<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: repair]]></title>
    <link>http://securityratty.com/tag/repair</link>
    <description></description>
    <pubDate>Wed, 07 May 2008 18:20:50 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[OpenOffice.org issues critical patches for older versions]]></title>
      <link>http://securityratty.com/article/90146978b97ff45fa7908a04dda082c2</link>
      <guid>http://securityratty.com/article/90146978b97ff45fa7908a04dda082c2</guid>
      <description><![CDATA[OpenOffice.org has released two patches that repair older versions of its open-source office productivity...]]></description>
      <content:encoded><![CDATA[OpenOffice.org has released two patches that repair older versions of its open-source office productivity suite.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:c22d671f3c066e8200578f7f3be5d0f7:zTOQf9YmutuAJeKmCbJ5nY1%2FzLw2%2BlzK7AjZZ35rzUF7N9TVVglgXTOPV%2BIbz7%2FBT0f%2FNTH068%2Fi'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:890e70b12016f2db78c12d66e9fb9dcc:SyTtS1myMMjqWHOFQq2PiQEQj2vHVdIPwLgxve353B16AjULnakfmfTFA54ouVibKgJ3RmDKbDnP9Q%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:cde42d3ec72bf9425819ea8ad15c432c:8EaIlNnLfsJg2qA5Mabcep3e51LtSujG1%2B0tRH7mzwX6VAmNDtYu2PPwjVM24%2B7T9hJYlugoAIYuVw%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:c8095a75a66159c25651711af9e7c611:HwfLE%2FHBSgJAJfHSiSqxVclgjkXsX5TzF1wV2FwEmZFmVKQ%2FugixZk0cUQWHLma0XAKITUi6am4rCA%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=f1beb8e2b619e958ad6b02dbeb460bd8" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=f1beb8e2b619e958ad6b02dbeb460bd8" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Thu, 30 Oct 2008 01:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/openoffice">openoffice</category>
      <category domain="http://securityratty.com/tag/patches">patches</category>
      <category domain="http://securityratty.com/tag/repair">repair</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=f1beb8e2b619e958ad6b02dbeb460bd8">OpenOffice.org issues critical patches for older versions</source>
    </item>
    <item>
      <title><![CDATA[OpenOffice.org issues critical patches for older versions]]></title>
      <link>http://securityratty.com/article/f5a94718038a0510d5dd5b5a45bf6572</link>
      <guid>http://securityratty.com/article/f5a94718038a0510d5dd5b5a45bf6572</guid>
      <description><![CDATA[OpenOffice.org has released two patches that repair older versions of its open-source office productivity...]]></description>
      <content:encoded><![CDATA[OpenOffice.org has released two patches that repair older versions of its open-source office productivity suite.]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/openoffice">openoffice</category>
      <category domain="http://securityratty.com/tag/patches">patches</category>
      <category domain="http://securityratty.com/tag/repair">repair</category>
      <source url="http://www.networkworld.com/news/2008/103008-openofficeorg-issues-critical-patches-for.html?fsrc=rss-security">OpenOffice.org issues critical patches for older versions</source>
    </item>
    <item>
      <title><![CDATA[Two Years of Broken Crypto: Debian's Dress Rehearsal for a Global PKI Compromise]]></title>
      <link>http://securityratty.com/article/432d2495bf0e8b9c969c9d8efd4895eb</link>
      <guid>http://securityratty.com/article/432d2495bf0e8b9c969c9d8efd4895eb</guid>
      <description><![CDATA[A patch to the OpenSSL package maintained by Debian GNU/Linux (an operating system composed of free and open source software that can be used as a desktop or server OS) submitted in 2006 weakened its...]]></description>
      <content:encoded><![CDATA[A patch to the OpenSSL package maintained by Debian GNU/Linux (an operating system composed of free and open source software that can be used as a desktop or server OS) submitted in 2006 weakened its pseudo-random number generator (PRNG), a critical component for secure key generation. Unnoticed for two years, the weak PRNG created a crypto-implementation nightmare with wide-ranging consequences that are difficult to repair. Putting both servers and users at risk, this vulnerability affected OpenSSH, Apache (mod_ssl), the onion router (TOR), OpenVPN, and other applications. In this article, I'll examine the issue and its consequences.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=82b45bc2d7e3da625459c51c5bb78bca" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=82b45bc2d7e3da625459c51c5bb78bca" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 00:42:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/prng">prng</category>
      <category domain="http://securityratty.com/tag/secure key generation">secure key generation</category>
      <category domain="http://securityratty.com/tag/weak prng">weak prng</category>
      <category domain="http://securityratty.com/tag/critical component">critical component</category>
      <category domain="http://securityratty.com/tag/openssl package">openssl package</category>
      <category domain="http://securityratty.com/tag/debian gnulinux">debian gnulinux</category>
      <category domain="http://securityratty.com/tag/onion router">onion router</category>
      <category domain="http://securityratty.com/tag/consequences">consequences</category>
      <category domain="http://securityratty.com/tag/source software">source software</category>
      <source url="http://www.pheedo.com/click.phdo?i=82b45bc2d7e3da625459c51c5bb78bca">Two Years of Broken Crypto: Debian's Dress Rehearsal for a Global PKI Compromise</source>
    </item>
    <item>
      <title><![CDATA[Brilliant UK Laptop Repair Service]]></title>
      <link>http://securityratty.com/article/f09dd3894fb6ff74b459017f09eddf9f</link>
      <guid>http://securityratty.com/article/f09dd3894fb6ff74b459017f09eddf9f</guid>
      <description><![CDATA[Its rare these days you get service so good you feel like writing to people about it. This morning (still sweaty from my morning run) I took the kids Vaio laptop (used for educational games and...]]></description>
      <content:encoded><![CDATA[It&#8217;s rare these days you get service so good you feel like writing to people about it. This morning (still sweaty from my morning run) I took the kids Vaio laptop (used for educational games and Internet TV (Windows Media Center of course)) to get a broken key repaired at PC World. After 15 mins [...]]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 07:02:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/kids vaio laptop">kids vaio laptop</category>
      <category domain="http://securityratty.com/tag/windows media center">windows media center</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/internet tv">internet tv</category>
      <category domain="http://securityratty.com/tag/educational games">educational games</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/rare">rare</category>
      <category domain="http://securityratty.com/tag/key">key</category>
      <category domain="http://securityratty.com/tag/days">days</category>
      <source url="http://securitybuddha.com/2008/10/07/brilliant-uk-laptop-repair-service/">Brilliant UK Laptop Repair Service</source>
    </item>
    <item>
      <title><![CDATA[Questions abound as San Francisco tries to repair network]]></title>
      <link>http://securityratty.com/article/3c67abab0bfc19c6115073ad0004880e</link>
      <guid>http://securityratty.com/article/3c67abab0bfc19c6115073ad0004880e</guid>
      <description><![CDATA[IT managers and analysts are expressing surprise at the amount of time it appears to be taking officials at the City of San Francisco to regain full control of the city's FiberWAN network after a...]]></description>
      <content:encoded><![CDATA[IT managers and analysts are expressing surprise at the amount of time it appears to be taking officials at the City of San Francisco to regain full control of the city's FiberWAN network after a disgruntled network administrator allegedly locked access to it by resetting administrative passwords to its switches and routers.]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/san francisco">san francisco</category>
      <category domain="http://securityratty.com/tag/network administrator allegedly">network administrator allegedly</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/administrative passwords">administrative passwords</category>
      <category domain="http://securityratty.com/tag/fiberwan network">fiberwan network</category>
      <category domain="http://securityratty.com/tag/routers">routers</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <source url="http://www.networkworld.com/news/2008/072208-questions-abound-as-san-francisco.html?fsrc=rss-security">Questions abound as San Francisco tries to repair network</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Errant email exposed Department of Consumer Affairs personal information]]></title>
      <link>http://securityratty.com/article/ca6f5be22b8296dc3dbda7041339d863</link>
      <guid>http://securityratty.com/article/ca6f5be22b8296dc3dbda7041339d863</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/23/08

Organization
State of California

Contractor/Consultant/Branch
Department of Consumer Affairs

Victims
employees, contractors and board members...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/caldca.jpg" width="169" align="right" height="65"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/23/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.ca.gov/">State of California</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.dca.ca.gov/">Department of Consumer Affairs</a><br><br><span style="font-weight: bold;">Victims:</span><br>"employees, contractors and board members"<br><br><span style="font-weight: bold;">Number Affected:</span><br>5,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, Social Security numbers, salaries and job titles<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The state Department of Consumer Affairs (DCA) has sent letters to 5,000 employees, contractors and board members warning them of a security breach that has compromised their names and social security numbers. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.capitolweekly.net/article.php?_adctlid=v%7Cjq2q43wvsl855o%7Cx7o1tt8kp1c3g5&amp;issueId=x79xdv8us2oeyp&amp;xid=x7csom3a3og08k">Capitol Weekly</a> <br><a href="http://www.centralvalleybusinesstimes.com/stories/001/?ID=9111">Central Valley Business Times</a> <br><a href="http://www.pogowasright.org/article.php?story=20080624114400847">Props to PogoWasRight</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Malcolm Maclachlan, Capitol Weekly<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The state Department of Consumer Affairs (DCA) has sent letters to 5,000 employees, contractors and board members warning them of a security breach that has compromised their names and social security numbers.<br><br>About 2,800 of the people on the list are current, full-time employees of the DCA.<br><br>The document also included some former employees and numerous contractors, such as people who proctor state job examinations.<br><br>The rest of the names were employees and board members of the 56 professional boards and bureaus administered by the DCA, such as the Bureau of Automotive Repair and the Medical Board.<br><br>The breach occurred on June 5 or 6 when a Microsoft Word document was improperly transmitted electronically outside of the department, said DCA spokesman Russ Heimerich.<br><br>The document also contained the salaries and titles of everyone on the list, but Heimerich noted that this was public information.<br><br>"The thing that is troubling to us is that information was coupled with their social security numbers," Heimerich said.<br><span style="font-style: italic;">[Evan] Troubling to you?&nbsp; It's probably hard for the victims to have much sympathy.</span><br><br>The main danger with giving away a social security number is that it can be used to set up new credit cards, loans or purchases in someone's name.<br><br>However, a thief would generally need other information that was not included and could be harder to get, such as addresses, phone numbers and driver's license numbers.<br><span style="font-style: italic;">[Evan] Addresses and phone numbers are usually pretty easy to obtain and I would think are much easier to get than Social Security numbers.&nbsp; Unless of course, somebody emails them to you.</span><br><br>The DCA is the main state agency charged with protecting consumers in California.<br><span style="font-style: italic;">[Evan] Ironic.</span><br><br>From 2003 to 2007, it also housed the office charged with educating consumers and businesses about identity theft and fraud.<br><span style="font-style: italic;">[Evan] More Ironic</span><br><br>One agency whose employees were not on the list is the California Office of Privacy Protection (OPP).<br><br>Heimerich said the incident is still being investigated, and that he could not disclose who had received the document.<br><br>He said that so far there is no evidence that any information has been used. It was not even clear the recipient had opened the document.<br><br>"We know that it left the building and that it wound up somewhere it shouldn't have wound up," Heimerich. "We're looking into how that happened."<br><br>“We kind of know where it was sent,” Mr. Heimerich says<br><span style="font-style: italic;">[Evan] Sounds obvious, but did anyone check "Sent Items"?&nbsp; Yeah, probably.&nbsp; Seriously though, does the California DCA not log email sends and receives?&nbsp; It's hard to believe that the sender does not recall to whom they sent the email and there is no evidence of where it was sent.</span><br><br>The breach was discovered on Monday, June 9<br><span style="font-style: italic;">[Evan] It took 3 or 4 days for the DCA to discover the breach.</span><br><br>People's whose names were on the list were sent an email the next day and an official letter a week later.<br><span style="font-style: italic;">[Evan] Excellent quick notification.&nbsp; The earlier that a breach is detected and communicated to the data owner, the better.</span><br><br>Heimerich said the DCA will pay for a year of free credit reports and provide fraud insurance of up to $25,000 for everyone on the list.<br><span style="font-style: italic;">[Evan] One year of protection does not adequately protect information that has a lifespan that far exceeds that one year.&nbsp; Most bad guys (or gals) know that the "standard" organization response to a breach includes one year of free credit monitoring/protection, so many of them wait a year to use the information.&nbsp; It is also important to point out that just because a person monitors their credit, does not mean that their identity isn't being used elsewhere.&nbsp; It's a scary thought, but it's a broken system.</span><br><br>He said the DCA had not yet determined how much these protections were going to cost. <br><span style="font-style: italic;">[Evan] You can estimate the cost yourself.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I like how Microsoft Outlook helps me when I am typing an email address in the "To:" field of my email.&nbsp; It saves me some keystrokes and a few precious seconds.&nbsp; Sometimes I am in such a hurry that I don't even notice that Outlook put in the wrong email address.&nbsp; I type my email, click send and away I go onto another task.&nbsp; A couple of days later, I get a call from a customer asking where their information is.&nbsp; I state that I sent it to them a couple of days ago, but they claim to have never gotten my email.&nbsp; I look through my sent items, and HOLY #*@^!&nbsp; I just sent some confidential (sensitive and potentially damaging) information to a competitor instead of my customer.<br><br>Sound conceivable?&nbsp; Have you ever sent an embarrassing email to the wrong person?&nbsp; It is very easy to do if your not paying attention.<br><br>There are a number of controls us information security guys can put in place to reduce the risk of this happening.&nbsp; One of the best is information security training and awareness (kind of an administrative control). <br><br><span style="font-weight: bold;">Past Breaches:</span><br><span style="font-weight: bold;">State of California:</span><br>March, 2008 - <a href="http://breachblog.com/2008/03/31/caldoc.aspx">San Quentin visitor and volunteer information lost</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/24/caldca.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 24 Jun 2008 13:51:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/volunteer information lost">volunteer information lost</category>
      <category domain="http://securityratty.com/tag/wrong email address">wrong email address</category>
      <category domain="http://securityratty.com/tag/email address">email address</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/adequately protect information">adequately protect information</category>
      <category domain="http://securityratty.com/tag/credit cards">credit cards</category>
      <category domain="http://securityratty.com/tag/credit">credit</category>
      <source url="http://breachblog.com/2008/06/24/caldca.aspx">Errant email exposed Department of Consumer Affairs personal information</source>
    </item>
    <item>
      <title><![CDATA[What Happens When You Mix A Real Infection With A Mass Mail Hoax?]]></title>
      <link>http://securityratty.com/article/dbcf1975a08632c61a109170590edfbf</link>
      <guid>http://securityratty.com/article/dbcf1975a08632c61a109170590edfbf</guid>
      <description><![CDATA[Here's a strange one. Snopes has always been a website that helped to combat mass mail hoaxes. However, I've seen a few mails snowballing (with ever increasing CC lists) regarding a page on Snopes...]]></description>
      <content:encoded><![CDATA[
        Here's a strange one. <a href="http://snopes.com/">Snopes</a> has always been a website that helped to combat mass mail hoaxes. However, I've seen a few mails snowballing (with ever increasing CC lists) regarding a page on Snopes that talks about a real infection - namely, the <a href="http://en.wikipedia.org/wiki/Storm_Worm">Storm Worm</a>. I'm all for spreading the word on infections going around, but as the emails talk about a "new threat incoming" (specifically, the title of the forwarded mail is "Subject: read this!Please read: Big Virus coming") when the Storm Worm has actually been around for some time, it seems almost perverse to be sending mass mails about a real infection from a website devoted to combating hoaxes and.....mass mails.<br /><br />Even weirder, the content of the mail begins with the Storm Worm, but actually <i>finishes</i> with text from a certified, 100% hoax (as you'll see with my handy all-in-bold additions).<br /><br />The full content of the mail reads as follows:<br /><br />&nbsp;&nbsp;&nbsp; <i>Subject: read this!Please read: Big Virus coming<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Please read: Big Virus coming<br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; http://www.snopes.com/computer/virus/postcard.asp<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Hi All, I checked with Norton Anti-Virus, and they are gearing up for this virus!<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; I checked Snopes (URL above:), and it is for real!!</i><br /><br /><b>(At this point, that would be correct - the&nbsp; link does indeed point to an article on Snopes regarding the Storm Worm. However, it's all about to go horribly wrong). </b><br /><br /><i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Get this E-mail message sent around to your contacts ASAP.<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; PLEASE FORWARD THIS WARNING AMONG FRIENDS, FAMILY AND CONTACTS!</i><br /><b><br />(The above suspiciously uses the required tone needed for fake EMail hoaxes to be passed around. It's almost like someone has done that on purpose, isn't it? At any rate, it all goes horribly wrong right....about.....now):</b><br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <i>You should be alert during the next few days. Do not open any message with an attachment entitled 'POSTCARD,' regardless of who sent it to you. It is a virus which opens A POSTCARD IMAGE, which 'burns' the whole hard disc C of your computer.<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; This virus will be received from someone who has your e-mail address in his/her contact list. This is the reason why you need to send this e-mail to all your contacts It is better to receive this message 25 times than to receive the virus and open it.<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; If you receive a mail called' POSTCARD,' even though sent to you by a friend, do not open it! Shut down your computer immediately.<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; This is the worst virus announced by CNN. It has been classified by Microsoft as the most destructive virus ever. This virus was discovered by McAfee yesterday, and there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the Hard Disc, where the vital information is kept .<br /><br />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; COPY THIS E-MAIL, A ND SEND IT TO YOUR FRIENDS. REMEMBER: IF YOU SEND IT TO THEM, YOU WILL BENEFIT ALL OF US.</i><br /><br /><b>(.....wait, what? We're suddenly talking about something entirely different. The above is taken from the "Invitation" <a href="http://www.snopes.com/computer/virus/invitation.asp">hoax virus warning</a>).</b><br /><br />Interestingly, Snopes themselves have picked up on the fact that people are combining two (or in some cases three) different sets of information about one real virus and two hoaxes, and warn people to that effect at the bottom of <a href="http://www.snopes.com/computer/virus/postcard.asp">this page</a>:<br /><br /><i>"Readers should take particular care not to confuse the real postcard/greeting card virus with a number of virus-related hoaxes that have been circulating for several years. A variety of messages forwarded by well-intended people to warn others about the Postcard virus contribute to this confusion by including within them links to our article about the "Virtual Card for You" hoax (or by mistakenly incorporating elements from that hoax into their warnings). Other versions of the postcard virus warning erroneously combine it with elements of the Invitation virus hoax"</i><br /><br />Whoops.&nbsp;<br /><br /><br /><br /><br /><br /><br /><br /><br /> 
        
    ]]></content:encoded>
      <pubDate>Mon, 23 Jun 2008 13:51:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/virus simply destroys">virus simply destroys</category>
      <category domain="http://securityratty.com/tag/virus">virus</category>
      <category domain="http://securityratty.com/tag/real virus">real virus</category>
      <category domain="http://securityratty.com/tag/norton anti-virus">norton anti-virus</category>
      <category domain="http://securityratty.com/tag/postcard virus contribute">postcard virus contribute</category>
      <category domain="http://securityratty.com/tag/mail">mail</category>
      <category domain="http://securityratty.com/tag/postcard virus">postcard virus</category>
      <category domain="http://securityratty.com/tag/destructive virus">destructive virus</category>
      <category domain="http://securityratty.com/tag/hoax virus">hoax virus</category>
      <source url="http://blog.spywareguide.com/2008/06/what-happens-when-you-mix-a-re.html">What Happens When You Mix A Real Infection With A Mass Mail Hoax?</source>
    </item>
    <item>
      <title><![CDATA[Did the Chinese PLA Attack the U.S. Power Grid?]]></title>
      <link>http://securityratty.com/article/5b52986466544ab7ed2ab88d8b8f1340</link>
      <guid>http://securityratty.com/article/5b52986466544ab7ed2ab88d8b8f1340</guid>
      <description><![CDATA[This article claims that the Chinese Peoples Liberation Army was behind, among other things, the August 2003 blackout: Computer hackers in China, including those working on behalf of the Chinese...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.nationaljournal.com/njmagazine/cs_20080531_6948.php">This</a> article claims that the Chinese Peoples Liberation Army was behind, among other things, the August 2003 blackout:</p>

<blockquote>Computer hackers in China, including those working on behalf of the Chinese government and military, have penetrated deeply into the information systems of U.S. companies and government agencies, stolen proprietary information from American executives in advance of their business meetings in China, and, in a few cases, gained access to electric power plants in the United States, possibly triggering two recent and widespread blackouts in Florida and the Northeast, according to U.S. government officials and computer-security experts.

<p>One prominent expert told <i>National Journal</i> he believes that China's People's Liberation Army played a role in the power outages. Tim Bennett, the former president of the Cyber Security Industry Alliance, a leading trade group, said that U.S. intelligence officials have told him that the PLA in 2003 gained access to a network that controlled electric power systems serving the northeastern United States. The intelligence officials said that forensic analysis had confirmed the source, Bennett said. "They said that, with confidence, it had been traced back to the PLA." These officials believe that the intrusion may have precipitated the largest blackout in North American history, which occurred in August of that year. A 9,300-square-mile area, touching Michigan, Ohio, New York, and parts of Canada, lost power; an estimated 50 million people were affected.</blockquote></p>

<p>This is all so much nonsense I don't even know where to begin.</p>

<p>I <a href="http://www.schneier.com/essay-002.html">wrote about</a> this blackout already.  It was Blaster.</p>

<blockquote>The "Interim Report: Causes of the August 14th Blackout in the United States and Canada," published in November and based on detailed research by a panel of government and industry officials, blames the blackout on an unlucky series of failures that allowed a small problem to cascade into an enormous failure.

<p>The Blaster worm affected more than a million computers running Windows during the days after Aug. 11. The computers controlling power generation and delivery were insulated from the Internet, and they were unaffected by Blaster. But critical to the blackout were a series of alarm failures at FirstEnergy, a power company in Ohio. The report explains that the computer hosting the control room's "alarm and logging software" failed, along with the backup computer and several remote-control consoles. Because of these failures, FirstEnergy operators did not realize what was happening and were unable to contain the problem in time.</p>

<p>Simultaneously, another status computer, this one at the Midwest Independent Transmission System Operator, a regional agency that oversees power distribution, failed. According to the report, a technician tried to repair it and forgot to turn it back on when he went to lunch.</p>

<p>To be fair, the report does not blame Blaster for the blackout. I'm less convinced. The failure of computer after computer within the FirstEnergy network certainly could be a coincidence, but it looks to me like a malicious worm.</blockquote></p>

<p>The rest of the <i>National Journal</i> article is filled with hysterics and hyperbole about Chinese hackers.  I have already written an essay about this -- it'll be the next point/counterpoint between Marcus Ranum and me for <i>Information Security</i> -- and I'll publish it here after they publish it.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=nv9LPI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=nv9LPI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=4f9MQI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=4f9MQI" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 02 Jun 2008 02:37:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/government officials">government officials</category>
      <category domain="http://securityratty.com/tag/august 14th blackout">august 14th blackout</category>
      <category domain="http://securityratty.com/tag/august">august</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/blackout">blackout</category>
      <category domain="http://securityratty.com/tag/status computer">status computer</category>
      <category domain="http://securityratty.com/tag/computer hackers">computer hackers</category>
      <source url="http://www.schneier.com/blog/archives/2008/06/did_the_chinese.html">Did the Chinese PLA Attack the U.S. Power Grid?</source>
    </item>
    <item>
      <title><![CDATA[Personal information from two Colorado mortgage companies found in dumpsters]]></title>
      <link>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</link>
      <guid>http://securityratty.com/article/7ae56d34b365648af4041ccd173db81f</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/28/08

Organization
Cove Creek Mortgage
Front Range Mortgage, LLC

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/covecreek.jpg" align="right" height="82" width="167"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/28/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.covecreekmortgage.com/">Cove Creek Mortgage</a> <br><a href="http://www.frontrangemortgage.com/">Front Range Mortgage, LLC</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Mortgage files, tax returns, pay stubs, Social Security numbers, and other personal information<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.thedenverchannel.com/news/16038972/detail.html">Denver Channel 7 News</a> <br><a href="http://www.thedenverchannel.com/news/16064711/detail.html">Denver Channel 7 News (update)</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Denver Channel 7 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>ENGLEWOOD, Colo. -- The Arapahoe County District Attorney's Office is advising anyone who has used Cove Creek Mortgage to watch out for identity theft after hundreds of mortgage files were dumped in a public trash bin over the weekend.<br><span style="font-style: italic;">[Evan] Cove Creek Mortgage joins the ranks of other mortgage companies reported for similar breaches on The Breach Blog.&nbsp; The others are </span><a style="font-style: italic;" href="http://breachblog.com/2008/03/19/affordable.aspx">Affordable Realty</a><span style="font-style: italic;"> and </span><a style="font-style: italic;" href="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage Services of Cleveland, Inc.</a><span style="font-style: italic;">. </span><br><br>Cove Creek's owner had abandoned his Englewood office in January, and property managers had not been able to find him<br><i>[Evan] What kind of businessman just abandons an office full of confidential files and equipment?</i><br><br>On Saturday, the property manager had a crew clean out his office and throw all items from the office -- including complete mortgage files -- into two Dumpsters.<br><i>[Evan] Maybe the property manager should pay a little closer attention to the things they throw in the dumpster.&nbsp; Having said this, the property manager is not really at fault.</i><br><br>David Peters who works in the same complex found the files Monday morning.<br><br>"I was taking some other trash out to the garbage can and opened the lid and on there was a couple of laptops,"<br><br>"Directly underneath them were files with people's names on it and I was like, 'Well, this is not right.'"<br><br>"There were tax returns, pay stubs, everything in there," he said. "And as I looked at the different files I realized that it was mortgage files, which was kind of scary, because who do you disclose the most information to or all of your information? That is when you are getting a mortgage loan."<br><i>[Evan] According to the news report, Mr. Peters contacted authorities.&nbsp; This could have easily been much worse for victims.</i><br><br>The Dumpsters were not secured and located at 88 Inverness Drive East, Bldg. F.<br><br>Sheriff's investigators finally found the owner of Cove Creek and talked him into retrieving the files, many of which had private information, including Social Security numbers and credit history.<br><span style="font-style: italic;">[Evan] Mr. owner guy, will you please come get your stuff and the personal information that was entrusted to you?&nbsp; According to </span><a style="font-style: italic;" href="http://www.zoominfo.com/Search/PersonDetail.aspx?PersonID=41991084">zoominfo</a><span style="font-style: italic;"> a guy named Charlie Cartwright is/was the president of Cove Creek Mortgage.&nbsp; I have no idea if this is the same guy that is referred to in the news article.</span><br><br>The district aAttorney's office got a tip about numerous mortgage files and two laptop computers in a Dumpster behind offices formerly used by Cove Creek Mortgage and Front Range Mortgage.<br><i>[Evan] Now Front Range Mortgage joins the ranks.&nbsp; Front Range Mortgage offers <a href="http://www.frontrangemortgage.com/credit_consultants.html">credit repair services</a> too! Do you suppose they could have repaired the damage that could have been done?</i><br><br>"With a name, Social Security number and bank account number, they can clean you out before you even know," said Arapahoe County District Attorney Carol Chambers.<br><br>The files and computers contained sensitive information on many former customers of Front Range Mortgage, including names and addresses, Social Security numbers and bank, credit card and investment account information.<br><br>While there are civil laws against dumping such documentation, Chambers said it is not against the law.<br><i>[Evan] It's too bad that we have to write and enforce laws to protect us from idiots.</i><br><br>"I think it is a matter of legislation not catching up with the realities of identity theft," said Chambers. "And absolutely, we think recklessly disposing or negligently disposing of this kind of information should maybe carry a criminal penalty, just to get people's attention that you can't just leave this information or leave it out in a Dumpster."<br><br>"The district attorney recommends that any former customers of Front Range or Cove Creek should place a fraud alert on their credit reports and monitor any bank, credit card or investment accounts that might have been included on a mortgage application with that firm."<br><br>For further information, assistance or questions, call the District Attorney's Fraud Assistance Line at 720-874-8547.<br><br><b>Commentary:</b><br>What is with these mortgage companies?&nbsp; The 90's and early 2000's was a wild ride for mortgage brokers, real estate agents, and investors.&nbsp; The money attracted people from all walks of life and a lot of poor decisions were made.&nbsp; Now that the bubble has burst, we start to see the true colors of some of these "professionals".<br><br>I don't know much if anything about the owners of these companies, but I do know that securing personal information poorly is bad business. <br><br><b>Past Breaches:</b><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/07/covecreek.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 07 May 2008 18:20:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mortgage files">mortgage files</category>
      <category domain="http://securityratty.com/tag/numerous mortgage files">numerous mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/complete mortgage files">complete mortgage files</category>
      <category domain="http://securityratty.com/tag/personal information poorly">personal information poorly</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/cove creek mortgage">cove creek mortgage</category>
      <category domain="http://securityratty.com/tag/cove creek">cove creek</category>
      <source url="http://breachblog.com/2008/05/07/covecreek.aspx">Personal information from two Colorado mortgage companies found in dumpsters</source>
    </item>
  </channel>
</rss>
