http://www.group6.net/defconapp/
DEFCON® Hacker Conference - The Hacker Community's Foremost Social Network.
After years of misplaced, begged, borrowed, stolen Defcon schedules, we decided to do something to help. Introducing the Defcon iPhone app. Get all the up to date details on the con on your iPhone/iPod Touch. In addition to that, you can view the official Defcon RSS feed and #defcon Twitter posts. Talk and event calendars, speaker and dj bios, and a map of the venue.
Features:
1. Talk Calendar
2. Event Calendar
3. Speaker/DJ Biographies
4. Defcon RSS Feed Reader
5. Twitter #defcon
Status: Available Soon
The app has currently been submitted for Apple’s approval into their store. We’re looking at other options for distribution in case the app does not get approved in time. Follow @dtjedi or @tkimball via twitter for updates or check back here.
Sunday, July 26, 2009
Saturday, July 25, 2009
Hacker Says iPhone 3GS Encryption Is ‘Useless’ for Businesses
Via Wired.com -
Apple claims that hundreds of thousands of iPhones are being used by corporations and government agencies. What it won’t tell you is that the supposedly enterprise-friendly encryption included with the iPhone 3GS is so weak it can be cracked in two minutes with a few pieces of readily available freeware.
“It is kind of like storing all your secret messages right next to the secret decoder ring,” said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. “I don’t think any of us [developers] have ever seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.”
With its easy-to-use interface and wealth of applications available for download, the iPhone may be the most attractive smartphone yet for business use. Many companies seem to agree: In Apple’s quarterly earnings conference call Tuesday, Apple chief operating officer Tim Cook said almost 20 percent of Fortune 100 companies have purchased 10,000 or more iPhones apiece; multiple corporations and government organizations have purchased 25,000 iPhones each; and the iPhone has been approved in more than 300 higher education institutions.
But contrary to Apple’s claim that the new iPhone 3GS is more enterprise friendly (for reference, see Apple’s security overview for iPhone in business [pdf]), the new iPhone 3GS’ encryption feature is “broken” when it comes to protecting sensitive information such as credit card numbers and social-security digits, Zdziarski said.
Zdziarski said it’s just as easy to access a user’s private information on an iPhone 3GS as it was on the previous generation iPhone 3G or first generation iPhone, both of which didn’t feature encryption. If a thief got his hands on an iPhone, a little bit of free software is all that’s needed to tap into all of the user’s content. Live data can be extracted in as little as two minutes, and an entire raw disk image can be made in about 45 minutes, Zdziarski said.
Wondering where the encryption comes into play? It doesn’t. Strangely, once one begins extracting data from an iPhone 3GS, the iPhone begins to decrypt the data on its own, he said.
To steal an iPhone’s disk image, hackers can use popular jailbreaking tools such as Red Sn0w and Purple Ra1n to install a custom kernel on the phone. Then, the thief can install an Secure Shell (SSH) client to port the iPhone’s raw disk image across SSH onto a computer.
To demonstrate the technique, Zdziarski established a screenshare with Wired.com, and he was able to tap into an iPhone 3GS’ data with a few easy steps. The encryption did not pose any hindrance.
Nonetheless, professionals using the iPhone for business don’t seem to care, or know, about the device’s encryption weakness.
“We’re seeing growing interest with the release of iPhone 3.0 and the iPhone 3GS due in part to the new hardware encryption and improved security policies,” Cook said during Apple’s earnings call. “The phone is particularly doing well with small businesses and large organizations.”
Clearly, the gigantic offering of iPhone applications is luring these business groups. Quickoffice Mobile, for example, enables users to access and edit Microsoft Word or Excel files on their iPhone. For handling transactions, merchants can use apps such as Accept Credit Cards to process a credit card on an iPhone anywhere with a Wi-Fi or cellular connection.
Several employees of Halton Company, an industrial equipment provider, are using iPhones for work, according to Lance Kidd, chief information officer of the company. He said the large number of applications available for the iPhone make it worthy of risk-taking.
“Your organization has to be culturally ready to accept a certain degree of risk,” Kidd said. “I can say we’ve secured everything as tight as a button, but that won’t be true…. Our culture is such that our general manager is saying, ‘I’m willing to take the risk for the value of the applications.’”
Kidd noted that Halton employees are not using iPhones for holding confidential customer information, but rather for basic tasks such as e-mailing and engaging with clients via social networking sites such as Facebook and Twitter. Halton also plans to code apps strictly for use at the company, Kidd said.
According to Kidd, a security expert performed an evaluation of Halton, and he said it was possible for any hacker to find an infiltration no matter the level of security. Therefore, Halton has measures in place to respond to an information security threat rather than attempt to avoid it.
“It’s like business continuity,” Kidd said. “You prepare for disasters. You prepare for if there’s an earthquake and the building breaks down, and you prepare for if there’s a crack in [information] security.”
But Zdziarski stands firm that the iPhone’s software versatility isn’t worth the risk for use in the workforce. He said sensitive information is bound to appear in e-mails or anything that can be contained on the iPhone’s disk, which can be easily extracted by thieves thanks to the new handset’s shoddy encryption.
---------------------
Lets get real here, the iPhone was never designed for business. It was born from the hugely popular iPod, which we would all agree wasn't designed with business needs in mind either.
Beyond the weak encryption on the device itself...why would any company want iTunes and Quicktime installed on its laptop, especially if they aren't required for business. Personally, I don't see many business benefits in iTunes anyways.
Every piece of software that is installed on a system increases its possible attack surface. Combined with Apple's lack luster security practices (both on a coding level & a communication level)....you have a recipe for increased risk of data breach...both on the iPhone and the machines used to manage it.
In 2007, Gartner suggested to keep the iPhone out of enterprise...and from a strictly security perception, I see few reason overall to change that suggestion.
Apple claims that hundreds of thousands of iPhones are being used by corporations and government agencies. What it won’t tell you is that the supposedly enterprise-friendly encryption included with the iPhone 3GS is so weak it can be cracked in two minutes with a few pieces of readily available freeware.
“It is kind of like storing all your secret messages right next to the secret decoder ring,” said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. “I don’t think any of us [developers] have ever seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.”
With its easy-to-use interface and wealth of applications available for download, the iPhone may be the most attractive smartphone yet for business use. Many companies seem to agree: In Apple’s quarterly earnings conference call Tuesday, Apple chief operating officer Tim Cook said almost 20 percent of Fortune 100 companies have purchased 10,000 or more iPhones apiece; multiple corporations and government organizations have purchased 25,000 iPhones each; and the iPhone has been approved in more than 300 higher education institutions.
But contrary to Apple’s claim that the new iPhone 3GS is more enterprise friendly (for reference, see Apple’s security overview for iPhone in business [pdf]), the new iPhone 3GS’ encryption feature is “broken” when it comes to protecting sensitive information such as credit card numbers and social-security digits, Zdziarski said.
Zdziarski said it’s just as easy to access a user’s private information on an iPhone 3GS as it was on the previous generation iPhone 3G or first generation iPhone, both of which didn’t feature encryption. If a thief got his hands on an iPhone, a little bit of free software is all that’s needed to tap into all of the user’s content. Live data can be extracted in as little as two minutes, and an entire raw disk image can be made in about 45 minutes, Zdziarski said.
Wondering where the encryption comes into play? It doesn’t. Strangely, once one begins extracting data from an iPhone 3GS, the iPhone begins to decrypt the data on its own, he said.
To steal an iPhone’s disk image, hackers can use popular jailbreaking tools such as Red Sn0w and Purple Ra1n to install a custom kernel on the phone. Then, the thief can install an Secure Shell (SSH) client to port the iPhone’s raw disk image across SSH onto a computer.
To demonstrate the technique, Zdziarski established a screenshare with Wired.com, and he was able to tap into an iPhone 3GS’ data with a few easy steps. The encryption did not pose any hindrance.
Nonetheless, professionals using the iPhone for business don’t seem to care, or know, about the device’s encryption weakness.
“We’re seeing growing interest with the release of iPhone 3.0 and the iPhone 3GS due in part to the new hardware encryption and improved security policies,” Cook said during Apple’s earnings call. “The phone is particularly doing well with small businesses and large organizations.”
Clearly, the gigantic offering of iPhone applications is luring these business groups. Quickoffice Mobile, for example, enables users to access and edit Microsoft Word or Excel files on their iPhone. For handling transactions, merchants can use apps such as Accept Credit Cards to process a credit card on an iPhone anywhere with a Wi-Fi or cellular connection.
Several employees of Halton Company, an industrial equipment provider, are using iPhones for work, according to Lance Kidd, chief information officer of the company. He said the large number of applications available for the iPhone make it worthy of risk-taking.
“Your organization has to be culturally ready to accept a certain degree of risk,” Kidd said. “I can say we’ve secured everything as tight as a button, but that won’t be true…. Our culture is such that our general manager is saying, ‘I’m willing to take the risk for the value of the applications.’”
Kidd noted that Halton employees are not using iPhones for holding confidential customer information, but rather for basic tasks such as e-mailing and engaging with clients via social networking sites such as Facebook and Twitter. Halton also plans to code apps strictly for use at the company, Kidd said.
According to Kidd, a security expert performed an evaluation of Halton, and he said it was possible for any hacker to find an infiltration no matter the level of security. Therefore, Halton has measures in place to respond to an information security threat rather than attempt to avoid it.
“It’s like business continuity,” Kidd said. “You prepare for disasters. You prepare for if there’s an earthquake and the building breaks down, and you prepare for if there’s a crack in [information] security.”
But Zdziarski stands firm that the iPhone’s software versatility isn’t worth the risk for use in the workforce. He said sensitive information is bound to appear in e-mails or anything that can be contained on the iPhone’s disk, which can be easily extracted by thieves thanks to the new handset’s shoddy encryption.
---------------------
Lets get real here, the iPhone was never designed for business. It was born from the hugely popular iPod, which we would all agree wasn't designed with business needs in mind either.
Beyond the weak encryption on the device itself...why would any company want iTunes and Quicktime installed on its laptop, especially if they aren't required for business. Personally, I don't see many business benefits in iTunes anyways.
Every piece of software that is installed on a system increases its possible attack surface. Combined with Apple's lack luster security practices (both on a coding level & a communication level)....you have a recipe for increased risk of data breach...both on the iPhone and the machines used to manage it.
In 2007, Gartner suggested to keep the iPhone out of enterprise...and from a strictly security perception, I see few reason overall to change that suggestion.
Friday, July 24, 2009
Blackhat 2009 Preview - Bypassing IE ActiveX Killbits
Preview Video
http://www.hustlelabs.com/bh2009preview/
Blackhat 2009 - The Language of Trust: Exploiting Trust Relationships in Active Content
https://www.blackhat.com/html/bh-usa-09/bh-usa-09-speakers.html#Dowd
http://www.hustlelabs.com/bh2009preview/
Blackhat 2009 - The Language of Trust: Exploiting Trust Relationships in Active Content
https://www.blackhat.com/html/bh-usa-09/bh-usa-09-speakers.html#Dowd
SHA-3 Second Round Candidates
NIST has selected the Second Round Candidates of the SHA-3 Competition. A report summarizing NIST’s selection of these candidates will be forthcoming. A year is allocated for the public review of these algorithms, and the Second SHA-3 Candidate Conference is being planned for August 23-24, 2010, after Crypto 2010.
------------------
Make sure you check out the SHA-3 Zoo as well...good stuff.
------------------
Make sure you check out the SHA-3 Zoo as well...good stuff.
Al-Shabaab Takes Over Two United Nations Offices in Somalia
Via Shimron Letters -
The Somali armed rebel group, Al Shabaab, looted two UN compounds and demanded an end to UN relief work in the impoverished Horn of Africa nation, the UN said Monday.
Al Shabaab, which has been trying to overthrow the transitional government in Mogadishu, looted the UN compound in Baidoa of emergency communication equipment, forcing the organisation to evacuate personnel and suspend its operations.
The UN said it was powerless when challenged by the rebels because the compound had no security guards.
In Wajid, protected by a minimum security, the rebels entered the compound of the World Food Programme and drove away with two vehicles and some furniture that did not belong to the UN.
“These two events happened as Al Shabaab broadcast on Monday a message on local Somali radio calling for the closing of offices” of several UN agencies, including the UN Development Programme, the UN said.
“The UN is reassessing the situation on the ground and is optimistic that the minimal conditions on the ground will be restored to allow the critical humanitarian work to resume in Baidoa and continue elsewhere in Somalia,” the UN said.
The Somali armed rebel group, Al Shabaab, looted two UN compounds and demanded an end to UN relief work in the impoverished Horn of Africa nation, the UN said Monday.
Al Shabaab, which has been trying to overthrow the transitional government in Mogadishu, looted the UN compound in Baidoa of emergency communication equipment, forcing the organisation to evacuate personnel and suspend its operations.
The UN said it was powerless when challenged by the rebels because the compound had no security guards.
In Wajid, protected by a minimum security, the rebels entered the compound of the World Food Programme and drove away with two vehicles and some furniture that did not belong to the UN.
“These two events happened as Al Shabaab broadcast on Monday a message on local Somali radio calling for the closing of offices” of several UN agencies, including the UN Development Programme, the UN said.
“The UN is reassessing the situation on the ground and is optimistic that the minimal conditions on the ground will be restored to allow the critical humanitarian work to resume in Baidoa and continue elsewhere in Somalia,” the UN said.
Russian Navy Declassifies Cold War Close Encounters
Via Wired.com (Danger Room) -
Great catch by Phil Ewing at Navy Times‘ Scoop Deck blog: the Russian navy has just declassified its records of Cold War UFO sightings. Turns out “50 percent of UFO encounters are connected with oceans. Fifteen [percent] more — with lakes. So UFOs tend to stick to the water,” one Russian officer explained.
“On several occasions the instruments gave reading of material objects moving at incredible speed,” a sub commander recalled. “Calculations showed speeds of about 230 knots, or 400 kph. Speeding so fast is a challenge even on the surface. But water resistance is much higher. It was like the objects defied the laws of physics. There’s only one explanation: the creatures who built them far surpass us in development.”
Insert jab about superior U.S. Navy submarine technology, here.
All joking aside, in one alleged incident in 1982, three navy diver trainees reportedly died pursuing what survivors described as “a group of humanoid creatures dressed in silvery suits” in Baikal, the world’s deepest lake.
Great catch by Phil Ewing at Navy Times‘ Scoop Deck blog: the Russian navy has just declassified its records of Cold War UFO sightings. Turns out “50 percent of UFO encounters are connected with oceans. Fifteen [percent] more — with lakes. So UFOs tend to stick to the water,” one Russian officer explained.
“On several occasions the instruments gave reading of material objects moving at incredible speed,” a sub commander recalled. “Calculations showed speeds of about 230 knots, or 400 kph. Speeding so fast is a challenge even on the surface. But water resistance is much higher. It was like the objects defied the laws of physics. There’s only one explanation: the creatures who built them far surpass us in development.”
Insert jab about superior U.S. Navy submarine technology, here.
All joking aside, in one alleged incident in 1982, three navy diver trainees reportedly died pursuing what survivors described as “a group of humanoid creatures dressed in silvery suits” in Baikal, the world’s deepest lake.
Heap Spraying with Actionscript
Via FireEyes Malware Intelligence Lab -
As you may have heard, there's a new Adobe PDF-or-Flash-or-something 0-day in the wild. So this is a quick note about how it's implemented, but this blog post is not going to cover any details about the exploit itself.
Most of the Acrobat exploits over the last several months use the, now common, heap spraying technique, implemented in Javascript/ECMAscript, a Turing complete language that Adobe thought would go well with static documents. (Cause that went so well for Postscript) (Ironically, PDF has now come full circle back to having the features of Postscript that it was trying to get away from.) The exploit could be made far far less reliable, by disabling Javascript in your Adobe Acrobat Reader.
But apparently there's no easy way to disable Flash through the UI. US-CERT recommends renaming the
Anyway, here's why… Flash has it's own version of ECMAScript called Actionscript, and whoever wrote this new 0-day, finally did something new by implementing the heap-spray routine with Actionscript inside of Flash.
As you may have heard, there's a new Adobe PDF-or-Flash-or-something 0-day in the wild. So this is a quick note about how it's implemented, but this blog post is not going to cover any details about the exploit itself.
Most of the Acrobat exploits over the last several months use the, now common, heap spraying technique, implemented in Javascript/ECMAscript, a Turing complete language that Adobe thought would go well with static documents. (Cause that went so well for Postscript) (Ironically, PDF has now come full circle back to having the features of Postscript that it was trying to get away from.) The exploit could be made far far less reliable, by disabling Javascript in your Adobe Acrobat Reader.
But apparently there's no easy way to disable Flash through the UI. US-CERT recommends renaming the
%ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dlland
%ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dllfiles. [Edit: Actually the source for this advice is the Adobe Product Security Incident Response Team (PSIRT).]
Anyway, here's why… Flash has it's own version of ECMAScript called Actionscript, and whoever wrote this new 0-day, finally did something new by implementing the heap-spray routine with Actionscript inside of Flash.
Thursday, July 23, 2009
Microsoft Scrambling to Close Stubborn Security Hole
Via Security Fix -
Microsoft may soon be taking the unusual step of issuing an out-of-band security update to address multiple weaknesses that stem from a Windows security flaw that the software giant tried to fix earlier this month, Security Fix has learned.
Microsoft may soon be taking the unusual step of issuing an out-of-band security update to address multiple weaknesses that stem from a Windows security flaw that the software giant tried to fix earlier this month, Security Fix has learned.
Last week, on its regularly scheduled Patch Tuesday (second Tuesday of the month), Redmond issued software updates to plug nine security holes. Among those was a patch for a flaw in Windows and Internet Explorer that hackers were exploiting to break into PCs. However, it soon became clear that Microsoft had known about this vulnerability since at least April 2008.
On July 9, noted security researcher Halvar Flake published a blog post suggesting that the reason Microsoft took so long to fix the bug may be because the flaw was caused by a far more systemic problem in Windows.
According to Flake, the problem resides in a collection of code that Microsoft uses in a number of places in Windows. This code "library" is also provided to third-party software makers to help them build programs that can leverage certain built-in features of Windows.
As a result, Flake concluded, Microsoft may have fixed only a subset of the problem on Windows with its patch this month.
"The bug is actually much 'deeper' than most people realize," Flake wrote. "MS might have accidentally introduced security vulnerabilities into third party products."
I reached out to Flake for additional information, but he told me that shortly after he published that blog post he received a 3 a.m. phone call from Microsoft asking him please not to comment further.
Microsoft has not officially responded to requests for comment about Flake's research. But a source within Microsoft said Redmond could issue an out-of-band update prior to next month's Patch Tuesday to address the outstanding flaws.
The decision over whether to do that or wait until next month's Patch Tuesday may hinge upon whether attackers begin exploiting these other vulnerable areas by using Microsoft's patch (and Flake's research) as a guide to locating the flaws. What's more, this bug is almost certain to be discussed at Black Hat and Defcon, the world's largest annual security conferences, being held next week in Las Vegas.
Indonesian Unaware Husband was Noordin Mohammed Top - Jemaah Islamiya's Bomb Maker & Financier
Via Reuters -
The Indonesian wife of Noordin Top, the region's most-wanted militant because of his role in a string of bomb attacks in Indonesia, did not know his real name and thought he was a teacher, her lawyer said on Thursday.
Malaysian-born Top is one of the prime suspects behind last week's near-simultaneous suicide bomb attacks on the JW Marriott and Ritz-Carlton, two luxury hotels in Jakarta's main business district, which killed nine people and injured 53, including Indonesians and foreigners.
Police and security analysts said the attacks bore the hallmarks of Jemaah Islamiah (JI), the militant Islamist group responsible for previous attacks in Jakarta and on the resort island of Bali, or of a splinter group headed by Top.
Arina Rochmah was detained by the police under Indonesia's terrorism law, her lawyer Achmad Michdan told Reuters, adding that she could be charged for harbouring or hiding information about a terror suspect.
Michdan said Rochmah had no knowledge that her husband, Abdul Halim, was Noordin Top, although she admitted he was seldom at home due to his work teaching at an Islamic boarding school in South Sulawesi.
He said that police took Rochmah, 25, her two children and her mother on Wednesday from an Islamic boarding school founded by her father in Cilacap, in central Java.
Michdan added that Rochmah had come to Jakarta and asked for legal protection a few weeks ago, after the police raided the family's house. Police said that a bomb found at the house was identical to those used in Friday's blasts.
Under the terrorism law, police have seven days to declare someone a suspect.
--------------------------------
Having fleeing from Malaysia after the government cracked down on Islamists following the September 11th attacks, he married using an assumed name, Abdurrachman Aufi.
In early 2006, Noordin Top is believed to have drifted away from the main Jemaah Islamiah structure due to a disagreement about attacks on "soft targets", which often kill civilians. Police said he was claiming to lead a previously unknown group called Tanzim Qaedat al-Jihad.
In naming the group "Tanzim Qaedat al-Jihad," or "Organization for the Base of Jihad," Top has intentionally established a clear association with Osama bin Laden's al Qaeda, mimicking early moves by Abu Musab al-Zarqawi as he was seeking to establish his credibility in Iraq.
The Indonesian wife of Noordin Top, the region's most-wanted militant because of his role in a string of bomb attacks in Indonesia, did not know his real name and thought he was a teacher, her lawyer said on Thursday.
Malaysian-born Top is one of the prime suspects behind last week's near-simultaneous suicide bomb attacks on the JW Marriott and Ritz-Carlton, two luxury hotels in Jakarta's main business district, which killed nine people and injured 53, including Indonesians and foreigners.
Police and security analysts said the attacks bore the hallmarks of Jemaah Islamiah (JI), the militant Islamist group responsible for previous attacks in Jakarta and on the resort island of Bali, or of a splinter group headed by Top.
Arina Rochmah was detained by the police under Indonesia's terrorism law, her lawyer Achmad Michdan told Reuters, adding that she could be charged for harbouring or hiding information about a terror suspect.
Michdan said Rochmah had no knowledge that her husband, Abdul Halim, was Noordin Top, although she admitted he was seldom at home due to his work teaching at an Islamic boarding school in South Sulawesi.
He said that police took Rochmah, 25, her two children and her mother on Wednesday from an Islamic boarding school founded by her father in Cilacap, in central Java.
Michdan added that Rochmah had come to Jakarta and asked for legal protection a few weeks ago, after the police raided the family's house. Police said that a bomb found at the house was identical to those used in Friday's blasts.
Under the terrorism law, police have seven days to declare someone a suspect.
--------------------------------
Having fleeing from Malaysia after the government cracked down on Islamists following the September 11th attacks, he married using an assumed name, Abdurrachman Aufi.
In early 2006, Noordin Top is believed to have drifted away from the main Jemaah Islamiah structure due to a disagreement about attacks on "soft targets", which often kill civilians. Police said he was claiming to lead a previously unknown group called Tanzim Qaedat al-Jihad.
In naming the group "Tanzim Qaedat al-Jihad," or "Organization for the Base of Jihad," Top has intentionally established a clear association with Osama bin Laden's al Qaeda, mimicking early moves by Abu Musab al-Zarqawi as he was seeking to establish his credibility in Iraq.
Wednesday, July 22, 2009
The Economics of Botnets
Via Viruslist.com -
In the past ten years, botnets have evolved from small networks of a dozen PCs controlled from a single C&C (command and control center) into sophisticated distributed systems comprising millions of computers with decentralized control. Why are these enormous zombie networks created? The answer can be given in a single word: money.
A botnet, or zombie network, is a network of computers infected with a malicious program that allows cybercriminals to control the infected machines remotely without the users’ knowledge. Zombie networks have become a source of income for entire groups of cybercriminals. The invariably low cost of maintaining a botnet and the ever diminishing degree of knowledge required to manage one are conducive to growth in popularity and, consequently, the number of botnets.
So how does one start? What does a cybercriminal in need of a botnet do? There are many possibilities, depending on the criminal’s skills. Unfortunately, those who decide to set up a botnet from scratch will have no difficulty finding instructions on the Internet.
---------------------------------
Check out the full article...good stuff.
In the past ten years, botnets have evolved from small networks of a dozen PCs controlled from a single C&C (command and control center) into sophisticated distributed systems comprising millions of computers with decentralized control. Why are these enormous zombie networks created? The answer can be given in a single word: money.
A botnet, or zombie network, is a network of computers infected with a malicious program that allows cybercriminals to control the infected machines remotely without the users’ knowledge. Zombie networks have become a source of income for entire groups of cybercriminals. The invariably low cost of maintaining a botnet and the ever diminishing degree of knowledge required to manage one are conducive to growth in popularity and, consequently, the number of botnets.
So how does one start? What does a cybercriminal in need of a botnet do? There are many possibilities, depending on the criminal’s skills. Unfortunately, those who decide to set up a botnet from scratch will have no difficulty finding instructions on the Internet.
---------------------------------
Check out the full article...good stuff.
Apple Backs Down On Bluwiki Threats
Via EFF -
Apple has retracted its legal threats against public wiki hosting site Bluwiki, and, in response, EFF is dismissing its lawsuit against Apple over those threats. The skirmish involved a set of anonymously authored wiki pages in which hobbyists were discussing how to "sync" media to iPods and iPhones using music library playback software other than Apple's own iTunes.
Apple has retracted its legal threats against public wiki hosting site Bluwiki, and, in response, EFF is dismissing its lawsuit against Apple over those threats. The skirmish involved a set of anonymously authored wiki pages in which hobbyists were discussing how to "sync" media to iPods and iPhones using music library playback software other than Apple's own iTunes.
In November 2008, Apple sent a series of legal threats to the operator of Bluwiki, alleging that these hobbyist discussions about interoperability violated copyright law and constituted a violation of the Digital Millennium Copyright Act (DMCA), even though the author(s) of the pages had not yet figured out how to accomplish their goal. In response to Apple's legal threats, Bluwiki took down the wiki pages in question. In April 2009, EFF and the San Francisco law firm Keker & Van Nest sued Apple on behalf of OdioWorks, which runs Bluwiki, asking a court to reject Apple's claims and allow Bluwiki to restore the discussions.
On July 8, 2009, Apple sent letter withdrawing its cease-and-desist demands and stating that "Apple no longer has, nor will it have in the future, any objection to the publication of the iTunesDB Pages." As a result, EFF has moved to dismiss its complaint against Apple.
"While we are glad that Apple retracted its baseless legal threats, we are disappointed that it only came after 7 months of censorship and a lawsuit," said EFF Senior Staff Attorney Fred von Lohmann. "Because Apple continues to use technical measures to lock iPod Touch and iPhone owners into -- and Palm Pre owners out of -- using Apple's iTunes software, I wouldn't be surprised if there are more discussions among frustrated customers about reverse engineering Apple products. We hope Apple has learned its lesson here and will give those online discussions a wide berth in the future."
For more details:
http://www.eff.org/deeplinks/2009/07/apple-backs-down-blu
For more information about OdioWorks v. Apple:
http://www.eff.org/cases/odioworks-v-apple
Adobe Reader, Acrobat and Flash Player Vulnerability
Via US CERT -
Adobe has released a blog post indicating that it is aware of reports of a vulnerability affecting Adobe Reader and Acrobat 9.1.2 and Flash Player 9 and 10.
US-CERT encourages users and administrators to review the blog post and implement the following workarounds until the vendor releases additional information:
US-CERT will provide additional information as it becomes available.
Adobe has released a blog post indicating that it is aware of reports of a vulnerability affecting Adobe Reader and Acrobat 9.1.2 and Flash Player 9 and 10.
US-CERT encourages users and administrators to review the blog post and implement the following workarounds until the vendor releases additional information:
- Disable Flash in Adobe Reader 9 on Windows platforms by renaming the following files: "%ProgramFiles%\Adobe\Reader 9.0\Reader\authplay.dll" and "%ProgramFiles%\Adobe\Reader 9.0\Reader\rt3d.dll".
- Disable Flash Player or selectively enable Flash content as described in the Securing Your Web Browser Document.
US-CERT will provide additional information as it becomes available.
Russian Intelligence Granted New Powers Over Citizens
Via Jamestown Foundation -
On July 6, the Russian ministry of communications posted its Order 65, on its official website (www.minkomsvjaz.ru). Effective as of July 21, the order decrees that Russian postal services must make available for inspection on demand to the Federal Security Service (the FSB, the main successor to the Soviet KGB) and seven other Russian security service agencies any private mail or shipments, as well as its exhaustive data on senders and addressees. Special rooms where security officers will be able to open and inspect private mail were decreed to be established at post offices. Order 65 also cancels the privacy of electronic correspondence. Operators will now formally grant the security services access to their electronic databases.
Though Soviet or Russian security services never hesitated to intercept, monitor, inspect or confiscate private correspondence, nothing like Order 65 has ever occurred openly, formally or so blatantly -not even under Soviet rule.
Order 65 is in manifest contravention of the 1966 International Covenant on Civil and Political Rights (ICCPR), a United Nations treaty, based on the Universal Declaration of Human Rights -Russia is a signatory to both. It is also in contravention of Article 23 of the Russian constitution, which proclaims the complete privacy of telephone, postal and other communications and states unequivocally that this privacy can be lifted solely on the authority of the courts.
However, Order 65 contains no reference to making private correspondence available to the security services on the strength of a court decision. The Order leaves such decisions at the discretion of the security services. In 2000 and 2007 the Russian supreme court (and also in 2003 in the constitutional court) upheld Article 23 of the constitution, and ruled that mail operators could not disclose private correspondence or telephone communications to the security services, without first securing a court order (www.newsru.com, July 15).
Yuri Vdovin, a prominent St. Petersburg's based human rights activist, told the Echo Moskvy Radio that Order 65 signifies a decisive step towards a totalitarian state. Unless this is revoked, Vdovin maintains, the next steps will include unlawful detentions and searches. Vdovin believes that the authorities are seeking ways to prevent possible social unrest, and take under their control any structures that might emerge in order "not to let the people speak their mind" (www.newsru.com, July 15).
At the same time as this secret police surveillance of correspondence was openly decreed, the ministry of the interior (the MVD) were setting up special regional task forces to keep track of public attitudes, in an effort to prevent public protests, caused by the worsening economic situation in Russia. Interior Minister Rashid Nurgaliyev told the press that he expected this effort to allow the police and authorities to work preemptively and prevent an escalation of protests during the economic crisis. Nurgaliyev wants incoming evidence of growing social tension to be analyzed. If economic factors are deemed responsible, police will inform local officials and the government in order to launch preventive measures jointly, and keep any potential unrest under control (www.theotherrussia.org, July 15).
To complement this massive gathering of information, the MVD is also strengthening its already considerable forces to act on the basis of the information obtained. In the Moscow suburbs, they are now forming a new elite brigade named "avant-garde," which will specialize in maintaining public order during large-scale demonstrations. The force is expected to deploy across the country at short notice (www.theotherrussia.org, July 15).
These latest steps form a new chapter in Russia's progression towards a totalitarian state, and they logically complement previous punitive measures, launched by the Putin government, previously highlighted by the Jamestown Foundation (EDM, January 5). Some Russian experts now estimate the total strength of the MVD and other security forces at 2.5 million, which are assigned to crush the projected domestic protests. They see this process as a crisis demanding the militarization of the state (www.newsru.com, July 14).
On July 6, the Russian ministry of communications posted its Order 65, on its official website (www.minkomsvjaz.ru). Effective as of July 21, the order decrees that Russian postal services must make available for inspection on demand to the Federal Security Service (the FSB, the main successor to the Soviet KGB) and seven other Russian security service agencies any private mail or shipments, as well as its exhaustive data on senders and addressees. Special rooms where security officers will be able to open and inspect private mail were decreed to be established at post offices. Order 65 also cancels the privacy of electronic correspondence. Operators will now formally grant the security services access to their electronic databases.
Though Soviet or Russian security services never hesitated to intercept, monitor, inspect or confiscate private correspondence, nothing like Order 65 has ever occurred openly, formally or so blatantly -not even under Soviet rule.
Order 65 is in manifest contravention of the 1966 International Covenant on Civil and Political Rights (ICCPR), a United Nations treaty, based on the Universal Declaration of Human Rights -Russia is a signatory to both. It is also in contravention of Article 23 of the Russian constitution, which proclaims the complete privacy of telephone, postal and other communications and states unequivocally that this privacy can be lifted solely on the authority of the courts.
However, Order 65 contains no reference to making private correspondence available to the security services on the strength of a court decision. The Order leaves such decisions at the discretion of the security services. In 2000 and 2007 the Russian supreme court (and also in 2003 in the constitutional court) upheld Article 23 of the constitution, and ruled that mail operators could not disclose private correspondence or telephone communications to the security services, without first securing a court order (www.newsru.com, July 15).
Yuri Vdovin, a prominent St. Petersburg's based human rights activist, told the Echo Moskvy Radio that Order 65 signifies a decisive step towards a totalitarian state. Unless this is revoked, Vdovin maintains, the next steps will include unlawful detentions and searches. Vdovin believes that the authorities are seeking ways to prevent possible social unrest, and take under their control any structures that might emerge in order "not to let the people speak their mind" (www.newsru.com, July 15).
At the same time as this secret police surveillance of correspondence was openly decreed, the ministry of the interior (the MVD) were setting up special regional task forces to keep track of public attitudes, in an effort to prevent public protests, caused by the worsening economic situation in Russia. Interior Minister Rashid Nurgaliyev told the press that he expected this effort to allow the police and authorities to work preemptively and prevent an escalation of protests during the economic crisis. Nurgaliyev wants incoming evidence of growing social tension to be analyzed. If economic factors are deemed responsible, police will inform local officials and the government in order to launch preventive measures jointly, and keep any potential unrest under control (www.theotherrussia.org, July 15).
To complement this massive gathering of information, the MVD is also strengthening its already considerable forces to act on the basis of the information obtained. In the Moscow suburbs, they are now forming a new elite brigade named "avant-garde," which will specialize in maintaining public order during large-scale demonstrations. The force is expected to deploy across the country at short notice (www.theotherrussia.org, July 15).
These latest steps form a new chapter in Russia's progression towards a totalitarian state, and they logically complement previous punitive measures, launched by the Putin government, previously highlighted by the Jamestown Foundation (EDM, January 5). Some Russian experts now estimate the total strength of the MVD and other security forces at 2.5 million, which are assigned to crush the projected domestic protests. They see this process as a crisis demanding the militarization of the state (www.newsru.com, July 14).
Osama Bin Laden's Son Thought Killed in Predator Strike
Via The Long War Journal -
Sa'ad bin Laden, the son of Osama bin Laden, is thought to have been killed in a US Predator airstrike in Pakistan's tribal areas. The report has not been confirmed.
Sa'ad bin Laden, the son of Osama bin Laden, is thought to have been killed in a US Predator airstrike in Pakistan's tribal areas. The report has not been confirmed.
Sa'ad is thought to have been killed during a strike earlier this year, US intelligence officials told The Long War Journal.
"We're pretty sure but we're not certain," one official said. "We are hopeful."
US intelligence officials want to confirm or deny Sa'ad's death by using DNA testing. But it is unclear if they have recovered a body from the attack site.
The officials would not identify the date or the location of the airstrike that is thought to have killed Sa'ad. The covert US air campaign has focused heavily on North and South Waziristan. Fifty percent of the attacks occurred in South Waziristan, and 38 percent took place in North Waziristan, according to data compiled by The Long War Journal. The US has killed a total of 22 High Value Targets, which include some of the high- and mid-level Taliban and al Qaeda leadership in the tribal agencies since the first strike was reported back in June 2004 [see LWJ report, US Predator strikes in Pakistan: Observations].
Al Qaeda has neither confirmed nor denied Sa'ad's death. Al Qaeda typically issues a martyrdom statement for senior leaders and commanders who have been killed in battle.
Sa'ad is considered a senior leader in al Qaeda. He is an operational commander who was involved in the 2003 bombings in Riyadh, Saudi Arabia. He is known to shelter in Iran and move back and forth across the border with Pakistan.
He is reported to have facilitated communications between Ayman al Zawahiri and Qods Force, the notorious special operations branch of the Iranian Revolutionary Guards Corps, in September 2008 after the deadly attack on the US embassy in Yemen.
Sa'ad made "key decisions for al Qaeda and was part of a small group of al Qaeda members that was involved in managing the terrorist organization from Iran," according to the US Treasury report that designated him as a terrorist on Jan. 16, 2009. "As of September 2008, it was possible that Sa'ad bin Laden was no longer in Iranian custody," the Treasury reported.
Sa'ad is believed to have entered Pakistan’s northwest to meet with Zawahiri in Pakistan sometime in early September, according to Mike McConnell, the outgoing Director of National Intelligence.
NSA Using Cloud Model For Intelligence Sharing
Via InformationWeek -
The National Security Agency is taking a cloud computing approach in developing a new collaborative intelligence gathering system that will link disparate intelligence databases.
The system, currently in testing, will be geographically distributed in data centers around the country, and it will hold "essentially every kind of data there is," said Randy Garrett, director of technology for NSA's integrated intelligence program, at a cloud computing symposium last week at the National Defense University's Information Resources Management College.
The system will house streaming data, unstructured text, large files, and other forms of intelligence data. Analysts will be able to add metadata and tags that, among other things, designate how securely information is to be handled and how widely it gets disseminated. For end users, the system will come with search, discovery, collaboration, correlation, and analysis tools.
The intelligence agency is using the Hadoop file system, an implementation of Google's MapReduce parallel processing system, to make it easier to "rapidly reconfigure data" and for Hadoop's ability to scale.
The NSA's decision to use cloud computing technologies wasn't about cutting costs or seeking innovation for innovation's sake; rather, cloud computing was seen as a way to enable new scenarios and unprecedented scalability, Garrett said. "The object is to do things that were essentially impossible before," he said.
NSA's challenge has been to provide vast amounts of real-time data gathered from intelligence agencies, military branches, and other sources of intelligence to authorized users based on different access privileges. Federal agencies have their own systems for sharing information, but many remain disconnected, while community-wide systems like Intellipedia require significant user input to be helpful.
The NSA effort is part of Intelligence Community Directive 501, an effort to overhaul intelligence sharing proposed under the Bush administration. Current director of national intelligence Dennis Blair has promised that intelligence sharing will remain a priority.
"The legacy systems must be modernized and consolidated to allow for data to actually be shared across an enterprise, and the organizations that collect intelligence must be trained and incentivized to distribute it widely," he said in response to questions from the Senate prior to his confirmation.
The new system will run on commodity hardware and "largely" on commercial software, Garrett said. The NSA will manage the arrayed servers as a pool of resources rather than as individual machines.
The National Security Agency is taking a cloud computing approach in developing a new collaborative intelligence gathering system that will link disparate intelligence databases.
The system, currently in testing, will be geographically distributed in data centers around the country, and it will hold "essentially every kind of data there is," said Randy Garrett, director of technology for NSA's integrated intelligence program, at a cloud computing symposium last week at the National Defense University's Information Resources Management College.
The system will house streaming data, unstructured text, large files, and other forms of intelligence data. Analysts will be able to add metadata and tags that, among other things, designate how securely information is to be handled and how widely it gets disseminated. For end users, the system will come with search, discovery, collaboration, correlation, and analysis tools.
The intelligence agency is using the Hadoop file system, an implementation of Google's MapReduce parallel processing system, to make it easier to "rapidly reconfigure data" and for Hadoop's ability to scale.
The NSA's decision to use cloud computing technologies wasn't about cutting costs or seeking innovation for innovation's sake; rather, cloud computing was seen as a way to enable new scenarios and unprecedented scalability, Garrett said. "The object is to do things that were essentially impossible before," he said.
NSA's challenge has been to provide vast amounts of real-time data gathered from intelligence agencies, military branches, and other sources of intelligence to authorized users based on different access privileges. Federal agencies have their own systems for sharing information, but many remain disconnected, while community-wide systems like Intellipedia require significant user input to be helpful.
The NSA effort is part of Intelligence Community Directive 501, an effort to overhaul intelligence sharing proposed under the Bush administration. Current director of national intelligence Dennis Blair has promised that intelligence sharing will remain a priority.
"The legacy systems must be modernized and consolidated to allow for data to actually be shared across an enterprise, and the organizations that collect intelligence must be trained and incentivized to distribute it widely," he said in response to questions from the Senate prior to his confirmation.
The new system will run on commodity hardware and "largely" on commercial software, Garrett said. The NSA will manage the arrayed servers as a pool of resources rather than as individual machines.
Deutsche Bank Fires Two as Possible Inquiry Looms
Via NYTimes -
Two executives have been fired at Deutsche Bank as prosecutors consider whether to open a criminal inquiry into surveillance measures conducted against board members and a shareholder advocate.
The executives fired were Wolfram Schmitt, head of investor relations, and Rafael Schenz, German security chief, a person with direct knowledge of the matter said on Tuesday. The person was not authorized to speak on the record and declined to be named.
The bank had ordered an internal review of possible violations of privacy laws in May, after several cases came to light. On Monday, the data protection agency for Hesse, the state where Deutsche Bank is based, said it had forwarded the case to state prosecutors in Frankfurt, after reviewing a preliminary report by the independent law firm Cleary Gottlieb Steen & Hamilton, which had been hired by the bank to conduct the review.
Doris Möeller-Scheu, a prosecutor and spokeswoman for the Frankfurt prosecutor’s office, said the office had received a “very big dossier” and would need about three weeks to decide whether a criminal investigation was warranted.
Ronald Weichert, head of media relations at Deutsche, said the bank could not comment until the report on its internal investigation was finished.
In May, the bank issued a statement saying that it had “learned about possible violations which occurred in past years of the bank’s internal procedures or legal requirements in connection with activities involving the bank’s corporate security department.”
The dismissal of Mr. Schmitt stems from the case of Michael Bohndorf, a shareholder with a history of litigation against the bank who was known to ask critical questions at its shareholder meetings.
After a shareholder’s meeting in 2006, Deutsche Bank hired private investigators to spy on Mr. Bohndorf, posing as vacationers to rent his house in Ibiza and trying to establish a link between him and Leo Kirch, a media tycoon who had waged a legal battle against the bank accusing it of provoking the collapse of some of his companies.
Around that same time, private investigators tested the security measures that Deutsche’s chief operating officer, Hermann-Josef Lamberti, took to protect himself from being tracked and bugged. Detectives tried to plant a GPS device on his car and to smuggle an inactive listening device into his house with a flower delivery.
Two executives have been fired at Deutsche Bank as prosecutors consider whether to open a criminal inquiry into surveillance measures conducted against board members and a shareholder advocate.
The executives fired were Wolfram Schmitt, head of investor relations, and Rafael Schenz, German security chief, a person with direct knowledge of the matter said on Tuesday. The person was not authorized to speak on the record and declined to be named.
The bank had ordered an internal review of possible violations of privacy laws in May, after several cases came to light. On Monday, the data protection agency for Hesse, the state where Deutsche Bank is based, said it had forwarded the case to state prosecutors in Frankfurt, after reviewing a preliminary report by the independent law firm Cleary Gottlieb Steen & Hamilton, which had been hired by the bank to conduct the review.
Doris Möeller-Scheu, a prosecutor and spokeswoman for the Frankfurt prosecutor’s office, said the office had received a “very big dossier” and would need about three weeks to decide whether a criminal investigation was warranted.
Ronald Weichert, head of media relations at Deutsche, said the bank could not comment until the report on its internal investigation was finished.
In May, the bank issued a statement saying that it had “learned about possible violations which occurred in past years of the bank’s internal procedures or legal requirements in connection with activities involving the bank’s corporate security department.”
The dismissal of Mr. Schmitt stems from the case of Michael Bohndorf, a shareholder with a history of litigation against the bank who was known to ask critical questions at its shareholder meetings.
After a shareholder’s meeting in 2006, Deutsche Bank hired private investigators to spy on Mr. Bohndorf, posing as vacationers to rent his house in Ibiza and trying to establish a link between him and Leo Kirch, a media tycoon who had waged a legal battle against the bank accusing it of provoking the collapse of some of his companies.
Around that same time, private investigators tested the security measures that Deutsche’s chief operating officer, Hermann-Josef Lamberti, took to protect himself from being tracked and bugged. Detectives tried to plant a GPS device on his car and to smuggle an inactive listening device into his house with a flower delivery.
Chinese News Sites Go Down After Reports on Gov't Scandal
Via cio.com -
Two of China's most popular technology news Web sites went offline Tuesday after carrying news reports that linked the son of China's president to a corrupt African deal.
The technology news sections disappeared for several hours from major Chinese portals Sina.com.cn and NetEase.com early Tuesday afternoon, when they started redirecting viewers to general news pages. Both tech sections had carried reports on a state-owned company accused of bribing Namibian officials in the last day, but those reports were missing when the Web pages reappeared.
The suspensions appeared to be a government penalty against the companies for reporting on a sensitive political issue.
"I'm impressed by the bravery of Sina and Netease in attempting to report this at all," said Rebecca MacKinnon, a Hong Kong-based expert on the Internet in China, in an online message.
Information on top leaders' children has always been off-limits in Chinese media, though the Internet has made it more difficult to control discussions on such topics, MacKinnon said.
Chinese police heavily patrol the Internet, and Internet companies run rigorous screening to prevent sensitive information from appearing on user forums or in search results on their sites. Companies can be punished if that process fails to catch certain political or pornographic content.
"This is not particularly surprising or different from long-standing censorship patterns," MacKinnon said.
A story posted on the NetEase tech page the night before its suspension cited English broadcaster BBC as saying that Nuctech, a Chinese company, was suspected of bribery in a deal to provide scanners for airports and ports in Namibia. The BBC report had said Namibian authorities wanted to question Hu Haifeng, the former company president and son of Chinese president Hu Jintao, but did not suspect him in the case.
The NetEase story did not mention Hu, but said Namibia wanted to question "relevant" Nuctech executives.
Sina's tech page carried a similar article the next morning, hours before the sites went down. After the tech sections returned to the portals, visiting the URLs of the scandal reports returned messages that they could not be found or had been deleted.
An employee who answered the phone at NetEase Tuesday said its tech section was down for tests. Sina did not respond to a request for comment.
Nuctech's parent company, Tsinghua Holdings, controls a range of other technology companies including Chinese PC maker Tsinghua Tongfang.
Two of China's most popular technology news Web sites went offline Tuesday after carrying news reports that linked the son of China's president to a corrupt African deal.
The technology news sections disappeared for several hours from major Chinese portals Sina.com.cn and NetEase.com early Tuesday afternoon, when they started redirecting viewers to general news pages. Both tech sections had carried reports on a state-owned company accused of bribing Namibian officials in the last day, but those reports were missing when the Web pages reappeared.
The suspensions appeared to be a government penalty against the companies for reporting on a sensitive political issue.
"I'm impressed by the bravery of Sina and Netease in attempting to report this at all," said Rebecca MacKinnon, a Hong Kong-based expert on the Internet in China, in an online message.
Information on top leaders' children has always been off-limits in Chinese media, though the Internet has made it more difficult to control discussions on such topics, MacKinnon said.
Chinese police heavily patrol the Internet, and Internet companies run rigorous screening to prevent sensitive information from appearing on user forums or in search results on their sites. Companies can be punished if that process fails to catch certain political or pornographic content.
"This is not particularly surprising or different from long-standing censorship patterns," MacKinnon said.
A story posted on the NetEase tech page the night before its suspension cited English broadcaster BBC as saying that Nuctech, a Chinese company, was suspected of bribery in a deal to provide scanners for airports and ports in Namibia. The BBC report had said Namibian authorities wanted to question Hu Haifeng, the former company president and son of Chinese president Hu Jintao, but did not suspect him in the case.
The NetEase story did not mention Hu, but said Namibia wanted to question "relevant" Nuctech executives.
Sina's tech page carried a similar article the next morning, hours before the sites went down. After the tech sections returned to the portals, visiting the URLs of the scandal reports returned messages that they could not be found or had been deleted.
An employee who answered the phone at NetEase Tuesday said its tech section was down for tests. Sina did not respond to a request for comment.
Nuctech's parent company, Tsinghua Holdings, controls a range of other technology companies including Chinese PC maker Tsinghua Tongfang.
Tuesday, July 21, 2009
Vordel SOAPBox is Now Free!
http://www.vordel.com/products/soapbox/
Vordel SOAPbox allows developers to test the performance, scalability, and security of Web Services. Using SOAPbox, a developer can test how Web Services perform under load, how they deal with unexpected input, and what their traffic ceiling is.
Vordel SOAPbox highlights security tokens, XML Signatures, and encrypted content in XML documents. SOAPbox supports established security technologies such as SSL and HTTP-Auth, as well as next-generation security technologies such as WS-Security and SAML.
-------------------------
My team has been using this tool for quite some time...and it was worth the money.
But now it is free. Just input your e-mail...and download.
Vordel has made an attempt to block the use of free e-mail accounts (i.e. Mailinator) but they forgot to include the alternative mailinator domains, like sogetthis.com ;)GAO: Many Federal Agencies Still Don't Meet Security Standards
Via DarkReading -
Virtually all of the U.S. federal government's key civilian agencies are still falling short of the security marks they have been asked to meet, according to the Government Accountability Office (GAO).
In a report (PDF) issued earlier today, the GAO says of the 24 agencies reviewed, almost all had deficiencies in security controls and management, "leaving them vulnerable to attack or compromise." The GAO says it has made "hundreds" of recommendations to the agencies, yet many have not been addressed.
During the past three years, the number of incidents reported by federal agencies to U.S.-CERT has increased by almost 200 percent -- from 5,503 in 2006 to 16,843 in 2008, according to the report. More than one-third of the incidents are still under investigation, and the sources of the compromises are not yet known.
Of the incidents in which the sources are known, approximately 22 percent were caused by improper use of computers by authorized users, the report states. Eighteen percent of the compromises were caused by unauthorized access, and 14 percent were caused by malicious code. About 12 percent of the breaches were caused by scans, probes, or attempted access by external attackers, the report says.
Of the 24 agencies reviewed, 13 reported "significant deficiencies" in information security, the GAO says. Seven agencies reported "material weaknesses" that still have not been repaired. Only four agencies reported "no significant weakness," the report states.
Virtually all of the U.S. federal government's key civilian agencies are still falling short of the security marks they have been asked to meet, according to the Government Accountability Office (GAO).
In a report (PDF) issued earlier today, the GAO says of the 24 agencies reviewed, almost all had deficiencies in security controls and management, "leaving them vulnerable to attack or compromise." The GAO says it has made "hundreds" of recommendations to the agencies, yet many have not been addressed.
During the past three years, the number of incidents reported by federal agencies to U.S.-CERT has increased by almost 200 percent -- from 5,503 in 2006 to 16,843 in 2008, according to the report. More than one-third of the incidents are still under investigation, and the sources of the compromises are not yet known.
Of the incidents in which the sources are known, approximately 22 percent were caused by improper use of computers by authorized users, the report states. Eighteen percent of the compromises were caused by unauthorized access, and 14 percent were caused by malicious code. About 12 percent of the breaches were caused by scans, probes, or attempted access by external attackers, the report says.
Of the 24 agencies reviewed, 13 reported "significant deficiencies" in information security, the GAO says. Seven agencies reported "material weaknesses" that still have not been repaired. Only four agencies reported "no significant weakness," the report states.
Indonesian TV Identifies Another Jakarta Hotel Bomber
Via xinhuanet.com -
An Indonesian television on Tuesday evening unveiled identity of another suicide bomber at Ritz Carlton Hotel as Ibrahim, a florist at the hotel, who conducted his action on Friday along with fellow Nurhasbi at JW Marriott Hotel in Jakarta.
Based on the cctv record seconds before the blast at 07:47 at Erlangga restaurant at Ritz Carlton Hotel, a man suspected as Ibrahim of 36, walked unsteadily carrying a black bag which seems very heavy, Metro television said.
The whereabouts of Ibrahim has been unknown since the bombings at the two luxurious hotels which located opposite each other on July 17 that killed nine people and wounded 55 others, half of them foreigners. The police conducted DNA test to make sure the body of Ibrahim.
Based on the hotel presentation list Ibrahim was working on Friday morning, the day of the bombings.
He called his family before the blasts.
After the bombings, his family had looked for him at some hospitals where the victims of the explosions were being treated.
Police are identifying parts of bodies found at the scene, but it is still unknown yet whether one of them is belonging to Ibrahim.
The perpetrators of the bombings assembled the bombs at room 1808 at JW Marriott Hotel. They ordered the room on July 10 and occupied it at 15:01 Jakarta time (0901 GMT) on July 15, two days before conducting their deadly acts. Police found active bomb in a black laptop computer bag after the blasts.
The police have found similarities in equipment and method of the bombs with those detonated in Bali in 2002 and 2005, and that found in recent raid in Cilacap of Central Java, in which the regional militant network of Jemaah Islamiyah was responsible.
Police widens investigation on the group.
The blasts in JW Marriott Hotel and Ritz Carlton Hotel in Jakarta's main business district occurred after four-years absence of major terrorist acts in the country.
Indonesia had been attacked by a series of terrorist attacks from 2000 to 2005, including Bali bombings, the JW Marriott explosion and the Australian embassy bombings in Jakarta that killed more than 250 people.
The police and analysts said that the bombings in the two hotels were led by a breakaway of Jemaah Islamiyah led by Malaysian fugitive Noordin Moh Top, who had organized the major bombings in Indonesia, targeting foreigners and facilities. He has been main target of the police.
An Indonesian television on Tuesday evening unveiled identity of another suicide bomber at Ritz Carlton Hotel as Ibrahim, a florist at the hotel, who conducted his action on Friday along with fellow Nurhasbi at JW Marriott Hotel in Jakarta.
Based on the cctv record seconds before the blast at 07:47 at Erlangga restaurant at Ritz Carlton Hotel, a man suspected as Ibrahim of 36, walked unsteadily carrying a black bag which seems very heavy, Metro television said.
The whereabouts of Ibrahim has been unknown since the bombings at the two luxurious hotels which located opposite each other on July 17 that killed nine people and wounded 55 others, half of them foreigners. The police conducted DNA test to make sure the body of Ibrahim.
Based on the hotel presentation list Ibrahim was working on Friday morning, the day of the bombings.
He called his family before the blasts.
After the bombings, his family had looked for him at some hospitals where the victims of the explosions were being treated.
Police are identifying parts of bodies found at the scene, but it is still unknown yet whether one of them is belonging to Ibrahim.
The perpetrators of the bombings assembled the bombs at room 1808 at JW Marriott Hotel. They ordered the room on July 10 and occupied it at 15:01 Jakarta time (0901 GMT) on July 15, two days before conducting their deadly acts. Police found active bomb in a black laptop computer bag after the blasts.
The police have found similarities in equipment and method of the bombs with those detonated in Bali in 2002 and 2005, and that found in recent raid in Cilacap of Central Java, in which the regional militant network of Jemaah Islamiyah was responsible.
Police widens investigation on the group.
The blasts in JW Marriott Hotel and Ritz Carlton Hotel in Jakarta's main business district occurred after four-years absence of major terrorist acts in the country.
Indonesia had been attacked by a series of terrorist attacks from 2000 to 2005, including Bali bombings, the JW Marriott explosion and the Australian embassy bombings in Jakarta that killed more than 250 people.
The police and analysts said that the bombings in the two hotels were led by a breakaway of Jemaah Islamiyah led by Malaysian fugitive Noordin Moh Top, who had organized the major bombings in Indonesia, targeting foreigners and facilities. He has been main target of the police.
Subscribe to:
Posts (Atom)