| |
Study: $350 Billion U.S. Security Market Expected to Grow
Security Director News (08/15/13)
A study of the $350 billion U.S. security market that was conducted by ASIS International and the Institute of Finance and Management analyzed the growth of private security over the last 10 years and offered predictions for future growth. The study authors estimated that spending for operational private security was around $202 billion, a figure that is expected to grow by 5.5 percent this year. The report noted that the market for private security related to information technology is around $80 billion, which is expected to grow by 9 percent in 2013. In addition, the study predicts that the number of full-time security workers will range from 1.9 million and 2.1 million, and that the number of security-related occupations will grow by more than 20 percent through 2020. ASIS President Geoff Craighead said the study will help security practitioners, manufacturers, and providers develop business plans and strategies. The study's findings will be presented on Sept. 26 at the ASIS International 59th Annual Seminar and Exhibits in Chicago, Ill.
Gunman and Hostage Killed in Louisiana Bank Standoff
Reuters (08/14/13) Finn, Kathy
A Louisiana State Police SWAT team raided the Tensas State Bank in St. Joseph, La., just after midnight on Aug. 14, bringing about an end to a 12-hour standoff and hostage situation. State Police spokesman Albert Paxton said that the officers killed the gunman, Fuaed A. Ahmed, who had been holding two hostages whom he was threatening to kill. Ahmed shot both hostages when the SWAT team entered the building. One of the hostages later died. Though Ahmed is a Yemeni, Paxton noted that the police "don't have any reason to believe there was any connection" to recent threats of attacks on the United States originating from Yemen. Ahmed was said to be suffering from paranoid schizophrenia and had previously complained of hearing voices. Paxton said that the gunman, who initially took three hostages but released one after several hours, had intended to take hostages from the beginning and added that police even found a book on hostage negotiations at his apartment. State Police Colonel Mike Edmonson commented that Ahmed's possession of the negotiations book showed that the incident "was not a bank robbery."
New St. Paul Police Unit Targets Shoplifting Rings, Fenced Goods
Twin Cities Business (08/13) Greder, Andy
Police in St. Paul, Minn., have formed a new unit designed to target organized retail-crime groups. Common items targeted by these organized groups include electronics, denim, razors, cleaning products, meat, batteries, diapers, and medications. The unit is hoping to cut down on shoplifting of these and other products by tightening the noose on the 10 to 20 fencing operations believed to be trafficking in stolen goods in St. Paul. To do so, police must identify which of the estimated 1,200 shoplifting cases that occur annually in St. Paul are connected to these fencing operations. The unit will work with an organized retail-crime association (ORCA) to share information on common suspects, trends, and best practices. The unit will also work with retailers such as Target, which has already helped create coalitions against organized retail crime in Chicago and Los Angeles. "We believe that by sharing our significant security resources and ideas with law enforcement, together we build safer communities," explained Target spokeswoman Jessica Stevens in her comments on the new partnership.
Stopping Copper Theft Becomes Big-Time Business
CNBC.com (08/12/13) Koba, Mark
With businesses in the U.S. losing around $1 billion a year from copper theft, a growing industry is stepping forward to help companies address the problem. Several companies are offering a variety of services for catching copper thieves and preventing thefts by implementing ideas ranging from heavy steel casing to satellite technology and video surveillance, and even using wiring that is less valuable than straight copper wiring. Videofied, for example, produces wireless theft monitoring devices for commercial locations that use copper tubing or wiring, such as cell phone towers and electric power substations. Other companies like VPS offer property protection devices, like heavy steel fortresses to encase air conditioning units and utility boxes. Still other companies, including DigitalGlobe, have taken security to a higher level, by using satellite imagery and analytic data to create models of where copper thieves may strike so that companies can design their structures to make them less appealing targets. Despite these services, experts say that copper theft is likely to remain a problem as long as the price of the metal remains high.
Investigators Track Technology Theft to China, Hit a Dead-End; Scale of Possible Losses Grows
Associated Press (08/08/13)
U.S. prosecutors say that China-based Pangang Group paid industrial spies to steal information on better processes for making titanium dioxide from chemical industry leader DuPont. Pangang has been indicted on these charges in U.S. court, but officials have had little success in prosecuting the company. DuPont has also asked China to ensure the stolen information is not used, but there is no indication any action has been taken. This situation is not uncommon, say corporate security experts, as the Chinese government is notorious for stonewalling any action against Chinese companies accused to stealing intellectual property. A May report by a former U.S. director of national intelligence shows that China is responsible for 50 percent to 80 percent of the cases of stolen American intellectual property. For these reasons, international companies doing business in China are “increasingly worried about trade secrets and technology being compromised in China,” according to Tadashi Kageyama, the head of the security firm Kroll Advisory Services for Asia. In the case of Pangang, U.S. prosecutors say the theft occurred because Chinese government officials considered it an "economic priority" to find a better process to produce titanium dioxide and DuPont declined to sell or license that information to Chinese companies. Prosecutors were able to obtain a letter from Malaysian-born Walter Liew, one of the DuPont scientists accused of stealing secrets, describing the efforts of Luo Gan, a former high-ranking official in the Communist Party, to entice him to obtain information on titanium dioxide production and other secrets. While China has stepped up enforcement of patents and copyright protection, the United States cannot pursue Luo or Pangang because neither has a presence in the U.S. The Chinese Ministry of Justice has not commented on the case.
NSA Broke Privacy Rules Thousands of Times Per Year, Audit Finds
Washington Post (08/16/13) Gellman, Barton
Former National Security Agency (NSA) contractor Edward Snowden has released an internal audit and other top-secret documents that indicate that the agency has violated privacy rules or operated outside of its legal authority thousands of times since 2008, although most of those incidents were accidental. According to the audit, there were 2,776 incidents of unauthorized collection, storage, access to legally-protected communications, or distribution of such communications in the 12 month period ending in May 2012. Most of these incidents were unintended, and many involved failures by personnel to perform due diligence or observe standard operating procedures. Perhaps the most serious violation outlined in the documents took place when the NSA collected and temporarily stored large amounts of data that passed through the U.S. while en route to other countries. One document noted that this operation resulted in the collection of both U.S. and foreign e-mails, since the NSA had no practical way of filtering out messages sent by Americans. The Foreign Intelligence Surveillance Court ultimately decided that the data collection program was unconstitutional, and it ordered the NSA to bring the program into compliance with standard privacy protections or end it. The documents also noted that once data on Americans is added to NSA's databases, it can be searched by analysts assuming there are no other restrictions that would prevent them from doing so.
Court: Ability to Police U.S. Spying Program Limited
Washington Post (08/15/13) Leonnig, Carol D.
The chief judge of the Foreign Intelligence Surveillance Court (FISC) says the court cannot independently verify how often government surveillance breaks the court’s rules and that it must rely on the government to self-report illegal surveillance on its citizens. "The FISC is forced to rely upon the accuracy of the information that is provided to the Court," says U.S. District Judge Reggie B. Walton. "The FISC does not have the capacity to investigate issues of noncompliance, and in that respect the FISC is in the same position as any other court when it comes to enforcing [government] compliance with its orders." Walton's written statement came in response to internal documents obtained by the Washington Post showing that the National Security Agency violated privacy rules thousands of times per year. Walton's statement undermines assurances by the Obama administration and intelligence officials that the court keeps government surveillance in check.
Bulger Guilty in Gangland Crimes, Including Murder
New York Times (08/13/13) Seelye, Katharine Q.
James "Whitey" Bulger was found guilty on 31 of the 32 charges brought against him on Monday, bringing an end to a trial that focused not only on Bulger's crimes but also allegations of corruption at the FBI. Bulger was convicted on 11 murder charges, including the murder of Deborah Hussey. Hussey was the daughter of a former girlfriend of Stephen Flemmi, who had previously worked with Bulger in his criminal enterprises. But the jury decided that the government had not proved that Bulger was responsible for seven other murders, and it made no finding in the murder case of Flemmi's girlfriend Deborah Davis. Assistant U.S. Attorney Fred Wyshak, the lead prosecutor in the case, said during the trial that some of the victims were killed because the FBI had told Bulger that they were informants who were planning to testify against him. The prosecution maintained that Bulger was himself an FBI informant, though the Winter Hill Gang leader denied that. Bulger's attorneys brought up the alleged corruption at the FBI during their arguments as well, noting that agents gave criminals information about informants that led to their killings, took bribes, and told criminals about wiretaps and pending indictments. But in convicting Bulger, the jury rejected the argument made by Bulger's defense team that their client deserved to be acquitted because of the corruption at the FBI. Bulger is scheduled to be sentenced on Nov. 13, though he is planning an appeal. If those appeals fail, he could spend the rest of his life in prison.
Embassies Open, But Yemen Stays on Terror Watch
New York Times (08/12/13) Schmitt, Eric
Most of the U.S. diplomatic outposts in the Middle East that were closed due to the recent terrorist threat were reopened on Sunday, with the exception of the American Embassy in Yemen, which remained closed. Intelligence officials have said that they have evidence that suggests that the U.S. Embassy in Yemen was one of the targets of the al-Qaida plot. The continued closure of the U.S. Embassy in Yemen highlights the ongoing threat from al-Qaida in the Arabian Peninsula (AQAP), the al-Qaida affiliate in that country, as well as the challenges the U.S. faces in eradicating that threat. The recent terrorist threat prompted the U.S. to step up its campaign of drone strikes against terrorist targets in Yemen, though it is not clear whether the nine strikes that have been carried out since July 28 have reduced the threat from AQAP. American intelligence officials said that roughly 36 militants had been killed in the attacks as of last week, adding that those who were killed were members of the next generation of AQAP's leadership. Meanwhile, the fallout from the Arab Spring protests is continuing to have an effect on American counterterrorism efforts. Security analysts say this is because the CIA and other American intelligence agencies have lost their influence over spy agencies in Yemen and other Middle Eastern countries that experienced revolutions during the Arab Spring.
Surveillance Reforms: Obama’s Specifics
ABC News (08/10/13) Good, Chris
President Obama proposed a number of specific reforms for U.S. surveillance policy in a background document released on Aug. 9. The first of these reforms will be to release more information on surveillance programs by ordering "the intelligence community to make public as much information about these programs as possible." No such information has yet been released, but the government is setting up a Web site to act as a "hub" for future information on the doings of the intelligence community. The president also called on Congress to reform Section 215 of the PATRIOT Act, which currently allows the government to obtain nearly any type of telecom data it wants if it is believed to be collected in connection with a terrorism investigation. Specific changes were not forthcoming, but the president did say he wanted "greater oversight, greater transparency, and constraints." In another change, the court that approves these surveillance actions will now hear from both government sources as well as an appointed "adversary" arguing against the surveillance request. The National Security Agency (NSA), meanwhile, will be tasked with adding "a full-time civil liberties and privacy officer." Finally, the president said that he has already met with tech CEOs to talk about intelligence gathering, and that he plans to form an expert panel to review technology changes that have taken place in the intelligence sector since the surveillance laws were implemented.
Washington Post, CNN Hit by Cyberattacks
Wall Street Journal (08/15/13) Launder, William
The Syrian Electronic Army, a hacker collective that supports Syrian President Bashar al-Assad, claimed responsibility for an Aug. 15 cyber attack against news sites such as CNN.com and Washingtonpost.com. The group said that the first stage of the attack consisted of a hack of Outbrain, a service that Web publishers use to recommend content from other sites. This allowed the Syrian Electronic Army to redirect users who viewed some online Washington Post articles to the Syrian Electronic Army's Web site. In addition, the hackers were able to compromise a Washington Post reporter's personal account to send out messages from the Syrian Electronic Army. CNN, meanwhile, reported that its content recommendation service on its Web site was briefly compromised during the attack but that neither CNN or its international Web site were directly affected by the hack. Washington Post Managing Editor Emilio Garcia-Ruiz commented that the paper has taken defensive measures and has removed the "offending module" from Washingtonpost.com. He added that there are no other issues affecting the paper's Web site. A spokeswoman for Outbrain, meanwhile, confirmed that there had been an attack but said that the company believes the service has been fully secured.
Hackers Targeting Servers Running Apache Struts Applications, Researchers Say
IDG News Service (08/14/13) Constantin, Lucian
Chinese hackers are using an automated tool to take advantage of known flaws in Apache Struts in order to insert backdoors on servers hosting applications developed within the application. Several security updates have been released for the popular open source framework so far this year to patch critical flaws that could enable remote attackers to execute arbitrary commands on Web servers running applications built within the framework. Hackers have noticed and are now actively exploiting these vulnerabilities, according to Trend Micro researchers who discovered a tool on Chinese underground forums that automates attacks against vulnerable Struts versions. Once hackers crack into a Linux-based or Windows-based server using the Struts attack tool, they can carry out pre-configured commands in order to procure data about the server's operating system, directory structure, active users, and network configuration, says Trend Micro's Noriaki Hayashi. He notes that the tool also lets attackers plant a Web shell that functions as a backdoor, giving them ongoing access to the servers to carry out other commands and use them as they wish. Hayashi recommends upgrading to the latest version of Struts, which is the most secure version.
NSA Boosting Automation in Wake of Snowden Leaks
Wall Street Journal (08/13/13) King, Rachel
National Security Agency (NSA) chief Gen. Keith Alexander announced Aug. 8 that the agency expects to reduce the number of systems administrators it uses by 90 percent in order to limit access to classified information. In order to do so, the NSA intends to automate its information technology processes. While the change was planned, the NSA's efforts were accelerated after former systems administrator Edward Snowden leaked information on the agency's surveillance programs. The NSA has already created a private cloud using OpenStack, which was developed by NASA and Rackspace Hosting. Using a private cloud like OpenStack allows a team of just 12 to 15 people manage NSA's IT operations. “We’ve transformed the NSA and over the next few months we’re going to be working with the larger intelligence community to roll out our OpenStack system across the entire intelligence community,” said OpenStack computer scientist Nathanael Burton.
Botnet Guesses Weak Passwords to Compromise Thousands of Web Servers
eWeek (08/12/13) Lemos, Robert
Researchers from Arbor Networks have been studying a botnet campaign that has seized control of about 6,000 servers by guessing 10 to 100 passwords per site. The Fort Disco campaign uses a botnet of approximately 25,000 Windows machines to try to compromise more bandwidth-capable content-management servers running WordPress and Joomla, the researchers say. Most of the breached websites are located in Russia and the Ukraine, and the success of the campaign indicates that many administrators still do not think about security when setting their passwords, says Arbor Networks' Matt Bing. He notes the passwords that successfully logged onto those sites, such as "admin" and "123456," are extremely weak. The campaign resembles the Brobot attacks that enabled the al Qassam Cyber Fighters to flood financial services firms with multi-gigabit-per-second attacks, slowing customers' access to bank accounts. The top five passwords that succeeded in breaching Web servers were admin, 123456, 123123, 12345, and the Web server's domain name.
XP's Retirement Will Be Hacker Heaven
Computerworld (08/12/13) Keizer, Gregg
Jason Fossen of the SANS Institute says hackers are likely to start banking new Windows XP exploits in the coming months in anticipation of Microsoft's official retirement of the operating system on April 8, 2014. "When someone discovers a very reliable, remotely executable XP vulnerability, and publishes it today, Microsoft will patch it in a few weeks," Fossen says. "But if they sit on a vulnerability, the price for it could very well double." If that is what happens, signs would likely include decreased public disclosures or in-the-wild sightings of XP vulnerabilities in the fourth quarter of 2013 and the first quarter of 2014. This did not occur three years ago when Microsoft retired Windows 2000, but XP is expected to still be used to run about 33 percent of all personal computers when it is retired next year, making it a much more tempting target. Rapid 7's HD Moore also expects the retirement of XP to increase the number and cost of Windows XP exploits, although he is more skeptical that this will be due to hackers banking exploits in anticipation, rather than to increased backporting of Windows 7 and 8 exploits to XP.
Abstracts Copyright © 2013 Information, Inc. Bethesda, MD |
No comments:
Post a Comment