<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: dodge]]></title>
    <link>http://securityratty.com/tag/dodge</link>
    <description></description>
    <pubDate>Thu, 27 Dec 2007 10:42:18 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[VCsChoosing How to Invest]]></title>
      <link>http://securityratty.com/article/c4d8ac0dd426afdf9ac1d38d36dad4e8</link>
      <guid>http://securityratty.com/article/c4d8ac0dd426afdf9ac1d38d36dad4e8</guid>
      <description><![CDATA[Don Dodge has a series going on about VCs and why startups fail, and he says VCs say no to startups 99% of the time, yet still choose failing companies 33% of the time or so. Interestingly he compares...]]></description>
      <content:encoded><![CDATA[<p>Don Dodge has a series going on about VCs and why startups fail, and he says VC&#8217;s say no to startups 99% of the time, yet still choose failing companies 33% of the time or so. Interestingly he <a rel="nofollow" target="_blank" href="http://dondodge.typepad.com/the_next_big_thing/2008/08/why-vcs-say-no-99-of-the-time.html">compares </a>the selection process to the way investors choose their stocks &#8211;</p>
<blockquote><p>I would guess that every one of you reading this blog have a stock portfolio with 5 to 10 individual stocks or mutual funds. There are more than 5,000 publicly listed companies to choose from, and another 5,000 mutual funds. But, out of 10,000 possible companies you chose 10 to invest in. Why? Why did you reject the other 9,990 companies? Obviously there are more than 10 good companies to invest in. Other investors chose to invest their money in the other 9,990 companies&#8230;why not you?</p></blockquote>
<p>I suppose the difference must be that many investors aren&#8217;t actively involved in their investments (maybe entrepreneurs are more so, since they have to know a certain investment space quite well)&#8230;</p>
<p>It sounds to me a lot like the editorial selection process for book manuscripts, articles, and so forth &#8212; editors receive a ton of submissions and they have to be choosy. Sometimes they don&#8217;t pick winners; sometimes they pick losers. More importantly, each has a personal style, opinions, preferences, and they are trying to appeal to a certain audience. It&#8217;s interesting to think that VCs are similar but makes sense&#8211;the end question of &#8220;What will be successful&#8221; really depends on the consumer base and industry, and VCs are just people who probably know and prefer to interact with a certain type of consumer base or audience.</p>]]></content:encoded>
      <pubDate>Mon, 04 Aug 2008 06:23:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/investors chose">investors chose</category>
      <category domain="http://securityratty.com/tag/chose">chose</category>
      <category domain="http://securityratty.com/tag/investors">investors</category>
      <category domain="http://securityratty.com/tag/editorial selection process">editorial selection process</category>
      <category domain="http://securityratty.com/tag/investors choose">investors choose</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/selection process">selection process</category>
      <category domain="http://securityratty.com/tag/choose">choose</category>
      <category domain="http://securityratty.com/tag/mutual funds">mutual funds</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/355545351/">VCsChoosing How to Invest</source>
    </item>
    <item>
      <title><![CDATA[We should all be this bad - Microsoft is dead, long live Microsoft!]]></title>
      <link>http://securityratty.com/article/ad83513676ccf299126b10f556d6b99e</link>
      <guid>http://securityratty.com/article/ad83513676ccf299126b10f556d6b99e</guid>
      <description><![CDATA[I have written before about what a joke I think it is when people write that Microsoft???s best days are behind it and that their corporate grave is already being dug. Google is going to usher in a...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I have written before about what a joke I think it is when people write that Microsoft???s best days are behind it and that their corporate grave is already being dug.&nbsp; Google is going to usher in a new age of net centric computing and topple the once and future king. Yeah sure.&nbsp; Don Dodge had a <a href="http://dondodge.typepad.com/the_next_big_thing/2008/07/microsoft-revenues-top-60-billion---up-9b-over-last-year.html">good article up the other day</a> about Microsoft???s recent end of FY numbers.&nbsp; The Redmond rockets racked up over 60 billion (yeah with a b) in revenue last year, an 18% increase over the year before!&nbsp; They dropped 17.6 billion (again with a b) to the bottom line.&nbsp; To give it some perspective, Yahoo all told only does about 7 or 8 billion in gross revenue a year.&nbsp; Microsoft grew 9 billion in revenue last year.&nbsp; That is they grew organically more than a whole Yahoo.&nbsp; You can check out Don???s article for more financial facts and figures.</p>

<p>I ask you ladies and gentlemen, does this sound like the numbers of a company on the way down?&nbsp; If you were a betting person, would you be betting against this monster?&nbsp; I would not be.&nbsp; Do you think by 2011 things are going to fundamentally change? Next time someone tells you how open source, Linux, Google or anyone else is going to kill Microsoft try to put some of these numbers in prospective.</p></div>
]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 20:57:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/kill microsoft">kill microsoft</category>
      <category domain="http://securityratty.com/tag/revenue">revenue</category>
      <category domain="http://securityratty.com/tag/gross revenue">gross revenue</category>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/yahoo">yahoo</category>
      <category domain="http://securityratty.com/tag/net centric">net centric</category>
      <category domain="http://securityratty.com/tag/article">article</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/07/we-should-all-b.html">We should all be this bad - Microsoft is dead, long live Microsoft!</source>
    </item>
    <item>
      <title><![CDATA[We should all be this bad - Microsoft is dead, long live Microsoft!]]></title>
      <link>http://securityratty.com/article/302c83cf612d5a4d4cae54bf106c3b8a</link>
      <guid>http://securityratty.com/article/302c83cf612d5a4d4cae54bf106c3b8a</guid>
      <description><![CDATA[I have written before about what a joke I think it is when people write that Microsofts best days are behind it and that their corporate grave is already being dug. Google is going to usher in a new...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>I have written before about what a joke I think it is when people write that Microsoft’s best days are behind it and that their corporate grave is already being dug.&nbsp; Google is going to usher in a new age of net centric computing and topple the once and future king. Yeah sure.&nbsp; Don Dodge had a <a href="http://dondodge.typepad.com/the_next_big_thing/2008/07/microsoft-revenues-top-60-billion---up-9b-over-last-year.html">good article up the other day</a> about Microsoft’s recent end of FY numbers.&nbsp; The Redmond rockets racked up over 60 billion (yeah with a b) in revenue last year, an 18% increase over the year before!&nbsp; They dropped 17.6 billion (again with a b) to the bottom line.&nbsp; To give it some perspective, Yahoo all told only does about 7 or 8 billion in gross revenue a year.&nbsp; Microsoft grew 9 billion in revenue last year.&nbsp; That is they grew organically more than a whole Yahoo.&nbsp; You can check out Don’s article for more financial facts and figures.</p>

<p>I ask you ladies and gentlemen, does this sound like the numbers of a company on the way down?&nbsp; If you were a betting person, would you be betting against this monster?&nbsp; I would not be.&nbsp; Do you think by 2011 things are going to fundamentally change? Next time someone tells you how open source, Linux, Google or anyone else is going to kill Microsoft try to put some of these numbers in prospective.</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=XGXO7U"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=XGXO7U" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=EXP6eJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=EXP6eJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=n2oHgJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=n2oHgJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=tEOe0J"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=tEOe0J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=wI63XJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=wI63XJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=QJDZLj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=QJDZLj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Pqbarj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Pqbarj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/344249153" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 19:57:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/revenue">revenue</category>
      <category domain="http://securityratty.com/tag/gross revenue">gross revenue</category>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/kill microsoft">kill microsoft</category>
      <category domain="http://securityratty.com/tag/article">article</category>
      <category domain="http://securityratty.com/tag/dons article">dons article</category>
      <category domain="http://securityratty.com/tag/microsofts recent">microsofts recent</category>
      <category domain="http://securityratty.com/tag/microsofts">microsofts</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/344249153/we-should-all-b.html">We should all be this bad - Microsoft is dead, long live Microsoft!</source>
    </item>
    <item>
      <title><![CDATA[Fort Lewis soldiers exposed by laptop theft]]></title>
      <link>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</link>
      <guid>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08 (UPDATED 7/11/08 - Laptop with information about soldier found; Lacey teen arrested

Organization
United States Army
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usarmy.jpg" width="88" align="right" height="119"><font size="2"><b>Date Reported: </b><br>7/9/08 (UPDATED 7/11/08 - </font><a href="http://www.theolympian.com/377/story/504243.html">Laptop with information about soldier found; Lacey teen arrested</a>)<br><font size="2"><br><b>Organization: </b><br><a href="http://www.army.mil/">United States Army</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.lewis.army.mil/index.asp">Fort Lewis</a>*<br><font size="1"><br>*The principal Fort Lewis maneuver units are the 1st Brigade, 25th Infantry Division and the 3d Brigade, 2nd Infantry Division. It is also home to the 593d Corps Support Group, the 555th Engineer Group, the 1st MP Brigade (Provisional), the I Corps NCO Academy, Headquarters, Fourth ROTC Region, the 1st Personnel Support Group, 1st Special Forces Group (Airborne), 2d Battalion (Ranger), 75th Infantry, and Headquarters, 5th Army (West).&nbsp; Fort Lewis has more than 25,000 soldiers and civilian workers, source: <a href="http://www.lewis.army.mil/about-ft-lewis.asp">About Fort Lewis</a> </font><br><br><span style="font-weight: bold;">Victims:</span><br>Soldiers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~800 - 900<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.king5.com/localnews/stories/NW_070808WAB_soldiers_ID_theft_KC.3e0bcdc6.html">KING Channel 5 News</a> <br><a href="http://www.thenewstribune.com/news/local/story/409911.html">Tacoma News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Elisa Hahn, KING Channel 5 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials.<br><br>In this case, an Army employee told Lacey police he left the laptop and a 500-gigabyte removable hard drive on the seat of his Dodge truck, parked unlocked in front of his house overnight July 3<br><span style="font-style: italic;">[Evan] Storing personal information on removable devices such as laptops, external hard drives and flash drives without encryption, strike one.&nbsp; Moving the mobile device outside of a controlled area is strike two.&nbsp; Leaving the mobile device overnight in an unlocked vehicle in plain sight of passers-by is an emphatic strike three.</span><br><br>He reported them stolen about 10 a.m. on July 4.<br><span style="font-style: italic;">[Evan] A soldier's personal information stolen on the day our country celebrates our independence is insulting.</span><br><br>A post spokeswoman said officials were notifying the involved soldiers out of concern that the case might put them at risk for identity theft.<br><br>the Army began no later than Wednesday notifying the affected soldiers through e-mail and phone calls. They’ll get follow-up letters.<br><br>Officials said the employee, a civilian military personnel specialist, appears to have violated Army standards and policies for protecting personal information and government property.<br><br>Army laptops and removable storage devices containing personal information are generally restricted to on-post workplaces but can be signed out with a supervisor’s permission.<br><br>They’re also supposed to be password-protected and personal information is supposed to be encrypted<br><br>The Army is assisting Lacey police with the theft investigation and conducting its own review, said Catherine Caruso, a Fort Lewis spokeswoman.<br><br>"We’re not releasing anything more about what information was inappropriately compromised or about the soldiers whose information was involved," Caruso said.<br><br>"Clearly it was personal information regarding 800 to 900 soldiers from Fort Lewis. Beyond that, we’d rather not specify."<br><br>there was no classified, secret or top-secret information on the laptop and the hard drive.<br><br>Caruso said the employee was working on a project regarding a particular unit at a location other than his office.<br><br>She said "it would be inappropriate to speculate" about what potential disciplinary action the worker might face if he is found to have broken security rules.<br><span style="font-style: italic;">[Evan] It is probably inappropriate to speculate, but you know we will anyway.&nbsp; My guess is that there is another person looking for a job in the Olympia, Washington area.</span><br><br>Since the theft, post officials have set new training requirements for military personnel staff and prepared a memo for each employee to sign outlining the safeguarding and reporting requirements<br><br><span style="font-weight: bold;">Commentary:</span><br>When someone's poor judgment creates unnecessary risk to military personnel it carries a little more weight for me.&nbsp; These men and women give everything to protect us.&nbsp; Without them I wouldn't be able to write this, and without them you wouldn't be able to read it. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>United States Army:<br>June, 2008 - <a href="http://breachblog.com/2008/06/03/walterreed.aspx">Walter Reed Army Medical Center breach through P2P</a> <br>April, 2008 - <a href="http://breachblog.com/2008/04/13/usaasc.aspx%20">Excel Spreadsheet on the web exposes Army officers and civilians</a> <br><br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/11/usarmy.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 09:44:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fort lewis soldiers">fort lewis soldiers</category>
      <category domain="http://securityratty.com/tag/soldiers">soldiers</category>
      <category domain="http://securityratty.com/tag/fort lewis">fort lewis</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/lacey police officials">lacey police officials</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/army">army</category>
      <category domain="http://securityratty.com/tag/army standards">army standards</category>
      <source url="http://breachblog.com/2008/07/11/usarmy.aspx">Fort Lewis soldiers exposed by laptop theft</source>
    </item>
    <item>
      <title><![CDATA[Cloud computing - I want my cake and eat it too]]></title>
      <link>http://securityratty.com/article/08cf5b6a5664248521e1cb7dde8a58c7</link>
      <guid>http://securityratty.com/article/08cf5b6a5664248521e1cb7dde8a58c7</guid>
      <description><![CDATA[Its easy to dismiss Don Dodge's asking &quot; Do you really want your data in the cloud &quot; as a Microsoft guy defending their turf. Don uses some recent uptime problems at Amazon, Twitter, Disqus and...]]></description>
      <content:encoded><![CDATA[<p>Its easy to dismiss Don Dodge's asking "<a href="http://dondodge.typepad.com/the_next_big_thing/2008/06/amazon-twitter-disqus-down-do-you-really-want-your-data-in-the-cloud.html">Do you really want your data in the cloud</a>" as a Microsoft guy defending their turf. Don uses some recent uptime problems at Amazon, Twitter, Disqus and Typepad to show that keeping your information in the cloud and relying on the net to deliver your applications gives you less control, less security, less scalability and less reliability. <br><br>Don has a point, even though net access and SaaS services are much more mature than they were in the past, there is always the times when it does not work. For that matter, cell phones, blackberries, and cable TV don't always work either. An indication of how vital something has become is how much we miss it if it is not available. But to the point, I remember when the personal computer first came into being. The idea of your data and the applications being "portable" to your device was revolutionary. The idea of keeping your data on those big floppy discs was so empowering. But even than, problems accessing data on a disk or an application not behaving or security problems could render you just as frustrated on your non-networked device as an Amazon or twitter being down does now.<br><br>Ultimately I think these things go in cycles and we are entering a centralized cycle now. However, I think this turn of the cycle could be different. Never before has net access been so ubiquitous. Never before have we seen the depth of optimized applications for the net. The infrastructure is finally in place to recognize the dreams of many of "thin clients" and net terminals. But I think the best model is a hybrid model. I like the Microsoft solution where I can work on stuff online and off line on my computer, than sync up later. Ultimately when it comes cloud versus local computing, I want my cake and eat it too.</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=bKo6aa"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=bKo6aa" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=6vn7pI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=6vn7pI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=UvbzAI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=UvbzAI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=CV7dwI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=CV7dwI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jRguVI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jRguVI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=3TAfWi"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=3TAfWi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=xv0V5i"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=xv0V5i" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/307722334" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 08 Jun 2008 18:20:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/net terminals">net terminals</category>
      <category domain="http://securityratty.com/tag/net access">net access</category>
      <category domain="http://securityratty.com/tag/cloud versus local">cloud versus local</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/model">model</category>
      <category domain="http://securityratty.com/tag/personal computer">personal computer</category>
      <category domain="http://securityratty.com/tag/applications">applications</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/307722334/cloud-computing.html">Cloud computing - I want my cake and eat it too</source>
    </item>
    <item>
      <title><![CDATA[LPL Financial reports eighteen compromised logons]]></title>
      <link>http://securityratty.com/article/cacd9aa988fd370cb50e60d379a7975a</link>
      <guid>http://securityratty.com/article/cacd9aa988fd370cb50e60d379a7975a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/6/08

Organization
LPL Financial

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
10,219

Types of Data
names, addresses, phone...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/lpl.jpg" align="right" height="60" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/6/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.lpl.com/">LPL Financial</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>10,219<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, phone numbers, account numbers, Social Security numbers, and dates of birth"<br><br><span style="font-weight: bold;">Breach Description:</span><br>LPL Financial recently notified the Maryland State Attorney General of a breach in which "hackers compromised the logon passwords of fourteen financial advisors and four assistants of LPL Financial ("LPL")."&nbsp; The "hackers used these passwords to gain access to customer accounts in order to "pump and dump" penny stocks."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-152079.pdf">Maryland State Attorney General breach notification</a>&nbsp; <br><br><span style="font-weight: bold;">Report Credit:</span><br>Maryland State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We write to advise you of incidents in which hackers compromised the logon passwords of fourteen financial advisors and four assistants of LPL Financial ("LPL").<br><span style="font-style: italic;">[Evan] How does a "hacker" compromise usernames and passwords of eighteen people working for the same company?&nbsp; Compromised logon server, spear phishing, malware?</span><br><br>To our knowledge, the hackers used these passwords to gain access to customer accounts in order to "pump and dump" penny stocks.<br><br>Attempted transactions were intercepted and either rejected or reversed.<br><br>No losses were passed on to customers<br><br>Hackers compromised the logon passwords of fourteen financial advisors and four assistants in branch offices located in New Jersey, Illinois, Rhode Island, Pennsylvania, Colorado, Texas, California, Georgia and Connecticut over the course of several months.<br><br>These incidents affected approximately 10,219 individuals<br><br>The information that was potentially accessible included unencrypted names, addresses and Social Security numbers of customers and non-customer beneficiaries.<br><span style="font-style: italic;">[Evan] I don't know the architecture of LPL's network or other infrastructure components, but I question why customers or financial advisors need access to Social Security numbers as part of a trading system.&nbsp; I know that LPL needs to store Social Security numbers for tax and other reporting purposes, but financial advisors, traders and customers don't need access to them.</span><br><br>At this time, LPL has no specific knowledge that any customer information was accessed or misused as a consequence of the breach<br><br>We also are unaware of any personal instance of identity theft related to these incidents.<br><br>LPL learned of the first incident on July 16, 2007 and took the following actions: (1) notified law enforcement; (2) notified our primary regulator, the Financial Industry Regulatory Authority; (3) investigated the situation; (4) determined what information had been compromised; and (5) notified and offered solutions to the affected individuals.<br><br>LPL has taken several important steps to improve its level of data security and compliance<br><br>LPL has increased the profile of data security issues within the company at all levels, up to and including senior management.<br><br>In March 2008, LPL hired Marc Loewenthal as SVP - Chief Security/Privacy Officer, a newly created position at LPL.<br><span style="font-style: italic;">[Evan] This is the first breach notification that I have read that included this type of information.&nbsp; I don't know Mr. Loewenthal (which doesn't say too much), but I do know that he is stepping into a pressure situation.</span><br><br>Mr. Loewenthal has extensive experience in the area of data protection.&nbsp; As a member of senior management, he reports directly to the Chief Risk Officer of LPL.<br><span style="font-style: italic;">[Evan] I like when I read about information security personnel occupying "senior management" positions.&nbsp; Effective information security management needs to be as "senior" as possible in order to effect change in the organization.&nbsp; Information security governance is NOT an IT issue, but an organizational issue.&nbsp; There needs to be more good CISOs and CSOs.</span><br><br>In addition, LPL has developed a new, comprehensive information privacy and security program with new policies and procedures that were implemented in April 2008.<br><br>In August 2007, LPL engaged the services of Kroll Inc. ("Kroll"), a risk consulting company, to provide various services<br><br>In addition, LPL has commenced a project to enhance security on its advisor facing trading and operations systems in September 2007 and expects the project to complete in December 2008.<br><span style="font-style: italic;">[Evan] Details are not available, but I would be interested in knowing more.&nbsp; Maybe removal of SSNs from the advisor facing trading systems and two-factor authentication are part of the mix.</span><br><br>Finally, LPL recently engaged the services of Edwards Angell Palmer &amp; Dodge LLP to advise Mr. Loewenthal and LPL's in-house counsel as needed on information privacy and security issues.<br><br>LPL Financial is providing affected individuals with credit protection services from Kroll, Inc.<br><br>If you have any questions or feel you have an identity theft issue, please call ID TheftSmart at 1-800-588-9839 between 9:00 a.m. and 6:00 p.m. (Eastern Time), Monday through Friday.<br><br>If you want to talk to someone at LPL Financial to clarify or discuss the contents of this letter, please call us 1-800-558-7567, option 3 - Customer Service, between 9:00 a.m. and 6:00 p.m. (Eastern Time), Monday through Friday.<br><br>We apologize for any inconvenience or concern this situation may cause.<br><br>We at LPL Financial believe it is important for you to be fully informed of any potential risk resulting from this incident.<br><br>We remain committed to maintaining customer privacy as a key priority and will continue to take the needed steps to protect your information.<br><br><span style="font-weight: bold;">Commentary:</span><br>What makes this breach so interesting to me is the fact that there were at least 18 points of attack.&nbsp; I don't get the feeling that this was some sophisticated high-tech "hack" of LLP Financial's systems.&nbsp; It is much easier to craft an email or call someone and convince them to give you their login information.&nbsp; <br><br>Good luck Mr. Loewenthal, I'm sure you'll do fine! <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/20/lpl.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 04:56:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lpl financial">lpl financial</category>
      <category domain="http://securityratty.com/tag/lpl">lpl</category>
      <category domain="http://securityratty.com/tag/lpl financial recently">lpl financial recently</category>
      <category domain="http://securityratty.com/tag/lpl recently">lpl recently</category>
      <category domain="http://securityratty.com/tag/login information">login information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security governance">information security governance</category>
      <category domain="http://securityratty.com/tag/information privacy">information privacy</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <source url="http://breachblog.com/2008/05/20/lpl.aspx">LPL Financial reports eighteen compromised logons</source>
    </item>
    <item>
      <title><![CDATA[Are your digital devices Certified Pre-0wned?]]></title>
      <link>http://securityratty.com/article/95751c95a8406869ae2dbe324ea5e7cd</link>
      <guid>http://securityratty.com/article/95751c95a8406869ae2dbe324ea5e7cd</guid>
      <description><![CDATA[I took part in the L0pht Reunion Panel at the Source Boston conference in Cambridge, MA last Friday. It was a lot of fun to get back together with the band and pontificate with no holds barred about...]]></description>
      <content:encoded><![CDATA[<p>I took part in the <a href="http://www.sourceboston.com/blog/?p=27">L0pht Reunion Panel</a> at the <a href="http://www.sourceboston.com/">Source Boston</a> conference in Cambridge, MA last Friday.  It was a lot of fun to get back together with the &#8220;band&#8221; and pontificate with no holds barred about the latest security threats, just <a href="http://www.nytimes.com/library/magazine/home/19991003mag-hackers.html">like we did in the old days</a>.</p>
<p>One of the questions asked of the panel by moderator <a href="http://mffitzgerald.com/">Michael Fitzgerald</a> (who did a kick-ass job) was,  &#8220;What scares you the most these days?&#8221;. My answer was the proliferation of of inexpensive digital devices made in China that we plug into our computers.  The malware problem is getting tricky to dodge.  First you <a href="http://en.wikipedia.org/wiki/Melissa_(computer_worm)">couldn&#8217;t open email attachments</a> you weren&#8217;t expecting. Then you had to worry about <a href="http://news.bbc.co.uk/2/hi/technology/6645895.stm">surfing even trusted websites</a> with JavaScript turned on, even with the latest patched browsers. Now you have to worry about <a href="http://news.yahoo.com/s/ap/20080314/ap_on_hi_te/factory_installed_viruses">plugging in the shiny new digital toy</a> you got as a gift. Perhaps its a digital picture frame, digital camera, music player or silly programmable gizmo. Welcome to the age of factory installed malware &#8211;the age of devices coming <em>Certified Pre-0wned</em>.</p>
<p>The Associated Press <a href="http://news.yahoo.com/s/ap/20080314/ap_on_hi_te/factory_installed_viruses">writes</a>:</p>
<blockquote><p>Recent cases reviewed by The Associated Press include some of the most widely used tech devices: Apple iPods, digital picture frames sold by <span class="yshortcuts" id="lw_1205492037_0">Target</span> and <span class="yshortcuts" id="lw_1205492037_1">Best Buy stores</span> and TomTom navigation gear.</p>
<p>In most cases, Chinese factories — where many companies have turned to keep prices low — are the source.</p></blockquote>
<p>We all know malware is starting to fly under the radar of black list style detection.  Low volume malware is flooding the AV labs&#8217; capability to build detection for it. The digital picture frame sold at Sam&#8217;s club was infected with previously unknown malware that stole passwords and turned off AV software.</p>
<p>An additional threat that has been reported is devices have been found infecting the flash memory cards that are often inserted to upload photos.  <a href="http://isc.sans.org/diary.html?storyid=3995">From SANS</a>:</p>
<blockquote><p><span></span>“Recently I found a virus on it called Troj_Agent.SAO, which is what Trend Micro named it.<span>  </span>Anytime you plug a removable device into it, it would create two files Autorun.inf and autorun.exe.<span>  </span>The exe would place itself in the recycler\recycler folder and the .inf would place itself on the root of the removable drive as a hidden file.<span>  </span>At first I thought this virus came in on one of our employee’s pen drive but after further investigation I discovered that the files that the virus uses were created on the kiosk the day it was shipped out to us.<span>  </span>Also our vendor is using this kiosk in some of their stores at the moment and there have been reports that the kiosks have given their customers a virus. “<span> </span></p></blockquote>
<p>We are back to the days of the floppy or &#8220;sneaker net&#8221; attack vector. Do you know who has touched your SD card or USB drive? Don&#8217;t use it in public.  Don&#8217;t share it with multiple machines. Dan Geer told me he once tossed a USB drive into an audience with the slides for a presentation he just delivered on it.  About 10 people passed it around and copied off the slides.  It came back with a virus on it.  And this was at a security conference.</p>
]]></content:encoded>
      <pubDate>Mon, 17 Mar 2008 13:11:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/low volume malware">low volume malware</category>
      <category domain="http://securityratty.com/tag/drive">drive</category>
      <category domain="http://securityratty.com/tag/tech devices">tech devices</category>
      <category domain="http://securityratty.com/tag/usb drive">usb drive</category>
      <category domain="http://securityratty.com/tag/previously unknown malware">previously unknown malware</category>
      <category domain="http://securityratty.com/tag/digital picture frame">digital picture frame</category>
      <category domain="http://securityratty.com/tag/inexpensive digital devices">inexpensive digital devices</category>
      <source url="http://www.veracode.com/blog/?p=82">Are your digital devices Certified Pre-0wned?</source>
    </item>
    <item>
      <title><![CDATA[Off the wire: Pump-and-dump scam spam switches on video]]></title>
      <link>http://securityratty.com/article/79bfec94f5c24d2c39221b3451ad855a</link>
      <guid>http://securityratty.com/article/79bfec94f5c24d2c39221b3451ad855a</guid>
      <description><![CDATA[Uses video clips to shill stock and dodge antispam...]]></description>
      <content:encoded><![CDATA[Uses video clips to shill stock and dodge antispam defenses.]]></content:encoded>
      <pubDate>Thu, 27 Dec 2007 10:42:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dodge antispam defenses">dodge antispam defenses</category>
      <category domain="http://securityratty.com/tag/shill stock">shill stock</category>
      <category domain="http://securityratty.com/tag/video clips">video clips</category>
      <source url="http://feeds.feedburner.com/~r/HelpNetSecurity/~3/207000658/news.php">Off the wire: Pump-and-dump scam spam switches on video</source>
    </item>
  </channel>
</rss>
