<![CDATA[[SecurityRatty] tag: reuters]]> http://securityratty.com/tag/reuters Tue, 03 Jun 2008 07:28:32 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more]]> http://securityratty.com/article/40c512ffa3724f6d4a41f0c63caad84d http://securityratty.com/article/40c512ffa3724f6d4a41f0c63caad84d

Synopsis:  Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more

Welcome to Blue Box: The VoIP Security Podcast #81, a 42-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 19MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on May 21, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 26 Aug 2008 17:16:43 +0000 voip voip security news voip users based enterprise voip planet voip calls voip privacy security voip news voip security podcast Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more <![CDATA[Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more]]> http://securityratty.com/article/133c80b2a9536649a83e82483659eb92 http://securityratty.com/article/133c80b2a9536649a83e82483659eb92

Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

Download the show here (MP3, 19MB) or subscribe to the RSS feed to download the show automatically. 

NOTE: This show was originally recorded on April 21, 2008.

You may also listen to this podcast right now:

Show Content:

Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

Thank you for listening and please do let us know what you think of the show.

]]> Tue, 26 Aug 2008 16:16:43 +0000 voip voip security news voip users based enterprise voip planet voip calls voip privacy security voip news voip security podcast Blue Box #81: iSkoot vulnerability, OFCOM legislation, VoIP security news and more <![CDATA[FaceTime wins lawsuit against Thomson Reuters over IM code]]> http://securityratty.com/article/ac0a5d55111401fcc38a631572924217 http://securityratty.com/article/ac0a5d55111401fcc38a631572924217

]]> Thu, 31 Jul 2008 09:00:00 +0000 thomson reuters facetime legal battle code instant messages enable stop application service FaceTime wins lawsuit against Thomson Reuters over IM code <![CDATA[Can The Gov Be Trusted With Your Personal Data?]]> http://securityratty.com/article/f09583068525ca2d56abe689ff8ea4e0 http://securityratty.com/article/f09583068525ca2d56abe689ff8ea4e0 Survey says…(insert buzzer noise)

Faith in the (UK) gov’s ability to securely manage personal data is out the window.

From Reuters:

The inquiries followed Britain’s biggest data loss scandal, when two discs containing child benefit records, including names, addresses and bank details, of some 25 million people, went missing after being put in the post by a junior employee.

The reports concluded that it wasn’t individuals who were to blame - some 30 were officials played some role in events leading to the loss of the discs - but institutional and systematic failures at Britain’s tax authority.

But the HMRC is not alone in such security breaches. A separate report into a stolen laptop containing the details of 600,000 potential recruits revealed similar failings at the Ministry of Defence. In all, four MoD computers had been stolen since 2004 and the report said the MoD was probably in breach of several principles set out in the Data Protection Act.

Well, where do you stand? Do you trust your respective government not to punt on data security?

Read on.

Article Link

]]> Thu, 26 Jun 2008 08:44:35 +0000 loss data loss scandal britains britains tax authority data protection act details child benefit records mod computers bank details Can The Gov Be Trusted With Your Personal Data? <![CDATA[Security Briefing: June 12th]]> http://securityratty.com/article/b2893d182cde9224ef787f6e8fd1b0ef http://securityratty.com/article/b2893d182cde9224ef787f6e8fd1b0ef
newspapera.jpg

Well, imagine that. I received this email at 9:31 am yesterday from the marketing folks at Infosecurity Canada.

Sorry Dave…I will make arrangements for a badge to be ready for pick up at pre-registration.

Um, yeah see I was on the other side of the city. At least Myrcurial is on the ground. Maybe he’ll grace us with an update.

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

  1. Banks slip through virus loophole | The Guardian UK
  2. Danish filter catches Romanian child-porn sites | Computer World
  3. City officials confident information is secure (This is funny. They’re claiming 15 char password is secure. Sigh)| Belleville Intelligencer
  4. Sophos assists Computer Crime Unit in bringing botnet master to justice | Sophos Press
  5. U.S. warns on Olympics computer security | UPI
  6. Lawmakers accuse China of hacking computers | Reuters
  7. China denies hacking into US computers | Associated Press
  8. Customer fears grow after mass hacking of retail website | Customer Strategy
  9. Online medical records offer convenience, may limit privacy | USA Today

Tags: , , , ,

]]> Thu, 12 Jun 2008 10:52:30 +0000 security news news lawmakers accuse china sophos press press olympics computer security customer fears secure retail website Security Briefing: June 12th <![CDATA[T-Mobile, AT&T, Starbucks Make Nice about Wi-Fi]]> http://securityratty.com/article/60919a9cb82e31cad0f852bf9779cf61 http://securityratty.com/article/60919a9cb82e31cad0f852bf9779cf61 Starbucks informed me that it, AT&T, and T-Mobile have signed a memorandum of understanding about the free Wi-Fi kerfuffle: T-Mobile filed a lawsuit a few days ago against Starbucks stating it wasn't involved in discussions about its network carrying free loyalty-awarded Wi-Fi via AT&T's authentication system. Now the three companies are apparently making nice.

The statement from Starbucks reads: "T-Mobile, AT&T and Starbucks have entered into a memorandum of understanding to resolve their disputes and are committed to providing a high quality WiFi experience for customers, including Starbucks Rewards Customers, at Starbucks locations nationwide."

My interpretation is Starbucks said, oops, our bad, and they're figuring out the dollars and cents. Sometimes companies move too rapidly. T-Mobile is a quasi-jilted suitor, although they get something out of AT&T transition, too, so they're not likely to cut any slack.

Reuters confirms that AT&T confirms the statement. I separately confirmed with T-Mobile that the statement is accurate as well.

]]> Wed, 11 Jun 2008 06:07:54 +0000 starbucks starbucks reads t-mobile starbucks rewards customers wi-fi starbucks locations nationwide att att confirms t-mobile filed T-Mobile, AT&T, Starbucks Make Nice about Wi-Fi <![CDATA[T-Mobile Sues Starbucks over Premature Free Wi-Fi]]> http://securityratty.com/article/9af62b0022762210a4e7cd7866ac74ff http://securityratty.com/article/9af62b0022762210a4e7cd7866ac74ff T-Mobile filed a complaint in New York's Supreme Court over the Starbucks Card Rewards free Wi-Fi launched this week: T-Mobile spokesperson Peter Dobrow said this evening that his firm was surprised when the free Wi-Fi was launched in every market, because T-Mobile wasn't party to that deal. "Starbucks launched this promotion without involving T-Mobile," he said. Dobrow said that T-Mobile continues to operate 95 percent of the Starbucks locations in the U.S. under contract as AT&T transitions into its role as the new operator.

The lawsuit, which I've read, says that T-Mobile never agreed to nor was compensated for providing free service in stores. A link to AT&T's network in all markets except San Antonio, Tex., and Bakersfield, Calif., is handled on the backend entirely by T-Mobile. The suit notes, "If AT&T or Starbucks wanted to offer 'free' Wi-Fi in non-transitioned stores for Starbucks customers, as they are now doing, they should have--and, indeed, were contractually required to--negotiate such an arrangement with T-Mobile."

The crux is that while T-Mobile did agree to provide free roaming to AT&T subscribers, as defined in a bilateral roaming agreement the two firms signed, T-Mobile states the agreement doesn't allow other parties to roam for free. (That's most likely why we haven't seen AT&T's roaming partners, like Boingo and iPass, appear in the login menu, too.)

Representatives of Starbucks immediately available on a Friday night. A Reuters report quotes a Starbucks spokesperson who doesn't comment directly on the suit.

An AT&T spokesperson said via email that the company doesn't comment on other companies' lawsuits. AT&T is not a party to the suit, although it is mentioned throughout.

The lawsuit provides quite a bit of previously private detail about the transition agreement. T-Mobile says that the transition contract signed by all three parties, T-Mobile still had responsibility for and ownership of a market until all equipment in all stores in a defined market belong to AT&T. The agreement also called for exclusive roaming only for each party's existing subscribers in markets that were converted or still under T-Mobile's control until 4-Jan-2009.

T-Mobile states in the suit that they didn't learn of the planned launch of the free Wi-Fi service until 30-May-2008.

T-Mobile wants money, release from current obligations, and other damages. I expect that things have gone quite far for them to file a suit.

"We hope to come to an amicable solution, and sometimes you do have to file a complaint in order to make that happen," T-Mobile's Dobrow said. "It's easy to give something away for free if it's not yours."

]]> Fri, 06 Jun 2008 15:18:56 +0000 free wi-fi free t-mobile wi-fi starbucks t-mobile filed t-mobile continues provide free subscribers T-Mobile Sues Starbucks over Premature Free Wi-Fi <![CDATA[Securiy Briefing: June 6th]]> http://securityratty.com/article/dd0c564dca2422cfc43519ef1455de5f http://securityratty.com/article/dd0c564dca2422cfc43519ef1455de5f
newspapera.jpg

Working form the home office this morning. The best kind of commute. Now, back to my research.

Click here to subscribe to Liquidmatrix Security Digest!

And now, the news…

  1. Google to allow third party code in Gmail? | Builder AU
  2. Skype patches security policy bypassing vulnerability | ZDNet
  3. Experts warn of security-dodging Trojans | vnunet
  4. Microsoft Patch Tuesday promises seven fixes | The Register
  5. 6 burning questions about network security | Network World
  6. ArcSight and VeriSign Enterprise Security Services Launch Global Business Relationship | Compliance Home
  7. EU gives mixed response to new U.S. travel laws | Reuters
  8. Conroy launches service to warn of e-crimes | Australian IT
  9. Are you a computer security professional? | InfoWorld

Tags: , , , ,

]]> Fri, 06 Jun 2008 08:56:35 +0000 security news news experts warn computer security professional conroy launches service warn network security travel laws mixed response Securiy Briefing: June 6th <![CDATA[Picture of Camera Thieves Uploaded by Eye-Fi]]> http://securityratty.com/article/4060220ba0cb57ff32255f9f96098ccb http://securityratty.com/article/4060220ba0cb57ff32255f9f96098ccb This story is a bit cute, but it's true: Alison DeLauzon, Reuters reports, had her camera stolen when left an equipment bag in a restaurant in Florida. The folks who allegedly took the bag also took pictures of themselves, which isn't unusual. But DeLauzon had an Eye-Fi wireless Secure Digital (SD) card in her camera, received as a gift. The thieves apparently wandered by an open access point with the same SSID as one that DeLauzon had configured for use, and pictures of her baby and the thieves were uploaded to her picture-sharing account. Nifty.

This is reminiscent of another recent story in which an Apple Store employee was able to use Mac OS X 10.5 Leopard's Back to My Mac remote access software to connect to a laptop that was stolen from her apartment to grab images and screenshots of the two men alleged to have taken the laptop and other gear.

]]> Thu, 05 Jun 2008 11:09:06 +0000 thieves delauzon camera alison delauzon recent story story apple store employee equipment bag bag Picture of Camera Thieves Uploaded by Eye-Fi <![CDATA[Personal information stolen from State Street mystery vendor]]> http://securityratty.com/article/e36f5feb727edb6b2a9058889b8adb2b http://securityratty.com/article/e36f5feb727edb6b2a9058889b8adb2b Security Breach

Date Reported:
5/29/08

Organization:
State Street Corporation

Stock Symbol:
NYSE: STT

Contractor/Consultant/Branch:
Unnamed vendor hired "to provide legal support services"

Victims:
"employees and some customers of the former Investors Financial Services Corp. (“IBT”)"

Number Affected:
"more than 45,000"

Types of Data:
Names, addresses, dates of birth, and, in some cases, Social Security numbers.

Breach Description:
"State Street Corp. (STT) sent notices to employees and some customers of the former Investors Financial Services Corp. that computer equipment containing personal data was stolen from a vendor's facility."

Reference URL:
State Street Corporation News Release
The Boston Globe
Dow Jones Newswires via CNNMoney
Boston Business Journal
Reuters via CNBC

Report Credit:
State Street Corporation

Response:
From the online sources cited above:

State Street Corp. said yesterday that a disk drive containing personal details from 5,500 employees and 40,000 customer accounts was stolen

BOSTON, MAY 29, 2008 – State Street Corporation (NYSE: STT) today began sending precautionary notifications to employees and some customers of the former Investors Financial Services Corp. (“IBT”) that computer equipment containing certain personal data was stolen from a vendor’s facility.
[Evan] So this vendor relationship is probably governed by a vendor/third-party security policy and supporting documentation and processes, right?

IBT had engaged the vendor for legal support services.

the compromised information was among a batch of data sent to the analysis firm, which she declined to identify except to say it was in the United States. (A spokeswoman for State Street of Boston)
[Evan] Why decline to identify?  If I were someone affected by this (thank God I am not), do you think that I should have the right to know?  After all, am I not the owner of my personal information?

At the time of the transfer, the data were encrypted, making it much more difficult to misuse. But the firm had unencrypted the information for its work and stored it on the hard drive that was then stolen
[Evan] This is why data-at-rest encryption is as (or more) important that data-in-transit encryption.  Both applications have their place in many information protection strategies.

Lost details included individuals' names, addresses, dates of birth, and, in some cases, Social Security numbers.

There is no evidence to date to suggest that the data has been misused or that legacy State Street customers or employees are impacted.

The theft was reported to federal authorities

the theft occurred in December and was reported to State Street in January

State Street didn't disclose the breach publicly or to individuals until yesterday because it took months to determine who was affected
[Evan] Yeah, like more than four months!  Let's say that only one FTE was assigned to determining what data was on the stolen computer equipment.  One FTE x 40 hours x 17 weeks (est.) = 680 hours.

As a precaution, State Street is notifying legacy IBT employees and certain legacy IBT customers whose personal data was on the stolen computer equipment.
[Evan] I don't like the word "precaution" used in notification that is a "reaction".

This notification process is expected to be completed shortly.

State Street has developed a dedicated section of its website with more details for the legacy IBT customers and employees who will receive these precautionary notifications. This information can be found at www.statestreet.com/notification and includes detail about a number of credit monitoring services being made available by State Street at no cost for two years.

State Street said this was the first case of data theft in its history.
[Evan] State Street was founded in 1792, and this is the first case of data theft?  If so, that's amazing!

Contact Information:
Customers:
Please contact your usual customer representative.
Media:
Please contact publicrelations@statestreet.com.
Employees:
Please contact GHR Customer Service at +1 617 985 8040.

Commentary:
Make sure that your information security program takes into account the information that is shared with vendors, partners, and other third-party providers.  There are numerous approaches that can be employed and customized to an individual business or organization.  Most effective information security programs govern the security of confidential information shared with third-parties through policy, contractual language, standards, and periodic assessments for compliance.  If possible, get information security personnel involved very early on in the establishment of the relationship.

Past Breaches:
Unknown

]]> Tue, 03 Jun 2008 07:28:32 +0000 information personal information street legacy ibt customers ibt street corp customers information protection strategies data Personal information stolen from State Street mystery vendor