Friday, April 05, 2013

Security Management Weekly - April 5, 2013

header

  Learn more! ->   sm professional  

April 5, 2013
 
 
Corporate Security
Sponsored By:
  1. "Retailers Track Employee Thefts in Vast Databases"
  2. "Haute Hippie Clothing Sues Former Employees for Theft of Company Funds"
  3. "States Propose Crackdowns on Copper Theft"
  4. "Report: Global Demand for Security Equipment to Reach $117B in 2016"
  5. "Chinese Company Sues Apple for Patent Infringement With Siri"

Homeland Security
Sponsored By:
  1. "Texas Slayings Draw Attention to White Supremacist Gang" Aryan Brotherhood of Texas
  2. "Condition of Suspect in West Virginia Sheriff Slaying 'Touch and Go'"
  3. "Couple Arrested in Arson on Virginia's Eastern Shore"
  4. "Surveillance Court’s Opinions Must Remain Secret, Feds Say"
  5. "Border Drones Fall Short of Target"

Cyber Security
  1. "Internal Audit Teams Target IT Security in 2013"
  2. "Employees Still Use Online File Sharing, Even If Companies Prohibit Its Use"
  3. "Malware Attacks Hitting Firms Every Three Minutes"
  4. "Ongoing Malware Attack Targeting Apache Hijacks 20,000 Sites"
  5. "Critical Denial-of-Service Flaw in BIND Software Puts DNS Servers at Risk" Berkeley Internet Name Domain, Domain Name System

   

 
 
 
 
 
 

 


Retailers Track Employee Thefts in Vast Databases
New York Times (04/03/13) Clifford, Stephanie; Silver-Greenberg, Jessica

Many retail employers across the U.S., including Target, CVS, and Family Dollar, often use vast databases that catalog theft complaints against employees. The information contained in the databases is usually minimal, but it can be enough for a retailer to turn down the application of someone who has been written up. Consumer lawyers say some employees have no idea that when they admit to a theft, usually by talking with loss prevention officers hired by the retailer, their name is placed in a nationwide database. While the databases are legal, labor lawyers say workers are usually coerced into confessing when they sometimes have done nothing wrong. The lawyers explain that employees are often subjected to what feels like an interrogation, but they are deprived of the protections afforded to alleged criminals because it is not the police who are performing the questioning. The informal accusation might not result in criminal charges being filed, but the end result can be equally devastating. Being placed in such a database can prove to be a career-ending event, as retailers have little incentive to hire someone with a less-than-perfect background when so many others are applying, according to lawyers.


Haute Hippie Clothing Sues Former Employees for Theft of Company Funds
New York Daily News (04/03/13) Ross, Barbara; McShane, Larry

Four former employees of the chic clothing label Haute Hippie, along with 10 others, are accused of stealing hundreds of thousands of dollars from the company to finance extravagant lifestyles, according to a New York state Supreme Court filing. Some of those involved allegedly used company credit cards to purchase expensive dinners, drinks, nightclub visits, vacations to California and Washington, clothes, and gym memberships. They also allegedly used company cars as "virtual round-the-clock chauffeur[s]," according to the filing. One defendant in the case allegedly used the funds to finance his dental work as well as $1,800 worth of purchases at an Apple store. The lawsuit accuses an employee in the company's accounting department of being the mastermind of the theft. An attorney for Haute Hippie said the money scam was exposed last summer, and he added the rapid growth of the company since 2008 had served to hide the misuse of funds.


States Propose Crackdowns on Copper Theft
National Public Radio (NPR) (04/02/13) Wheeler, Candace

The high price of copper has made theft of the metal a lucrative trade, with the incidence of copper theft jumping by as much as 80 percent in recent years, according to Sen. Amy Klobuchar (D-Minn.), who is proposing a bill that would make stealing copper in some cases a federal crime. Copper thieves target a wide variety of items including telephone wire, copper plumbing, catalytic converters, radiators, air conditioning units, and heat pumps. Some thieves even target electrical substations despite the risk of electrocution from high voltage conductors. Once stolen, copper is hard to track down because it is usually sold to scrap yards and melted down, leaving no trace. Some states are trying to change this by proposing new laws that would require scrap yard owners to document copper buys. Since January, 23 states have introduced a total of 49 bills to curb theft of the metal. Ohio has a bill in the works that would prohibit scrap dealers from buying copper plumbing pipe from anyone other than a plumber, while Virginia recently passed a law that requires scrap dealers to keep photos of the metal they buy on file for a month. Other states have proposed instating a waiting period between when copper recyclers can purchase the metal to when they can recycle it. This has drawn opposition from some recyclers, who claim they do not have enough storage space to hold onto the metal for that long and would be in economic turmoil if they had to hold off on melting it down and selling it immediately.


Report: Global Demand for Security Equipment to Reach $117B in 2016
SecurityInfoWatch.com (04/01/13)

World demand for security equipment will likely increase 7 percent annually over the next three years, reaching $117 billion by 2016, according to a report recently released by the research firm The Freedonia Group. Underdeveloped security markets in parts of Asia, Eastern Europe, Africa, and the Middle East will see the largest growth because of their greater economic growth, new business formation and foreign investment activity, rising urbanization, and growing middle and upper class populations, the report said. The report also noted that China and India will both likely see a growth in their security markets of more than 10 percent annually through 2016, with China expected to account for more than a quarter of global increases in security equipment sales. North America, meanwhile, will likely see a 6.5 percent increase in demand for security equipment each year between now and 2016, the report found. The products covered in the report include access control, video surveillance systems, alarms, mechanical security devices, and other electronic security products.


Chinese Company Sues Apple for Patent Infringement With Siri
Apple Insider (03/27/13) Bostic, Kevin

Representatives from Apple will appear in court in July to defend against allegations that its Siri software infringes on a patent filed by the Chinese company Zhi Zhen Network Technology for its Xiao i Robot software. Xiao i Robot, like Siri, features voice interactions, the ability to answer questions, and the ability to hold simple conversations. Zhi Zhen has released versions of its software for the Web, Android, Windows Phone, desktops, and Apple's iOS, and the company claims the software has some 100 million users in China. Zhi Zhen launched its lawsuit in July 2012 not long after Siri became available in China. Should Apple be found guilty of patent infringement, the repercussions could have a significant impact. "The company will ask Apple to stop manufacturing and selling products using its patent rights, once Apple's infringement is confirmed," said Si Weijiang, a Zhi Zhen lawyer. "We don't exclude the possibility of demanding compensation in the future."




Texas Slayings Draw Attention to White Supremacist Gang
Los Angeles Times (04/05/13) Hennessy-Flake, Molly; Pearce, Matt

Increased attention is being paid to a prison gang known as the Aryan Brotherhood of Texas (ABT) following the recent deaths of several law enforcement officials. Nearly three dozen alleged ABT leaders and other members of the gang were indicted in November, prompting other high-ranking members of the gang to order retaliation against law enforcement officials involved in cases where ABT members were facing life sentences or the death penalty. Roughly two months later, a prosecutor in Texas was shot outside the Kaufman County Courthouse on the same day that federal officials publicly praised legal officials in the county for their work in prosecuting ABT members. The ABT is also believed to have been involved in the recent deaths of Kaufman County District Attorney Mike McLelland and his wife Cynthia. If the ABT was involved in these killings, it appears that the group may have achieved its goal of intimidating law enforcement officials. One federal prosecutor assigned to handle an indictment in a case involving an ABT member recently withdrew from the legal proceedings due to "security reasons." But some who are familiar with the history of ABT say they doubt the gang was behind the killings, saying that the group would not engage in activity that would draw so much attention to itself.


Condition of Suspect in West Virginia Sheriff Slaying 'Touch and Go'
CNN.com (04/04/13) Candiotti, Susan; Mungin, Lateef

The sheriff of a rural West Virginia county known for the tough stand he has taken against drug dealers was shot and killed Wednesday. The shooting took place several blocks from a courthouse where Mingo County Sheriff Walter E. "Eugene" Crum had parked his squad car to eat lunch. As he was eating, suspect Tennis M. Maynard pulled up along side Crum, got out of his car, and shot at Crum through the window of his vehicle. Authorities say that Maynard then tried to escape, though he was followed by a sheriff's deputy and quickly apprehended. Maynard was shot in the chest by the deputy during the brief pursuit and was taken to a hospital, where he remained as of Thursday. It remains unclear what motive the suspect may have had for shooting Crum, who has been the sheriff of Mingo County since January and also serves as a county magistrate and a special investigator for the prosecutor's office. The shooting is particularly unusual given that Mingo County typically sees one to two murders each year. It remains unclear whether the incident is tied to the recent deaths of other law enforcement officials in other parts of the country. When asked whether he thought Crum's murder might have been related to the recent killings of a Colorado prison official and two prosecutors in Texas, Lt. Randy Hatfield of the Mingo County Sheriff's office said he hoped not, but refused to go into more detail about a possible connection or lack thereof.


Couple Arrested in Arson on Virginia's Eastern Shore
Washington Post (04/03/13) Jouvenal, Justin

Police in Virginia on April 1 caught a serial arsonist who had eluded them for five months after witnessing the man set fire to an abandoned home in Accomack County. Police said they witnessed Charles R. Smith III, who friends said was a former captain with a volunteer fire department in the county, setting fire to the home before escaping the scene in a gold minivan driven by his girlfriend, Tonya S. Bundick. Smith and Bundick are also believed to have been behind the setting of nearly 80 other fires at vacant buildings along Virginia's Eastern Shore since mid-November. The arsons were set seemingly randomly and in a way that allowed them to go undetected for an hour or two, according to police. Police charged Bundick and Smith with one felony count of arson and one felony count of conspiracy to commit arson in connection with the April 1 fire. Police expect to pursue other charges against the couple as the investigation continues. Virginia State Police have declined to discuss a possible motive for the arsons.


Surveillance Court’s Opinions Must Remain Secret, Feds Say
Wired (04/13) Kravetz, David

The Obama administration has warned a federal judge about the negative impacts on national security that could arise if it is forced to disclose a 2012 opinion handed down by a Foreign Intelligence Surveillance Court. The administration's statement comes in response to a lawsuit filed by the Electronic Frontier Foundation (EFF) in U.S. District Court for the District of Columbia to gain access to the opinion. In that opinion, the Foreign Intelligence Surveillance Court ruled that the government had broken a 2008 wiretapping law which legalized warrantless e-mail and phone surveillance in the U.S. if authorities have reason to believe that the target of that surveillance is a suspected overseas terrorist group. The EFF was forced to file a lawsuit to try to obtain the opinion after the federal government said that it would not release it under the Freedom of Information Act request filed by the organization. Senior Justice Department Counsel Jacqueline Coleman Snead told the court that the opinion should not be released because it "implicates classified intelligence sources and methods." She added that the EFF cannot prove in court that the opinion does not contain such sensitive information or that releasing would not cause harm to national security.


Border Drones Fall Short of Target
Wall Street Journal (04/03/13) Perez, Evan; Barrett, Devlin

Drones and blimps could play a larger role in securing the nation's borders in the coming years, even though the use of these aircraft has been fraught with problems in the past. Several pieces of legislation currently being considered by Congress call for greater use of high-tech military equipment such as unmanned aerial vehicles in order to obtain data about how secure the border is. However, government data suggests that drones and blimps have been more complicated and expensive to use than expected. A report issued last May by the Department of Homeland Security's inspector general found that Customs and Border Protection (CBP), which has been using unmanned aircraft for almost 10 years, only used its drones for about a third of the time they were available. The report found that the drones were lightly used because of shortages of people who were qualified to help operate them, regulations that placed limits on drone flights, and other issues. The use of drones along U.S. borders has also prompted concern among civil libertarians because CBP allows both local law enforcement and federal agencies to use unmanned aircraft to carry out special missions over U.S. territory. But supporters of the drones say that the aircraft will help border agents increase the security of the nation's borders.




Internal Audit Teams Target IT Security in 2013
Dark Reading (04/04/13) Chickowski, Ericka

Internal auditors have recognized the dangers posed by cyberattacks and are planning to beef up their IT security competence in 2013, according to two recent studies by Protiviti and PricewaterhouseCoopers (PwC). Protiviti's 2013 Internal Audit Capabilities and Needs Survey Report questioned 1,000 U.S. auditors and found that auditing IT was the second mot cited area ripe for improvement, a stark change from 2011 when it was No. 4, and 2012 when it did not even make the top five. PwC's study on the state of internal auditing, which questioned a selection of auditors and executives from around the world, found that 41 percent of internal audit organizations were planning to beef up their IT security expertise within the next 18 months. Of those, 71 percent said doing so would require hiring additional personnel or turning to third-party experts. Protiviti's Brian Christensen says in addition to hiring IT security experts, auditors also will likely need to work more closely with IT staff and be involved in strategic change planning and decisions about investing in systems and infrastructure from the outset, rather than coming in and carrying out after-the-fact assessments.


Employees Still Use Online File Sharing, Even If Companies Prohibit Its Use
Computerworld (04/03/13) Mearian, Lucas

Consumer-oriented online file sharing (OFS) and collaboration tools are widely used by workers on their employer's network, despite the fact that most organizations have policies prohibiting this practice, according to an Enterprise Strategy Group survey. ESG questioned 499 IT personnel throughout the United States who had some level of control over corporate file management and found that 77 percent worked for organizations that strongly discouraged or prohibited OFS use. Nevertheless, 36 percent said end users in their organization were using consumer-oriented OFSes, while 34 percent said they suspected end users were doing so. Analyst Terri McClure says workers are able to use consumer-oriented OFSes even if security policies on their employer's network bar them from doing so because they are often able to access them through a nearby Wi-Fi hotspot or a conference room network. McClure notes workers using OFSes that are beyond the control of IT is a serious problem because these services could be used to steal data from an organization. One solution that some organizations have turned to is the use of their own file-sharing applications.


Malware Attacks Hitting Firms Every Three Minutes
V3.co.uk (04/03/13) Stevenson, Alastair

Cybercriminals are using advanced malware that evades detection by traditional tools such as firewalls and antivirus software to target businesses as frequently as once every three minutes, according to a FireEye report. The report, based on data culled from 89 million malware events and intelligence from a research team, found that spear phishing remained the most common attack strategy for getting malware into an enterprise. FireEye says most of the messages it filtered masqueraded as shipping and delivery, finance, and general business topics, and the most common term in malware file names was UPS. FireEye notes that although attack methods remain simple, the malware being used is getting more sophisticated. One innovation attackers use is malware that executes only when users move a mouse, which can trick current sandbox detection systems since the malware does not generate any activity. Malware writers also have incorporated virtual machine detection to circumvent sandboxing, FireEye reports.


Ongoing Malware Attack Targeting Apache Hijacks 20,000 Sites
Ars Technica (04/02/13) Goodin, Dan

Tens of thousands of websites, including those run by the Los Angeles Times and Seagate, have recently been impacted by Darkleech, an exploitation toolkit that exposes visitors to malware attacks. The attacks are estimated to have infected at least 20,000 websites in a matter of weeks, and are powerful because they target Apache, the Internet's most widely used Web server software. Darkleech releases invisible code into Web pages that create concealed connections, thereby exposing visitors to malicious third-party websites, researchers say. The attacks have been active since at least August, but researchers have not been able to identify the weakness attackers use when taking over Apache-based machines. Vulnerabilities in Plesk, Cpanel, or other software used to administer websites have been proposed, but researchers are also mulling the possibility of password cracking, social engineering, or attacks that exploit unknown viruses in frequently used applications and operating systems.


Critical Denial-of-Service Flaw in BIND Software Puts DNS Servers at Risk
IDG News Service (03/29/13) Constantin, Lucian

Remote attackers have figured out how to exploit a flaw in the widely used BIND Domain Name System software to crash DNS servers and impact the operation of other programs running on the same machines. The flaw comes from the way regular expressions are processed by the libdns library that is part of the BIND software distribution. A security advisory from the Internet Systems Consortium (ISC) said BIND versions 9.7.x, 9.8.0 up to 9.8.5b1 and 9.9.0 up to 9.9.3b1 for UNIX-like systems are vulnerable. The Windows versions of BIND are not at risk, however. The flaw can be exploited by sending specifically crafted requests to vulnerable BIND installations that would cause the DNS server process to use excessive memory resources, leading the DNS server process to crash and severely affecting the operation of other programs. As a workaround, the ISC suggests compiling BIND without support for regular expressions, which involves manually editing the config.h file using instructions provided in the advisory.


Abstracts Copyright © 2013 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

1 comment:

  1. Anonymous1:32 PM

    http://www.waynelevinimages.com/random/buyvaliumonline/index.php?page=buy valium fedex no prescription - valium discount coupons

    ReplyDelete