<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: southern]]></title>
    <link>http://securityratty.com/tag/southern</link>
    <description></description>
    <pubDate>Fri, 30 May 2008 11:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Of Planes and Ships]]></title>
      <link>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</link>
      <guid>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</guid>
      <description><![CDATA[Tom Barnett is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.thomaspmbarnett.com/weblog/2008/09/column_121.html">Tom Barnett</a> is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the &quot;nail it to the wall&quot; quote at the end):</p><p><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">One of the main problems in counterterrorism today is that there are so many people and vehicles, and so much data and material, moving through globalization&#39;s myriad networks that it seems virtually impossible to track it all effectively. Nowhere has this problem been more acute than on the high seas.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">In 2006, Adm. Harry Ulrich, then U.S. commander of NATO Naval Forces Europe, decided to do something about it. Despite having virtually no resources, his dream was to transpose the global air-traffic control system onto sea traffic.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Worldwide, aircraft are transparent, because they&#39;re all required to carry an identification beacon that allows them to be tracked leaving and entering airports, and monitored between airports, by a global network of sensors. Act suspiciously and somebody&#39;s fighter aircraft will soon be on your tail.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">No such pervasive system currently exists globally for maritime traffic. While bigger ships carry an ID beacon similar to aircraft, without a shared monitoring network, that&#39;s like tracking only selected commercial jets and giving everyone else a pass.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">So Ulrich, upon taking command, asked a simple question: &quot;If we can do that in the air, why can&#39;t we do it on the sea?&quot; He made a point of pioneering his sea-traffic-control effort first inside the Mediterranean, where NATO&#39;s southern naval forces have historically been concentrated, but his real target was waters off Africa -- the most ungoverned maritime space in the world.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich knew the U. S. Navy couldn&#39;t do it alone, much less bring Africa&#39;s meager coast-guard-like navies up to snuff so they could do it on their own. So he quickly created a network of assets -- both public and private -- to manage that space, modeling his monitoring system on international air-traffic control.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich began stitching together a network of shore-based sensors ringing the Mediterranean. His naval command then began initial monitoring by tapping into the International Maritime Organization&#39;s existing Automated Identification System, transforming NATO&#39;s ability to track ship traffic in the Med.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Almost overnight, NATO went from tracking dozens of ships on the Mediterranean to thousands, and instead of getting the data sometimes up to 72 hours late, now the contacts were being tracked in one to five minutes -- to an accuracy within 50 feet on the earth&#39;s surface.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When the classic big-firm systems integrators told Ulrich it would be too costly to pull it off, the admiral turned to the Volpe Center in Cambridge, Massachusetts, a U.S. Department of Transportation research center. Instead of hundreds of millions of dollars, Ulrich&#39;s initial network cost $900,000. The shore-based receivers are small, roughly the size of a radar dish you might find on a pleasure craft.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The strength of the system is a function of its reach: the more countries join, the larger the shared operational picture. By the time Ulrich retired at the end of 2007, he had enlisted 32 countries throughout the Mediterranean, the North Atlantic, along the west coast of Africa, around the Black Sea, and in the Pacific. Today, the network continues to spread around the planet.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; font-size: 14px; line-height: 20px; "><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">With Ulrich&#39;s system in place, local police, coast guards, and border patrols catch most bad guys, obviating American military responses. As Harry told me for an article I wrote about his work in a fall 2007 issue of Esquire, </span><span style="font-weight: bold; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">&quot;I don&#39;t do defense; I do security. When you talk defense, you talk containment and mutually assured destruction. When you talk security, you talk collaboration and networking. This is the future.&quot;</span></span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The admiral&#39;s legacy program, the Maritime Safety and Security Information System, earned the Volpe Center a prestigious &quot;Innovations in American Government&quot; award this month from Harvard University&#39;s Ash Institute for Democratic Governance and Innovation.</span></p></blockquote><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Security Collaboration + Networking &#160;= Federation. This is indeed the future - SAML came along just at the nick of time.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When you assume that to do access control you must have &quot;Complete Mediation&quot; in Saltzer and Schroeder&#39;s terms of the subject (users), the objects (data), the session, and the roles, then you are going to have an interesting life trying to deliver anything. And if you do it will mucho expensive.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">if you take the federated autonomous nodes approach, agree upon an attribute schema plus a protection model for same, and basic protocol, you are then free to move about the country. Security doesn&#39;t have to equal centralization or high cost. Get the attributes from point a to point b securely.</span></div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 19:04:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security architect">security architect</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/identification system">identification system</category>
      <category domain="http://securityratty.com/tag/initial network cost">initial network cost</category>
      <category domain="http://securityratty.com/tag/initial">initial</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/ulrich">ulrich</category>
      <category domain="http://securityratty.com/tag/time ulrich">time ulrich</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/of-planes-and-ships.html">Of Planes and Ships</source>
    </item>
    <item>
      <title><![CDATA[Sorry, Qantas, No Unfettered Broadband]]></title>
      <link>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</link>
      <guid>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</guid>
      <description><![CDATA[Qantas backs off from earlier plans, changes provider for in-flight broadband: The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://www.smh.com.au/news/travel/qantas-limits-access-to-web/2008/09/17/1221330929870.html"><strong>Qantas backs off from earlier plans, changes provider for in-flight broadband:</strong></a> The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its in-flight broadband plans. Aeromobile was the provider when the service <a href="http://www.breakingtravelnews.com/article.php?story=2007081609481129&query=qantas"><strong>was tested in second quarter 2007</strong></a>, but OnAir is now described as the airline's partner. This was noted by colleague Fabio Zambelli, who emailed me the news, and <a href="http://www.setteb.it/content/view/4742"><strong>has his own account</strong></a> at 7BIT (in Italian).</p>

<p><a href="http://www.onair.aero/index.php?pid=123"><strong>OnAir</strong></a> has so far tested their calling/texting-only service on two aircraft--one operated by Air France, one by TAP Portugal--even though RyanAir announced plans that its planes would started being unwired with the service by late 2007. Still no word on that fleet progress.</p>

<p>Qantas will apparently launch cached Web browsing and limited Web email (probably through a proxy) along with instant messaging, with full Internet service coming "later in 2009." This is clearly due to a lack of satellite coverage that was just remediated a few weeks ago (see below). The first plane with limited service, a new A380, should be in flight 20-October-2008.</p>

<div style="float:right; margin:0px; padding-left: 10px; padding-bottom: 0px;"><p><img src="http://wifinetnews.com//images/2008/SorryQantas.jpg" alt="SorryQantas.jpg" border="0" width="100" height="152"></p><p style="font-size: 10px">I hate in-flight<br/>broadband</p></div>To Qantas' credit, note that each seat on the plane will have a laptop opower socket, a USB port, and a multimedia system that can show 100 movies and 500 TV show episodes, play the contents of 1,000 CDs and 20 radio stations, and offer 80 games. 

<p>The Morning Herald seems to overstate the importance and scope of a complaint filed by the union representing American Airlines' flight attendants. The detailed coverage in the U.S. had more to do with the potential for issues, and likely attendants lack of interest in policing yet another media on the plane. Filtering doesn't work, the attendants probably already know, and this may just be a negotiating point with the airline.</p>

<p>On why Qantas is waiting until late 2009? This requires unwinding how OnAir gets its signal.</p>

<p>Aeromobile and OnAir both rely on Inmarsat satellites for their service. Both companies had several years ago staked their futures on the fourth-generation network Inmarsat was to inaugurate with three satellites that would use beamforming to allow precise delivery of nearly 500 Kbps per receiver, with hundreds or thousands of regions being able to be targeted from a single satellite. Inmarsat's third-gen network--don't confuse this with 3G cellular ground-based networks--can deliver about 64 Kbps per channel.</p>

<p>Now, unfortunately, Inmarsat was three years late on launching its trans-Pacific bird. While the company <a href="http://www.inmarsat.com/About/Newsroom/Press/00021465.aspx?language=EN&textonly=False"><strong>claims 85 percent coverage of the earth</strong></a> and 98 percent coverage of population, there's a big gap over the Pacific that also prevents them from having good overlap between the U.S. and Japan/China/Korea, as well as the southern Pacific, covering Australia. Since the biggest market for long-haul flights would likely be Australia, Japan, and China, traveling trans-Pacific or trans-hemispheric routes, that gap is rather large.</p>

<p>Aeromobile opted to build out a service, deployed only by Emirates airline as far as I can tell, that uses the 3G service since it was available, and most necessary equipment is already installed on most over-water planes. OnAir was waiting for 4G, which has necessitated a long wait, but allowed them to launch in Europe with a seemingly next-generation service. Given that OnAir is controlled by an airline-owned integration firm, SITA, and by Airbus, they're not going anywhere.</p>

<p>Inmarsat finally <a href="http://spaceflightnow.com/proton/i4f3/"><strong>lofted its third satellite on Baikonur Cosmodrome in Kazakhstan</strong></a> on 19-August-2008, and the launch and separation was reported as successful. Previously, the company has needed up to a year to verify and deploy its 4G satellites. (You can <a href="http://forum.nasaspaceflight.com/index.php?topic=12380.105"><strong>read extremely close coverage of the launch</strong></a> at a Web site devoted to space enthusiasm.)</p>

<p>However, the dirty little secret about Inmarsat's BGAN is that it costs a fortune to heft bandwidth across it. Thus, in-flight broadband over BGAN, if it's ever available, is going to be changed on an extremely high per-MB rate. None of the providers want to say this. This is in contrast to Row 44 (and, once, Connexion by Boeing), which relies on leased Ku-band transponders where they can fix costs and they require high volumes to keep per-bit costs efffectively low.</p>

<p>OnAir's launch of calling on Air France's service involves paying a few euros per minute for calls, which might help you understand what data costs could ultimately run.</p>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 06:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/satellite coverage">satellite coverage</category>
      <category domain="http://securityratty.com/tag/coverage">coverage</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service involves">service involves</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/in-flight broadband plans">in-flight broadband plans</category>
      <category domain="http://securityratty.com/tag/plans">plans</category>
      <category domain="http://securityratty.com/tag/inmarsat satellites">inmarsat satellites</category>
      <category domain="http://securityratty.com/tag/inmarsat">inmarsat</category>
      <source url="http://wifinetnews.com/archives/008448.html">Sorry, Qantas, No Unfettered Broadband</source>
    </item>
    <item>
      <title><![CDATA[Cybersecurity lacking in Africa, official says]]></title>
      <link>http://securityratty.com/article/5425c8ae0f8c057c443b246c940ba8cd</link>
      <guid>http://securityratty.com/article/5425c8ae0f8c057c443b246c940ba8cd</guid>
      <description><![CDATA[Africa will not realize the benefits of IT without improvements in cybersecurity, the secretary general of the Common Market for Eastern and Southern Africa (COMESA) said...]]></description>
      <content:encoded><![CDATA[Africa will not realize the benefits of IT without improvements in cybersecurity, the secretary general of the Common Market for Eastern and Southern Africa (COMESA) said today.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=19659?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=19659?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 24 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/africa">africa</category>
      <category domain="http://securityratty.com/tag/southern africa">southern africa</category>
      <category domain="http://securityratty.com/tag/common market">common market</category>
      <category domain="http://securityratty.com/tag/cybersecurity">cybersecurity</category>
      <category domain="http://securityratty.com/tag/benefits">benefits</category>
      <category domain="http://securityratty.com/tag/secretary">secretary</category>
      <category domain="http://securityratty.com/tag/improvements">improvements</category>
      <category domain="http://securityratty.com/tag/eastern">eastern</category>
      <category domain="http://securityratty.com/tag/comesa">comesa</category>
      <source url="http://www.networkworld.com/news/2008/082508-cybersecurity-lacking-in-africa-official.html?fsrc=rss-security">Cybersecurity lacking in Africa, official says</source>
    </item>
    <item>
      <title><![CDATA[Q&A: Views on Privacy and Identity Theft]]></title>
      <link>http://securityratty.com/article/469cb8eea8d19ab3af5936dc7104dafa</link>
      <guid>http://securityratty.com/article/469cb8eea8d19ab3af5936dc7104dafa</guid>
      <description><![CDATA[Jonathan Moneymaker is VP of Operations at Anonymizer. He is a certified Project Management Professional and also holds a BS in Systems Engineering from the University of Southern California. In...]]></description>
      <content:encoded><![CDATA[Jonathan Moneymaker is VP of Operations at Anonymizer. He is a certified Project Management Professional and also holds a BS in Systems Engineering from the University of Southern California.
 
 In th...]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 08:15:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/project management professional">project management professional</category>
      <category domain="http://securityratty.com/tag/southern california">southern california</category>
      <category domain="http://securityratty.com/tag/jonathan moneymaker">jonathan moneymaker</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/anonymizer">anonymizer</category>
      <category domain="http://securityratty.com/tag/operations">operations</category>
      <category domain="http://securityratty.com/tag/holds">holds</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <source url="http://www.net-security.org/article.php?id=1165">Q&amp;A: Views on Privacy and Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Indiana State University professor's laptop is stolen]]></title>
      <link>http://securityratty.com/article/ac01a165449e657f832374db2c405cad</link>
      <guid>http://securityratty.com/article/ac01a165449e657f832374db2c405cad</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
Indiana State University

Contractor/Consultant/Branch
None

Victims
students who took economics classes from 1997 through the...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/indianastate.jpg" width="137" align="right" height="48"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://www.indstate.edu/home.htm">Indiana State University</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>"students who took economics classes from 1997 through the spring semester 2008"<br><br><span style="font-weight: bold;">Number Affected:</span><br>"more than 2,500"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, grades, e-mail addresses and student identification numbers"*<br><br><font size="1">*Until 2003, student identification numbers were the equivalent of each student’s Social Security number.</font><br><br><span style="font-weight: bold;">Breach Description:</span><br>"A password-protected laptop computer containing personal information for current and former Indiana State University students was stolen during the weekend, the university reported Tuesday."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www1.indstate.edu/laptopsecurity/">Indiana State University</a> <br><a href="http://www.wthitv.com/Global/story.asp?S=8684098&amp;nav=menu593_1">Associated Press via WTHI Channel 10 News</a> <br><a href="%20http://www.chicagotribune.com/news/chi-ap-in-isu-stolenlaptop,0,1255776.story">Associated Press via Chicago Tribune</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>Indiana State University<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A password-protected laptop computer containing personal information for current and former Indiana State University students was stolen during the weekend, the university reported Tuesday.<br><span style="font-style: italic;">[Evan] What do you suppose the purpose of the "password-protected" mention is?&nbsp; I hope it is not meant to reassure anyone that the information is safe.&nbsp; For those of you that do not know, password-protection is easily bypassed and in the opinion of many information security professionals (this one included), does NOT provide adequate protection for confidential information.</span><br><br>While there is no evidence to suggest that password security was breached, the university is taking the precaution of notifying all affected students for whom it has current contact information.<br><span style="font-style: italic;">[Evan] If someone were to breach the "password security", what evidence would the school see?&nbsp; None.&nbsp; There would be no evidence (except locally on the laptop) if the local password store had been compromised.&nbsp; The school no longer has possession of the laptop, so the school would have no evidence.</span><br><br>The laptop contained data for students who took economics classes from 1997 through the spring semester 2008, estimated at more than 2,500 individuals.<br><br>If you took an economics class during this time period, but did not receive a letter, please call the Registrar’s Office to verify that you were on the list, and to update your address so that we may send you a letter.<br><span style="font-style: italic;">[Evan] Contact information for the Registrar's Office, click </span><a style="font-style: italic;" href="http://www1.indstate.edu/registrar/">here</a><span style="font-style: italic;">.</span><br><br>The information includes names, grades, e-mail addresses and student identification numbers.<br><br>Beginning in 2003, use of social security numbers as student ID numbers was discontinued in favor of university-specific identification numbers.<br><span style="font-style: italic;">[Evan] A sound security decision by the university would have been to follow up with a project to identify and remove Social Security numbers already held as student IDs.&nbsp; Maybe it was, but the information on this laptop was missed.</span><br><br>The theft occurred Saturday while the professor was traveling in southern Indiana<br><br>the professor was traveling with his family and briefly left the computer unattended<br><span style="font-style: italic;">[Evan] A laptop can grow legs in a flash.&nbsp; A person doesn't need to leave a laptop unattended for very long for it to disappear.</span><br><br>The incident occurred on July 12, 2008 and was reported to university officials on July 14, 2008.<br><br>The incident was reported immediately to the appropriate law enforcement agency and early Monday to university officials.<br><br>The extent of the information contained on the computer was not determined until Monday night.<br><br>Faculty and staff are being reminded that university policy prohibits the storage of private, sensitive data on portable computers.<br><span style="font-style: italic;">[Evan] Excellent policy provision.&nbsp; Policy does little if it is not communicated, enforced, audited against, and improved.&nbsp; Where was the failure in the breach?&nbsp; Was the policy not communicated to this professor, and thus he/she was not aware?</span><br><br>In addition, laptops provided to faculty are equipped with several security measures including encryption and a bio-metric fingerprint reader to prevent access by anyone other than the assigned user.<br><span style="font-style: italic;">[Evan] An excellent standard (or procedure).</span><br><br>Approximately 500 ISU faculty members have laptop computers.<br><br>The university is reviewing its procedures to ensure compliance with existing policies, said Interim President C. Jack Maynard, the university’s provost and vice president for academic affairs<br><br><span style="font-weight: bold;">From the FAQs:</span><br><br>Q: What can someone do with a stolen SSN?<br>A: "With just a SSN there is little anyone can do in the way of setting up a false identity or securing credit. Generally an identity thief would need more information and documentation to set up false credit.<br><span style="font-style: italic;">[Evan] A SSN needs to be held in strict confidentiality in today's financial, employment, health, and other systems.&nbsp; It is often used for identification and authentication.&nbsp; Once an identity thief has a SSN, the owner of that SSN is now a prime target because the thief has the most confidential piece of information (ingredient) in the identity theft recipe.&nbsp; The rest of the information is typically easier to come by, i.e. name, address, employer, etc.&nbsp; It is true that an SSN alone is not enough information to commit identity theft, but it is an EXCELLENT start.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>We can assume that the school knows the risks involved in storing confidential information on a poorly protected laptop.&nbsp; Otherwise, they probably wouldn't have policy and procedure against it.&nbsp; The school's statements that are meant to minimize the risk, seemingly without fact, are disappointing. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/17/indianastate.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 05:29:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information includes names">information includes names</category>
      <category domain="http://securityratty.com/tag/university students">university students</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/evan contact information">evan contact information</category>
      <category domain="http://securityratty.com/tag/university policy prohibits">university policy prohibits</category>
      <source url="http://breachblog.com/2008/07/17/indianastate.aspx">Indiana State University professor's laptop is stolen</source>
    </item>
    <item>
      <title><![CDATA[CBAC & Medical Identity Theft]]></title>
      <link>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</link>
      <guid>http://securityratty.com/article/02105d066a63c57c66a00f92ef63e99d</guid>
      <description><![CDATA[Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: askelizabeth
The Sopranokovs
The...]]></description>
      <content:encoded><![CDATA[<p>Good story to keep in mind for those of you working on CBAC. Claims neeed protection and verification. Why steal an identity when you can capture a claim? (hattip: <a href="http://askelizabeth.typepad.com/weblog/2008/07/medical-identity-theft-the-new-frontier-for-organized-crime.html">askelizabeth</a>)

</p><blockquote><p>
	The Sopranokovs 
	</p></blockquote><blockquote><p>The Russian mob comes to town with a new scam—medical identity theft. 	
	</p></blockquote><blockquote><p>When FBI special agent Ted Price peered through the window of a dingy brick storefront on Southwest Morrison Street in March, it was what he didn’t see that caught his attention. 	</p></blockquote><blockquote><p>The business, called UnimedCorner, claimed to provide ailing seniors with orthotics—braces and other devices to correct foot, joint and back problems. 	
	</p></blockquote><blockquote><p>Price and other federal investigators were skeptical. 	
	</p></blockquote><blockquote><p>On Unimed’s showroom floor, Price saw wheelchairs, motorized scooters, a variety of canes and, on the walls, a selection of amateurish paintings and framed photographs. There was no evidence, however, of the kinds of equipment for which Unimed had billed Medicare nearly $2 million in the previous couple of months. 	
	</p></blockquote><blockquote><p>“I observed wheelchairs and canes through the window but did not see any orthotics in the store,” Price later wrote in a search-warrant affidavit. “It is a sign of fraud that the store is not stocking the items [for which] it is billing.” 	
	</p></blockquote><blockquote><p>By the time Price arrived on the scene, the company’s owner, a shadowy Russian immigrant named Alexandr Shcherbakov, was long gone. 	
	</p></blockquote><blockquote><p>Today, Shcherbakov’s store sits undisturbed. The message light on the phone blinks, dead potted plants droop and a stuffed toy monkey slumps in a glass display case. 	
	</p></blockquote><blockquote><p>And behind the cash register hangs a framed poster of television’s best-known mobsters, the Sopranos. 	
	</p></blockquote><blockquote><p>From interviews and information presented in federal affidavits, it is clear Shcherbakov moved to Oregon to commit a crime elegant and lucrative enough to make Tony Soprano envious: medical identity theft. 	
	</p></blockquote><blockquote><p>... 	
	</p></blockquote><blockquote><p>“Medical identity theft is the new frontier for organized crime,” says Alex Johnson, a former FBI agent who investigates fraud for Regence BlueShield. “Pretty much anybody can set up a mom-and-pop operation and start cranking out claims.”
	
	Someday, most Americans will need a cane, wheelchair, home hospital bed or another of the items healthcare professionals call “durable medical equipment,” or DME. 	
	</p></blockquote><blockquote><p>For those over 64 and without private insurance, there’s a good chance federally funded Medicare will pick up the tab for that equipment. Last year, according to federal statistics, Medicare spent $8.6 billion on DME. 	
	</p></blockquote><blockquote><p>Here’s the way the system is supposed to work: A doctor prescribes a device such as a wheelchair for a patient, who presents his prescription to a DME supplier. The supplier provides the equipment and bills Medicare, which typically pays 80 percent of the cost.
	
	Unlike pharmacists, who fill prescriptions under strict scrutiny of state and federal watchdogs, DME suppliers are lightly regulated.
	
	“DME is very vulnerable to fraud,” says Consuelo Woodhead, the chief healthcare fraud prosecutor for the U.S. Attorney’s Office in Los Angeles. “It doesn’t require any background in medicine, any kind of professional licensure or appreciable capital. </p></blockquote><blockquote><p>There are barriers of entry in other medical fields, but not in DME.”
	
	To operate, DME suppliers simply need a place of business, a business license and liability insurance. Unlike pharmacists, DME suppliers operate under an honor system: The feds count on them to supply the equipment they claim to provide to the beneficiaries who need it. 	
	</p></blockquote><blockquote><p>That honor system is not working. 	
	</p></blockquote><blockquote><p>The epicenter of DME fraud, according to the federal Department of Health and Human Services, is South Florida, where Medicare billing for DME quadrupled from 2002 to 2006 to $1.7 billion.
	
	Investigators found much of that increase was due to fraud. In 2006, federal inspectors revoked the licenses of 634 DME suppliers in South Florida, nearly half the DME dealers in the region. </p></blockquote><blockquote><p>Later the same year, raids in Southern California yielded similar results: The feds shut down 95 DME suppliers.
	
	Many of the DME suppliers shut down around Los Angeles were run by immigrants from the former Soviet Union. It’s probably no coincidence that when the feds raided Los Angeles DME suppliers, some Angelenos fled to cities where there was less scrutiny—such as Portland.</p></blockquote>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:09:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dme suppliers simply">dme suppliers simply</category>
      <category domain="http://securityratty.com/tag/dme suppliers">dme suppliers</category>
      <category domain="http://securityratty.com/tag/dme fraud">dme fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/dme">dme</category>
      <category domain="http://securityratty.com/tag/identity">identity</category>
      <category domain="http://securityratty.com/tag/medical identity theft">medical identity theft</category>
      <category domain="http://securityratty.com/tag/dme dealers">dme dealers</category>
      <category domain="http://securityratty.com/tag/dme supplier">dme supplier</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/07/cbac-medical-identity-theft.html">CBAC &amp; Medical Identity Theft</source>
    </item>
    <item>
      <title><![CDATA[Metro Round-Up: Phila., Minneapolis, St. Louis Park (Minn.), Texas, Foster City (Calif.), Naperville (Ill.), Chehalis and Centralia (Wash.), Cambria C]]></title>
      <link>http://securityratty.com/article/ba9fa39ee95e3dd8fdd6d81a86d5370d</link>
      <guid>http://securityratty.com/article/ba9fa39ee95e3dd8fdd6d81a86d5370d</guid>
      <description><![CDATA[Philadelphia may find operator for Wi-Fi network: The AP reports that the City of Brotherly Love's Wi-Fi network isn't yet down, or down for the count. While it's scheduled to be flipped off tomorrow...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.forbes.com/feeds/ap/2008/06/11/ap5104811.html"><strong>Philadelphia may find operator for Wi-Fi network:</strong></a> The AP reports that the City of Brotherly Love's Wi-Fi network isn't yet down, or down for the count. While it's scheduled to be flipped off tomorrow (you can read whatever you like into the phrase "flipped off"), the city is talking to a party it won't disclose about the networks future. EarthLink sued Phila. in May to be able to remove its equipment and cap its liabilities. The city's wireless non-profit arm, Wireless Philadelphia, has made noises about what EarthLink's true liability could be; the non-profit has born some of the electrical cost, and might be seeking to have that repaid on top of penalties and other expenses.</p>

<p><a href="http://www.startribune.com/business/19726749.html?location_refer=Homepage"><strong>Minneapolis suffers the heartbreak of leafage:</strong></a> Leaves are popping in Minneapolis, and Star-Tribune columnist Steve Alexander writes that residents are seeing some Wi-Fi reception problems on that city's Wi-Fi network. This is the only big-city network that can be currently described "successful," even though its long-term success has to be proven out. The firm responsible, USI Wireless, told Alexander they're working on adjusting about 5 percent of antennas to cope with the pesky greenery.</p>

<p><a href="http://www.startribune.com/local/west/19745504.html?location_refer=Style%20+%20People"><strong>St. Louis Park sues ARINC over Wi-Fi network:</strong></a> The Minnesota town says the network never worked, and had earlier discussed a lawsuit. The city wants the value of the contract ($1.7m) plus a very modest amount in damages and fees ($50,000). The city plans to start removing gear if ARINC doesn't sometime in June. But they have to deal with 490 poles erected to hold the nodes and solar-charging gear--sunk into concrete. More recent testing showed that the network worked well in some areas, but the majority of the network did not, according to the Star Tribune.</p>

<p><a href="http://telecompetitor.com/node/671"><strong>Verizon builds out fiber in AT&T territory:</strong></a> Interesting sign of competition in otherwise monopoly-per-provider-type world. Verizon is using AT&T's hard-won statewide video franchising rules in Texas to build competitive fiber in Dallas suburbs. They're apparently not bringing telecom; they're acting like a cable TV firm with data. Verizon owns chunks of territory all over due to it encompassing GTE in a deal years ago. GTE serves suburbs west of Portland, Ore., and east of Seattle, for instance, while Qwest serves most of the rest of each state.</p>

<p><a href="http://sanmateodailynews.com/article/2008-6-7-fc-metrofi"><strong>Foster City Wi-Fi dies on June 20:</strong></a> MetroFi is unlighting its cities, and Foster City opted not to spend the nearly $200,000 asking price MetroFi put on its equipment. MetroFi might still find a buyer, but June 20 is the network's current final day. Naperville, Ill., <a href="http://www.suburbanchicagonews.com/napervillesun/news/998667,6_1_NA11_WIFI_S1.article"><strong>also expects a June 20 shutdown</strong></a>. They, too, were offered the network hardware for 200 grand.</p>

<p><a href="http://www.chronline.com/story.php?subaction=showfull&id=1213119382&archive=&start_from=&ucat=1"><strong>Chehalis lights up:</strong></a> A small city in southern Washington votes to put in Wi-Fi hotzones. The cost is about $53,000 and annual fees $15,000. Funds will come from existing tax and grant sources. The city chose to install service to make sure they're not missing a checkbox on the amenities list for visitors and businesses rather than for a particular, measurable goal.</p>

<p><a href="http://www.chronline.com/story.php?subaction=showfull&id=1213205136&archive=&start_from=&ucat=1"><strong>Nearby Centralia pulls its Wi-Fi:</strong></a> A pilot project in the larger city of Centralia, Wash., a bit north of Chehalis, is shut down when poles used to mount Wi-Fi radios are removed as electrical wires are buried. (The reporter here confuses broadband over powerlines (BPL) with broadband wireless.) The system might be restarted later.</p>

<p><a href="http://www.muniwireless.com/2008/06/10/guest-commentary-how-a-pennsylvania-county-paved-the-way-to-muni-broadband-success/"><strong>Craig Settles writes up Pennsylvania's Cambria County wireless success:</strong></a> This is a network built for particular municipal purposes, part of Settles's long-time drumbeat about having applications first and then networks built for those networks second. He notes that Cambria built a 700 sq mi network that sounds nearly cost neutral through efficiency and cost conservation--it's cheaper to get much more service with this network than it was for a smaller array of services with incumbent-provided networks. </p>

<p><a href="http://www.scsun-news.com/news/ci_9545465"><strong>Santa Fe residents oppose Wi-Fi in the library on health grounds:</strong></a> You know what I have to say about how provable this has turned out to be in clinical studies. I am, however, as always, concerned about these people's health, even if I don't believe that Wi-Fi (or EMF) causes their problems. The group opposed to library-Fi is citing the ADA in this case, uniquely I believe. Six libraries suggested that EMF triggers seizures in epileptics, something I've never heard cited before; maybe CRTs (flickering), but EMF? Wired is substantially less kind than I am, pointing out that EMF other than Wi-Fi produces <a href="http://blog.wired.com/gadgets/2008/06/santa-fe-whiner.html"><strong>vastly higher signal strength</strong></a>. (They're sort of ignoring signal strength at a given point where an individual stands in relation to a transmitter, however.)</p>]]></content:encoded>
      <pubDate>Wed, 11 Jun 2008 10:33:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/big-city network">big-city network</category>
      <category domain="http://securityratty.com/tag/residents oppose wi-fi">residents oppose wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/mount wi-fi radios">mount wi-fi radios</category>
      <category domain="http://securityratty.com/tag/wi-fi hotzones">wi-fi hotzones</category>
      <category domain="http://securityratty.com/tag/wi-fi network">wi-fi network</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network hardware">network hardware</category>
      <source url="http://wifinetnews.com/archives/008353.html">Metro Round-Up: Phila., Minneapolis, St. Louis Park (Minn.), Texas, Foster City (Calif.), Naperville (Ill.), Chehalis and Centralia (Wash.), Cambria C</source>
    </item>
    <item>
      <title><![CDATA[Nuke Plant Shutdown Due To Upgrade]]></title>
      <link>http://securityratty.com/article/09c8cb2ce21240d4f610244eeeb5afad</link>
      <guid>http://securityratty.com/article/09c8cb2ce21240d4f610244eeeb5afad</guid>
      <description><![CDATA[Ah the joys of critical infrastructure. One wrong move with a software upgrade and the whole house of cards could come tumbling down
Case in point
From Washington Post
A nuclear power plant in Georgia...]]></description>
      <content:encoded><![CDATA[<p>Ah the joys of critical infrastructure. One wrong move with a software upgrade and the whole house of cards could come tumbling down. </p>
<p>Case in point.</p>
<p>From Washington Post:</p>
<blockquote><p>A nuclear power plant in Georgia was recently forced into an emergency shutdown for 48 hours after a software update was installed on a single computer.</p>
<p>The incident occurred on March 7 at Unit 2 of the Hatch nuclear power plant near Baxley, Georgia. The trouble started after an engineer from Southern Company, which manages the technology operations for the plant, installed a software update on a computer operating on the plant&#8217;s business network.</p>
<p>The computer in question was used to monitor chemical and diagnostic data from one of the facility&#8217;s primary control systems, and the software update was designed to synchronize data on both systems. According to a report filed with the Nuclear Regulatory Commission, when the updated computer rebooted, it reset the data on the control system, causing safety systems to errantly interpret the lack of data as a drop in water reservoirs that cool the plant&#8217;s radioactive nuclear fuel rods. As a result, automated safety systems at the plant triggered a shutdown. </p></blockquote>
<p>Um, whoops.</p>
<p><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/06/05/AR2008060501958.html">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=92yKBd"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=92yKBd" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=1oW0fI"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=1oW0fI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=vbbmqi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=vbbmqi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=TVh3Bi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=TVh3Bi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=pIWDwi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=pIWDwi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=9tynzi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=9tynzi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/307115524" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 07 Jun 2008 22:53:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/plant">plant</category>
      <category domain="http://securityratty.com/tag/shutdown">shutdown</category>
      <category domain="http://securityratty.com/tag/single computer">single computer</category>
      <category domain="http://securityratty.com/tag/safety systems">safety systems</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/nuclear power plant">nuclear power plant</category>
      <category domain="http://securityratty.com/tag/diagnostic data">diagnostic data</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/307115524/">Nuke Plant Shutdown Due To Upgrade</source>
    </item>
    <item>
      <title><![CDATA[1st Source Bank reissues all debit cards in response to breach]]></title>
      <link>http://securityratty.com/article/6badbe70f0f784d2a4c54ac1d44b88a2</link>
      <guid>http://securityratty.com/article/6badbe70f0f784d2a4c54ac1d44b88a2</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/30/08

Organization
1st Source Bank

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
Debit card...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/1stsource.jpg" align="right" height="58" width="180"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/30/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.1stsource.com/">1st Source Bank</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Debit card information including Track 2 data contained on magnetic stripes and some PIN numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"South Bend, Ind.-based 1st Source Bank is reissuing its entire portfolio of debit cards after a hacker or hackers broke into a bank server containing debit card data. No fraud has been discovered as a result of the intrusion"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.digitaltransactions.net/newsstory.cfm?newsid=1804">Digital Transactions News</a> <br><a href="http://www.wsbt.com/news/local/19416024.html">WSBT TV News</a> <br><a href="http://www.southbendtribune.com/apps/pbcs.dll/article?AID=/20080531/News01/805310350/0/Lives">South Bend Tribune</a> <br><a href="http://www.journalgazette.net/apps/pbcs.dll/article?AID=/20080605/BIZ/806050366">The Journal Gazette</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WSBT TV News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>South Bend, Ind.-based 1st Source Bank is reissuing its entire portfolio of debit cards after a hacker or hackers broke into a bank server containing debit card data.<br><span style="font-style: italic;">[Evan] I wonder how many debit cards are in its "entire portfolio".&nbsp; I'm guessing that the number is in the tens of thousands.</span><br><br>a hacker broke into the system from the outside and compromised the system.<br><br>No fraud has been discovered as a result of the intrusion<br><br>The $4.5-billion-asset bank with 79 branches in northern Indiana and southern Michigan began alerting customers last month after an outside monitoring service it uses noticed on May 12 an unusual flow of data from a bank server containing debit card data, says James Seitz, senior vice president of consumer and electronic banking. "We immediately saw that and shut it down," says Seitz.<br><span style="font-style: italic;">[Evan] It appears as though the bank employs a managed security services provider for intrusion detection monitoring and alerting (and possibly more).&nbsp; Using a third-party provider as a part of information security strategy is probably a good idea for organizations that do not have, cannot afford, or do not want to build in-house expertise.&nbsp; Managing third-party service agreements can sometimes be quite a challenge.</span><br><br>The bank notified law-enforcement authorities and hired outside forensic firms to analyze the breach.<br><br>"The server that holds our debit card information they were in there and they transferred information out. But we can't really tell if it was 10, 20, or 30 percent of our card holders," said Seitz.<br><br>They did, however, get Track 2 data contained on magnetic stripes, including account numbers, according to Seitz, as well as PINs in at least some cases. "They got some PIN numbers, but a very small percentage compared to the debit card base that we have," says Seitz.<br><br>Exactly how the hackers tapped the server isn’t publicly known.<br><span style="font-style: italic;">[Evan] This will be determined as part of the forensic investigation, but publicly this may never be known.&nbsp; We can only speculate. The information that was compromised is very sensitive and should have never been accessible from the "outside". Who knows if the server was actually compromised directly or through another avenue of attack.&nbsp; See, I am speculating.&nbsp; Thankfully, the bank had detective controls in place.</span><br><br>1st Source Bank is sending out letters reminding their customers to check their recent bank account activity.<br><span style="font-style: italic;">[Evan] As people should anyway.</span><br><br>"Out of an overabundance of care, we’re reissuing new debit cards to all our customers"<br><span style="font-style: italic;">[Evan] We could argue "overabundance".</span><br><br>the bank is reissuing all cards, which are MasterCard-branded, as a precaution<br><br>1st Source also is offering customers free credit-report monitoring for a year.<br><br>He adds that he couldn’t comment about the state of the bank’s compliance with the Payment Card Industry data-security standard, or PCI.<br><span style="font-style: italic;">[Evan] The Visa U.S.A. Cardholder Information Security Program (CISP) "List of Compliant Service Providers - All" is </span><a style="font-style: italic;" href="http://www.usa.visa.com/download/merchants/cisp_list_of_cisp_compliant_service_providers.pdf?it=c%7C/merchants/risk_management/cisp.html%7CCISP%20List%20of%20Compliant%20Service%20Providers">here</a><span style="font-style: italic;"> (a little different, but good information nonetheless).</span><br><br>"We are working with law enforcement to find these bad guys, and we didn't want to tip them off," said James Seitz<br><span style="font-style: italic;">[Evan] Chances are that the "bad guys" already know what the have.</span><br><br>"Our number one priority is our customers. We shut everything down right away and hired the best people we could get our hands on to see what happened here and to make sure it doesn't happen again," said Seitz.<br><br>1st Source began working with law enforcement and called in a forensic computer specialist team from the Washington, D.C., area to shut down the breach immediately and to help determine who was behind it.<br><span style="font-style: italic;">[Evan] 1st Source should be commended for not hesitating to bring in outside help.</span><br><br>It has taken a while to get all the information out about the breach, Seitz said, since the bank had to spend time going through all of its laptops and computer systems.<br><br>"You've got to understand what you have," he said.<br><span style="font-style: italic;">[Evan] A high-priority task for information security governance is to understand what you have. During an incident response is not a good time to figure out what you have.</span><br><br>Though the breach is something rather new for 1st Source, Seitz said these types of breaches seem to be hitting businesses in general more and more this day and age.<br><br>"Certainly, it's never happened to us before," Seitz said. "But it's becoming more prevalent. Daily, banks are going through this."<br><span style="font-style: italic;">[Evan] Breaches are as prevalent or more prevalent than they have ever been.&nbsp; I agree with Mr. Seitz.&nbsp; Recognizing this fact, what excuses do organizations have for not investing in and properly managing information security programs?&nbsp; I am not saying that 1st Source does not, I am writing in general terms.</span><br><br>Bank officials have yet to tally the cost of mailings to customers, creating new debit cards, consultants’ fees, paying for identity theft protection and employee overtime related to the security breach. Seitz called it a "considerable cost."<br><br>"Actually, our customers have been very understanding," he said. "Obviously, this is something that puts a little stress on that relationship."<br><br><span style="font-weight: bold;">Customer Reactions:</span><br>"My main worry is that my money is going to be gone tomorrow when I got to my account," said Jeremy Reinke, a 1st Source Bank customer.<br><br>"Is my money still in my account, and can they correct this so it doesn't happen again?" asked Chris Stump, another customer who hadn't heard about the May 12 security breach. "I guess in some ways I would have liked to know by now."<br><br><span style="font-weight: bold;">Commentary:</span><br>Judging from the customer comments I have read, people are concerned about the breach, but not angry with 1st Source Bank.&nbsp; I think this is because they perceive the bank's response to be open and genuine.&nbsp; The bank did employ proper controls to identify this breach early on and provided notice to customers in a timely manner.&nbsp; The fact that the bank took additional steps like re-issuing cards and providing credit monitoring only adds to the favorable perception.<br><br>I am still interested in knowing more detail around how an unauthorized outside entity was able to access this sensitive information in the first place.<br>&nbsp;&nbsp;&nbsp;&nbsp;  <br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/05/1stsource.aspx%E2%80%9D%20type=" text="" javascript="" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 05:09:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/1st source">1st source</category>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/1st source bank">1st source bank</category>
      <category domain="http://securityratty.com/tag/evan 1st source">evan 1st source</category>
      <category domain="http://securityratty.com/tag/server">server</category>
      <category domain="http://securityratty.com/tag/bank server">bank server</category>
      <category domain="http://securityratty.com/tag/bank officials">bank officials</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/bank employs">bank employs</category>
      <source url="http://breachblog.com/2008/06/05/1stsource.aspx">1st Source Bank reissues all debit cards in response to breach</source>
    </item>
    <item>
      <title><![CDATA[From the Eye of a Legal Storm, Murdoch's Satellite-TV Hacker Tells All]]></title>
      <link>http://securityratty.com/article/75c4bd1099f9d260b821fdd9a841f9bd</link>
      <guid>http://securityratty.com/article/75c4bd1099f9d260b821fdd9a841f9bd</guid>
      <description><![CDATA[SAN DIEGO -- Christopher Tarnovsky feels vindicated. The software engineer and former satellite-TV pirate has been on the hot seat for five years, accused of helping his former employer, a Rupert...]]></description>
      <content:encoded><![CDATA[<p>SAN DIEGO -- Christopher Tarnovsky feels vindicated. The software engineer and former satellite-TV pirate has been on the hot seat for five years, accused of helping his former employer, a Rupert Murdoch company, sabotage a rival to gain the top spot in the global pay-TV wars.
</p><p>
But two weeks ago a jury in the civil lawsuit against that employer, NDS Group, largely cleared the company -- and by extension Tarnovsky -- of piracy, finding NDS guilty of only a single incident of stealing satellite signals, for which Dish was awarded $1,500 in damages.
</p><p>
"I knew this was going to come," Tarnovsky says. "They didn't have any proof or evidence."
</p><p>
The trial was <a href="http://www.wired.com/politics/law/news/2008/04/murdoch">years in the making</a>, yet raised more questions than it answered. It came down to testimony between admitted pirates on both sides who accused each other of lying. Now that it's over Tarnovsky, who was fired by NDS last year, is eager to tell his side of the story.
</p><p>
Dressed in loose jeans, flip-flops and a T-shirt, Tarnovsky, 37, spoke with Wired.com by phone and in an air-conditioned lab in Southern California where he's been running a <a href="http://www.flylogic.net">consultancy</a> since losing his job. Surrounded by boxes of smart cards and thousands of dollars worth of microscopes and computers used for researching chips, he talked excitedly at lightning speed about his strange journey, which began in a top-secret Pentagon communications center, and ended with him working both sides of a heated electronic war over pay TV.
</p>

<div class="feedroomstoryembedlarge">

<iframe src="http://video.wired.com/linking/index.jsp?skin=oneclip&fr_story=b9671bb032f83a50ca57ae40b194d3feb3a8d77d&rf=ev&hl=false" width="404" height="346" scrolling="no" frameborder="0"></iframe>

<div class="storyimagecaption"><p>Satellite-TV hacker Chris Tarnovsky opens his laboratory to <a href="http://blog.wired.com/27bstroke6/">Threat Level</a> reporter Kim Zetter, providing a unprecedented peek into the world of smart-card hacking.<br />
<em>Editor: Annaliza Savage<br />
Camera: Steve Raines</em></p>


</div>

</div>


<p>
His story sheds new light on the murky, morally ambiguous world of international satellite pirates and those who do battle with them.
</p><p>
The stakes are high: Earnings in the satellite-TV industry reach the billions. In the first quarter of this year alone, U.S. market leader DirecTV announced revenue of $4.6 billion from more than 17 million U.S. subscribers. Dish Network earned $2.8 billion from nearly 14 million subscribers. Although satellite piracy has greatly diminished from its peak seven to 10 years ago when the events detailed in the civil lawsuit took place, the two companies lost millions in potential revenue, and spent millions more to replace insecure smart cards used in their systems and track down dealers selling pirated smart cards.
</p><!--pagebreak--><p>
Those smart cards are at the center of the controversy over NDS, a British-Israeli company and a majority-owned subsidiary of Murdoch's News Corp. The company makes access cards used by pay-TV systems, most prominently DirecTV -- itself a former Murdoch company. Nagrastar, a plaintiff in the case and NDS's chief competitor, makes access cards used by Dish Network and other runners-up in the market.
</p><p>
According to allegations in the lawsuit, in the late '90s NDS extracted and cracked the proprietary code used in Nagrastar's cards, a fact that NDS doesn't contest. What happened next, though, is hotly disputed. Nagrastar says Tarnovsky used the code to create a device for reprogramming Nagrastar cards into pirate cards, and gave the cards to pirates eager to steal Dish Network's programming. Tarnovsky was also accused of posting to the internet a detailed road map for hacking Nagrastar's cards. 
</p><p>
Nagrastar says NDS had an obvious motive for these antics: Their own chip, the so-called P1 or "F Card," had already been thoroughly cracked by pirates, and the company wanted to level the playing field with its competitors.
</p><p>
NDS denied the allegations at trial. The company declined to comment for this article or to confirm details of Tarnovsky's employment other than to say it was pleased that the verdict "ended in a resounding affirmation of NDS and its business ethics and proper conduct."
</p><p>
Tarnovsky began his pirating career in the '90s while serving in the U.S. Army. He had a top-secret SCI security clearance working on cryptographic computers in Belgium for NATO headquarters, and spent a year at Ft. Detrick in Maryland providing support to the National Security Agency for satellite transmissions to Europe.
</p><p>
In 1996, he was stationed in Germany when his colonel sold him a used satellite-TV system, along with two pirated access cards, neither of which worked. Tarnovsky began posting on online pirate forums, and developed contacts in the community, ultimately learning how to fix the cards to access English-language programs from Sky in the United Kingdom.
</p>
<p>
After leaving the Army and returning to the States, he got a call from Ron Ereiser, a Canadian pirate who'd heard about him through the grapevine. Pirates had found a back door in the P1 card and were vigorously exploiting it to get DirecTV content. But the cards kept failing. In a game of pirate pingpong, DirecTV periodically deployed electronic countermeasures, or ECMs, in the satellite stream that killed the cards in their set-top boxes. Ereiser needed someone to fix the cards.
</p><p>
There was serious black-market money on the line. In Canada, where pirating of U.S. satellite services wasn't considered illegal until 2002, syndicates of dealers did enough business that they could afford to chip in about $50,000 to hire a programmer to reverse engineer the latest cards. Pirate cards would sell for about $200 each, with the profit split between the investors and engineers. Tarnovsky claims Canadian pirate dealers could make $400,000 in a weekend; when Reginald Scullion, a notorious pirate in Canada, was raided in 1998, authorities seized $5.5 million from his bank accounts and safe-deposit boxes, though not all of it was from piracy.
</p><p>
Ereiser, who now works as a consultant to Nagrastar, concedes that the money from piracy was good, but insists that nobody became an overnight millionaire. "It was lucrative," he said in a telephone interview. "But to suggest that millions were being made in a month is an absolute crock."
</p><p>
DirecTV's countermeasures were a nagging drag on this lucrative trade. Every time an ECM was deployed, Ereiser and other dealers would be harangued by customers demanding to have the cards fixed and their TV programs restored. 
</p><!--pagebreak--><p>
Tarnovsky, who was known online as "Big Gun," says Ereiser offered him $20,000 to fix cards that were killed by ECMs, and he agreed. Each time NDS created a countermeasure, Tarnovsky would analyze the code and find a way to circumvent the countermeasure. He did it while working full-time as a software engineer for a semiconductor company in Massachusetts.
</p><p>
"I'd be at work and I'd check the IRC (channel) to see if they'd launched their Thursday countermeasure yet," he says. "It was like a chess game for me. I couldn't wait for them to do a countermeasure because I would counter it in minutes."
</p><p>
Tarnovsky suffers from attention deficit hyperactivity disorder, which he says helped with the detailed work.
</p><p>
"I think so fast," he says.
</p><p>
It wasn't long before NDS came courting. Tarnovsky had a contact at the company to whom he'd begun passing information about holes in its software, even supplying patches to fix them. NDS offered him a job earning $65,000 a year. By the time the company fired him last year, he was earning about $245,000 in salary and bonuses and had another $100,000 in stock options, he says.
</p><p>
The company set him up in a lab in Southern California equipped with a computer, some DirecTV set-top boxes, sample DirecTV cards and NDS source code. There was no fancy equipment at first, but his relationship with NDS and the lab grew over the decade he worked with them. Tarnovsky says the job was a dream come true. While living in Europe he'd once seen a news report showing an engineer at a French satellite company writing countermeasures, sitting in a lab with smart cards piled around him on his desk.
</p><p>
"I always thought it would be so cool to be that guy," Tarnovsky says. "Finally I got the chance." 
</p><p>
Tarnovsky had two roles at NDS -- to find holes in its software and work undercover with pirates to discover what they were doing against NDS technology.
</p><p>
To conceal his relationship with NDS from pirates, few people at the company knew his identity. He used the name "Michael George" and for the first four years was paid through other companies, including, for about five months, HarperCollins, the Murdoch-owned book publisher.
</p><p>
"It was very hush-hush, because we didn't know who could be an inside informant," he says.
</p><p>
Part of his job was developing ECMs for NDS. He'd examine pirate NDS cards to determine how they worked, then send instructions to engineers in Israel to create a kill for them.
</p><p>
"I didn’t actually load the gun and pull the trigger but I got to make the bullet," Tarnovsky says. 
</p><p>
Among the countermeasures he says he created was one known among pirates as the <a href=" http://www.theregister.co.uk/2001/01/25/directv_attacks_hacked_smart_cards/">"Black Sunday" kill</a> -- an elaborate scheme that destroyed tens of thousands of pirate DirecTV cards a week before Super Bowl Sunday in 2001.
</p><p>
Instead of being delivered all at once like other measures, the Black Sunday attack code was sent to pirate cards in about five dozen parts over the course of two months, like a tank transported piece by piece to a battlefield to be assembled in the field. "They never expected us to do this," Tarnovsky says.
</p><p>
The kill didn't last long before pirates found a way to jump-start the cards. But it holds an enduring position in pirate lore; for the first time, they could see a cunning mind at work on the other side.
</p><p>
While Tarnovsky was killing cards, however, he was also helping pirates fix them. 
</p><!--pagebreak--><p>
Days before Tarnovsky began working for NDS, the company began phasing in its latest-generation smart card, the P2, which was thought to be virtually uncrackable. But word reached the company that two Bulgarian hackers working for Ereiser had cracked the P2. On NDS's instructions, Tarnovsky met with Ereiser undercover in Calgary to get the code. When he got there, Ereiser offered him $20,000 to work for him fighting whatever countermeasures NDS and DirecTV cooked up to thwart their P2 hack.
</p><p>
NDS considered it a great opportunity for Tarnovsky to maintain his pirate identity, but DirecTV insisted on some controls. Under "Operation Johnny Walker," as they dubbed it, Tarnovsky gave Ereiser a program to create pirate NDS cards, but encrypted it so no one could copy it. The program worked only with a dongle attached to Ereiser's computer and created a limited number of cards that could be killed at any time.
</p><p>
But, according to Nagrastar, Tarnovsky wasn't just helping NDS fight piracy by working undercover and creating ECMs, he was also committing piracy against NDS's competitors to weaken their place in the market.
</p><p>
After NDS engineers in Israel hacked the Nagrastar code in the late '90s, Nagrastar says Tarnovsky created a "stinger" program that turned Nagrastar cards into pirate cards. He allegedly gave the program to a Canadian named Al Menard in 1999 who sold reprogrammed Nagrastar cards for $350 each. Then in December 2000, someone anonymously posted code and detailed instructions for hacking Nagrastar's card to two websites, one of them run by Menard, exposing Dish Network to even more piracy. It was estimated in court testimony that between 100,000 and 165,000 pirated Nagrastar cards were released to the market in the wake of this posting.
</p><p>
Nagrastar says Menard began sending Tarnovsky cash from the sale of the pirate cards. At the end of August 2000, authorities acting on an anonymous tip seized two boxes destined for a mail drop Tarnovsky rented in Texas. Inside, they found a CD and DVD player with $20,000 and $20,100 concealed inside.
</p><p>
The boxes were sent from a phony address for "Regency Audio" in Vancouver to C.T. Electronics at Tarnovsky's address. A customs form for a third package that wasn't seized indicated that it was sent from Menard to Tarnovsky and also contained electronic goods.
</p><p>
Tarnovsky was in Israel at the time, and says he didn't know anything about the packages until he was notified that they'd been seized. He thinks they were sent by someone in Nagrastar's camp who was trying to frame him. He says Nagrastar's accusations about the "stinger" program were baseless, and that he never gave Menard any software.
</p><p>
On Feb. 9, 2001, U.S. Customs agents appeared at his doorstep. On advice of a lawyer, he declined to let them search his house without a warrant. Tarnovsky was never arrested or charged with any crime, but suspicions against him were mounting. NDS gave Tarnovsky a polygraph test, but asked only two, self-interested questions that never touched on the Nagrastar accusations: Had Tarnovsky sold any modified NDS smart cards, or company secrets, since he'd been working for the company? Tarnovsky answered no, and passed the test.
</p><p>
He continued to work for NDS for six years. But then last year, Nagrastar confronted NDS with a sheriff's report showing that fingerprints lifted from the seized electronics equipment sent to Tarnovsky's Texas mail drop belonged to an associate of Menard, raising suspicions again that Tarnovsky might have sold pirate Nagrastar cards without NDS's knowledge. NDS fired him.
</p><p>
Tarnovsky says his termination proves he and NDS weren't conspiring against Nagrastar. Had they been, NDS would have done anything to keep him happy, and quiet. He says the fact that Nagrastar lost the case shows he wasn't pirating on his own either.
</p><p>
"I've never sold a single Nagra card, ever," he says.
</p><p>
Although he was angry at NDS for abandoning him, he told Wired.com before the trial ended that he hoped to work for the company again.
</p><p>
"I want to make sure that NDS wins this lawsuit because that will clear my name," he said at the time.
</p><p>
When it was suggested that someone might view this as motivation for him to lie on NDS's behalf, he disagreed.
</p><p>
"That's crazy. I could go to jail," he said. "I would never perjure myself for some company."
</p><p>
Since NDS fired him he's been consulting for two semiconductor companies and a manufacturer of dongle tokens, but he misses his life in electronic warfare. If NDS doesn't want him, he says he'd be happy to work for Nagrastar -- jumping sides once again.
</p><p>
"I could design a whole entire chip for them like I did for NDS," he says. "NDS thinks today that their technology is superior to everybody else's and it probably is, because they're 17 years ahead of Nagra technologically. But Nagra could catch up overnight if they used my services.
</p><p>
"I'm a very valuable asset as far as smart-card technology goes," he adds. "I know everything about (NDS) as far as their intellectual property models go."
</p><p>
He offered his services to the company last year, while the lawsuit was pending. Nagrastar declined.
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=e479ec41ffd452c9a6deef2acea6eafc" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=e479ec41ffd452c9a6deef2acea6eafc" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=VY9TTH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=VY9TTH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=J0yWwh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=J0yWwh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=4JlE1h"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=4JlE1h" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=uuCFEH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=uuCFEH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=WYuknH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=WYuknH" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=NZYibh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NZYibh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=Lvsfyh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=Lvsfyh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=NXXjSH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NXXjSH" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/301513715" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/301513721" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 30 May 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/smart cards piled">smart cards piled</category>
      <category domain="http://securityratty.com/tag/cards">cards</category>
      <category domain="http://securityratty.com/tag/nds cards">nds cards</category>
      <category domain="http://securityratty.com/tag/access cards">access cards</category>
      <category domain="http://securityratty.com/tag/sample directv cards">sample directv cards</category>
      <category domain="http://securityratty.com/tag/directv cards">directv cards</category>
      <category domain="http://securityratty.com/tag/smart cards">smart cards</category>
      <category domain="http://securityratty.com/tag/nds smart cards">nds smart cards</category>
      <category domain="http://securityratty.com/tag/nds">nds</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/301513721/tarnovsky">From the Eye of a Legal Storm, Murdoch's Satellite-TV Hacker Tells All</source>
    </item>
  </channel>
</rss>
