and Foreign Minister Hoshyar Zebari would not say which European country or countries are believed to be the targets of the attack. However, an Iraqi intelligence official said that there was information that indicated that Denmark might be one of the targets. Although al-Bolani refused to say which countries in Europe al-Qaida may be planning to attack, he did say that the insurgents revealed that last week's terrorist attack in Sweden was one of the attacks that al-Qaida was planning to carry out. The insurgents made that claim after the attack took place, al-Bolani said. A U.S. intelligence official said that the threat of suicide bombings in the U.S. and Europe is credible, though there is no way to determine whether the claims are true or not. The threats come as Western nations are already on high alert in the wake of last year's attempt to bomb a Detroit-bound flight on Christmas Day.


Arlington Man Charged With Terror Threat
Washington Post (12/15/10) Glod, Maria

Authorities have arrested a man who allegedly threatened to bomb several targets in the Washington, D.C., area. In correspondence with a Facebook user in November, 25-year-old Awais Younis of Arlington County, Va., allegedly talked about how to construct a pipe bomb as well as what type of shrapnel would cause the most damage. In addition, Younis also talked about placing bombs on the third and fifth cars of a Metro train, since these cars hold the largest number of passengers, as well as placing a bomb in Washington's Georgetown neighborhood during rush hour in order to maximize the number of casualties. An affidavit in the case shows that Younis said that he could place the bombs on Metro train cars without being noticed, to which the Facebook user he was corresponding with replied, "you wouldn't do that." Younis wrote back, saying "watch me," the affidavit said. Younis also allegedly warned the Facebook user to tell his father not to take Metro to work the following day. Arthur Hulnick, a professor at Boston University who has worked with the CIA, said that he doubted that Younis was serious about carrying out the bombings, since a real terrorist who wanted to bomb the Washington Metro system "wouldn't put an advertisement on Facebook." However, Hulnick noted that authorities could not have ignored the threats.


Gunman Opens Fire at School Board, Kills Self
Associated Press (12/14/10)

One person was killed in a shooting at a school board meeting in Panama City, Fla., on Tuesday. Witnesses say that the incident began when the shooter, who has been identified as Clay A. Duke, walked up to the podium at the meeting and spray painted it with a "V" with a circle around it. Duke then pulled out a pistol and ordered everyone but the male members of the school board out of the room. One witness said that Duke then started having an angry discussion with the school board members about his unemployed wife. After one of the board members told Duke that he would help his wife get a job, Duke opened fire. Duke was then hit by several shots fired by school district security chief Mike Jones. After being hit, Duke fatally shot himself. No one else was injured in the incident.


Police Say Early Detonation of Bomb Averted Disaster in Sweden
New York Times (12/14/10) Burns, John F.; Somaiya, Ravi

It appears that last weekend's terrorist attack in Stockholm, Sweden, could have been more deadly than it was had it not been for a mistake on the part of the man who carried out the bombing. The attack consisted of two explosions, the first one of which was caused by the ignition of several gas canisters inside a car that had been purchased by the suicide bomber, who has been identified as 28-year-old Taimour Abdulwahab al-Abdaly. As Abdaly walked away from the car, he somehow accidentally triggered one of the 12 belt-bombs he was wearing. Abdaly died as the result of that explosion. Authorities say that the accident may have prevented Abdaly from setting off his bomb in a busy department store or inside Stockholm's main train station. Meanwhile, authorities have turned up new information about Abdaly, an Iraqi Swede who had been living with his wife and children north of London. For instance, authorities believe that Abdaly had been traveling between Europe and the Middle East to train for jihad. Although authorities have not yet said that al-Qaida or another terrorist group was involved in the attack and that it appears that Abdaly carried out the bombings on his own, they also noted that such cases usually involve more than one person.




Server Breach at Ohio State Exposes Data of 760,000
DarkReading (12/15/10) Wilson, Tim

Ohio State University in mid December began warning past and present students, faculty, and employees that a university computer server was unlawfully accessed by unauthorized individuals. A forensic audit found no evidence that any data was breached, according to a press statement, so the university does not believe the incident will lead to identity theft for any of the affected persons. However, OSU is providing free credit protection services. In late October, the university discovered unauthorized individuals had accessed an Ohio State server that kept personal information for roughly 760,000 individuals—including current and former faculty, staff, and students, in addition to applicants and other persons with ties to the university, such as consultants and contractors. The server contains names, Social Security numbers, dates of birth, and addresses, the university says. No patient or student health records from OSU Medical Center were breached. The university says it hired "some of the nation's best computer forensic consultants" to investigate the incident. Late last month, they concluded that although access was confirmed, there was no evidence that any information was swiped from the system by unauthorized persons. The experts determined that the purpose of the intrusion was to launch cyberattacks.


Online Access With a Fingerprint
University of Southampton (United Kingdom) (12/15/10) Lewis, Joyce

University of Southampton researcher Sara Alotaibi has developed FingerID, a system that allows the identities of owners of Web accounts to be verified with fingerprints rather than user names and passwords. Users provide their fingerprints for FingerID during a one-time registration process. After they register, users will be able to use their fingerprints to gain access to various online accounts. Alotaibi plans to expand the system to authenticate users with palm prints and facial expressions. The FingerID system's two main constituent elements are the Web site and software. "We propose a cost-effective, convenient, and secure authentication solution for undertaking secure dealings over the Internet," Alotaibi says. "It will allow Internet users to authenticate their identity in a hassle-free manner and go about their activities in a secure environment without the fear of loss of identity and money."


Internet Hit by Wave of Fake PC 'Defrag' Tools
Techworld (12/14/10) Dunn, John E.

A wave of scareware applications that dupe users into purchasing useless hard disk repair tools seems to be part of a comprehensive campaign to promulgate fake defrag software, according to a GFI-Sunbelt Security blog. A new kind of sham disk software has suddenly become very popular on the back of this, with several convincing impostors appearing in the last month. Users encountering new examples of HDDRepair, HDDRescue, and HDDPlus should ignore them. They are nefarious applications that claim to defragment a user's hard disk even though there is barely a need for such a requirement given that Windows does much of this work behind the scenes anyway. Users can differentiate between the real and helpful from the fake and expensive. Depending on the kind of app, it is often easier to consult lists of genuine apps than worry about determining which ones are not real.


Start-Up Uses 'Virtualization' to Defend Against Cyber Attacks
Wall Street Journal (blog) (12/14/10)

A Fairfax, Va.-based startup has developed a product that uses virtualization to protect computers and corporate networks from cyberattacks. The software developed by Invincea Inc. creates a virtual environment for running a Web browser or a PDF reader. In the event the software observes behavior that is indicative of malware, the secure environment is shut down and reloaded. This prevents the malware from ever coming into contact with the computer's operating system or the network to which it is connected. Invincea says that its software does not use a signature-based approach to identifying malware, unlike traditional anti-virus programs. As a result, Invincea's software is capable of identifying malware that it has never seen before. In addition, Invincea's software is capable of sharing information about attacks with intrusion-prevention devices that are connected to the same network. The software is being marketed primarily to large companies, federal agencies, and defense companies. Those who want to use the software will be required to pay a subscription fee.


Senator Proposes Cybersecurity Standards
InformationWeek (12/13/10) Montalbano, Elizabeth

Sen. Ben Cardin (D-Md.), the chairman of the Senate Judiciary Terrorism and Homeland Security Subcommittee, has introduced legislation that aims to improve cybersecurity in the U.S. Under the legislation, which is called the Internet and Cybersecurity Safety Standards Act, top government officials would be required to determine whether or not it would be cost effective to mandate that Internet service providers and others develop and enforce cybersecurity safety standards. In addition, the bill would require the secretary of homeland security, the attorney general, and the commerce secretary, to determine what impact the standards would have on homeland security, the economy, innovation, individual freedoms, and privacy. Before the standards are finalized, officials must work together with a number of different organizations in the private sector, including companies that would be impacted by the standards and experts on technology. Should the legislation be passed, officials would have one year to give Congress recommendations on standards that would cover all Internet-connected devices.


Abstracts Copyright © 2010 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: