Friday, August 05, 2011

Security Management Weekly - August 5, 2011

header

  Learn more! ->   sm professional  

August 5, 2011
 
 
Corporate Security
Sponsored By:
  1. "Neck Bomb Hoax Was a 'Very Serious' Plot" Australia
  2. "Third Charge in Fraud Case" Columbia University in New York
  3. "Britain Takes New Tack in Piracy Fight"
  4. "Face-ID Tools Pose New Risk"
  5. "Violence Afflicts ER Workers" Emergency Room

Homeland Security
  1. "Virginia Tech Security Put to the Test in Gun Scare"
  2. "Oklahoma Woman Says Uncle Was Notorious 1971 Hijacker"
  3. "Lawyer: Norwegian Attacker Makes Demands"
  4. "U.S. Soldier Charged for Planned Attack" Alleged Plot Against Fort Hood, Texas
  5. "Syria Launches 'Horrifying' Raids"

Cyber Security
  1. "Hackers Infiltrate Computer Networks of Thousands of Companies"
  2. "Expert Warns Nigerian Banks Against Cyber Terrorism"
  3. "European Security Group Issues Warning on HTML5"
  4. "U.K. Man Charged Over Web-Hacking"
  5. "Enterprises Hit With More Advanced Malware-Based Attacks in 2011: Report"

   

 
 
 

 


Neck Bomb Hoax Was a 'Very Serious' Plot
MSNBC (08/04/11)

Australian police are continuing to investigate what appears to have been an attempted extortion attempt that took place at the Sydney home of the CEO of an information technology company on Wednesday. The incident began when a masked man broke into the home of William Pulver in the upscale Sydney suburb of Mosman and chained what appeared to be a bomb to the neck of his 18-year-old daughter Madeleine. The man then fled. When authorities arrived on the scene, they found a list of the attacker's demands attached to the device. Authorities have not said what those demands were. Homes in the area were then evacuated and streets were closed as bomb squad specialists spent 10 hours trying to remove the device from Madeleine's neck. The bomb squad was ultimately successful in removing the device, which they later determined did not contain any explosives. No suspect has been identified in the case.


Third Charge in Fraud Case
Wall Street Journal (08/04/11) El-Ghobashy, Tamer

A third man sought on charges of defrauding Columbia University out of almost $6 million was arraigned on Aug. 3 after being apprehended in Massachusetts. According to the indictment, Jeremy Dieudonne received $285,000 of the money that was allegedly stolen from Columbia. Dieudonne appeared in State Supreme Court in Manhattan and pleaded guilty to charges of grand larceny and two counts of criminal possession of stolen property. The 46-year-old was held pending a future bail hearing. Dieudonne disappeared after he and the other two defendants were indicted in June. Manhattan District Attorney Cyrus Vance Jr. said the alleged mastermind of the theft, George Castro, rerouted 56 payments from Columbia's accounts-payable department to a TD Bank account registered to a company that he owned and where his co-defendants were employed. Officials are unsure how the men gained access to Columbia's system.


Britain Takes New Tack in Piracy Fight
New York Times (08/03/11) Pfanner, Eric

The British government has announced that it will legalize format-shifting, which will allow users to copy music or other copyrighted materials from CDs or DVDs to iPods or other devices. The move is part of a legislative overhaul meant to prevent digital piracy. The legislation also backs away from a proposal that would have streamlined procedures for blocking access to Web sites that illegally host copyrighted material. That decision was based on a report from British media regulator, Ofcom, which concluded site blocking would raise too many complications. The government did, however, say that it had not ruled out the possibility of creating a fast-track blocking system in the future. Additionally, the government says it intends to continue implementing a system that would cause repeat piracy offenders to have their Internet access suspended. Those offenders who want to appeal their case will now have to pay a fine of approximately $33 in order to discourage frivolous claims.


Face-ID Tools Pose New Risk
Wall Street Journal (08/01/11) Angwin, Julia

Carnegie Mellon University (CMU) researchers are studying how facial-recognition tools can be detrimental to privacy. In a recent test, the researchers were able to identify about 33 percent of the people they tested, only using a snapshot and facial-recognition technology from Google. In addition, CMU professor Alessandro Acquisti found that he could use information available on Facebook to correctly predict the first five digits of a person's Social Security number about 27 percent of the time, demonstrating the potentially intrusive potential of facial-recognition technology when used with publicly available personal data. Acquisti says the study shows how Facebook is becoming a de facto identity-verification service. As part of the CMU study, 93 student volunteered to be photographed with a webcam. The pictures were uploaded to a cloud computer and put into a database of 261,262 publicly available photos taken from CMU students' Facebook profiles. The researchers were able to find 10 possible matching photos in the Facebook database with more than 30 percent accuracy. The research "suggests that the identity of about one-third of subjects walking by the campus building may be inferred in a few seconds combining social network data, cloud computing, and an inexpensive webcam," Acquisti says.


Violence Afflicts ER Workers
Los Angeles Times (07/31/11) Garrison, Jessica; Hennessy-Fiske, Molly

Statistics show that violence against nurses and other caregivers at hospitals is commonplace across the country. A 2007 survey by UC San Francisco and other researchers found that nearly 40 percent of emergency room employees in California had been assaulted at work during the previous year. In addition, the Emergency Nurses Association--which represents 40,000 emergency room nurses across the country--found last year that more than 10 percent of the emergency room nurses it surveyed had been attacked in the previous week. Emergency room nurses are typically the scene of violent incidents in hospitals, security officials and researchers say, because waiting times have increased. Violence also typically takes place in hospital psychiatric wards. However, such violent incidents may be underreported, because hospital officials discourage nurses from reporting assaults to protect the image of their facilities as being a safe haven, said California Nurses Association head Bonnie Castillo. In addition, hospital workers often do not report assaults because they consider such incidents to be a part of their jobs, a 2009 survey found. Nevertheless, hospital employee unions are calling for increased protections for their employees and for more reporting of violent incidents. Some hospitals have already taken steps to improve security, including installing metal detectors and posting armed police officers in emergency rooms.




Virginia Tech Security Put to the Test in Gun Scare
Hampton Roads News (08/05/11) Moxley, Tonia; Hardbarger, Mary; Matzke-Fawcett, Amy

A spokesman for Virginia Tech said that the university's security system worked without any problems on Thursday after a gunman was reported on campus. The incident began at about 9 a.m., when three teenage girls reported seeing a man possibly carrying a gun near a campus dining hall. About half an hour later, alerts were sent out via outdoor loudspeakers, text message, e-mail, phone, social networking sites, electronic classroom signs, the Virginia Tech home page, and the university's desktop alert system. Many of the thousands of people who were on campus responded by seeking shelter inside buildings. Soon after the possible gunman was reported, police from five different law enforcement agencies responded to the campus to look for the suspect. After spending several hours searching on foot and in vehicles, police were unable to find any evidence of a gunman. The alerts were subsequently lifted at roughly 2:40 p.m. However, a large number of police remained on the campus to continue to conduct patrols into Thursday evening. A composite sketch of a person of interest was also issued.


Oklahoma Woman Says Uncle Was Notorious 1971 Hijacker
Associated Press (08/04/11) Murphy, Sean

An Oklahoma woman says that she thinks that her late uncle was responsible for the unsolved hijacking of a Northwest Orient flight in 1971. During that hijacking, a man who identified himself as Dan Cooper announced shortly after taking off from Portland, Ore., that he had a bomb. The flight subsequently landed in Seattle, where passengers were exchanged for $200,000 in ransom money and parachutes. After the plane took off for Mexico, the hijacker parachuted from the plane in the dark over a rugged, wooded area. The FBI is not convinced that the hijacker survived the jump, though Marla Cooper said she witnessed her uncle, Lynn Doyle Cooper, returning to her grandmother's house with extensive injuries after plotting something with another one of her uncles during the Thanksgiving holiday in 1971. Marla Cooper also said that she heard her uncle Lynn tell her father that they had hijacked an airplane and that their money troubles were over. Marla Cooper only contacted the FBI about what happened after determining that what she remembered had actually happened. Lynn Cooper died in 1999. Authorities are trying to identify items that can be analyzed in order to tie him to the hijacking.


Lawyer: Norwegian Attacker Makes Demands
Associated Press (08/02/11) Ritter, Karl

The lawyer for Anders Behring Breivik, the man who is accused of carrying out the July 22 attacks in Oslo, Norway, that killed 77 people, has demanded several things in exchange for information about the two terrorist cells that he has claimed to be associated with. However, the demands are completely unrealistic, and they illustrate that Breivik does not know how society works, said attorney Geir Lippestad. For instance, Breivik has demanded the complete overthrow of Norwegian and European societies, including the resignation of the Norwegian government. Breivik has also asked to play a role in any political reform, Lippestad said. The attorney also noted that Breivik wants to be examined by Japanese mental health specialists in addition to Norwegian psychiatrists, since Breivik feels that someone from Japan "would understand the idea and values of honor" and would thus understand him much better than someone from Europe would. Meanwhile, investigators are searching Breivik's computer and cell phone records for any evidence that other right-wing extremists were involved in the attacks. No evidence of a larger conspiracy has been found so far. Breivik, who said that he carried out the attacks to launch a revolution against the influx of Muslim immigrants into Europe, could face as much as 21 years in prison if he is convicted on terrorism charges. However, he could stay in prison indefinitely if an alternative custody arrangement is adopted.


U.S. Soldier Charged for Planned Attack
UPI (08/01/11)

Pfc. Naser Jason Abdo of the U.S. Army's 101st Airborne division has been charged with possessing an unregistered destructive device in connection with his alleged plot to attack troops at Fort Hood, Texas. Abdo was arrested in Killeen, Texas, on July 27 after an employee of the gun store where he purchased ammunition and smokeless gunpowder called police to report his suspicious actions. A subsequent search of the motel room Abdo was staying at near Fort Hood uncovered bomb making materials for two explosive devices. In addition to planning a bombing attack of Fort Hood, authorities believe that Abdo was also planning to shoot soldiers at the base. Officials also believe that Abdo was about ready to carry out the plot. No ties between Abdo and a terrorist cell have yet to be found. Mark F. Giuliano, the assistant director of the FBI's counter-terrorism division, said that the threat from homegrown extremists, which Abdo is believed to be, is one of the most serious threats the U.S. faces, besides al-Qaida and its affiliated groups. Giuliano added that the threat from homegrown extremists is quickly evolving as the result of external experiences and motivational factors.


Syria Launches 'Horrifying' Raids
Wall Street Journal (08/01/11)

Dozens of people were killed in Syria on Sunday as the country's security forces launched a crackdown on anti-government protesters ahead of the beginning of the Muslim holy month of Ramadan. In the city of Hama, which has been under the control of protesters since the withdrawal of security forces in June, more than 53 people were killed by soldiers and security personnel. Local Coordination Committees, a network of activist groups that have been watching the anti-government protests, most of the people who were killed were Hama residents who tried to defend the city from the soldiers and security personnel who arrived in tanks early on Sunday morning. The timing of the incursion into Hama could be an indication that the Syrian government believes that it could permanently lose control of the city of 800,000 during Ramadan, a time when the possibility of regular protests could be increased due to more frequent visits by Muslims to the country's mosques. Protests in the country have often started after Friday prayers. In the eastern city of Deir el-Zour, meanwhile, at least 11 people were killed after tanks opened fire on protesters there. Deir el-Zour has also come under the control of anti-government protesters. Fatalities were also reported in the border town of Al Boukamal, while dozens of people were said to be injured in the Damascus suburb of Harasta.




Hackers Infiltrate Computer Networks of Thousands of Companies
Los Angeles Times (08/04/11) Sarno, David; Rodriguez, Salvador; Dilanian, Ken

McAfee revealed in a report it released Aug. 3 that the computer networks of thousands of companies, organizations, and governments were hacked over a period of at least five years. During the hacks, which security experts say may be the largest coordinated attack ever to have taken place, the perpetrators stole large amounts of intellectual property, military information, and state secrets. The hackers were able to steal the data by remaining in the hacked computer systems for a period of several years. McAfee was only able to identify roughly 72 companies, organizations, and governments that were affected by the attack. Among the targets were six federal agencies, more than 12 defense contractors, several multinational companies, and a county government in Southern California. Dmitri Alperovitch, the vice president of threat research at McAfee and the author of the report, said that it remains unclear what happened to all of the stolen data. He added that the theft would represent a major economic threat if even a small portion of the data was used to build more competitive products or beat a competitor at an important negotiation. Meanwhile, security experts are pointing their fingers at China as the country that is likely responsible for the attacks. One reason why analysts believe that China may have been involved is the fact that the attackers paid close attention to Asian government agencies and manufacturing and technology companies. China, however, has denied responsibility for the attacks.


Expert Warns Nigerian Banks Against Cyber Terrorism
Vanguard (08/03/11) Odiogor, Hugo

U.S.-based security expert Bob Inyang has warned Nigerian banks and financial institutions that they should be wary of potential cyberterrorism threats. “Nigeria should be concerned of this threat because of renewed upsurge in hacking into personal computers and electronic mail accounts, using it to defraud friends and relatives," he said. The United States has approved a $130 billion budget to fight cyberterrorism, hacking, and identity theft, and Inyang hopes that Nigeria will take the threat just as seriously because of the impact it could have on the country's financial assets. These warnings coincided with reports from the Economic and Financial Crimes Commission that people had tried to use electronic means to divert public funds in order to perpetuate forgery and fraud. In addition to being a financial threat, identity theft has become a key component of a global terrorism strategy, meaning that cyberterrorism could also enable physical attacks on Nigeria or other countries.


European Security Group Issues Warning on HTML5
IDG News Service (08/01/11) Kirk, Jeremy

New standards under development as part of HTML5 neglect important security issues, according to a European Network and Information Security Agency (ENISA) report. ENISA examined 13 specifications within HTML5 and found 51 security issues. The specifications are important because application designers and Web developers will use them as a guide for several years. "I think this is special in that it's the first time anyone has look at those suites of specifications together from a security point of view," says ENISA's Giles Hogben. Some of the issues can be fixed by making minor changes to the specifications, while other risks are based on features that users should know about. The HTML5 specification allows for a submit button for a Web-based form to be placed anywhere on a Web page, which makes it possible for an attacker to inject other HTML onto the page and cause the information in the form to be sent to the attacker rather than the legitimate Web site. The World Wide Web Consortium, which curates HTML5, plans to revise the specifications by January 2012.


U.K. Man Charged Over Web-Hacking
Wall Street Journal (08/01/11) Bryan-Low, Cassell

Police in the U.K. have identified the man they recently arrested in connection with the denial-of-service attacks launched by Anonymous and LulzSec. British authorities said that the man who they initially identified only by the online nickname "Topiary" is 18-year-old Jake Davis, who was charged Sunday with obtaining unauthorized access to a computer system and engaging in a conspiracy to launch cyberattacks against the Web site of the U.K.'s Serious and Organized Crime Agency (SOCA). Davis's arrest comes after British authorities in June charged 19-year-old Ryan Cleary, a major figure in Anonymous and LulzSec, with forming a botnet that was used to launch attacks against SOCA. More than a dozen people have also been arrested in the U.S. for having ties to the hacker groups. Most of those individuals are believed to have been involved in the attacks against PayPal last year. Anonymous attacked PayPal, MasterCard, and Visa after the companies took steps to prevent people from using their services to make donations to the Web site WikiLeaks. Anonymous and LulzSec have also claimed responsibility for attacks against Sony and several other companies and government agencies.


Enterprises Hit With More Advanced Malware-Based Attacks in 2011: Report
eWeek (08/01/11) Rashid, Fahmida Y.

Cisco researchers found that the volume of unique malware attacks that can lead to advanced ongoing threats has increased by a factor of four since the beginning of 2011. Malware is increasingly being wielded as advanced persistent attacks against organizations, according to the latest quarterly report from Cisco. There were 287,298 "unique malware encounters" in June 2011, twice what was found in March, according to a Global Threat Report from Cisco Security Intelligence Operations. Since January 2011, unique malware encounters have almost quadrupled, Cisco reports. In the study, Cisco analysts did not restrict a malware encounter to just a malware infecting an individual system. It also can include incidents when a platform was initially compromised by a basic downloader, which analyzed the system and downloaded even more sophisticated data-collecting malware. "Malware has evolved along with the Internet and is now the tool of choice for would-be attackers," writes Cisco's Gavin Reid.


Abstracts Copyright © 2011 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments:

Post a Comment