<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: taxes]]></title>
    <link>http://securityratty.com/tag/taxes</link>
    <description></description>
    <pubDate>Mon, 25 Feb 2008 11:03:19 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Is That a Coffee Table or a Munition?]]></title>
      <link>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</link>
      <guid>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</guid>
      <description><![CDATA[One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard....]]></description>
      <content:encoded><![CDATA[<p>One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard. When the rubber meets the real world road, things often turn out slightly different.&#0160;</p><br /><div>It turns out that it is hard to conduct business with excessive granularity.</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-pi" style="display: inline;"><a href="http://www.economist.com/displaystory.cfm?story_id=11965352"><img alt="D3408BB1" class="at-xid-6a00d83451c75869e201053619a7a7970b " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-320wi" /></a></a><span style="font-family: &#39;Trebuchet MS&#39;; ">
</span> <br /></div><br /><div>Here is an <a href="http://www.economist.com/displaystory.cfm?story_id=11965352">article</a> from The Economist on the challenges of space technology, commercialization and information sharing. This is widely applicable to corporate information security policies:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-weight: bold; line-height: normal; ">Gravity is not the main obstacle for America’s space business. Government is</span></p><p><span style="font-family: Verdana; line-height: normal; ">IN THE spring of 2006 Robert Bigelow needed to take a stand on a trip to Russia to keep a satellite off the floor. The stand was made of aluminium. It had a circular base and legs. It was, says the entrepreneur and head of Bigelow Aerospace in Nevada, “indistinguishable from a common coffee table”. Nonetheless, the American authorities told Mr Bigelow that this coffee table was part of a satellite assembly and so counted as a munition. During the trip it would have to be guarded by two security officers at all times.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal;"><br /></span><span style="font-family: Verdana; line-height: normal; ">Exporting technology has always presented a dilemma for America. The country leads the world in most technologies and some of these give it a military advantage. If export rules are too lax, foreign powers will be able to put American technology in their systems, or copy it. But if the rules are too tight, then it will stifle the industries that depend upon sales to create the next generation of technology.</span><br /><span style="font-family: Verdana; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal; ">It is a difficult balance to strike and critics charge that America has erred on the side of stifling. They claim that overly strict export controls have so damaged the space industry that America’s national security is now threatened by its dwindling leadership in space technology. The system, they complain, fails to distinguish between militarily sensitive hardware that should be controlled and widely available commercial technologies, such as lithium-ion batteries and solar cells. The zealous application of the export rules is the American space industry’s biggest handicap.</span></p></blockquote><div><span style="font-family: Verdana; font-weight: bold; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal; ">Read the whole thing its fascinating. So what started off as well intentioned asset protection eventually compromised the most important asset of all - strategic advantage.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">So what&#39;s a better model? I am partial to think about these sorts of problems as free trade agreements. Each integration point should have a set of policies, and enforcement mechanisms that also include compensating transactions.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">For example, did you know that in the US you can buy companies that trade on other exchanges through ADRs? You buy the ADR of say a French Telco which trades on a European exchange only you buy the ADR on the NYSE or Nasdaq. Then the French Telco issues you a dividend because you are a shareholder, but the French government withholds the dividend for foreign owners. Yet because there is a free trade agreement between the two countries, the US lets you write off the unreceived portion of the dividend on your taxes. (this may or may not be the case in US-France just an example). Anyway, its not a silver bullet but its an interesting strategy.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 09:40:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coffee table">coffee table</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/american technology">american technology</category>
      <category domain="http://securityratty.com/tag/free trade agreement">free trade agreement</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <category domain="http://securityratty.com/tag/space technology">space technology</category>
      <category domain="http://securityratty.com/tag/french telco issues">french telco issues</category>
      <category domain="http://securityratty.com/tag/common coffee table">common coffee table</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/is-that-a-coffee-table-or-a-munition.html">Is That a Coffee Table or a Munition?</source>
    </item>
    <item>
      <title><![CDATA[XSS Comedy III: Tax Cheats with Small Equipment]]></title>
      <link>http://securityratty.com/article/231bdf97af3811aa73d852717e216a77</link>
      <guid>http://securityratty.com/article/231bdf97af3811aa73d852717e216a77</guid>
      <description><![CDATA[As part of an ongoing series, if I may I, the third in a series on the absurd, inane, and perhaps even funny. Lest you forget: the first and second in the series
I don't know about you, but I enjoy...]]></description>
      <content:encoded><![CDATA[As part of an ongoing series, if I may I, the third in a series on the absurd, inane, and perhaps even funny. Lest you forget: the <a href="http://holisticinfosec.blogspot.com/2008/06/xss-comedy-at-mcafee-secures-expense.html" target="_blank">first</a> and <a href="http://holisticinfosec.blogspot.com/2008/09/xss-fortune-cookie.html" target="_blank">second</a> in the series.<br />I don't know about you, but I enjoy occasionally watching offerings like the History Channel, AMC, or the Military Channel. I'm a 40ish, white male and as such I likely fit the general demographic as perceived by the marketing geniuses who buy the late evening advertising blocks on these channels. <br />That does NOT mean that I cheat of my taxes and thus need the services of a plethora of scam artists selling tax relief. Nor does it mean that I have any interest in "enhancement" opportunities like Enzyte or ExtenZe. <br />I just love people who choose to skip out on a primary obligation of citizenship that most of us choose to meet, and expect to magically turn $100,000 in tax debt into $999. Then there are the "businesses" who exploit these folks and willingly convince them of their "success" via the power of advertising, at which point my patience just snaps, as it did last night. <br />Thus, part one of this rant is a mighty <span style="font-weight:bold;">bugger off</span> to all the "tax relief" companies. To their patrons, may I suggest simply paying taxes like the rest of us?<br />Here's an XSS vulnerability in the Freedom Financial Network, "as seen on TV", designed to express precisely how I feel: <br /><br /><a href="http://www.freedomfinancialnetwork.com/tax_debt.php?pid=ffn+go&key=%22%3E%3Cmarquee%3E%3Ch1%3ENOTHING_IS_FREE!%3C%2Fh1%3E%3C%2Fmarquee%3E" target="_blank">http://www.freedomfinancialnetwork.com/tax_debt.php?pid=ffn+go&key=%22%3E%3Cmarquee%3E%3Ch1%3ENOTHING_IS_FREE!%3C%2Fh1%3E%3C%2Fmarquee%3E</a><br /><br />If and when they fix this issue, here's the <a href="http://holisticinfosec.org/video/freedomtaxrelief/nothingisfree.html" target="_blank">video</a> for posterity.<br /><br />Part two of this rant will get you more bang for your buck, and I'm not talking enhancement.<br />Thanks to my utter disdain for the endlessly annoying advertising I went to the ExtenZe site to see what might be broken which immediately led me to discover an entire platform vulnerability in the ColdFusion application built by <a href="http://www.internet-direct-response.com/portfolio.html" target="_blank">Internet Direct Response (IDR)</a>, the wankers who proudly bring you Maxoderm, Vivaxa, Vazomyne, Smoke Away, and Hydroxydrene; all such reputable products, and all repetitively wearing me out via DirectTV. At the ExtenZe site I spotted a variable that seemed worthy of building a <a href="http://www.google.com/search?hl=en&q=inurl:%22microppcsite%22&start=0&sa=N" target="_blank">Googledork</a> from, and I soon discovered that it was a consistent variable in most of the sites pimping this crap; specifically, <span style="font-style:italic;">microppcsite</span>. You can follow all the search results back to our friends at IDR. <br />A little experimentation and I quickly discovered that the similar <span style="font-style:italic;">microppcterm</span> variable was vulnerable to entertaining XSS exploitation so I started with:<br /><br /><a href="http://www.extenzeforlife.com/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EToo_short,_Morningwood?%3C%2Fh1%3E%3C%2Fmarquee%3E&gclid=CJ3T2NXH8JYCFQQCagod7xyBrA" target="_blank">http://www.extenzeforlife.com/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EToo_short,_Morningwood?%3C%2Fh1%3E%3C%2Fmarquee%3E&gclid=CJ3T2NXH8JYCFQQCagod7xyBrA</a><br /><br />Pick your poison, it works on most IDR gems.<br /><br /><a href="http://www.enzyte-male-enhancement.com/google/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EBob_just_wants_your_money.%3C%2Fh1%3E%3C%2Fmarquee%3E" target="_blank">http://www.enzyte-male-enhancement.com/google/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EBob_just_wants_your_money.%3C%2Fh1%3E%3C%2Fmarquee%3E</a><br /><br />Again, a <a href="http://holisticinfosec.org/video/enhancement/enhancement.html" target="_blank">video</a>, should IDR choose to fix their app.<br /><br />And now, the grand prize for pathetic: The ExtenZe site is <a href="https://www.mcafeesecure.com/RatingVerify?ref=www.extenzeforlife.com" target="_blank">McAfee Secure</a>. <br /><br />I couldn't make this stuff up if I tried.<br />You thought www stood for world wide web. Try wee willy wankers. *sigh*<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html&title=XSS%20Comedy%20III:%20Tax%20Cheats%20with%20Small%20Equipment " title="XSS Comedy III: Tax Cheats with Small Equipment ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html" title="XSS Comedy III: Tax Cheats with Small Equipment ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 13:52:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/idr">idr</category>
      <category domain="http://securityratty.com/tag/idr choose">idr choose</category>
      <category domain="http://securityratty.com/tag/extenze site">extenze site</category>
      <category domain="http://securityratty.com/tag/extenze">extenze</category>
      <category domain="http://securityratty.com/tag/variable">variable</category>
      <category domain="http://securityratty.com/tag/consistent variable">consistent variable</category>
      <category domain="http://securityratty.com/tag/wankers">wankers</category>
      <category domain="http://securityratty.com/tag/choose">choose</category>
      <category domain="http://securityratty.com/tag/tax relief">tax relief</category>
      <source url="http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html">XSS Comedy III: Tax Cheats with Small Equipment</source>
    </item>
    <item>
      <title><![CDATA[Feds tighten security on .gov ]]></title>
      <link>http://securityratty.com/article/859be15e565c41e95c1800c08d870935</link>
      <guid>http://securityratty.com/article/859be15e565c41e95c1800c08d870935</guid>
      <description><![CDATA[When you file your taxes online, you want to be sure that the Web site you visit -- www.irs.gov -- is operated by the Internal Revenue Service and not a scam artist. By the end of next year, you can...]]></description>
      <content:encoded><![CDATA[When you file your taxes online, you want to be sure that the Web site you visit -- www.irs.gov -- is operated by the Internal Revenue Service and not a scam artist. By the end of next year, you can be confident that every U.S. government Web page is being served up by the appropriate agency.]]></content:encoded>
      <pubDate>Sun, 21 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/internal revenue service">internal revenue service</category>
      <category domain="http://securityratty.com/tag/government web page">government web page</category>
      <category domain="http://securityratty.com/tag/taxes online">taxes online</category>
      <category domain="http://securityratty.com/tag/scam artist">scam artist</category>
      <category domain="http://securityratty.com/tag/gov">gov</category>
      <category domain="http://securityratty.com/tag/web site">web site</category>
      <category domain="http://securityratty.com/tag/irs">irs</category>
      <category domain="http://securityratty.com/tag/visit">visit</category>
      <category domain="http://securityratty.com/tag/file">file</category>
      <source url="http://www.networkworld.com/news/2008/092208-government-web-security.html?fsrc=rss-security">Feds tighten security on .gov </source>
    </item>
    <item>
      <title><![CDATA[Comments made in 1955]]></title>
      <link>http://securityratty.com/article/532e094ca97a18b38d2d314867e734b1</link>
      <guid>http://securityratty.com/article/532e094ca97a18b38d2d314867e734b1</guid>
      <description><![CDATA[Great Site I found today, Who would have thought they would say these things the year I was born


clipped from www.thecoolnews.org


Comments made in 1955 (53 Years Ago
Author: Metalwarrior


16
Apr...]]></description>
      <content:encoded><![CDATA[<div > Great Site I found today,<br/>Who would have thought they would say these things the year I was born! </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/D422F723-D846-4CDD-84F4-EBB4B4155727/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/9e830b6b-51a2-468b-a406-b47faa8ec2b4/D422F723-D846-4CDD-84F4-EBB4B4155727/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/" href="http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/" style="font-size: 11px;">www.thecoolnews.org</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><DIV class="PostHead"></p>
<div style="margin: 4px 0px; color: #000000; font-size: 20px;"><A rel="bookmark" href="http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/" title="Permanent Link to Comments made in 1955 (53 Years Ago)">Comments made in 1955 (53 Years Ago)</A></div>
<p><SMALL class="PostAuthor">Author: Metalwarrior </SMALL><br />
<P class="PostDate"><br />
<SMALL class="day">16</SMALL><br />
<SMALL class="month">Apr</SMALL><br />
<SMALL class="year"></SMALL>
</p>
<p> </DIV></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“Thank goodness I won’t live to see the day when the Government takes half our income in taxes. I sometimes wonder if we are electing the best people to congress.”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“I’m afraid the Volkswagen car is going to open the door to a whole lot of foreign business.”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“It won’t be long before young couples are going to have to hire someone to watch their kids so they can both work.”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“I read the other day where some scientist thinks it’s possible to put a man on the moon by the end of the century. They even have some fellows they call astronauts preparing for it down in Texas ..”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“When I first started driving, who would have thought gas would someday cost 29 cents a gallon. Guess we’d be better off leaving the car in the garage.”</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.thecoolnews.org/2008/04/16/comments-made-1955-53-years-ago/ --><P>“Did you see where some baseball player just signed a contract for $75,000 a year just to play ball? It wouldn’t surprise me if someday they’ll be making more than the President.”</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/D422F723-D846-4CDD-84F4-EBB4B4155727/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 17:42:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/someday">someday</category>
      <category domain="http://securityratty.com/tag/someday cost">someday cost</category>
      <category domain="http://securityratty.com/tag/government takes half">government takes half</category>
      <category domain="http://securityratty.com/tag/call astronauts">call astronauts</category>
      <category domain="http://securityratty.com/tag/comments">comments</category>
      <category domain="http://securityratty.com/tag/day">day</category>
      <category domain="http://securityratty.com/tag/play ball">play ball</category>
      <category domain="http://securityratty.com/tag/foreign business">foreign business</category>
      <category domain="http://securityratty.com/tag/baseball player">baseball player</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=497">Comments made in 1955</source>
    </item>
    <item>
      <title><![CDATA[SCSU web server becomes spam server and exposes personal information]]></title>
      <link>http://securityratty.com/article/3c31bfb37a4fd50836b6330ede592347</link>
      <guid>http://securityratty.com/article/3c31bfb37a4fd50836b6330ede592347</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/24/08

Organization
Southern Connecticut State University

Contractor/Consultant/Branch
None

Victims
Current and former students

Number Affected...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/scsu.jpg" align="right" height="62" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/24/08<br><br><span style="font-weight: bold;">Organization: </span><br>Southern Connecticut State University<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Current and former students<br><br><span style="font-weight: bold;">Number Affected:</span><br>11,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, addresses and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Two weeks after discovering that its Web site had been used by hackers to flog fancy wedding rings, Southern Connecticut State University is notifying 11,000 current and former students that their Social Security numbers may have been compromised."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.southernct.edu/creditmonitoring/">SCSU Alert</a> <br><a href="http://www.pcworld.com/businesscenter/article/145087/after_web_defacement_university_warns_of_data_breach.html">PCWorld</a> <br><a href="http://www.nbc30.com/education/15979690/detail.html">NBC Channel 30 News</a> <br><a href="http://chronicle.com/wiredcampus/index.php?id=2940">Chronicle of Higher Education</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Southern Connecticut State University<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br><span style="font-weight: bold;">From the University's Alert Page:</span><br>During a recent security review of the Southern Connecticut State University Web server, it was discovered that certain identifying information pertaining to current students and alumni could have been vulnerable to access by unauthorized individuals.<br><span style="font-style: italic;">[Evan] As you will read further in this posting, the web server appears to have been compromised.&nbsp; I don't think "could have been vulnerable" is an accurate assessment.&nbsp; The information <span style="font-weight: bold;">WAS </span>vulnerable.</span><br><br>The information, including names, addresses, and Social Security numbers, was contained in a protected records office file in which students would register for graduation. <br><br>Records of about 11,000 students had been stored in the file dating back to 2002.<br><span style="font-style: italic;">[Evan] Personal information belonging to thousands of people on a public web server.&nbsp; UGH.</span><br><br>Upon discovering this potential vulnerability, the university immediately disabled the application and secured the file.<br><br>There has been no determination that the personal information contained in the file was accessed, nor is there any indication that this data has been or will be used for purposes of identity theft.<br><span style="font-style: italic;">[Evan] Even novice web site administrators log access to web pages and files.&nbsp; If the attacker accessed the file through the web service/daemon, then access was probably logged.&nbsp; If the attacker had completely compromised the web server or taken a different avenue of attack, then there might not be easily obtained evidence of access.&nbsp; Either way, I assume that the file could have been accessed easily.</span><br><br>The university has notified all the affected individuals by letter and taken a number of proactive steps, along with a full security review of the university's Web server.<br><span style="font-style: italic;">[Evan] What is proactive in a response?</span><br><br>The University has undertaken a review of all files containing personal information on its Web server and there is no evidence to date that any of them have been compromised.<br><span style="font-style: italic;">[Evan] The University should undertake a review of all files containing personal (and other confidential) information everywhere, not just its Web server.&nbsp; Why would personal information storage be permitted at all on a web server?</span><br><br>Identity protection services will be provided at the university's expense to the affected individuals, for a period of up to two years. To obtain this optional coverage, registration for this service is necessary.<br><span style="font-style: italic;">[Evan] At the "university's expense" means at the current and future student's expense.&nbsp; As the cost of business goes up, so does the cost of service (at some point) which means an increase in the price of tuition or increase in taxes (SCSU is a member of the Connecticut State University System).&nbsp; Does this sound like good management?</span><br><br>A help desk has been established to respond to questions. The help desk number is: (203) 392-7216 and will be staffed between the hours of 8:30 a.m. to 4:30 p.m.<br><br>A dedicated Web page, containing updated information, has been created and may be accessed at <a href="http://www.southernct.edu/creditmonitoring/%3Cbr%3E%3Cbr%3E%3Cspan">www.southernct.edu/creditmonitoring/<br><br><span></span></a><span style="font-weight: bold;">Now From Outside Sources:</span><br>Two weeks after discovering that its Web site had been used by hackers to flog fancy wedding rings, Southern Connecticut State University is notifying 11,000 current and former students that their Social Security numbers may have been compromised.<br><span style="font-style: italic;">[Evan] Do you see how the school's alert web site differs from outside sources?&nbsp; See a spin (one way or the other)?&nbsp; Do you think that the outside sources try to sensationalize the story, or do you think that the school doesn't want the embarrassment that their web server was a spam-related site for some time?&nbsp; Maybe a combination of the two.</span><br><br>The personal data was in a file on the university's Web server, which was accessed by criminals who were using the university's site as part of a spam operation, said Patrick Dilger, the university's director of public affairs.<br><span style="font-style: italic;">[Evan] Not only was personal information stored on a public web server, but it was stored on a poorly secured (and probably poorly monitored) public web server.</span><br><br>"The hackers were using our Web server as a host for their own Web site," he said.<br><br>Pages on the university's site contained ads for diamond rings, Viagra and Cialis.<br><br>After noticing the ads on April 9th, IT staff discovered the file containing the sensitive information. "When we were doing the security review after the hacker incident, we saw this file there and it wasn't properly secured, so it could have been targeted by someone," Dilger said.<br><br>The university believes that the hackers came from outside the U.S., and it is working with Connecticut's attorney general's office to investigate<br><br>Richard Blumenthal, Connecticut’s attorney general, sent a letter last week to Michael J. Hogan, president of the University of Connecticut, describing the breach and advising him that the many campuses he oversees should be vigilant about their storage, use, and disposal of confidential data.<br><br><span style="font-weight: bold;">Commentary:</span><br>There are so many things wrong with this, it is hard to know where to start.&nbsp; Will anyone be held accountable. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>April, 2008 - <a href="http://breachblog.com/2008/04/21/sungard.aspx">Stolen SunGard laptop affects at least 10 post-secondary schools</a> (PogoWasRight has been keeping a running update of the Sungard breach, check out their <a href="http://www.pogowasright.org/search.php?type=all&amp;query=Sungard&amp;mode=search&amp;Submit=Search">search</a>.)</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/05/02/scsu.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 02 May 2008 07:12:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/evan personal information">evan personal information</category>
      <category domain="http://securityratty.com/tag/web server">web server</category>
      <category domain="http://securityratty.com/tag/personal information storage">personal information storage</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/university system">university system</category>
      <category domain="http://securityratty.com/tag/personal">personal</category>
      <category domain="http://securityratty.com/tag/university immediately">university immediately</category>
      <source url="http://breachblog.com/2008/05/02/scsu.aspx">SCSU web server becomes spam server and exposes personal information</source>
    </item>
    <item>
      <title><![CDATA[Tax information exposed in trash]]></title>
      <link>http://securityratty.com/article/fb959ec3a4769fd1460c0419cca911c7</link>
      <guid>http://securityratty.com/article/fb959ec3a4769fd1460c0419cca911c7</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/6/08

Organization
Peter Roberts, FCA

Contractor/Consultant/Branch
None

Victims
Clients

Number Affected
dozens

Types of Data
names, addresses, tax...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/peterroberts.jpg" align="right" height="120" width="159"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/6/08<br><br><span style="font-weight: bold;">Organization: </span><br>Peter Roberts, FCA<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Clients<br><br><span style="font-weight: bold;">Number Affected:</span><br>"dozens"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, tax information, business transactions, and social insurance numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The private information of dozens of British Columbians was unearthed from a dumpster in downtown Vancouver and turned over to CTV News over the weekend."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20080406/BC_information_dumpster_080406/20080406?hub=TopStories">CTV News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>David Kincaid and Jina You, CTV British Columbia<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>The private information of dozens of British Columbians was unearthed from a dumpster in downtown Vancouver and turned over to CTV News over the weekend.<br><br>Documents containing names, addresses, tax information, business transactions, and social insurance numbers from several firms in a Howe Street office building were visible by someone having a cigarette in the alley.<br><span style="font-style: italic;">[Evan] Not just one firm, but "several firms"!</span><br><br>Many of the documents -- marked with phrases such as "personal and confidential" -- come from the office of Peter Roberts, a well-known accountant.<br><span style="font-style: italic;">[Evan] Mr. Roberts is a director of the </span><a style="font-style: italic;" href="http://www.cica.ca/1/9/6/4/8/index1.shtml">Canadian Institute of Chartered Accountant's (CICA) Risk Management and Governance Board</a><span style="font-style: italic;">.&nbsp; He has set a very poor example in risk management and governance.</span><br><br>When reached by phone, Roberts said that he put a bag full of the documents in the dumpster on Saturday.<br><br>He said he doesn't own a shredder and believed the documents would be safe because the dumpster is secured by a padlock.<br><span style="font-style: italic;">[Evan] Not owning a shredder is an absurd excuse.&nbsp; Heck, you can buy a </span><a style="font-style: italic;" href="http://shopping.yahoo.com/s%3Cimg%20src=" http:="" breachblog.com="" emoticons="" tongue.png="" border="0">aper%20Shredders"&gt;paper shredder</a><span style="font-style: italic;"> for less than a hundred bucks!</span><br><br>But to Vancouver's large and innovative homeless population, a lock isn't much of a safeguard.<br><br>"Guys will bend ... the lids or use rocks to pry them open," said one binner to CTV News.<br>&nbsp;<br>"I watched a guy cut a lock off a bin with bolt cutters and he took 35 cents out of the bin, but the lock cost $19.95," he said. <br><br>"Businesses need to know it's not something they should know, it's a legislated requirement that they know," said Valerie MacLean the executive director of the BCCPA. "They have to protect their clients and employees information."<br><br>The penalties for breaking the law on protecting privacy can be stiff: individuals face a maximum $10,000 fine, and companies can be fined as much as $100,000.<br><span style="font-style: italic;">[Evan] A fine of up to $10,000, loss of customer confidence, bad press, etc., or invest in a $100 paper shredder.&nbsp; Risk management?</span><br><br>Among the documents found this weekend are: <br></font><ul><li><font size="2">Federal T1 tax return forms from 2003 to 2008, including names, financial details, addresses, and social insurance numbers</font></li><li>Federal T1013E forms, which contain names, addresses, social insurance numbers, and telephone numbers</li><li>Property sales, which include names, addresses, prices paid for the property, and balance owing to solicitors in the deal</li><li>Consent forms, which include names, addresses and phone numbers</li><li>Statements of investment income, which include financial details.</li><li>Draft statement of account, including names, addresses, and a detailed breakdown of expenses <br></li></ul><font size="2"><br>Many of the documents appeared to be drafts or copies for records, and as such did not contain signatures. A few of the pages were hand-shredded, but for the most part the documents were intact.<br>&nbsp;<br>One of the pages was a letter from Roberts addressed to the Institute of Chartered Accountants of B.C., which describes itself on its website as a group that fosters public confidence in the profession of chartered accountants.<br><br><span style="font-weight: bold;">Victim Reaction:</span><br>"Oh my gosh," said one of Roberts' clients, David Weinberg, whose name was on several files<br><span style="font-style: italic;">[Evan] I wonder if this quote may have been edited for public consumption.&nbsp; I wonder if my reaction would be as politically correct.</span><br><br>"I'll have him either return this to me or assure me that he will be changing his privacy practices going forward to assure that not just this but all of his clients' documents are properly shredded." <br><br><span style="font-weight: bold;">Commentary:</span><br>Many companies turn to accountants (and accounting firms) for guidance on "IT Audit, Governance &amp; Security", and I question how valuable this guidance is sometimes.&nbsp; I don't want to discount the information security guidance given by all accountants because to do so would be unfair.&nbsp; I have seen many cases where an organization has put too much credence in the guidance of unqualified accounting firms.&nbsp; On the other hand, I have seen some impressive guidance too.&nbsp; I guess I wouldn't call an information security professional to audit my books or do my taxes, so I don't think I would call an accountant to audit my information security. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/06/peterroberts.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 07 Apr 2008 09:20:28 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/tax information">tax information</category>
      <category domain="http://securityratty.com/tag/employees information">employees information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information security guidance">information security guidance</category>
      <category domain="http://securityratty.com/tag/guidance">guidance</category>
      <category domain="http://securityratty.com/tag/information security professional">information security professional</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/include names">include names</category>
      <source url="http://breachblog.com/2008/04/07/peterroberts.aspx">Tax information exposed in trash</source>
    </item>
    <item>
      <title><![CDATA[Toronto Columnists: City Owned Exclusive Broadband a Good Deal]]></title>
      <link>http://securityratty.com/article/d1f55ceb4688fdda7707ff835a00ca6b</link>
      <guid>http://securityratty.com/article/d1f55ceb4688fdda7707ff835a00ca6b</guid>
      <description><![CDATA[Scary idea to force Torontonians to implement universal broadband, even to those with broadband: I'll admit I don't understand Canada as well as I should, but this column in the Toronto Star advocates...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.thestar.com/comment/article/406981"><strong>Scary idea to force Torontonians to implement universal broadband, even to those with broadband:</strong></a> I'll admit I don't understand Canada as well as I should, but this column in the Toronto Star advocates public ownership of broadband in the city that would supplant all privately supplied broadband to homes. I'm not kidding. Toronto Hydro is considering selling its telecom division, which includes its well-engineered but limited One Zone service (6 sq km of downtown). </p>

<p>This op-ed recommends that the city buy the division, and have it build service, which they estimate at about $100 per household, which could save $300 to $400 per household per year for those with broadband. But that means that they prefer any market for broadband to be destroyed in favor of a publicly owned and operated network. Which, frankly, would scare me if such a thing were proposed in my city.</p>

<p>It's not so much that any given broadband firm is so marvelous that I wouldn't prefer another. (I am surprisingly happy with my DSL from incumbent Qwest, including their fantastically improved technical support.) But, rather, that cities seem to do best in ensuring that missing pieces of all kinds are provided to those least able to advocate for themselves. This, in my mind, extends to cities providing incentives for supermarkets to be built in disadvantaged areas. (There's always an irony that people least able to afford food must travel the furthest to obtain food at prices below that offered in their neighborhood, typically through convenience stores. That's changing.)</p>

<p>One prominent argument that I found myself agreeing with when the discussion of municipal Wi-Fi was in its infancy was the problem of building a broadband network that used taxpayer dollars to improve the lot of some citizens, often those who could afford a variety of broadband options. Plans that used city budgets to reduce costs for telecom or provide municipal services are more egalitarian, and seem to have won the day.</p>

<p>In this case, the op-ed writers are suggesting a course that would eliminate all competition. Can anyone trust their city well enough that they support starting a bureaucracy that would completely de facto (not de jure) prevent any better service from being installed? Or that would require you to pay as part of your taxes for service that you wouldn't use?</p>

<p>The columnists do more sagely suggest that a "city-wide fibre/wireless network could be an important boost to city departments and other civic services that have growing needs for networking, such as education, libraries, police and emergency health services." </p>]]></content:encoded>
      <pubDate>Mon, 31 Mar 2008 09:50:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/broadband">broadband</category>
      <category domain="http://securityratty.com/tag/city budgets">city budgets</category>
      <category domain="http://securityratty.com/tag/city departments">city departments</category>
      <category domain="http://securityratty.com/tag/city-wide fibrewireless network">city-wide fibrewireless network</category>
      <category domain="http://securityratty.com/tag/broadband options">broadband options</category>
      <category domain="http://securityratty.com/tag/implement universal broadband">implement universal broadband</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/broadband firm">broadband firm</category>
      <source url="http://wifinetnews.com/archives/008245.html">Toronto Columnists: City Owned Exclusive Broadband a Good Deal</source>
    </item>
    <item>
      <title><![CDATA[To be liberated, you need to be educated in the facts]]></title>
      <link>http://securityratty.com/article/4f8accdfe2729a3a297f7983e04e293a</link>
      <guid>http://securityratty.com/article/4f8accdfe2729a3a297f7983e04e293a</guid>
      <description><![CDATA[Online safety 101. When will it happen? Sadly, never. Uninformed users will continue to fall for scams and allow their computer and others to be infected and give the malware marketeers lots of...]]></description>
      <content:encoded><![CDATA[<div > Online safety 101. When will it happen? Sadly, never.<br/>Uninformed users will continue to fall for scams and allow their computer and others to be infected and give the malware marketeers lots of profit.<br/>Ok, Im done ranting, Im fine now, really. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/128A15F3-B0FC-4169-BABB-9D7B1F10DF66/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/bfbf9289-8b18-413c-9f3e-acbfd92ee6a4/128A15F3-B0FC-4169-BABB-9D7B1F10DF66/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.download.com/8301-2007_4-9904894-12.html?tag=bubbl_3" href="http://www.download.com/8301-2007_4-9904894-12.html?tag=bubbl_3" style="font-size: 11px;">www.download.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.download.com/8301-2007_4-9904894-12.html?tag=bubbl_3 -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Spyware Horror Story: Debugging for newbies</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.download.com/8301-2007_4-9904894-12.html?tag=bubbl_3 --><P>As liberating as computers are, it&#8217;s terrifying when things go wrong. You&#8217;re left abandoned, even mocked!, by the tools on which you&#8217;ve come so heavily to rely. It&#8217;s like having your trusty accountant wipe a stack of forms to the floor, storm out of the office, and leave you to sort out your own taxes.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/128A15F3-B0FC-4169-BABB-9D7B1F10DF66/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Fri, 28 Mar 2008 11:28:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware marketeers lots">malware marketeers lots</category>
      <category domain="http://securityratty.com/tag/trusty accountant wipe">trusty accountant wipe</category>
      <category domain="http://securityratty.com/tag/spyware horror story">spyware horror story</category>
      <category domain="http://securityratty.com/tag/online safety">online safety</category>
      <category domain="http://securityratty.com/tag/taxes">taxes</category>
      <category domain="http://securityratty.com/tag/sadly">sadly</category>
      <category domain="http://securityratty.com/tag/floor">floor</category>
      <category domain="http://securityratty.com/tag/heavily">heavily</category>
      <category domain="http://securityratty.com/tag/users">users</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=409">To be liberated, you need to be educated in the facts</source>
    </item>
    <item>
      <title><![CDATA[Union Mortgage loan applicant information found in dumpster]]></title>
      <link>http://securityratty.com/article/e521113877509ae97abc821cd675e5d7</link>
      <guid>http://securityratty.com/article/e521113877509ae97abc821cd675e5d7</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/22/08, updated on 2/28/08

Organization
Union Mortgage Services of Cleveland, Inc

Contractor/Consultant/Branch
None

Victims
Loan applicants

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/mortgage.jpg" align="right" height="184" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/22/08, updated on 2/28/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.unionmortgageservices.com/">Union Mortgage Services of Cleveland, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Loan applicants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*"hundreds of people" including "Thousands of pages of sensitive documents"</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>Information that is typically found in loan applications, including bank statements, credit reports, and tax returns.<br><br><span style="font-weight: bold;">Breach Description:</span><br>Thousands of pages of sensitive loan application information were discovered in a dumpster behind a pizza shop in Cleveland, Ohio.&nbsp; The documents were allegedly discarded by employees of Union Mortgage Services of Cleveland, Inc., which has closed down after failing to pay taxes or failure to file tax returns.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wkyc.com/news/news_article.aspx?storyid=83808">WKYC-TV News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>WKYC-TV News, by way of Attrition.org<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Thousands of pages of sensitive documents were thrown out in a dumpster located behind a pizza shop at East 105th and Superior in Cleveland.<br><br>Confidential files were found on hundreds of people who applied for loans with a company called Union Mortgage, whose last known addresses were in Beachwood and Parma.<br><span style="font-style: italic;">[Evan] Union Mortgage Services addresses are/were; 23611 Chagrin Blvd Suite 275 </span><span style="font-style: italic;">Beachwood, OH 44122 and 1440 Snow Road Suite 118 Parma, OH 44134</span><br><br>Investigator Tom Meyer learned the company closed its doors recently after either failing to pay taxes or file its tax returns<br><span style="font-style: italic;">[Evan] Sounds shady for a mortgage company that people trust much of their financial lives with.</span><br><br>Channel 3 News retrieved as many documents as possible and returned them to their rightful owners.<br><br>Ken Knabe, a lawyer from Lakewood, was shocked that we had his bank accounts, credit reports, tax returns and other personal information including his social security number. "That's appalling. This is private information in a dumpster,"<br><br>Channel 3 News returned files of information on Kim and Edwin Soeder of Mentor, including their retirement accounts. "It makes you wonder how bad your credit rating becomes if people get this in their hands," said Mrs. Soeder.<br><br>Ohio Attorney General, Marc Dann, has sued another mortgage company, Randall Mortgage Services, Inc., for allegedly abandoning customers' loan and financial information. Dann says he would take action against Union Mortgage if customers came forward and filed complaints with his office.<br><br><img src="http://images.quickblogcast.com/95781-88451/marcdann.jpg" border="0" width="124"><br><br><span style="font-style: italic;">[Evan] Attorney General Marc Dann's site has some good information for consumers.&nbsp; To file a complaint, visit <a href="http://www.ag.state.oh.us/citizen/consumer/complaints.asp">http://www.ag.state.oh.us/citizen/consumer/complaints.asp</a></span><br><br>Dann said businesses that collect personal information are responsible for protecting it just like they would protect their own information.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is similar to the <a href="http://breachblog.com/2008/02/21/firstmagnus.aspx">First Magnus breach</a> reported earlier this month.&nbsp; Similarities include two financially troubled (or bankrupt) loan companies that figured their obligation to protect confidential personal information ceased when they closed the doors.&nbsp; The obligation to protect information entrusted to you only ceases when you transfer custodianship (i.e. return it to the owner, destruction, etc.)<br><br>I assume that we will only continue to see more of these types of breaches as more loan companies continue to suffer from today's credit crunch.&nbsp; When I researched Union Mortgage Services for this posting, I had a general sense of uneasiness.&nbsp; The lack of discovered background information and other legitimate references about the company might have made me question whether or not I would have done business with them in the first place.&nbsp; Hindsight is 20/20 they say. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/02/29/unionmortgage.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 29 Feb 2008 11:14:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collect personal information">collect personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/union mortgage">union mortgage</category>
      <category domain="http://securityratty.com/tag/loan">loan</category>
      <category domain="http://securityratty.com/tag/loan companies continue">loan companies continue</category>
      <category domain="http://securityratty.com/tag/loan companies">loan companies</category>
      <category domain="http://securityratty.com/tag/union mortgage services">union mortgage services</category>
      <category domain="http://securityratty.com/tag/background information">background information</category>
      <source url="http://breachblog.com/2008/02/29/unionmortgage.aspx">Union Mortgage loan applicant information found in dumpster</source>
    </item>
    <item>
      <title><![CDATA[Cashing in on employee theft, or honest whistleblower?]]></title>
      <link>http://securityratty.com/article/6220385518c92bd41671151d57327dcd</link>
      <guid>http://securityratty.com/article/6220385518c92bd41671151d57327dcd</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
2/22/08

Organization
LGT Group - The Wealth and Asset Management Group of the Princely House of Liechtenstein
English Version
German Version
French...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/lgt.jpg" align="right" height="67" width="71"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>2/22/08<br><br><span style="font-weight: bold;">Organization: </span><br>LGT Group - The Wealth and Asset Management Group of the Princely House of Liechtenstein<br><a target="_blank" href="http://www.lgt.com/en/index.html">English Version</a> <br><a target="_blank" href="http://www.lgt.com/de/index.html">German Version</a> <br><a target="_blank" href="http://www.lgt.com/fr/index.html">French Version</a> <br><a target="_blank" href="http://www.lgt.com/it/index.html">Italian Version</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>LGT Treuhand AG<br>(LGT Trust Ltd in English)<br><br><span style="font-weight: bold;">Victims:</span><br>Clients of LGT Trust (prior to 2002)<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,400*<br><br><font size="1">*there may be an additional 4,527 beneficiaries affected.</font><br><br><span style="font-weight: bold;">Types of Data:</span><br>Confidential bank account information.<br><br><span style="font-weight: bold;">Breach Description:</span><br>Confidential customer information was stolen from LGT Trust in 2002 by a former employee of the company.&nbsp; As a result of this breach, Heinrich Kieber was convicted of "serious fraud, dangerous threats, unlawful compulsion, and suppression of documents."&nbsp; Now it appears that German authorities paid Mr. Kieber "as much as 5 million euros ($7.4 million)" for information about German account holders for the purpose of investigating tax evaders.&nbsp; Other countries that are interested in the information allegedly stolen by Mr. Kieber include the United Kingdom (U.K.), the United States (U.S.), Australia and others.&nbsp; Mr. Kieber now has a new identity (possibly as part of the arrangement with Germany) and his whereabouts are unknown.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a target="_blank" href="http://www.lgt.com/export/sites/inta_lgtcom/_news/attachments/080224_LGT_Media_Release_en.pdf">LGT Group Media Communique dated 2/24/08</a> <br><span style="font-style: italic;">[Evan] Highly recommended interesting read</span><br><a target="_blank" href="http://www.theaustralian.news.com.au/story/0,25197,23276025-601,00.html">The Australian online news story</a> <br><a target="_blank" href="http://www.bloomberg.com/apps/news?pid=20601085&amp;sid=atBBrvCnsT6w&amp;refer=europe">Bloomberg.com online news story</a> <br><a target="_blank" href="http://www.marketwatch.com/news/story/uk-authorities-have-liechtenstein-tax/story.aspx?guid=%7BC132E3BB-306E-46C9-B4D0-37F2CBD5C4A2%7D">MarketWatch online news story</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Chad Thomas, Bloomberg.com<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>For LGT Group, all the facts now point - despite contradictory statements form sources said to be close to the German intelligence service - to the fact that the data material illegally disclosed to the German authorities is limited, in as far as LGT is concerned, to the client data stolen from LGT Treuhand in 2002.<br><br>Even though other rumors have been circulated about the occurrences, LGT Group is assuming on the basis of numerous indications that the person, who illegally passed the data on to the German intelligence service, is the same former employee of LGT Treuhand who stole the data in 2002.<br><br>Apparently, the stolen data material has also been illegally disclosed, directly or indirectly, to other authorities.&nbsp; According to reports in the media, the previously convicted offender was paid a sum of several millions for the information and was provided with a new identity.<br><br>this is a possibility that law firms were interposed as intermediaries.&nbsp; LGT will now re-register its report of a criminal offence committed by a person unknown directly against the convicted data thief.<br><br>approximately 1,400 client relationships with LGT Treuhand, which were established before the end of 2002.&nbsp; The largest proportion, about 600 clients, are resident in Germany.&nbsp; The figure circulated in the media of 4,527 sets of data represents the number of beneficiaries of all the foundations<br><br>it has become increasingly clear that the so-called "informant" of the BND German intelligence service is indeed the same convicted data thief who illegally disclosed the client data in 2002<br><br>Acting on the information, German authorities raided the home of one of the country's most high-profile executives, the chief executive of Deutsche Post AG, alleging he evaded paying about E1 million in taxes.<br><br>The government, which paid as much as 5 million euros ($7.4 million) for information on German account holders in Liechtenstein on a disk provided by an informant to the Federal Intelligence Service, or BND, will share this information with other countries, the finance ministry said today.<br><span style="font-style: italic;">[Evan] You mean to tell me that its possible (and acceptable) to steal confidential corporate information and sell it for big bucks?&nbsp; German authorities paid over $12,000 per record (7,400,000/600)!&nbsp; The question is, is this an informant or a data thief cashing in?</span><br><br>U.K. tax collectors, after initially turning up their nose at an informant's offer to sell them confidential data from a Liechtenstein bank, have now paid up and have information on about 100 wealthy British subjects<br><br>they were persuaded to pay the informant around 100,000 pounds only after Berlin tax officials launched in recent weeks a high-profile crackdown on Germans with money said to be stowed away in Liechtenstein<br><span style="font-style: italic;">[Evan] The UK got a deal.&nbsp; They only paid ~$2,000 per record.</span><br><br>Australian authorities have been given details of Australian clients of Liechtensteinische Landesbank (LL<img src="http://breachblog.com/emoticons/cool.png" border="0" />, according to reports in the Wall Street Journal and Guardian newspapers.<br><br>"The Australian Tax Office does not pay for information about tax schemes," an ATO spokeswoman said. "Nonetheless, we have a good flow of information from people concerned about fairness and equity in the tax system."<br><span style="font-style: italic;">[Evan] The best deal of all.&nbsp; Australia got the stolen information for free!</span><br><br>The former employee, who was convicted of the data theft, is a Liechtenstein citizen named Heinrich Kieber (HK).<br><br>He was active from October 1999 as an external employee of an IT-company, and from April 2001 to November 2002 as an employee of LGT Treuhand.&nbsp; At the time of his recruitment and during his employment with LGT Treuhand, he had not been previously convicted of a crime.&nbsp; However, as would become known later, an arrest warrant had been issued against HK, which was not accessible for examination during the standard checks carried out on new employees.<br><br>This arrest warrant was linked to a real estate deal in Spain in 1996, which HK had allegedly financed with uncovered checks, and was issued by the Spanish criminal prosecution authorities in 1997, firstly at national and subsequently at international level.<br><br>It has been reported that he (Heinrich Kieber)&nbsp; has been given a new identity and is living in Australia.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is a very intriguing story and one that will take a while to shake out.&nbsp; I am a little torn by the series of events, and struggle with the ethics of it all.&nbsp; I don't think Heinrich Kieber is any kind of hero by any means.&nbsp; I think he is a common thief that just received a huge payday. <br><br>A couple of questions to think about:<br></font><ul><li><font size="2">Do you think Heinrich Kieber is lucky criminal, or do you think he is an honest "informant" and "whistleblower"?&nbsp; <br></font></li><li><font size="2">If he were truly an honest guy, why would he shop the confidential information around like he did and not give it freely?</font></li><li>Do you think this story will encourage other insiders to follow suit?<br></li></ul><font size="2"><br>On one hand authorities catch criminals, which is great!&nbsp; On the other hand, we just enabled (and in some circles encouraged) insider criminal activity and potentially employee fraud.&nbsp; Read the <a target="_blank" href="http://www.lgt.com/export/sites/inta_lgtcom/_news/attachments/080224_LGT_Media_Release_en.pdf">LGT Group Media Communique</a>, it is very interesting stuff. <br><br>Past Breaches:<br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/02/25/lgt.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 25 Feb 2008 11:03:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/confidential">confidential</category>
      <category domain="http://securityratty.com/tag/confidential data">confidential data</category>
      <category domain="http://securityratty.com/tag/kieber">kieber</category>
      <category domain="http://securityratty.com/tag/named heinrich kieber">named heinrich kieber</category>
      <category domain="http://securityratty.com/tag/lgt">lgt</category>
      <category domain="http://securityratty.com/tag/lgt trust">lgt trust</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <source url="http://breachblog.com/2008/02/25/lgt.aspx">Cashing in on employee theft, or honest whistleblower?</source>
    </item>
  </channel>
</rss>
