<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: buffalo]]></title>
    <link>http://securityratty.com/tag/buffalo</link>
    <description></description>
    <pubDate>Wed, 05 Mar 2008 03:25:43 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Experimental Shoe-Print Database Sees the Soles of Criminals]]></title>
      <link>http://securityratty.com/article/73d424be4bcf9450ba9909cde391d5c3</link>
      <guid>http://securityratty.com/article/73d424be4bcf9450ba9909cde391d5c3</guid>
      <description><![CDATA[Criminals better watch their steps, as a Univerisity of Buffalo computer science professor develops a search engine for shoe prints left at crime scenes. With funding from the Justice Department,...]]></description>
      <content:encoded><![CDATA[Criminals better watch their steps, as a Univerisity of Buffalo computer science professor develops a search engine for shoe prints left at crime scenes. With funding from the Justice Department, professor Sargur Srihari hopes his computational forensics will make life easier for shoe-identification experts, and harder for criminals.<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=0e4f0454b937ec1c86cbeef54e59f34d&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=0e4f0454b937ec1c86cbeef54e59f34d&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=0e4f0454b937ec1c86cbeef54e59f34d" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=TWImN"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=TWImN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=wWZxn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=wWZxn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=ZS6wn"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=ZS6wn" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=KG72N"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=KG72N" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=KhH1N"><img src="http://feeds.wired.com/~f/wired/politics/security?i=KhH1N" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=atSUn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=atSUn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=0EJqn"><img src="http://feeds.wired.com/~f/wired/politics/security?i=0EJqn" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=9xkgN"><img src="http://feeds.wired.com/~f/wired/politics/security?i=9xkgN" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/459953424" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/459953427" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 20 Nov 2008 15:58:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/criminals">criminals</category>
      <category domain="http://securityratty.com/tag/computational forensics">computational forensics</category>
      <category domain="http://securityratty.com/tag/justice department">justice department</category>
      <category domain="http://securityratty.com/tag/life easier">life easier</category>
      <category domain="http://securityratty.com/tag/crime scenes">crime scenes</category>
      <category domain="http://securityratty.com/tag/shoe prints">shoe prints</category>
      <category domain="http://securityratty.com/tag/steps">steps</category>
      <category domain="http://securityratty.com/tag/univerisity">univerisity</category>
      <category domain="http://securityratty.com/tag/harder">harder</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/459953427/professor-sees.html">Experimental Shoe-Print Database Sees the Soles of Criminals</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9]]></title>
      <link>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</link>
      <guid>http://securityratty.com/article/95aa70e977b254cabeb9c3b2679b4b8d</guid>
      <description><![CDATA[Australian tech office wins appeal: Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.zdnet.com.au/news/hardware/soa/CSIRO-victorious-in-Wi-Fi-appeal/0,130061702,339292134,00.htm?omnRef=1337"><strong>Australian tech office wins appeal:</strong></a> Buffalo sinks further into the hole as it loses its appeal against a judgement over its use of what the Australian CSIRO technical agency asserts is its patented technology used in all 802.11 implementations. The case, in the patent-holder-friendly US Eastern District Court of Texas--a venue that may be dethroned as a <em>forum coveniens</em> for patentholders' suits in new legislation--prevents Buffalo from importing or selling gear in the US with Wi-Fi technology embedded. In Japan, the patent office threw out CSIRO's patent. While Cisco paid CSIRO as the result of an acquisition of an Australian company a few years ago, most US-based technology giants are involved in resisting the patent's continued validation and enforcement. I've read the patent and some of the suits, and as a non-patent expert, it's clear CSIRO original invention didn't cover what's at stake. However, CSIRO was allowed in a subsequent filing to extend its patent to cover already-in-use technology in a way that seems odd to me, but happens in patents all the time. Many millions of dollars and many more years may be expended before a resolution happens. CSIRO apparently isn't asking for insane fees, although anything paid to them would be passed along to consumers. If companies settled, this might result in an increase of 1 to 5 percent on retail prices. It may ultimately effect WiMax, too, though no suits in that area have been filed.</p>

<p><a href="http://news.cnet.com/8301-10805_3-10046542-75.html"><strong>Finding Zune-Fi:</strong></a> Ina Fried of News.com wanders the polite streets of San Francisco in search of Zune connections over Wi-Fi. She finds a few, and has a good experience. One cafe owner sees the ease with which she can stream music and calls it cool. She can't connect at the long-running Google-sponsored free Wi-Fi at Union Square, however, which means the Wi-Fi likely has an accept button that must be pressed. Surely Microsoft could insert a little technology that would allow a browser-free acceptance of terms? Probably involves Yet Another Protocol: the Wi-Fi Terms Browser-Free Presentation Protocol (WTBFPP).</p>

<p><img src="http://wifinetnews.com//images/2008/kodakesp9.jpg" alt="kodakesp9.jpg" border="0" width="150" height="120" align="right" /><a href="http://www.kodak.com/eknec/PageQuerier.jhtml?pq-path=13572&pq-locale=en_US"><strong>Kodak adds interesting Wi-Fi enabled all-in-one:</strong></a> The new Kodak ESP 9 is a multi-function printer (fax, scan, print, copy) that connects to a network via Wi-Fi or Ethernet. The $300 device spits out 30 pages per minutes in color, 32 ppm in black only. Kodak claims that the model line to which the ESP belongs uses ink in a vastly more efficient manner than the "average of comparable consumer inkjet printers." </p>]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 05:53:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/csiro">csiro</category>
      <category domain="http://securityratty.com/tag/patent">patent</category>
      <category domain="http://securityratty.com/tag/cover">cover</category>
      <category domain="http://securityratty.com/tag/cover already-in-use technology">cover already-in-use technology</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/kodak">kodak</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wi-fi technology">wi-fi technology</category>
      <source url="http://wifinetnews.com/archives/008452.html">Wee-Fi: CSIRO Wins Patent Appeal; Zune-Fi in SF; Kodak ESP 9</source>
    </item>
    <item>
      <title><![CDATA[Creepy Customer Profiling via Facial Recognition]]></title>
      <link>http://securityratty.com/article/dfdb490391ea01b54e8449583b7ebb5b</link>
      <guid>http://securityratty.com/article/dfdb490391ea01b54e8449583b7ebb5b</guid>
      <description><![CDATA[Usually, shopping off-line is usually more ad-free than shopping online. But this is changing, with ads coming in strange places like video screens at Gas Stations, Albertsons, and so on. Googles been...]]></description>
      <content:encoded><![CDATA[<p>Usually, shopping off-line is usually more ad-free than shopping online. But this is changing, with ads coming in strange places like video screens at Gas Stations, Albertson&#8217;s, and so on. Google&#8217;s been using content targeted at users for some time, and now this is coming to offline ads too. Some unlikely retailers like Dunkin Donuts are installing facial recognition systems that change the ads shown, depending whether the viewer is male or female, and in what age range.</p>
<div id="main">
<div id="content">
<div class="post post-permalink">
<div class="entry">
<blockquote><p>The <em>Wall Street Journal</em> says that Dunkin&#8217; Donuts is experimenting with video screens that use facial recognition technology to figure out your age and gender. The screens then display ads targeted specifically to you.</p>
<p>Creepy!</p>
<p>Dunkin&#8217; Donuts is also tailoring the cash register ads to your specific purchase. If you buy a breakfast sandwich, you can expect an ad prompting you to return &#8220;for a coffee break in the afternoon&#8221; to &#8220;try an oven-toasted pizza.&#8221; The system is already in place at two Buffalo, NY locations.</p></blockquote>
<p>Read the<a rel="nofollow" target="_blank" href="http://consumerist.com/5040049/facial-recognition-technology-%252B-video-screens--creepy-dunkin-donuts-ads"> full article here</a>.</div>
</div>
</div>
</div>]]></content:encoded>
      <pubDate>Fri, 22 Aug 2008 05:41:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ads">ads</category>
      <category domain="http://securityratty.com/tag/cash register ads">cash register ads</category>
      <category domain="http://securityratty.com/tag/display ads">display ads</category>
      <category domain="http://securityratty.com/tag/dunkin donuts">dunkin donuts</category>
      <category domain="http://securityratty.com/tag/screens">screens</category>
      <category domain="http://securityratty.com/tag/video screens">video screens</category>
      <category domain="http://securityratty.com/tag/ads shown">ads shown</category>
      <category domain="http://securityratty.com/tag/age range">age range</category>
      <category domain="http://securityratty.com/tag/wall street journal">wall street journal</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/372009137/">Creepy Customer Profiling via Facial Recognition</source>
    </item>
    <item>
      <title><![CDATA[Buffalo ships low-cost drive with native encryption]]></title>
      <link>http://securityratty.com/article/c832dea7891e7a6ec89ea6b453881569</link>
      <guid>http://securityratty.com/article/c832dea7891e7a6ec89ea6b453881569</guid>
      <description><![CDATA[Buffalo has launched a USB hard drive featuring built-in, hardware-backed...]]></description>
      <content:encoded><![CDATA[Buffalo has launched a USB hard drive featuring built-in, hardware-backed encryption.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=RQQ3uM"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=RQQ3uM" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/328887461" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/usb hard drive">usb hard drive</category>
      <category domain="http://securityratty.com/tag/encryption">encryption</category>
      <category domain="http://securityratty.com/tag/buffalo">buffalo</category>
      <category domain="http://securityratty.com/tag/built-in">built-in</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/328887461/article.do">Buffalo ships low-cost drive with native encryption</source>
    </item>
    <item>
      <title><![CDATA[Buffalo ships low-cost encryption drive]]></title>
      <link>http://securityratty.com/article/59cbd6f5819fcccce5eb114f2b9037f7</link>
      <guid>http://securityratty.com/article/59cbd6f5819fcccce5eb114f2b9037f7</guid>
      <description><![CDATA[Buffalo Technology has become the latest vendor to announce a USB hard drive featuring built-in, hardware-backed encryption. Almost as interesting is that is costs almost the same as the same drive...]]></description>
      <content:encoded><![CDATA[Buffalo Technology has become the latest vendor to announce a USB hard drive featuring built-in, hardware-backed encryption. Almost as interesting is that is costs almost the same as the same drive without security.]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/drive">drive</category>
      <category domain="http://securityratty.com/tag/usb hard drive">usb hard drive</category>
      <category domain="http://securityratty.com/tag/encryption">encryption</category>
      <category domain="http://securityratty.com/tag/buffalo technology">buffalo technology</category>
      <category domain="http://securityratty.com/tag/costs">costs</category>
      <category domain="http://securityratty.com/tag/built-in">built-in</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/announce">announce</category>
      <category domain="http://securityratty.com/tag/vendor">vendor</category>
      <source url="http://www.networkworld.com/news/2008/070308-buffalo-ships-low-cost-encryption.html?fsrc=rss-security">Buffalo ships low-cost encryption drive</source>
    </item>
    <item>
      <title><![CDATA[Stolen SunGard laptop affects at least 10 post-secondary schools]]></title>
      <link>http://securityratty.com/article/1617ae0ac3225e4776e688f447ddbccc</link>
      <guid>http://securityratty.com/article/1617ae0ac3225e4776e688f447ddbccc</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/17/08

Organization
Various post-secondary schools, including but not necessarily limited to
Central Connecticut State University
Eastern Connecticut...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/sungard.jpg" align="right" height="72" width="199"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/17/08<br><br><span style="font-weight: bold;">Organization: </span><br>Various post-secondary schools, including but not necessarily limited to:<br><a href="http://www.ccsu.edu/">Central Connecticut State University</a> <br><a href="http://www.easternct.edu/">Eastern Connecticut State University</a> <br><a href="http://www.southernct.edu/">Southern Connecticut State University</a> <br><a href="http://www.wcsu.edu/%203502">Western Connecticut State University</a> <br><a href="http://www.nmc.edu/">Northwestern Michigan College</a> <br><a href="http://www.nwmissouri.edu/%201100">Northwest Missouri State University</a> <br><a href="http://www.buffalostate.edu/">Buffalo State College</a><br><a href="http://www.brockport.edu/">State University College at Brockport</a><br><a href="http://www.monroecc.edu/">Monroe Community College</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.sungardhe.com/index.aspx">SunGard Higher Education</a>*<br><br><font size="1">*From the SunGard Higher Education "About Us" page:<br>"SunGard Higher Education provides software, strategic consulting, and technology management services to colleges and universities. We help more than 1,600 institutions worldwide strengthen institutional performance by improving constituent services, increasing accountability, and enhancing the education experience.<br><br>SunGard Higher Education has a vision to unify people, process, and technology in an environment that addresses the needs of higher education institutions and the people they serve. We call this vision the Unified Digital Campus."</font><br><font style="font-style: italic;" size="1">[Evan] All of "the needs" except one critical one... SECURITY!</font><br><br><span style="font-weight: bold;">Victims:</span><br>Students and a limited number of employees<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown, but at least 23702<br><br><span style="font-weight: bold;">Types of Data:</span><br>Personal information including names, Social Security numbers and financial aid information<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop belonging to a consultant at SunGard Higher Education was stolen on March 13, 2008. The theft was immediately reported to law enforcement but the laptop has not been recovered. After analyzing a backup of the computer, SunGard Higher Education found that the stolen laptop contained data from projects with a number of customers."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.sungardhe.com/laptoptheft">SunGard Higher Education (general)</a> <br><a href="http://www.newstimes.com/ci_8956150?source=most_emailed">The News-Times (Connecticut State University Schools)</a> <br><a href="http://www.newsday.com/news/local/wire/connecticut/ny-bc-ct--stolenlaptop0417apr17,0,6006519.story">Associated Press Connecticut (Connecticut State University System)</a> <br><a href="http://www.mlive.com/newsflash/michigan/index.ssf?/base/news-52/1208630945313100.xml&amp;storylist=newsmichigan">Associated Press Michigan (Northwestern Michigan College)</a> <br><a href="http://www.maryvilledailyforum.com/articles/2008/04/17/news/news3.txt">Maryville Daily Forum (Northwest Missouri State University)</a> <br><a href="http://www.buffalonews.com/home/story/325975.html">The Buffalo News (Buffalo State College)</a> <br><a href="http://www.democratandchronicle.com/apps/pbcs.dll/article?AID=/20080419/NEWS01/804190328/1002/NEWS">Democrat and Chronicle (State University of New York schools)</a> <br><a href="http://www.nmc.edu/news/2008/041804-potential-data-theft.html">Northwestern Michigan College</a> <br><a href="http://www.buffalostate.edu/privatedata/">Buffalo State College</a> <br><a href="http://www.brockport.edu/newsbureau/1063.html">State University College at Brockport</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>SunGard Higher Education<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A laptop belonging to a consultant at SunGard Higher Education was stolen on March 13, 2008. The theft was immediately reported to law enforcement but the laptop has not been recovered. After analyzing a backup of the computer, SunGard Higher Education found that the stolen laptop contained data from projects with a number of customers.<br><br>Security teams from affected institutions and SunGard Higher Education are working together to analyze and verify the data and notify affected individuals.<br><br>The laptop was protected with a strong password to access the operating system.<br><span style="font-style: italic;">[Evan] It could be the strongest damn password in the world and still not provide an adequate level of security in my opinion.&nbsp; Operating system passwords (especially Windows) can be bypassed in a matter of seconds.&nbsp; This is a poor attempt to minimize the incident.</span><br><br>The computer was password-protected but contained unencrypted files with personally identifiable data<br><span style="font-style: italic;">[Evan] Even though encryption is not the "end all", it would have (in conjunction with other controls) reduced the risk of exposure to a level that is acceptable to many organizations (mine included).</span><br><br>All affected customers have been notified. Customer names will not be disclosed for privacy and security reasons as the investigation continues.<br><span style="font-style: italic;">[Evan] We already know of at least 10 post-secondary institutions.</span><br><br>The laptop was stolen in New York on March 13 and state officials say it contains the names and personal information of 3,502 present and former students of the four CSU universities. <br><br>could put the personal information of 1,600 Northern Michigan College students from 2003 at risk.<br><br>could potentially put personal information about Northwest Missouri State University students and alumni in the wrong hands.<br><br>Northwest believes it followed all appropriate internal procedures for protecting the privacy of its students. For its part, SunGard Higher Education has accepted responsibility for this incident and is working with the University to minimize any adverse consequences.<br><span style="font-style: italic;">[Evan] This is a classic misunderstanding of the roles and responsibilities for information security governance and management.&nbsp; The custodians of the personal information were the schools AND SunGard, not only SunGard.&nbsp; It is the responsibility of the schools (as co-custodians) to require certain information protections from their vendors and contractors.&nbsp; This should be done through policy, contractual language and regular audit/enforcement.</span><br><br>Social Security numbers of about 16,000 current and former Buffalo State College students<br><br>affected thousands of students at State University College at Buffalo, State University College at Brockport and Monroe Community College.<br><br>We believe that the laptop was stolen for the hardware rather than the data. We do not know if any personally identifiable data was accessed by the thieves.<br><span style="font-style: italic;">[Evan] This is another statement meant to minimize the impact of the incident.&nbsp; I do not doubt that often times computer equipment is stolen for the hardware value, but how do we know?&nbsp; I am guessing that more and more criminals are examining the contents of poorly secured computing devices and looking for additional opportunities.&nbsp; The "laptop was stolen for the hardware" argument doesn't work anymore.</span><br><br>The nature of that employee’s job included analysis of customer data as part of software implementation and upgrade projects.<br><br>The laptop was taken from an employee of SunGard, a Pennsylvania-based computer software company that provides Buffalo State’s records system, said Voldemar Innus, a college vice president and chief information officer.<br><br>Innus also said the laptop was secure.<br><span style="font-style: italic;">[Evan] No offense Mr. Innus, but the laptop <span style="font-weight: bold;">WAS NOT</span> secure.</span><br><br>"The laptop was stolen for its own worth as hardware," Innus said. "We do not believe it was stolen because of the information that was on it. And it was heavily password protected, we’re told."<br><br>"The risk I would say is not that high, but that doesn’t matter," Innus said. "There are steps we need to take because of what happened."<br><span style="font-style: italic;">[Evan] People like to throw these terms like "secure" and "risk" around without any validation.&nbsp; How did Mr. Innus determine the risk (of exposure and/or misuse) with respect to this incident?</span><br><br>The data was originally provided for SunGard to perform various services for the university system, but it was apparently retained longer than necessary to perform those services,<br><br>A dedicated Web site containing updated information may be accessed at <a href="http://www.sungardhe.com/laptoptheft.%3Cbr%3E%3Cbr%3EA">www.sungardhe.com/laptoptheft.<br><br></a>A help desk has been established with a toll-free number, (866) 520-2408, to respond to questions from affected individuals.<br><br>Credit monitoring will be provided at no cost to the affected individuals, for a period of one year.<br><span style="font-style: italic;">[Evan] Credit monitoring is a post-fraud activity.&nbsp; One year is very limited for information that has a much longer lifespan.</span><br><br>Buffalo State student reaction:<br>In a campus dormitory, Ben Bissell, a sophomore special education major, and his friend Thomas Dennis, a freshman English education major, were making housing arrangements for next year. Bissell said he got the e-mail and was aware of the situation. Dennis was not. <br><br>Bissell was surprised such sensitive information could be placed in such a portable device as a laptop, which could easily be lost or stolen. <br><span style="font-style: italic;">[Evan] Mr. Bissell is a "data owner" in this instance.&nbsp; The school and SunGard are "data custodians".&nbsp; In simplistic terms, data owners dictate what level of protection is required for the data that they own and data custodians apply the designated level of protection.&nbsp; Did the school and SunGard apply the designated level of protection in this case?</span><br><br>"You’d think it would be somewhat secure," Bissell said of his personal information. <br><br>He plans to closely monitor his bank statements and account activity following the announcement.<br>&nbsp;<br>Omar Vargas, a sophomore elementary education major, told a reporter it was the first he had heard of the stolen laptop, admitting he feels "less secure" knowing about it.<br>&nbsp;<br>"There’s enough things to handle being on campus, like going to classes and deadlines," Vargas said. "Then, just to find out my personal information is threatened is like, man, who knows what that could jeopardize."<br><span style="font-style: italic;">[Evan] Very true.&nbsp; If we all just did what we were supposed to do, we wouldn't have to worry so much about what others aren't doing.</span><br><br>"I could wind up with bad credit when I’m on a good roll."<br><br><span style="font-weight: bold;">Commentary:</span><br>I provided a lot of my commentary above.&nbsp; There is no excuse that I can think of for such poor information security practice and management.&nbsp; Can the people running these companies (such as SunGard) and those responsible for information security claim they didn't know any better?&nbsp; Does it not go against SunGard Higher Education (or school) policy to store confidential information on a laptop while relying solely on operating system level passwords?<br><br>Nuts. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/21/sungard.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 21 Apr 2008 10:49:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/store confidential information">store confidential information</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/university system">university system</category>
      <category domain="http://securityratty.com/tag/data custodians apply">data custodians apply</category>
      <category domain="http://securityratty.com/tag/data custodians">data custodians</category>
      <category domain="http://securityratty.com/tag/information security governance">information security governance</category>
      <category domain="http://securityratty.com/tag/sungard">sungard</category>
      <source url="http://breachblog.com/2008/04/21/sungard.aspx">Stolen SunGard laptop affects at least 10 post-secondary schools</source>
    </item>
    <item>
      <title><![CDATA[Students breach Williamsville Central School District security]]></title>
      <link>http://securityratty.com/article/469e27140de7cb1c2b33167d99e0f5c4</link>
      <guid>http://securityratty.com/article/469e27140de7cb1c2b33167d99e0f5c4</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/12/08

Organization
Williamsville Central School District

the largest suburban school district in Western New York, Williamsville Central encompasses...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/williamsville.jpg" align="right" height="42" width="174"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/12/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.williamsvillek12.org/index.cfm">Williamsville Central School District</a>* <br><br><font size="1">*"the largest suburban school district in Western New York, Williamsville Central encompasses 40 square miles including portions of the towns of Amherst, Clarence and Cheektowaga."<br></font><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.williamsvillek12.org/north_high.cfm">Williamsville North High School</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Employees<br><br><span style="font-weight: bold;">Number Affected:</span><br>1,800<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Several current and former Williamsville North High School students are believed to have broken into the school district’s computer system last month and copied secure files that included the personal information and Social Security numbers of school employees"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.buffalonews.com/home/story/321395.html">The Buffalo News</a> <br><a href="http://www.wcax.com/Global/story.asp?S=8157556&amp;nav=menu183_11_6_2">WCAX-TV News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Buffalo News and the Associated Press (AP)<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>WILLIAMSVILLE, N.Y. (AP) - Authorities say several current and former students broke into a school district’s computer system in western New York last month and copied secure files that included the personal information of employees.<br><br>This computer breach marks the third time in the past month that students have gained unauthorized access to sensitive information in area school districts.<br><span style="font-style: italic;">[Evan] What did the school district do after the first two in an attempt to prevent a third?</span><br><br>"From talking with staff and from talking with students involved, we know these students gained access to personal information regarding employees of the school district," Amherst Police Chief John Askey said.<br><br>The students, Askey said, overrode the security defenses of a classroom computer at Williamsville North and went trolling for information.<br><span style="font-style: italic;">[Evan] I can only imagine what the "security defenses" entailed.&nbsp; A student (or "hacker") can do a lot of damage if they are granted physical access to a computer.&nbsp; Obviously the students need to access classroom computers.&nbsp; Having said this, doesn't it then become critical that they be closely supervised.</span><br><br>"They actively attacked the system " subverted those security procedures and precautions," he said.<br><br>He added that several of the hackers are considered "very bright kids" and good students with no lengthy disciplinary records.<br><br>The extent of the security breach remains unknown because police are required to have computer evidence extracted by the Western New York Regional Computer Forensics Laboratory, Askey said, which might take several weeks.<br><br>This prompted Superintendent Howard S. Smith to send a letter this week to the district’s 1,800 employees, asking them to notify Amherst police if they uncover any suspicious credit card or banking activity.<br><br>So far, however, police and school officials say they have no evidence that any of the accessed data has been distributed or used to commit crimes.<br><br>Employees or students who suspect their private information might have been used improperly should call the police at 689-1311.<br><br>District computer technicians noticed some unusual activity during routine monitoring of its network on March 26, Smith said.<br><br>"Immediately upon getting the information, we began our investigation and involved the police," he said, "and they have been working with us ever since."<br><br>Two school computers, four personal student computers and one portable flash drive have been confiscated as part of the investigation, Askey said.<br><br>At least three individuals are suspected in the breach, he said, and several more knew about it. Those involved have told police they simply were interested in how far they could get into the system.<br><span style="font-style: italic;">[Evan] I remember the day when being "interested in how far" we "could get into the system" was commonplace.&nbsp; We were curious and we wanted a challenge, but things are much different today.</span><br><br>Smith said the district has begun disciplinary action against one student and expects to take further action as the police wind up their investigation. He added that the district also has taken steps to improve security.<br><span style="font-style: italic;">[Evan] We don't have all the facts, but assuming that the information security practices at the school are less than adequate, how about some disciplinary action against the people that did not secure the information in the first place?</span><br><br>"There are several charges, mostly misdemeanors, that could result," Askey said.<br><span style="font-style: italic;">[Evan] This is in reference to the students.&nbsp; Should charges be considered for those who collected the personal information and likely did not secure it properly?&nbsp; I think that the finger could be pointed in either direction.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Kids are kids.&nbsp; On one hand, I think it's important for them to push the boundaries, explore and challenge themselves.&nbsp; On the other hand, their actions in this case led to potential victims.&nbsp; These students should be punished, but I think that the school could come up with some creative solutions (after they secure personal information better).&nbsp; If students are interesting in "hacking", why not teach it.&nbsp; Teach it in a way that clearly communicates the law, but at the same time challenges students to explore and learn.&nbsp; Maybe we can make good information security professionals out of them.&nbsp; My blog, my $.02 <img src="http://breachblog.com/emoticons/smile.png" border="0">&nbsp; <br><br>Whatever the school district has been doing isn't working.&nbsp; Otherwise, this wouldn't be the third occurrence in the past month. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/15/williamsville.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 15 Apr 2008 11:12:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/district">district</category>
      <category domain="http://securityratty.com/tag/students">students</category>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/suburban school district">suburban school district</category>
      <category domain="http://securityratty.com/tag/school students">school students</category>
      <category domain="http://securityratty.com/tag/secure personal information">secure personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/school district">school district</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <source url="http://breachblog.com/2008/04/15/williamsville.aspx">Students breach Williamsville Central School District security</source>
    </item>
    <item>
      <title><![CDATA[40,000 BlueCross BlueShield members notified of lost laptop]]></title>
      <link>http://securityratty.com/article/4d3b40d70e709c609969c6cfd0bb93f0</link>
      <guid>http://securityratty.com/article/4d3b40d70e709c609969c6cfd0bb93f0</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
3/10/08

Organization
HealthNow New York Inc

Contractor/Consultant/Branch
BlueCross BlueShield of Western New York

Victims
Healthcare members

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/bcbswny.jpg" align="right" height="78" width="128"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>3/10/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.healthnowny.com/">HealthNow New York Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.bcbswny.com/">BlueCross BlueShield of Western New York</a><br><br><span style="font-weight: bold;">Victims:</span><br>Healthcare members<br><br><span style="font-weight: bold;">Number Affected:</span><br>40,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, dates of birth, Social Security numbers, addresses, employer group names, and health insurance identifier numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Blue-Cross Blue-Shield of Western New York says it is notifying tens of thousands of its members about identity theft concerns after one of it's company laptops went missing."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.buffalonews.com/145/story/296415.html">The Buffalo News</a> <br><a href="http://http://www.wivb.com/Global/story.asp?S=7992428">WIVB Channel 4 News</a> <br><a href="http://www.wgrz.com/sports/sports_article.aspx?storyid=56110&amp;provider=gnews">WGRZ Channel 2 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WGRZ Channel 2 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>HealthNow New York has alerted 40,000 members in Western and Northeastern New York that they may be at risk for identity theft, after a former employee’s laptop computer went missing with confidential information several months ago.<br><br>The Buffalo-based parent of Blue- Cross BlueShield of Western New York sent letters late last week to the affected customers, even though officials are still not certain what, if anything, was on the computer.<br><span style="font-style: italic;">[Evan] Not sure where confidential information is?&nbsp; Sad, common and true.</span><br><br>Based on the company’s investigation, the potential information includes names, dates of birth, Social Security numbers, addresses, employer group names, and health insurance identifier numbers.<br><br>there was no health or medical claims information involved<br><span style="font-style: italic;">[Evan] I think a name, date of birth, Social Security number, address, and employer should be enough to do some damage.</span><br><br>HealthNow has arranged for any affected member to receive a one-year free membership in Equifax Credit Watch, to monitor for identity theft.<br><br>The laptop was not encrypted, but does have security features, including the requirement to enter the user’s identification number and passcode after 15 minutes of inactivity.<br><span style="font-style: italic;">[Evan] OK, seriously?&nbsp; Does anyone expect a username and password to stop someone with even novice computer skills?&nbsp; I am assuming that this is a Windows laptop, all the more simple.</span><br><br>the company shut down the laptop’s access to the corporate network, and has not detected any activity from the laptop since the disappearance.<br><span style="font-style: italic;">[Evan] Shutdown the laptop's access or access from the user id of the person that had been using the laptop?&nbsp; Semantics, I know.&nbsp; The information that may be on the laptop is the real concern.</span><br><br>The employee is no longer with HealthNow, having accepted a position at another company out of state, but the insurer is still in contact.<br><br>the company is reconfiguring its claims software system, and the employee had downloaded some member information to his laptop while working on the project so he could work either in building or at home<br><span style="font-style: italic;">[Evan] Too many "no-nos".&nbsp; "No-no" #1 is not knowing where confidential resides within the organization.&nbsp; "No-no" #2 is allowing confidential information onto mobile devices without additional controls such as encryption.&nbsp; "No-no" #3 is working with sensitive confidential information for software development and testing purposes.&nbsp; Only sanitized information should be used for development and test work.</span><br><br>The laptop was reported missing in late fall, but the company did not notify customers until now because officials wanted to make sure whether such action would be necessary.<br><span style="font-style: italic;">[Evan] This is way too long!&nbsp; An excerpt from New York Bill A02261 "Notice of Information Breach" can be found in the commentary below.</span><br><br>officials first "spent an exhorbitant amount of time" to try and locate the laptop, which they still believe is in the company’s building<br><br>Using the company’s shared drive and with the cooperation of the employee, officials retraced his path to determine what information he was working with. The company then set up the credit-monitoring, and began contacting members last Thursday and Friday.<br><br>"We didn’t want to have to reach out to our members and cause them unnecessary worry until we knew the potential of what we were dealing with," she said. "With all of the factors and orchestrating credit monitoring, we do believe our response time has been reasonable."<br><span style="font-style: italic;">[Evan] "We didn't want to have to reach out to our members and cause them unnecessary worry until we know the potential of what we were dealing with" is a terrible reason to delay notification.&nbsp; BlueCross BlueShield needs to understand that they are NOT the information owners.</span><br><br>The company has also tightened its policies and procedures about use of laptops and other mobile devices "to ensure that the policies are more strict," she said. She added that officials are also encrypting all information on laptops "to prevent this situation from recurring."<br><span style="font-style: italic;">[Evan] Of the "No-nos" I mentioned above, this takes care of one.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Another laptop that may or may not have contained sensitive personal information that goes missing without encryption.&nbsp; Do you think John Doe from XYZ company thought twice about filling out his health insurance forms on his first day of work?&nbsp; He probably just expected better protection from a company that handles thousands of personal records. <br><br>I am certainly not a lawyer, nor am I qualified to give legal advise of any kinds, but this is a simple copy and paste...<br><br>Excerpt from <a href="http://assembly.state.ny.us/leg/?bn=A02261&amp;sh=t">New York Bill A02261</a>:<br>"ANY&nbsp; PERSON,&nbsp; FIRM,&nbsp; PARTNERSHIP,&nbsp; ASSOCIATION OR CORPORATION THAT COLLECTS, OWNS, MAINTAINS OR USES PERSONAL INFORMATION SHALL DISCLOSE&nbsp; A BREACH&nbsp; OF&nbsp; SECURITY&nbsp; RELATED&nbsp; TO&nbsp; UNENCRYPTED&nbsp; OR NON-REDACTED PERSONAL INFORMATION CONCERNING TWENTY-FIVE OR MORE RESIDENTS OF NEW YORK.&nbsp;&nbsp;&nbsp; THE DISCLOSURE&nbsp; SHALL BE MADE WITHIN TWO BUSINESS DAYS AFTER LEARNING OF THE BREACH OF SECURITY, BUT MAY BE&nbsp; DELAYED&nbsp; IF&nbsp; A&nbsp; LAW&nbsp; ENFORCEMENT&nbsp; AGENCY DETERMINES&nbsp; THAT&nbsp; THE NOTIFICATION WILL IMPEDE A CRIMINAL INVESTIGATION. THE NOTIFICATION REQUIRED BY THIS SECTION SHALL BE MADE&nbsp; AFTER&nbsp; THE&nbsp; LAW ENFORCEMENT&nbsp; AGENCY&nbsp; DETERMINES THAT IT WILL NOT COMPROMISE THE INVESTIGATION."<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/11/bcbswny.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 11 Mar 2008 12:31:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/information owners">information owners</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <source url="http://breachblog.com/2008/03/11/bcbswny.aspx">40,000 BlueCross BlueShield members notified of lost laptop</source>
    </item>
    <item>
      <title><![CDATA[Wired.com and History.com Getting RBN-ed]]></title>
      <link>http://securityratty.com/article/43140f23637e75c4ac1b173b0948fe77</link>
      <guid>http://securityratty.com/article/43140f23637e75c4ac1b173b0948fe77</guid>
      <description><![CDATA[Monitoring last week's IFRAME injection attack at high page rank-ed sites , reveals a simple truth, that persistent simplicity seems to work. The attack is still ongoing, this time successfully...]]></description>
      <content:encoded><![CDATA[<a href="http://bp2.blogger.com/_wICHhTiQmrA/R9Ve-0-0F7I/AAAAAAAABcY/FHcHNlSIh1k/s1600-h/Wired_com_IFRAME_RBN.jpg"><img id="BLOGGER_PHOTO_ID_5176147780199258034" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Ve-0-0F7I/AAAAAAAABcY/FHcHNlSIh1k/s200/Wired_com_IFRAME_RBN.jpg" border="0" /></a>Monitoring <a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">last</a> week's <a href="http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">IFRAME</a> injection <a href="http://ddanchev.blogspot.com/2008/03/more-cnet-sites-under-iframe-attack.html">attack</a> at high <a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">page rank-ed sites</a>, reveals a simple truth, that persistent simplicity seems to work. <strong>The attack is still ongoing, this time successfully injecting a multitude of new domains into Wired Magazine, and History.com's search engines, which are again caching anything submitted, particularly not validated input to have the malicious parties in the face of the RBN introducing a new malware, in between the pharmaceutical scams that they serve on the basis</strong><strong style="font-weight: bold;"> of an <a href="http://ddanchev.blogspot.com/2007/10/incentives-model-for-pharmaceutical.html">affiliation model</a>.</strong> So, after "<a href="http://www.itwire.com/content/view/17059/53/">CNET stops IFRAME site attacks - who's next?</a>" in terms of high-profile sites, that is <span style="font-weight: bold;">Wired.com</span> and <span style="font-weight: bold;">History.com</span><br /><div><br /><strong>Key summary points :</strong><br /><div> </div><br /><div>- the same malicious parties behind the CNET and TorrentReactor's IFRAME injection are also the ones behind Wired.com and History.com's <a href="http://ddanchev.blogspot.com/2008/03/injecting-iframes-by-abusing-input.html">abuse of input validation</a></div><br /><div> </div>- the IFRAME injection entirely relies on the lack of input validation within their search engines, making executable code possible to submit and therefore automatically execute upon accessing the cached page with a popular search query<div><strong></strong> </div><br />- many other domains have been introduced within the IFRAMEs, a complete list of which you can find in this post, several directly hosted within RBN's network<br /><div> </div><br /><div>- the main domain serving the heavily obfuscated VBS malware is located within the Russian Business Network's known netblocks</div><br /><div> </div>- given the high page ranks of the current and the previous targets, it is evident that the malicious parties are prioritizing based on the possibility to abuse input validation on high page rank-ed sites, presumably in an automated fashion<br /><div> </div><br /><div>- Keep it Simple Stupid works, as since they cannot find a way to embedd the IFRAME at these hosts, a clear indicating of the fact that they've breached them, they figured out a way to inject the IFRAMEs and again take advantage of the high page ranks to attract traffic by gaining on popular key words, or any kind of key words that they want to</div><br /><div><strong></strong></div><div><strong></strong></div><div><strong></strong></div><div><strong><div><a href="http://bp1.blogger.com/_wICHhTiQmrA/R9Vgsk-0F8I/AAAAAAAABcg/52pUSKuJCCQ/s1600-h/TV_com_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5176149665689900994" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R9Vgsk-0F8I/AAAAAAAABcg/52pUSKuJCCQ/s200/TV_com_IFRAME.jpg" border="0" /></a></div>Sites currently affected next to Wired.com and History.com :</strong><br />fhp.osd.mil<br /></div>hcc.cc.gatech.edu<br />buffalo.edu<br />uninews.unimelb.edu.au<br />uvm.edu<br />jurist.law.pitt.edu<br />bushtorrent.com<br />torrentportal.com<br /><br /><br /><div><strong></strong><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/R9Vn40-0F9I/AAAAAAAABco/OYZwfHnp6C0/s1600-h/IFRAME_inputvalidation_RBN.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Vn40-0F9I/AAAAAAAABco/OYZwfHnp6C0/s200/IFRAME_inputvalidation_RBN.jpg" alt="" id="BLOGGER_PHOTO_ID_5176157572724692946" border="0" /></a><strong>Newly introduced domains within the IFRAMEs :</strong></div>f3w.info (74.54.95.242)<br /><div>chdjzn.info (75.125.181.78)</div>gmjett.info (75.125.181.89)<br /><div>yscmps.info (75.125.181.124)</div>egkjnx.info (75.125.208.242)<br /><div>qkecep.info (75.125.181.99)</div>qxdprq.info (75.125.181.113)<br /><div>yscmps.info (75.125.181.124)</div>mqghrd.info (75.125.181.82)<br /><div>yydcaj.info (75.125.181.122)</div>ecwrhk.info (75.125.181.86)<br /><div>zdksgj.info (75.125.181.112)</div>stysqf.info (75.125.181.67)<br /><div>egyffr.info (75.125.181.112)</div>prnprn.info (75.125.181.106)<br /><div>fast-look.com (195.225.176.25)</div>fami4ka.net (217.20.127.217)<br /><div>looseais.info (70.47.105.5)</div>my-ringtones.org (78.108.182.164)<br /><div>eyzempills.com (81.222.139.184)</div>leohin.com (58.65.239.10)<br /><div>is-t-h-e.com (69.50.167.165)</div>89.149.220.85<br /><div> </div><br /><div><strong>Where are the IFRAMEs relocating the visitor to?</strong></div>search-vip.org/pharmacy/search.php?q= (195.225.178.19)<br /><div>pharma-cist.com/item.php?id=156 (81.222.139.93)</div>vip-pharmacy.org (195.225.178.19)<br /><div>adultfriendfinder.com/go/g665961<br />gift-vip.net/images/index1.php<br /></div><div> </div><br /><div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/R9Voo0-0F-I/AAAAAAAABcw/YEnw-tBUcG8/s1600-h/RBN_hosted_VBS.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/R9Voo0-0F-I/AAAAAAAABcw/YEnw-tBUcG8/s200/RBN_hosted_VBS.jpg" alt="" id="BLOGGER_PHOTO_ID_5176158397358413794" border="0" /></a><strong>Where's the malware?</strong></div><div> </div>The malware is loading from <strong>g</strong><strong>ift-vip.net/images/index1.php</strong> (195.225.178.19) where upon loading another IFRAME pointing to <strong>e.pepato.org/e/ads.php?b=3029</strong> (58.65.238.59) which is using <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">HostFresh</a> proving hosting, dns services courtesy of <a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">INTERCAGE-NETWORK-GROUP</a>, or the The Russian Business Network in all of its netblock diversity. It seems that <strong>pepato.org</strong>, currently hosted on one of RBN's netblocks, also made an appearance at <a href="http://blogs.ittoolbox.com/security/epl/archives/another-gov-site-hacked-22649">malware embedded attack at a .gov site</a> recently.<br /><div> </div><br /><div><strong>Scanner results</strong> : 3% Scanner(1/36) found malware!</div><strong>File Size</strong> : 16643 byte<br /><div><strong>MD5</strong> : 99eae1a189443c1a87681579cb4b5dbd</div><strong>SHA1</strong> : 89a04c4d06f51aa6d6cb54925a2c84d2bbdba06b<br /><div><strong>Arcavir</strong> - Trojan.HTML.JScript.Freebs.gen.9 under the JS:Feebs family; W32/Feebs-Fam ;JS.Feebs.Gen</div><br /><div> </div><strong>Several more currently active internal pages serving variants :</strong><br /><div>e.pepato.org/e/ads.php?b=3029</div>e.pepato.org/e/ads_nl.php?b=1006<br /><div>e.pepato.org/e/ads.php?b=1004</div>e.pepato.org/e/adsr.php?t=0<br /><div>e.pepato.org/e/mdqt.php</div>e.pepato.org/e/e1004.html<br /><br />Monitoring these connected incidents will continue, particularly the RBN connection, and other high profile sites' susceptibility to their attack methods.<br /><br /><span style="font-weight: bold;">Related embedded malware research :</span><br /><a href="http://ddanchev.blogspot.com/2008/03/embedding-malicious-iframes-through.html">Embedding Malicious IFRAMEs Through Stolen FTP Accounts</a><br /><a href="http://ddanchev.blogspot.com/2008/02/yet-another-massive-embedded-malware.html">Yet Another Massive Embedded Malware Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/12/mdac-activex-code-execution-exploit.html">MDAC ActiveX Code Execution Exploit Still in the Wild</a><br /><a href="http://ddanchev.blogspot.com/2008/01/malware-serving-exploits-embedded-sites.html">Malware Serving Exploits Embedded Sites as Usual</a><br /><a href="http://ddanchev.blogspot.com/2008/01/massive-realplayer-exploit-embedded.html">Massive RealPlayer Exploit Embedded Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/09/syrian-embassy-in-london-serving.html">Syrian Embassy in London Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/08/bank-of-india-serving-malware.html">Bank of India Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2007/09/us-consulate-st-petersburg-serving.html">U.S Consulate St. Petersburg Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/01/dutch-embassy-in-moscow-serving-malware.html">The Dutch Embassy in Moscow Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/uks-feta-serving-malware.html">U.K's FETA Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/anti-malware-vendors-site-serving.html">Anti-Malware Vendor's Site Serving Malware</a><br /><a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">The New Media Malware Gang - Part Three</a><br /><a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">The New Media Malware Gang - Part Two</a><br /><a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">The New Media Malware Gang</a><br /><a href="http://ddanchev.blogspot.com/2007/10/portfolio-of-malware-embedded-magazines.html">A Portfolio of Malware Embedded Magazines</a><br /><a href="http://ddanchev.blogspot.com/2007/11/another-massive-embedded-malware-attack.html">Another Massive Embedded Malware Attack</a><br /><a href="http://ddanchev.blogspot.com/2007/11/i-see-alive-iframes-everywhere.html">I See Alive IFRAMEs Everywhere</a><br /><a href="http://ddanchev.blogspot.com/2007/11/i-see-alive-iframes-everywhere-part-two.html">I See Alive IFRAMEs Everywhere - Part Two</a><br /><br /><span style="font-weight: bold;">Related RBN research :</span><br /><a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br /><a href="http://ddanchev.blogspot.com/2008/02/rbns-malware-puppets-need-their-master.html">RBN's Puppets Need Their Master</a><br /><a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices</a><br /><a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software</a><br /><a href="http://ddanchev.blogspot.com/2007/11/go-to-sleep-go-to-sleep-my-little-rbn.html">Go to Sleep, Go to Sleep my Little RBN</a><br /><a href="http://ddanchev.blogspot.com/2007/11/exposing-russian-business-network.html">Exposing the Russian Business Network</a><br /><a href="http://ddanchev.blogspot.com/2007/11/detecting-and-blocking-russian-business.html">Detecting the Blocking the Russian Business Network</a><br /><a href="http://ddanchev.blogspot.com/2007/10/over-100-malwares-hosted-on-single-rbn.html">Over 100 Malwares Hosted on a Single RBN IP</a><br /><a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br /><a href="http://ddanchev.blogspot.com/2007/10/russian-business-network.html">The Russian Business Network</a><br /><div> </div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sJfg24F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sJfg24F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lYPOJOF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lYPOJOF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=tSeiX9f"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=tSeiX9f" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0JQnkkf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0JQnkkf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=904JlAF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=904JlAF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=92oj9xF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=92oj9xF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JV7Ydmf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JV7Ydmf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/249045166" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 10 Mar 2008 11:20:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/vbs malware">vbs malware</category>
      <category domain="http://securityratty.com/tag/malware attack">malware attack</category>
      <category domain="http://securityratty.com/tag/rbn">rbn</category>
      <category domain="http://securityratty.com/tag/media malware gang">media malware gang</category>
      <category domain="http://securityratty.com/tag/iframe injection attack">iframe injection attack</category>
      <category domain="http://securityratty.com/tag/iframe injection">iframe injection</category>
      <category domain="http://securityratty.com/tag/malware research">malware research</category>
      <category domain="http://securityratty.com/tag/high-profile sites">high-profile sites</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/249045166/wiredcom-and-historycom-getting-rbn-ed.html">Wired.com and History.com Getting RBN-ed</source>
    </item>
    <item>
      <title><![CDATA[Creating and Entrapping Terrorists]]></title>
      <link>http://securityratty.com/article/2f39bf4f70e8c93e2a43b2bf16f48157</link>
      <guid>http://securityratty.com/article/2f39bf4f70e8c93e2a43b2bf16f48157</guid>
      <description><![CDATA[When I wrote this essay -- &quot;Portrait of the Modern Terrorist as an Idiot&quot; -- I thought a lot about the government inventing terrorist plotters and entrapping them, to make the world seem scarier....]]></description>
      <content:encoded><![CDATA[<p>When I wrote this essay -- <a href=http://www.schneier.com/essay-174.html>"Portrait of the Modern Terrorist as an Idiot"</a> -- I thought a lot about the government inventing terrorist plotters and entrapping them, to make the world seem scarier.  Since then, it's been on my list of topics to write about someday.</p>

<p><i>Rolling Stone</i> has <a href="http://www.rollingstone.com/politics/story/18137343/the_fear_factory">this excellent article</a> on the topic, about the Joint Terrorism Task Forces in the U.S.:</p>

<blockquote>But a closer inspection of the cases brought by JTTFs reveals that most of the prosecutions had one thing in common: The defendants posed little if any demonstrable threat to anyone or anything. According to a study by the Center on Law and Security at the New York University School of Law, only ten percent of the 619 "terrorist" cases brought by the federal government have resulted in convictions on "terrorism-related" charges -- a category so broad as to be meaningless. In the past year, none of the convictions involved jihadist terror plots targeting America. "The government releases selective figures," says Karen Greenberg, director of the center. "They have never even defined 'terrorism.' They keep us in the dark over statistics."

<p>Indeed, Shareef is only one of many cases where the JTTFs have employed dubious means to reach even more dubious ends. In Buffalo, the FBI spent eighteen months tracking the "Lackawanna Six" -- a half-dozen men from the city's large Muslim population who had been recruited by an Al Qaeda operative in early 2001 to undergo training in Afghanistan. Only two lasted the six-week course; the rest pretended to be hurt or left early. Despite extensive surveillance, the FBI found no evidence that the men ever discussed, let alone planned, an attack -- but that didn't stop federal agents from arresting the suspects with great fanfare and accusing them of operating an "Al Qaeda-trained terrorist cell on American soil." Fearing they would be designated as "enemy combatants" and disappeared into the legal void created by the Patriot Act, all six pleaded guilty to aiding Al Qaeda and were sentenced to at least seven years in prison.</p>

<p>In other cases, the use of informants has led the government to flirt with outright entrapment. In Brooklyn, a Guyanese immigrant and former cargo handler named Russell Defreitas was arrested last spring for plotting to blow up fuel tanks at JFK International Airport. In fact, before he encountered the might of the JTTF, Defreitas was a vagrant who sold incense on the streets of Queens and spent his spare time checking pay phones for quarters. He had no hope of instigating a terrorist plot of the magnitude of the alleged attack on JFK -- until he received the help of a federal informant known only as "Source," a convicted drug dealer who was cooperating with federal agents to get his sentence reduced. Backed by the JTTF, Defreitas suddenly obtained the means to travel to the Caribbean, conduct Google Earth searches of JFK's grounds and build a complex, multifaceted, international terror conspiracy -- albeit one that was impossible to actually pull off. After Defreitas was arrested, U.S. Attorney Roslynn Mauskopf called it "one of the most chilling plots imaginable."</p>

<p>Using informants to gin up terrorist conspiracies is a radical departure from the way the FBI has traditionally used cooperating sources against organized crime or drug dealers, where a pattern of crime is well established before the investigation begins. Now, in new-age terror cases, the JTTFs simply want to establish that suspects are predisposed to be terrorists -- even if they are completely unable or ill-equipped to act on that predisposition. High-tech video and audio evidence, coupled with anti-terror hysteria, has made it effectively impossible for suspects to use the legal defense of entrapment. The result in many cases has been guilty pleas -- and no scrutiny of government conduct.</p>

<p>In most cases, because no trial is ever held, few details emerge beyond the spare and slanted descriptions in the indictments. When facts do come to light during a trial, they cast doubt on the seriousness of the underlying case. The "Albany Pizza" case provides a stark example. Known as a "sting case," the investigation began in June 2003 when U.S. soldiers raided an "enemy camp" in Iraq and seized a notebook containing the name of an imam in Albany -- one Yassin Aref. To snare Aref, the JTTF dispatched a Pakistani immigrant named Shahed "Malik" Hussain, who was facing years in prison for a driver's-license scam. Instead of approaching Aref directly, federal agents sent Malik to befriend Mohammed Hossain, a Bangladeshi immigrant who went to the same mosque as Aref. Hossain, an American citizen who ran a place called Little Italy Pizzeria in Albany, had no connections whatsoever to terrorism or any form of radical Islam. After the attacks on 9/11, he had been quoted in the local paper saying, "I am proud to be an American." But enticed by Malik, Hossain soon found himself caught up in a government-concocted terror plot. Posing as an arms dealer, Malik told Hossain that a surface-to-air missile was needed for an attack on a Pakistani diplomat in New York. He offered Hossain $5,000 in cash to help him launder $50,000 -- a deal Hossain claims he never properly grasped. According to Muslim tradition, a witness is needed for significant financial transactions. Thus, the JTTF reached out for Hossain's imam and the true target of the sting -- Aref.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=P9Pt7lF"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=P9Pt7lF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=iq7QmOF"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=iq7QmOF" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 05 Mar 2008 03:25:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/terrorist">terrorist</category>
      <category domain="http://securityratty.com/tag/modern terrorist">modern terrorist</category>
      <category domain="http://securityratty.com/tag/hossain">hossain</category>
      <category domain="http://securityratty.com/tag/terrorist conspiracies">terrorist conspiracies</category>
      <category domain="http://securityratty.com/tag/deal hossain claims">deal hossain claims</category>
      <category domain="http://securityratty.com/tag/yassin aref">yassin aref</category>
      <category domain="http://securityratty.com/tag/aref">aref</category>
      <category domain="http://securityratty.com/tag/terrorist plot">terrorist plot</category>
      <category domain="http://securityratty.com/tag/stop federal agents">stop federal agents</category>
      <source url="http://www.schneier.com/blog/archives/2008/03/creating_and_en.html">Creating and Entrapping Terrorists</source>
    </item>
  </channel>
</rss>
