<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: sacramento]]></title>
    <link>http://securityratty.com/tag/sacramento</link>
    <description></description>
    <pubDate>Mon, 28 Jan 2008 08:26:35 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Silent Break-Ins: How Technology Compromises Physical Security Too]]></title>
      <link>http://securityratty.com/article/037bb160455e2a7c95f039f67e29cad0</link>
      <guid>http://securityratty.com/article/037bb160455e2a7c95f039f67e29cad0</guid>
      <description><![CDATA[I could have used this technique last night I got home to my apartment in Oakland at 11:30, only to realize Id left my keys in Sacramento. Two hours later a locksmith finally came and charged me $100...]]></description>
      <content:encoded><![CDATA[<p>I could have used this technique last night &#8212; I got home to my apartment in Oakland at 11:30, only to realize I&#8217;d left my keys in Sacramento. Two hours later a locksmith finally came and charged me $100 to let me in my own apartment. Expensive? Maybe, but comparable to other services, and compared to the havoc that a lock-breaker could wreak if he was trying to use his talents for crime rather than service, it&#8217;s a small price.</p>
<p>It&#8217;s kind of frightening to see how quickly a skilled lock-picker can jimmy a lock and get in. But new technology makes it even simpler &#8212; apparently all you need is a good telephoto lens to break in to someone&#8217;s house &#8212; just wait till they leave their keys out on a table, snap a picture, and take it to an unethical key maker, and wha-la, a perfect replica:</p>
<blockquote><p><span id="intelliTXT"> &#8220;We built our key duplication <a rel="nofollow" class="iAs" style="border-bottom:0.075em solid darkgreen important;font-weight:normal;font-size:100%;text-decoration:underline;padding-bottom:1px;color:darkgreen important;background-color:transparent important;" target="_blank" href="http://www.physorg.com/news144519246.html#">software</a> system to show people that their keys are not inherently secret,&#8221; said Stefan Savage, the <a rel="nofollow" class="iAs" style="border-bottom:0.075em solid darkgreen important;font-weight:normal;font-size:100%;text-decoration:underline;padding-bottom:1px;color:darkgreen important;background-color:transparent important;" target="_blank" href="http://www.physorg.com/news144519246.html#">computer</a> science professor from UC San Diego&#8217;s Jacobs School of Engineering who led the student-run project. &#8220;Perhaps this was once a reasonable assumption, but advances in digital imaging and optics have made it easy to duplicate someone&#8217;s keys from a distance without them even noticing.&#8221;<br />
</span></p>
<p><span id="intelliTXT">Professor Savage presents this work on October 30 at ACM&#8217;s Conference on Communications and Computer Security (CCS) 2008, one of the premier academic computer security conferences. </span></p></blockquote>
<p><a rel="nofollow" target="_blank" href="http://www.secureconsulting.net/2008/11/remote_key_copying_eep.html">Read</a> the <a rel="nofollow" target="_blank" href="http://www.physorg.com/news144519246.html">full article</a> here.</p>]]></content:encoded>
      <pubDate>Tue, 11 Nov 2008 12:17:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/someones keys">someones keys</category>
      <category domain="http://securityratty.com/tag/keys">keys</category>
      <category domain="http://securityratty.com/tag/lock">lock</category>
      <category domain="http://securityratty.com/tag/computer science professor">computer science professor</category>
      <category domain="http://securityratty.com/tag/unethical key maker">unethical key maker</category>
      <category domain="http://securityratty.com/tag/lock-picker">lock-picker</category>
      <category domain="http://securityratty.com/tag/lock-breaker">lock-breaker</category>
      <category domain="http://securityratty.com/tag/apartment">apartment</category>
      <category domain="http://securityratty.com/tag/reasonable assumption">reasonable assumption</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/450105958/">Silent Break-Ins: How Technology Compromises Physical Security Too</source>
    </item>
    <item>
      <title><![CDATA[Ive got a better idea Arnold!]]></title>
      <link>http://securityratty.com/article/21e3d1e27562b99d879c6db49a49a7ce</link>
      <guid>http://securityratty.com/article/21e3d1e27562b99d879c6db49a49a7ce</guid>
      <description><![CDATA[Why dont you and the rest of our corrupt officials start working for nothing


clipped from www.latimes.com

Schwarzenegger seeks to slash state workers pay till budget passes



SACRAMENTO
Gov....]]></description>
      <content:encoded><![CDATA[<div > Why dont you and the rest of our corrupt officials start working for nothing? </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/79EED02D-4A87-42B0-AAF4-689ABB0939C6/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/8094a3e2-ddd7-4b54-9e45-1984d95097a5/79EED02D-4A87-42B0-AAF4-689ABB0939C6/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.latimes.com/news/local/la-me-budget24-2008jul24,0,7487129.story" href="http://www.latimes.com/news/local/la-me-budget24-2008jul24,0,7487129.story" style="font-size: 11px;">www.latimes.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.latimes.com/news/local/la-me-budget24-2008jul24,0,7487129.story -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Schwarzenegger seeks to slash state workers&#8217; pay till budget passes</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.latimes.com/news/local/la-me-budget24-2008jul24,0,7487129.story --><DIV><br />
SACRAMENTO &#8212; &#8211;<br />
Gov. Arnold Schwarzenegger has prepared an order to cut the pay of about 200,000 state workers to the federal minimum wage of $6.55 an hour until a budget is signed.</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/79EED02D-4A87-42B0-AAF4-689ABB0939C6/blog/" title="blog or email this clip"><img src="http://content9.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Thu, 24 Jul 2008 15:10:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/budget">budget</category>
      <category domain="http://securityratty.com/tag/till budget passes">till budget passes</category>
      <category domain="http://securityratty.com/tag/federal minimum wage">federal minimum wage</category>
      <category domain="http://securityratty.com/tag/corrupt officials start">corrupt officials start</category>
      <category domain="http://securityratty.com/tag/arnold schwarzenegger">arnold schwarzenegger</category>
      <category domain="http://securityratty.com/tag/workers">workers</category>
      <category domain="http://securityratty.com/tag/schwarzenegger seeks">schwarzenegger seeks</category>
      <category domain="http://securityratty.com/tag/hour">hour</category>
      <category domain="http://securityratty.com/tag/rest">rest</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=512">Ive got a better idea Arnold!</source>
    </item>
    <item>
      <title><![CDATA[Can Azulstar Make WiMax Work without Buying Spectrum?]]></title>
      <link>http://securityratty.com/article/ec86f80f6738fbb2c72db711116d378a</link>
      <guid>http://securityratty.com/article/ec86f80f6738fbb2c72db711116d378a</guid>
      <description><![CDATA[Azulstar once pinned its fortunes on city-wide Wi-Fi, but now looks to a special licensed spectrum band to make WiMax work where Wi-Fi failed: Azulstar has been the also-ran in Wi-Fi for some years,...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><strong>Azulstar once pinned its fortunes on city-wide Wi-Fi, but now looks to a special licensed spectrum band to make WiMax work where Wi-Fi failed:</strong> <a href="http://www.azulstar.com/">Azulstar</a> has been the also-ran in Wi-Fi for some years, I'll just state bluntly and upfront. They built a network in Grand Haven, Mich., in 2003 that's one of--if not the--longest running metro-scale Wi-Fi networks in the world designed for public access. The mayor of Grand Haven since 2003, Roger Bergman, told me, "I got on board personally right away, and I am still on." </p>

<p>Azulstar soon answered several RFPs and partnered up with major firms to bring Wi-Fi to Rio Rancho, N.M., Winston-Salem, N.C., Sacramento, Calif., and most notably Silicon Valley--a set of dozens of cities along with county government and private enterprise all wanting some kind of tiered Wi-Fi across 1,500 sq mi.</p>

<p>While EarthLink, MetroFi, and even Kite Networks (with their extensive Arizona buildout in Tempe launched a bit before any other large competiting network) seized the headlines, and later made news about their stalls, failures, and exits, Azulstar seemed quietly to sink into the sand. The Wireless Silicon Valley deal fell apart, as did Sacramento after efforts to get stakeholder and outside investment seemed to fail to materialize, and the marquee partners--Cisco, IBM, and Intel--just wouldn't step up to the plate to make the project move forward. Azulstar was the lead techology firm, but the money just didn't come. (Both California projects are moving forward with a different set of partners and expectations now.)</p>

<p>Rio Rancho was perhaps one of the biggest letdowns. City manager Jim Payne explained in an interview a few weeks ago, "They had a number of things that were going against them from the start, and they did make an attempt to meet the requirements of the contract." But Rio Rancho voted to not just terminate the contract after years of attempts to make the network work, but rejected a proposal from Azulstar a few weeks ago to switch over equipment on the poles. Azulstar now has to remove all its devices. </p>

<p>All of this might make the typical company head a bit depressed about his firm's future, and less than sanguine about the potential for wireless broadband to work at all. Not so for Tyler van Houwelingen, Azulstar's chief, and I have to admit that he convinced me that the wireless provider has a fighting chance, due to a good combination of timing, spectrum policy, and a large dollop of can-do spirit.</p>]]></content:encoded>
      <pubDate>Fri, 09 May 2008 06:58:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/azulstar">azulstar</category>
      <category domain="http://securityratty.com/tag/city-wide wi-fi">city-wide wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/rio rancho voted">rio rancho voted</category>
      <category domain="http://securityratty.com/tag/metro-scale wi-fi networks">metro-scale wi-fi networks</category>
      <category domain="http://securityratty.com/tag/rio rancho">rio rancho</category>
      <category domain="http://securityratty.com/tag/forward">forward</category>
      <category domain="http://securityratty.com/tag/weeks ago">weeks ago</category>
      <category domain="http://securityratty.com/tag/firm">firm</category>
      <source url="http://wifinetnews.com/archives/008313.html">Can Azulstar Make WiMax Work without Buying Spectrum?</source>
    </item>
    <item>
      <title><![CDATA[BART Wi-Fi Access Moves Closer in Bay Area]]></title>
      <link>http://securityratty.com/article/d73122c3bc0c1f93eec67b59922f15e3</link>
      <guid>http://securityratty.com/article/d73122c3bc0c1f93eec67b59922f15e3</guid>
      <description><![CDATA[WiFi Rail may sign contract with Bay Area Rapid Transit soon: That's typical marketing fare from many companies, to pre-announce deals, but a BART official confirmed the state of negotiations in this...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/train.jpg" align="right" hspace="5" height="80" width="80" border="0" /><strong><a href="http://www.sacbee.com/103/story/847624.html">WiFi Rail may sign contract with Bay Area Rapid Transit soon:</a></strong> That's typical marketing fare from many companies, to pre-announce deals, but a BART official confirmed the state of negotiations in this Sacramento Bee article. I had a long talk with the WiFi Rail folks a few months ago, and they sent me some fascinating video of a live four-way video chat with three participants communicating from moving trains.</p>

<p>Their technical description of what they're doing makes a lot of sense, and if they can pull off their trial work in a production environment, they will have a set of patents and products that will likely be the model for deploying subway and train Wi-Fi in urban areas around the world. Yes, that's a big claim; but they have a unique and interesting solution.</p>

<p>The company told the Bee that they would start on heavily traveled underground routes first, with service available within 4 months of a contract. WiFi Rail relies on leaky coax, which is wiring that runs in the tunnel already, and they've overlaid Wi-Fi signals on in a way that simulates a very long antenna.</p>

<p>The Bee reports that they've raised $1.5m in financing so far with another round of $15m to $20m to close later this year. With a BART contract in hand, I can't imagine they'll have any difficulty getting funds. Captive audiences are worth the big bucks.</p>]]></content:encoded>
      <pubDate>Wed, 09 Apr 2008 02:39:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wifi rail">wifi rail</category>
      <category domain="http://securityratty.com/tag/wifi rail relies">wifi rail relies</category>
      <category domain="http://securityratty.com/tag/bee">bee</category>
      <category domain="http://securityratty.com/tag/sacramento bee article">sacramento bee article</category>
      <category domain="http://securityratty.com/tag/contract">contract</category>
      <category domain="http://securityratty.com/tag/sign contract">sign contract</category>
      <category domain="http://securityratty.com/tag/wifi rail folks">wifi rail folks</category>
      <category domain="http://securityratty.com/tag/overlaid wi-fi signals">overlaid wi-fi signals</category>
      <category domain="http://securityratty.com/tag/months ago">months ago</category>
      <source url="http://wifinetnews.com/archives/008265.html">BART Wi-Fi Access Moves Closer in Bay Area</source>
    </item>
    <item>
      <title><![CDATA[New parents exposed in Fresno County lost mail]]></title>
      <link>http://securityratty.com/article/4b50b16067e6326c756d635c87b5dba1</link>
      <guid>http://securityratty.com/article/4b50b16067e6326c756d635c87b5dba1</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/3/08

Organization
Fresno County

Contractor/Consultant/Branch
None

Victims
New parents and babies

Number Affected
279

Types of Data
Names and...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/fresno.jpg" align="right" height="77" width="78"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/3/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.co.fresno.ca.us/portal/Default.asp">Fresno County</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>New parents and babies<br><br><span style="font-weight: bold;">Number Affected:</span><br>279<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Fresno County health officials say 279 birth certificate applications that list personal information of Valley babies and their parents are missing after they were mailed to the state. An envelope containing the birth certificate applications arrived at the the state Department of Public Health in Sacramento damaged, but with most of the forms missing."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.mercurynews.com/news/ci_8796927">The Mercury News</a> <br><a href="http://www.fresnobee.com/opinion/story/505256.html">The Fresno Bee</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Associated Press<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Fresno County health officials say 279 birth certificate applications that include the Social Security numbers of the babies' parents are missing.<br><span style="font-style: italic;">[Evan] Thankfully, these babies do not have Social Security numbers yet, otherwise this adds a whole new dimension.</span><br><br>The state Department of Public Health told the county in February that an envelope containing 378 birth certificate applications from Fresno County had arrived damaged in Sacramento and that most were missing.<br><br>The forms contain information about babies born in six San Joaquin Valley hospitals, including their parents' names and Social Security numbers.<br><span style="font-style: italic;">[Evan] Again, Social Security numbers used as personal identifiers in a manner that they were never designed for.</span><br><br>State officials called the incident a low risk for identity theft, but parents were notified about the missing forms.<br><span style="font-style: italic;">[Evan] I wonder who makes the judgment call that terms this "low risk".&nbsp; Must be somebody that is well versed in risk management, right?</span><br><br>The Postal Service is searching for the items and trying to figure out where the certified letter was damaged.<br><br><span style="font-weight: bold;">Fresno Bee Opinion Column:</span><br>The latest screw-up by Fresno County is more evidence of how cavalierly county officials treat the public's sensitive personal information. No wonder identity theft is out of control. Our government, at all levels, is a major contributor to the problem.<br><br>Sending this information by mail may not have been the dumbest thing county officials have done lately, but it has to be right up there. Why wasn't this packet sent by courier or some other more secure means?<br><span style="font-style: italic;">[Evan] Like encrypted on a CD or transferred over a secure network.</span><br><br>In February, county officials warned thousands of CalWORKs clients that they could be victimized after a laptop computer was stolen.<br><span style="font-style: italic;">[Evan] We missed this one on <a href="http://breachblog.com">The Breach Blog</a>.&nbsp; I may have to go back an add it now.</span><br><br>The response by county officials is to shrug off these lapses, and offer the standard response that they don't think anyone has been the victim of fraud because of their negligence. How do they really know?<br><br>The security of personal information must have a much higher priority than the Board of Supervisors gives it. The board should be demanding that sensitive information not be put on laptops that can be easily stolen, or bundled up and dropped in the mail -- a packet that can be easily damaged during the mailing process.<br><br>Every year, tens of thousands of Californians become identity theft victims. Thieves create new credit card accounts with stolen Social Security numbers, then rack up huge expenditures on the cards before the victims notice.<br><span style="font-style: italic;">[Evan] Tens of thousands of victims in California, yet people continue to tag breaches as "low risk".</span><br><br>In the San Joaquin Valley, methamphetamine users are glad that Fresno County doesn't have strong security procedures for personal data. Police tell us that 70% of Fresno's identity-theft cases are committed by meth addicts. They stay up for days finding ways to steal personal financial information.<br><br>Fresno County makes it easy for them. <br><br><span style="font-weight: bold;">Commentary:</span><br>Can you imagine the joy that many of these parents feel in bringing home a new baby boy or girl.&nbsp; Now imagine some of the joy being taken away because somebody unnecessarily exposed your personal details.&nbsp; It stinks that terrible security practices have the potential to affect personal lives. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/06/fresno.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 07 Apr 2008 12:07:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/county">county</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/fresno">fresno</category>
      <category domain="http://securityratty.com/tag/fresno county">fresno county</category>
      <category domain="http://securityratty.com/tag/list personal information">list personal information</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security breach">security breach</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <source url="http://breachblog.com/2008/04/07/fresno.aspx">New parents exposed in Fresno County lost mail</source>
    </item>
    <item>
      <title><![CDATA[OmniAmerican Bank targeted by cyber criminals]]></title>
      <link>http://securityratty.com/article/726c4a052fe955720d99ad62680b2d66</link>
      <guid>http://securityratty.com/article/726c4a052fe955720d99ad62680b2d66</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
1/24/08

Organization
OmniAmerican Bank

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
Internal bank...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/omni.jpg" align="right" height="45" width="198"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>1/24/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.omniamerican.com/" target="_blank"> OmniAmerican Bank</a><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Internal bank systems and account numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>An "international gang of cyber criminals" breached OmniAmerican bank systems and used a variety of information to create new personal identification numbers (PINs) and fake debit cards.&nbsp; The criminals then used the cards at to make withdrawls at ATMs in Eastern Europe, Russia, Ukraine, Britain, Canada and New York.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.star-telegram.com/business/story/429367.html" target="_blank"> Star-Telegram Story</a> <br><a href="http://www.sacbee.com/103/story/660690.html" target="_blank"> Sacramento Bee Story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Barry Shlachter, Star-Telegram<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>An international gang of cyber criminals hacked into OmniAmerican Bank's records, the bank's president disclosed Wednesday.<br><br>They stole scores of account numbers, created new PINs, fabricated debit cards, then withdrew cash from ATMs in Eastern Europe, including Russia and Ukraine, as well as in Britain, Canada and New York.<br><span style="font-style: italic;">[Evan] This is either a geographically disperse "gang", or the information was sold to various buyers.</span><br><br>"It was a pretty sophisticated scheme," said Tim Carter, president of the Fort Worth-based bank.<br><span style="font-style: italic;">[Evan] I wonder how sophisticated this attack really was.&nbsp; My first suspicion is a targeted (spear) phishing attack, which isn't very sophisticated.</span><br><br>The amount stolen is not yet known, he said, describing it only as "minimal." No depositors will lose money, he said.<br><br>Fewer than 100 accounts, some of them dormant, were compromised, all with a daily withdrawal limit of less than $1,000, he said.<br><br>After discovering the fraudulent activity Friday afternoon, OmniAmerican placed temporary limits on some ATM and debit-card transactions and suspended some electronic banking services, which were restored Sunday, Carter said. At no time were customer deposits at risk, he stressed. "We reduced by half the dollar amount that could be withdrawn and limited [access] to Texas. We cut out anything outside Texas," Carter said.<br><span style="font-style: italic;">[Evan] Seems like a logical response, but what a hassle for customers.&nbsp; As of Monday morning, the warning below is still posted on OmniAmerican's home page.<br><br><img src="http://images.quickblogcast.com/95781-88451/omninotice.jpg" border="0" width="310"><br></span><br>The unauthorized withdrawals were stopped Friday, and bank employees worked over the weekend to deal with the damage, he said.<br><span style="font-style: italic;">[Evan] The unauthorized withdrawls made on accounts that were known to have been compromised at least.</span><br><br>The bank learned of the breach from customers inquiring about unusual activity in their accounts, from internal monitoring and from a law-enforcement agency, which Carter declined to name.<br><br>Letters alerting check-card holders of the fraudulent activity were mailed Wednesday, the bank said.<br><br>OmniAmerican is also issuing approximately 40,000 new debit cards as a safeguard against future fraudulent activity, Carter said. Each needs a revised personal identification number.<br><br>Martin Carmichael, the Plano-based chief security officer at McAfee, a computer-security firm, said this type of cyber-attack has become "a commonplace occurrence," although some banks are reluctant to admit that their security has been breached.<br><span style="font-style: italic;">[Evan] I agree with Mr. Carmichael.&nbsp; In my work with banks, they all expect to lose a certain amount of money.&nbsp; They say it comes with the territory.&nbsp; If a breach is disclosed to the public, it could negatively affect customer confidence which equates to lost revenue.&nbsp; Lost dollars due to customer confidence usually outweigh the lost dollars from the breach itself.&nbsp; I guess anyway.&nbsp; Banks are attacked and/or compromised every day because they have the one thing everybody wants…money.</span><br><br>Carmichael said OmniAmerican apparently fell victim to one of the more skilled gangs of criminal hackers.<br><span style="font-style: italic;">[Evan] Again, I question how skilled an attacker really needs to be.&nbsp; Many "skilled" attackers go unnoticed and why would skilled attackers stop at "fewer than 100 accounts" before calling attention to themselves?</span><br><br>"If you look at the sophistication of it -- going in, modifying PINs, issuing cards -- this is not a kid out there," he said. "This appears to be something set up. Time was involved in executing it."<br><br>Whoever they are, he said, "they're elite, more elegant, and it's difficult for banks and many enterprises to keep pace with their activities.<br><br>"Banks are under a great amount of pressure to balance risk and shareholder value," said Carmichael, speaking from Las Vegas, where he is attending a conference. "They could do more, [but they] have a hard time justifying the cost until an incident occurs."<br><span style="font-style: italic;">[Evan] Very well put, sad and true.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Maybe this was a sophisticated attack like some are claiming.&nbsp; I just think about how easy it could be to carry out a spear phishing attack either to download and install malware or collect a password of a bank employee (because many people use one password for everything) and proxy the network traffic through compromised systems in other countries.&nbsp; Phishing and other attacks based on human behavior are usually much more successful than high-tech exploits.<br><br>OmniAmerican deserves some credit for a firm and decisive incident response. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/01/28/omni.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 28 Jan 2008 08:26:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/omniamerican bank">omniamerican bank</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/omniamerican bank systems">omniamerican bank systems</category>
      <category domain="http://securityratty.com/tag/omniamerican">omniamerican</category>
      <category domain="http://securityratty.com/tag/internal">internal</category>
      <category domain="http://securityratty.com/tag/internal bank systems">internal bank systems</category>
      <category domain="http://securityratty.com/tag/debit cards">debit cards</category>
      <category domain="http://securityratty.com/tag/cards">cards</category>
      <category domain="http://securityratty.com/tag/bank employees">bank employees</category>
      <source url="http://breachblog.com/2008/01/28/omni.aspx">OmniAmerican Bank targeted by cyber criminals</source>
    </item>
  </channel>
</rss>
