<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: trash]]></title>
    <link>http://securityratty.com/tag/trash</link>
    <description></description>
    <pubDate>Tue, 20 May 2008 15:49:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Anti-Terror Law Mission Creep in the U.K.]]></title>
      <link>http://securityratty.com/article/d210842070419d07ee8cfee2be4e8e51</link>
      <guid>http://securityratty.com/article/d210842070419d07ee8cfee2be4e8e51</guid>
      <description><![CDATA[First terrorists, then trash cans : More than half of town halls admit using anti-terror laws to spy on families suspected of putting their rubbish out on the wrong day
Their tactics include putting...]]></description>
      <content:encoded><![CDATA[<p>First terrorists, then <a href="http://www.dailymail.co.uk/news/article-1082225/March-dustbin-Stasi-Half-councils-use-anti-terror-laws-watch-people-putting-rubbish-wrong-day.html?ITO=1490">trash cans</a>:</p>

<blockquote>More than half of town halls admit using anti-terror laws to spy on families suspected of putting their rubbish out on the wrong day. 

<p>Their tactics include putting secret cameras in tin cans, on lamp posts and even in the homes of 'friendly' residents. </p>

<p>The local authorities admitted that one of their main aims was to catch householders who put their bins out early.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=kcA9N"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=kcA9N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=uUuPN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=uUuPN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 07 Nov 2008 05:18:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/town halls admit">town halls admit</category>
      <category domain="http://securityratty.com/tag/trash cans">trash cans</category>
      <category domain="http://securityratty.com/tag/main aims">main aims</category>
      <category domain="http://securityratty.com/tag/tactics include">tactics include</category>
      <category domain="http://securityratty.com/tag/wrong day">wrong day</category>
      <category domain="http://securityratty.com/tag/secret cameras">secret cameras</category>
      <category domain="http://securityratty.com/tag/tin cans">tin cans</category>
      <category domain="http://securityratty.com/tag/local authorities">local authorities</category>
      <category domain="http://securityratty.com/tag/lamp posts">lamp posts</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/anti-terror_law.html">Anti-Terror Law Mission Creep in the U.K.</source>
    </item>
    <item>
      <title><![CDATA[Wells Fargo Opt Out 800 Number]]></title>
      <link>http://securityratty.com/article/7196138e5586bb624e0e2802946ab975</link>
      <guid>http://securityratty.com/article/7196138e5586bb624e0e2802946ab975</guid>
      <description><![CDATA[I have been a happy customer of Wells Fargo for a couple of years now, but one thing has always bothered me: being solicited by loosely affiliated companies. Well, I finally found out how to fix this....]]></description>
      <content:encoded><![CDATA[<p>I have been a happy customer of Wells Fargo for a couple of years now, but one thing has always bothered me: being solicited by loosely affiliated companies. Well, I finally found out how to fix this. I called 888.528.8460, which is their &quot;privacy preference line&quot;. From there I was able to opt out of all solicitation for new services.</p> <p>We&#39;ll see how well it works.</p> <p>I&#39;m not a crazy environmentalist, but waste makes me cringe. I make it a habit to contact companies that mail me catalogs that I don&#39;t read, telling them to take me off of their lists. I also do little things like bring a couple of bags to the grocery store every time I go in order to avoid generating more plastic waste.</p> <p>The other day, I was buying my son a sweatshirt in T.J. Maxx, and the clerk popped it into a plastic bag. I said, &quot;Thanks, but I really don&#39;t need that bag.&quot; He promptly balled it up and threw it in the trash. It makes me sad how so many people just don&#39;t get it. If everyone would just think a little bit about this in their daily lives, I think it&#39;d make a big difference for the world we leave to our kids and grandkids.</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=54177" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 30 Oct 2008 15:04:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/plastic waste">plastic waste</category>
      <category domain="http://securityratty.com/tag/plastic bag">plastic bag</category>
      <category domain="http://securityratty.com/tag/waste">waste</category>
      <category domain="http://securityratty.com/tag/contact companies">contact companies</category>
      <category domain="http://securityratty.com/tag/bag">bag</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/privacy preference line">privacy preference line</category>
      <category domain="http://securityratty.com/tag/opt">opt</category>
      <category domain="http://securityratty.com/tag/grocery store">grocery store</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/10/30/wells-fargo-opt-out-800-number.aspx">Wells Fargo Opt Out 800 Number</source>
    </item>
    <item>
      <title><![CDATA[Leave Your Webcam On 24/7? Might Want To Reconsider...]]></title>
      <link>http://securityratty.com/article/4d1de8afa43b141ff7ed90cd99cc3cb3</link>
      <guid>http://securityratty.com/article/4d1de8afa43b141ff7ed90cd99cc3cb3</guid>
      <description><![CDATA[It's nothing new that many hackers use programs that allow them to &quot;spy&quot; on their victims once they've compromised the PC (as long as they have a webcam switched on, of course). Similarly, hacking...]]></description>
      <content:encoded><![CDATA[
        It's nothing new that many hackers use programs that allow them to "spy" on their victims once they've compromised the PC (as long as they have a webcam switched on, of course). Similarly, hacking culture has always had a fascination for memes, <a href="http://blog.spywareguide.com/2008/05/memehacks_1.html">incorporating them</a> into part of the design of their latest DDoS tools.<br /><br />However, the strange obsession with <a href="http://en.wikipedia.org/wiki/Shock_sites">shock memes</a> has now spilled into a "fun" game currently doing the rounds on various hacking sites and forums.<br /><br />What this involves is hackers compromising a PC, ensuring the victim has a webcam switched on then opening up shock meme websites at the most inopportune moment, recording the moment of impact with the webcam feed. Or, as one guy put it:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="spinny1.jpg" src="http://blog.spywareguide.com/images/spinny1.jpg" class="mt-image-none" style="" height="86" width="451" /></span></div><br /><br />If you don't know what Meatspin is, you can probably count yourself lucky. If you still want to know, click <a href="http://answers.yahoo.com/question/index?qid=20060710001351AAMxYqY">here</a> (for an <i>explanation</i>. Not Meatspin itself, though the explanation might be classed NSFW anyway).<br /><br />Here's a real life example of one such incident, taken from a message board:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/spinny2.html" onclick="window.open('http://blog.spywareguide.com/images/spinny2.html','popup','width=929,height=192,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/spinny2-thumb-329x67.gif" alt="spinny2.gif" class="mt-image-none" style="" height="67" width="329" /></a></span><br />Click to Enlarge<br /></div><br />Typically, the shock meme website is opened up at full blast, which startles the victim (most sites of this nature loop a piece of music in the background while the, er, action takes place on screen). The bigger the shock, the better. Here's one guy who sounds like he shot about six feet in the air when the meme site fired up in his browser:<br /><br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/spinny3.html" onclick="window.open('http://blog.spywareguide.com/images/spinny3.html','popup','width=636,height=108,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/spinny3-thumb-336x57.jpg" alt="spinny3.jpg" class="mt-image-none" style="" height="57" width="336" /></a></span><br />Click to Enlarge<br /></div><br />This might all sound like fun and games - <i>sort of</i> - but note that the above individual did try to grab the victims credit card details. <br /><br />Generally, the attacker doesn't interact with the victim (because they want friends, relatives or others to think the victim actually brought the site up themselves) but here's a little trash talk anyway:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="spinny4.jpg" src="http://blog.spywareguide.com/images/spinny4.jpg" class="mt-image-none" style="" height="188" width="245" /></span></div><br /><br />At this point, the attacker may or may not grab a screenshot for posterity. I've seen quite a few galleries on sites comprised of people looking shocked at Tubgirl, or being spun round baby right round by Meatspin, and there's no doubt countless others out there floating around. Of course, not everybody is shocked (or indeed impressed) by a shockmeme site popping up on their computer. As an example of that, take this guy:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="spinny5.jpg" src="http://blog.spywareguide.com/images/spinny5.jpg" class="mt-image-none" style="" height="342" width="334" /></span></div><br /><br />Full credit to anyone that counters a shockmeme site appearing on their desktop by picking their nose for five minutes. At any rate, the golden rule with this is that the hackers only bother doing this when a webcam is present and left switched on. If there's no webcam, there's no point trying to elicit a response (because for all they know they're popping open 2 Girls and 1 Cup to an empty server room).<br /><br />Webcams can be a fun tool, but remember to switch them off every now and again or they could come back to haunt you. Of course, depending on the shock meme site deployed (and who happens to be in the room with you at the time), that could be the least of your worries...<br /><div><br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Mon, 01 Sep 2008 11:46:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/shockmeme site">shockmeme site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/meme site fired">meme site fired</category>
      <category domain="http://securityratty.com/tag/shock">shock</category>
      <category domain="http://securityratty.com/tag/shock meme websites">shock meme websites</category>
      <category domain="http://securityratty.com/tag/webcam">webcam</category>
      <category domain="http://securityratty.com/tag/shock meme site">shock meme site</category>
      <category domain="http://securityratty.com/tag/shock meme website">shock meme website</category>
      <category domain="http://securityratty.com/tag/webcam feed">webcam feed</category>
      <source url="http://blog.spywareguide.com/2008/09/leave-your-webcam-on-247-might.html">Leave Your Webcam On 24/7? Might Want To Reconsider...</source>
    </item>
    <item>
      <title><![CDATA[U.S. Government Policy for Seizing Laptops at Borders]]></title>
      <link>http://securityratty.com/article/644821439b7605896de17d8ca6d3a3de</link>
      <guid>http://securityratty.com/article/644821439b7605896de17d8ca6d3a3de</guid>
      <description><![CDATA[Amazing. The U.S. government has published its policy : they can take you laptop anywhere they want, for as long as they want, and share the information with anyone they want
Here's the actual policy:...]]></description>
      <content:encoded><![CDATA[<p>Amazing.  The U.S. government has <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/08/01/AR2008080103030.html">published its policy</a>: they can take you laptop anywhere they want, for as long as they want, and share the information with anyone they want.</p>

<p><a href="http://www.cbp.gov/linkhandler/cgov/travel/admissability/search_authority.ctt/search_authority.pdf">Here's</a> the actual policy:</p>

<blockquote>Federal agents may take a traveler's laptop or other electronic device to an off-site location for an unspecified period of time without any suspicion of wrongdoing, as part of border search policies the Department of Homeland Security recently disclosed. Also, officials may share copies of the laptop's contents with other agencies and private entities for language translation, data decryption, or other reasons, according to the policies, dated July 16 and issued by two DHS agencies, US Customs and Border Protection and US Immigration and Customs Enforcement... DHS officials said that the newly disclosed policies — which apply to anyone entering the country, including US citizens — are reasonable and necessary to prevent terrorism... The policies cover 'any device capable of storing information in digital or analog form,' including hard drives, flash drives, cell phones, iPods, pagers, beepers, and video and audio tapes. They also cover 'all papers and other written documentation,' including books, pamphlets and 'written materials commonly referred to as "pocket trash..."</blockquote>

<p>It's not the policy that's amazing; it's the fact that the government has actually made it public.</p>

<p>Slashdot <a href="http://yro.slashdot.org/yro/08/08/01/0958242.shtml">thread</a>.  My previous <a href="http://www.schneier.com/essay-217.html">essay</a> on crossing borders with laptops, and how to protect yourself.</p>

<p>Although honestly, the best thing is probably to keep your encrypted archives on some network drive somewhere, and download what you need after you cross the border.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xpja3K"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xpja3K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=vWPUNK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=vWPUNK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 01 Aug 2008 08:21:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/policy">policy</category>
      <category domain="http://securityratty.com/tag/cover">cover</category>
      <category domain="http://securityratty.com/tag/policies cover">policies cover</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/actual policy">actual policy</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/border protection">border protection</category>
      <category domain="http://securityratty.com/tag/border">border</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/us_government_p.html">U.S. Government Policy for Seizing Laptops at Borders</source>
    </item>
    <item>
      <title><![CDATA[Houston law firm threw confidential client information in the trash]]></title>
      <link>http://securityratty.com/article/f6684ed1c67a7acb138958de524dcb1a</link>
      <guid>http://securityratty.com/article/f6684ed1c67a7acb138958de524dcb1a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
Weber Law Firm

Contractor/Consultant/Branch
his wife

Victims
Clients

Number Affected
hundreds

Types of Data
personal financial...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/weber.jpg" width="200" align="right" height="60"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://weberlaw.com/">Weber Law Firm</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>"his wife"<br><br><span style="font-weight: bold;">Victims:</span><br>Clients<br><br><span style="font-weight: bold;">Number Affected:</span><br>"hundreds"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal financial records, documents with Social Security numbers, people's medical files and more"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"HOUSTON -- Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.khou.com/business/stories/khou080711_tj_recordsfound.57f842ba.html">KHOU-TV News (original)</a> <br><a href="http://www.khou.com/business/stories/khou080716_tj_filesdumped.6221053b.html">KHOU-TV News (follow-up)</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Jeremy Desel, KHOU-TV<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Harris County Sheriff's deputies uncovered hundreds of people's personal financial files that had been discarded in a dumpster in northwest Houston on Monday.<br><br>The records were mostly bankruptcy case files from a Houston attorney's office that found their way into a dumpster belonging to a Houston day care.<br><span style="font-style: italic;">[Evan] There is little doubt about the sensitivity of the information found in a person's bankruptcy files.&nbsp; Don't you think that an attorney should know better?</span><br><br>The discovery came in a trash bin in the 9100 block of Jones Road, with box after box of records including personal financial records, documents with Social Security numbers, people's medical files and more.<br><br>When the sheriff's office first arrived, the responding deputies had no idea what to do with the records. <br><br>So, they called the law office from where the records had come from. 11 News called the law offices of William Weber as well.<br><span style="font-style: italic;">[Evan] Mr. Weber's </span><a style="font-style: italic;" href="http://weberlaw.com/attorneys-staff.htm">bio</a><span style="font-style: italic;"> is pretty extensive.</span><br><br>Weber, who eventually arrived to pick up the discarded records, told both 11 News and the sheriff's office that it was "no big deal"<br><span style="font-style: italic;">[Evan] Obviously, this answer probably doesn't go over very well.&nbsp; In hindsight, I am guessing that Mr. Weber wishes he could take these words back.</span><br><br>Still, at the insistence of the sheriff's office, Weber did arrive to pick the boxes up.<br><br>Weber had a different answer for 11 News when he showed up to retrieve the 32 boxes.<br><br>"It's a mistake," he said. "We regret it. We regret it. They weren't intended to be put here. I didn't put them here. It was a misunderstanding between me and my wife."<br><span style="font-style: italic;">[Evan] Ugh.&nbsp; Blaming the wife would not be a good idea in my house, even if it were my her fault.</span><br><br>He added it was a one-time problem.<br><br>But he also said his firm does not have a policy for disposing of sensitive documents. <br>"No, I do not. I don't think there is a formal disposal policy. Legally," he answered. <br><br>Don't tell that to Radio Shack or Select Medical Corporation. Both settled lawsuits with the Texas Attorney General's Office this week for violating the Texas ID Theft Law that was passed in 2005.<br><br>It requires businesses to destroy any documents that contain sensitive information. Select Medical dumped 4,000 documents in its own dumpster, but did not destroy them first.<br><br>Both companies settled this week with the state for hundreds of thousands of dollars in fines.<br><span style="font-style: italic;">[Evan] Don't forget about </span><a style="font-style: italic;" href="http://www.oag.state.tx.us/oagNews/release.php?id=2519">EZMONEY, L.P. and EZPAWN L.P.</a><span style="font-style: italic;">&nbsp; They agreed to pay $660,000 to the Texas Attorney General.&nbsp; Don't mess with Texas!</span><br><br>However, it's not just a civil law question. It is also an ethics question. <br><br>"If a customer of Radio Shack had an interest in privacy and an interest to have their identity protected (and) not just tossed to the wind, I can assure you that a medical provider or a lawyer has a higher duty," said 11 News legal expert Gerald Treece.<br><br>The sheriff's office is looking into the possibility laws were broken by throwing away the records in that dumpster, but were unsure if anything illegal happened.<br><br>As a matter of fact, there's a good possibility no laws were broken.<br><span style="font-style: italic;">[Evan] Not criminal.&nbsp; This case may be ripe for a civil proceeding, however.</span><br><br>Weber spent several minutes loading the boxes into his car, but he also spent a lot of time avoiding the 11 News cameras as he picked up the discarded records.<br><br>Eventually, he left the scene, leaving a few boxes behind when he was confronted by 11 News cameras.<br><br>In his rush to get away, a box was left on the trunk lid of his vehicle and some of the papers inside flew out as he sped off.<br><span style="font-style: italic;">[Evan] Embarrassed?</span><br><br>Weber told 11 News that all the documents were shredded on Wednesday morning.<br><span style="font-style: italic;">[Evan] Any thought given to notifying the affected individuals?&nbsp; If not, it is probably too late now.</span><br><br>Weber also said he has talked with an attorney at the attorney general's office and told them he would cooperate fully. <br><br>11 News also spoke with one of the clients whose file was found in the dumpster on Monday. She said she's angry and feels betrayed.<br><br><span style="font-weight: bold;">Commentary:</span><br>We have read about organizations dumping sensitive confidential information in dumpsters before, but this is the first time I have read about a lawyer being responsible (or his wife).&nbsp; Mistakes do happen, but I question how much of a mistake this actually was due to Mr. Weber's initial "no big deal" reaction. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/17/weber.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 10:59:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/houston">houston</category>
      <category domain="http://securityratty.com/tag/weber">weber</category>
      <category domain="http://securityratty.com/tag/weber wishes">weber wishes</category>
      <category domain="http://securityratty.com/tag/houston attorney">houston attorney</category>
      <category domain="http://securityratty.com/tag/bankruptcy">bankruptcy</category>
      <category domain="http://securityratty.com/tag/khou-tv news">khou-tv news</category>
      <category domain="http://securityratty.com/tag/news">news</category>
      <category domain="http://securityratty.com/tag/bankruptcy files">bankruptcy files</category>
      <category domain="http://securityratty.com/tag/william weber">william weber</category>
      <source url="http://breachblog.com/2008/07/17/weber.aspx">Houston law firm threw confidential client information in the trash</source>
    </item>
    <item>
      <title><![CDATA[How personal information wound up at the side of the road is a mystery]]></title>
      <link>http://securityratty.com/article/42893bd55f98a595373bc046f7b93a94</link>
      <guid>http://securityratty.com/article/42893bd55f98a595373bc046f7b93a94</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/10/08

Organization
Liberty Furniture

a North Carolina based company with Mid-South ties to Cromcraft - a furniture warehouse in Tate County&quot;,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/liberty.jpg" width="200" align="right" height="150"><font size="2"><b>Date Reported: </b><br>7/10/08<br><br><b>Organization: </b><br>Liberty Furniture*<br><br><font size="1">*"a North Carolina based company with Mid-South ties to Cromcraft - a furniture warehouse in Tate County", Mississippi.&nbsp; According to the report, Liberty Furniture may have gone out of business more than 20 years ago.</font><br><br><b>Contractor/Consultant/Branch:</b><br>Unknown<br><br><b>Victims:</b><br>Former employees<br><br><b>Number Affected:</b><br>"hundreds, maybe even thousands of people"<br><br><b>Types of Data:</b><br>Personal information including W-2 forms and tax forms containing names, addresses, and Social Security numbers<br><br><b>Breach Description:</b><br>"Eyewitness News Everywhere Uncovers the personal information of hundreds, maybe even thousands of people - dumped along a Mid-South road."<br><br><b>Reference URL:</b><br><a href="http://www.myeyewitnessnews.com/news/local/story.aspx?content_id=1601248c-3496-44ad-a2a3-053a779e9edf">Eyewitness News Everywhere</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Kevin Holmes, Eyewitness News Everywhere<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Eyewitness News Everywhere Uncovers the personal information of hundreds, maybe even thousands of people - dumped along a Mid-South road.<br><span style="font-style: italic;">[Evan] For those readers who may be unsure where this "Mid-South" is located, in this case it is Mississippi.</span><br><br>We even found W-2 forms, tax forms with people's names, addresses and social security numbers.<br><br>Investigators in Tate County are trying to figure out how the papers got there.<br><br>Larry Davis made the discovery.<br><br>He says he was driving into town when he came across thousands of forms.<br><br>"That's just uncalled for...you are entrusting these people with a lot of information that could ruin you very quickly, but yet they treat it like it's trash," said Davis.<br><span style="font-style: italic;">[Evan] I think most people share Mr. Davis' feelings.&nbsp; It is puzzling.&nbsp; What was the person who dumped the information on the side of the road thinking, supposing the the person was thinking and supposing the information was dumped and not lost (i.e. fell off a truck).</span><br><br>Financial records, shipping order forms, and W-2's of former employees<br><br>"Stupidity on the person that threw it out on the road.&nbsp; The people who disposed of these, there should be some legal action against them, but to me that's mismanagement," said Davis.<br><span style="font-style: italic;">[Evan] Again, I think many people share the same feelings as Mr. Davis.</span><br><br>Many of the records are from Liberty Furniture, a North Carolina based company with Mid-South ties to Cromcraft - a furniture warehouse in Tate County<br><br>"There all from North Carolina, how did they get here?&nbsp; This is Mississippi.&nbsp; We got some strong wind, but they ain't that strong," says Davis. <br><br>Even Cromcraft employees were shocked when we brought this to their attention. <br><br>Most of the W-2's are from the late 1970's and early 80's.<br><span style="font-style: italic;">[Evan] Wow!&nbsp; These W-2's are 20-30+ years old?!</span><br><br>we're told Liberty Furniture went out of business more than twenty years ago.<br><br>Larry Davis' daughter Susan Herron said, "This could be someone's grandparents on fixed income, now their social security number is floating around somewhere and it's awful, people need to be more careful."<br><br>Eyewitness News Everywhere caught up with one of the former employees whose personal information was exposed. <br><br>"My initial feeling was a very sinking, horrified, scared, feeling....You feel vulnerable and hope your social security number hasn't fallen into the wrong hands.&nbsp; So I have to be diligent in checking my credit report," said the employee.<br><span style="font-style: italic;">[Evan] It is interesting to read how a person feels when they learn that their personal information has been compromised.&nbsp; I feel bad for these people.&nbsp; This employee doesn't need to feel "horrified and scared", but he/she does nonetheless, and it's all due to negligence.&nbsp; This is just one reason why information security is so personal to me.</span><br><br>Other former Liberty Furniture employees tell Eyewitness News Everywhere they will be doing the same thing - checking their credit report.<br><br>Eyewitness News Everywhere will keep those forms in a secure place until we hand them over to the proper authorities.<br><br><span style="font-weight: bold;">Commentary:</span><br>There is a lot of mystery surrounding this breach.&nbsp; How did the information get there?&nbsp; Why was the information still kept?&nbsp; Who was in possession of the information before it was found on the side of the road?&nbsp; Why wasn't the information already destroyed if the company who was responsible for it is no longer in business?<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/10/liberty.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 06:50:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/road">road</category>
      <category domain="http://securityratty.com/tag/personal">personal</category>
      <category domain="http://securityratty.com/tag/w-2 forms">w-2 forms</category>
      <category domain="http://securityratty.com/tag/liberty furniture employees">liberty furniture employees</category>
      <category domain="http://securityratty.com/tag/w-2">w-2</category>
      <category domain="http://securityratty.com/tag/eyewitness news">eyewitness news</category>
      <category domain="http://securityratty.com/tag/liberty furniture">liberty furniture</category>
      <source url="http://breachblog.com/2008/07/10/liberty.aspx">How personal information wound up at the side of the road is a mystery</source>
    </item>
    <item>
      <title><![CDATA[Petroleum Wholesale charged with exposing customers]]></title>
      <link>http://securityratty.com/article/1e0eee4c18853dda51b902995e1d952a</link>
      <guid>http://securityratty.com/article/1e0eee4c18853dda51b902995e1d952a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/19/08

Organization
Petroleum Wholesale, L. P

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
Unknown

Types of Data
sensitive...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/pw.jpg" width="200" align="right" height="93"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/19/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.petroleumwholesale.com/sunmart.web/homepage.html">Petroleum Wholesale, L. P.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"sensitive personal information, including Social Security numbers, bank account numbers, and credit or debit card information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>”HOUSTON -- Petroleum Wholesale, which operated Sunmart Travel Centers and Convenience Stores in 10 states, was charged by the Texas Attorney General of improperly disposing of customer records"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.hcnonline.com/site/news.cfm?newsid=19788139&amp;BRD=1574&amp;PAG=461&amp;dept_id=532238&amp;rfi=6">The Pasadena Citizen</a> <br><a href="http://www.khou.com/news/local/crime/stories/khou080619_jj_storeid.1c30dcf3.html">KHOU-TV Channel 11 News</a> <br><a href="http://www.csnews.com/csn/news/article_display.jsp?vnu_content_id=1003819492">Convenience Store News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Pasadena Citizen<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>HOUSTON - Texas Attorney General Greg Abbott today charged Houston-based Petroleum Wholesale, L.P., which operates Sunmart Travel Centers &amp; Convenience Stores in 10 states, for exposing its customers to identity theft.<br><br>According to the state's enforcement action, Petroleum Wholesale improperly discarded customer records containing sensitive personal information, including Social Security numbers, bank account numbers, and credit or debit card information.<br><br>"This defendant is charged with failing to protect its customers' sensitive information," Attorney General Abbott said.<br><br>"With more than 20,000 Texas victims each year, identity theft remains one of the nation's fastest-growing crimes. The Office of the Attorney General will continue working to protect Texans from identity theft."<br><br>Investigators with the Office of the Attorney General (OAG) discovered that the company improperly discarded hundreds of customer records in a publicly-accessible trash container outside its former headquarters.<br><span style="font-style: italic;">[Evan] According to information posted on the Petroleum Wholesale web site, "Petroleum Wholesale services more than 350 retail locations throughout ten states."&nbsp; This breach has the potential to affect many, many people.</span><br><br>According to investigators, the records included sales receipts with customers' names and full credit or debit card numbers with expiration dates.<br><br>The records also included returned checks, along with forms listing customers' names, banking routing numbers, driver's license and Social Security numbers.<br><br>The defendant is charged with violating the 2005 Identity Theft Enforcement and Protection Act, which requires the safeguarding and proper destruction of clients' sensitive personal information.<br><br>State law establishes penalties of up to $50,000 per violation of the Act.<br><span style="font-style: italic;">[Evan] This could add up quick.&nbsp; What's a better business decision, a few hundred bucks for a cross-cut shredder and accompanying procedures, or fifty grand per incident?&nbsp; Although, I am not sure that a shredder and procedures are not all that is needed in Petroleum Wholesale's information security program (assuming one exists).</span><br><br>The OAG also charged the company with violating Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients' personal information.<br><br>The law provides for civil penalties of up to $500 for each abandoned record.<br><br>For more information about preventing identity theft, contact the Office of the Attorney General at (800) 252-8011 or visit the agency's Web site at <a href="http://www.texasattorneygeneral.gov.<br><br><span">www.texasattorneygeneral.gov.<br><br><span</a> style="font-weight: bold;">Commentary:</span><br>One question that isn't clear from the news reports is whether or not this was a common practice at Petroleum Wholesale.&nbsp; Organizations should take heed of this case.&nbsp; I think actions taken by Mr. Abbott and other State Attorney Generals will only become more frequent.<br><br>I look forward to more information in the future about this case. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/22/pw.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 22 Jun 2008 17:58:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/petroleum wholesale">petroleum wholesale</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/company improperly">company improperly</category>
      <category domain="http://securityratty.com/tag/improperly">improperly</category>
      <category domain="http://securityratty.com/tag/debit card information">debit card information</category>
      <category domain="http://securityratty.com/tag/debit card">debit card</category>
      <source url="http://breachblog.com/2008/06/22/pw.aspx">Petroleum Wholesale charged with exposing customers</source>
    </item>
    <item>
      <title><![CDATA[Insurance claims and policy information in the dumpster]]></title>
      <link>http://securityratty.com/article/ae2a94a41f5bdb5795784e6c6f9639b9</link>
      <guid>http://securityratty.com/article/ae2a94a41f5bdb5795784e6c6f9639b9</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/13/08

Organization
Texas Insurance Claims Services

Contractor/Consultant/Branch
None

Victims
Customers

Number Affected
hundreds of files

Types of...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/shredded.jpg" width="133" align="right" height="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/13/08<br><br><span style="font-weight: bold;">Organization: </span><br>Texas Insurance Claims Services<br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>"hundreds of files"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Insurance claims and policy paperwork including "names, social security numbers and policy numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>Files containing sensitive confidential information were discovered in a dumpster in Richardson, Texas.&nbsp; The files are believed to have been thrown out by the owner of a company called Texas Insurance Claims Services.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wfaa.com/sharedcontent/dws/news/localnews/tv/stories/wfaa080613_lj_lopez.2c3f840a.html">WFAA Channel 8 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Rebecca Lopez, WFAA-TV<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>on Friday, hundreds of files with people's names, social security numbers and policy numbers were found in a Richardson dumpster<br><br>The files contain a lot of private information.<br><br>The people who filled out the forms probably never expected them to end up where anyone could simply walk away with them.<br><span style="font-style: italic;">[Evan] There we go with expectations again.&nbsp; See my comments in the "</span><a style="font-style: italic;" href="http://breachblog.com/2008/06/18/dominos.aspx">Tucson area Domino's Pizza customer information exposed</a><span style="font-style: italic;">" breach.</span><br><br>You expect when you give your private information to an insurance company, it will stay that way.<br><br>Mike McCarty was driving by a dumpster near his work in Richardson. He saw a man taking pictures of trash inside, so he stopped.<br><span style="font-style: italic;">[Evan] Taking pictures?</span><br><br>"[The man] said he was looking for empty boxes because he was going to move but he found a bunch of these files."<br><span style="font-style: italic;">[Evan] But why was the man taking pictures?&nbsp; The story isn't clear on this point, so I wonder.</span><br><br>There were files with people's names, addresses, social security numbers and even pictures of their homes and cars. <br><br>The files were dumped here by a company called Texas Insurance Claims Services which processes people's claims.<br><br>We asked the owner why he threw them away. He wouldn't go on camera but said he was only required to keep the files five years and could then toss them.<br><span style="font-style: italic;">[Evan] Oh, well then.&nbsp; Sounds like a good enough explanation to me... NOT!&nbsp; Where is the corporate and social responsibility?</span><br><br>The company says it sometimes uses commercial shredding services but decided not to do so this time.<br><span style="font-style: italic;">[Evan] Let me see if I understand this correctly.&nbsp; The company obviously knows the importance of shredding confidential papers in general, otherwise they wouldn't "sometimes use commercial shredding services".&nbsp; What the @#$^ explains why the company chose not to use the shredding services in this instance?</span><br><br>Authorities say it's not unusual for criminals to dumpster dive to look for ways to get personnel information that they can use to illegally run up huge bills.<br><span style="font-style: italic;">[Evan] This is very true.&nbsp; There are even people who organize and belong to dumpster diving clubs, not to imply that THESE people are "criminals", but only to point out that people DO dumpster dive.</span><br><br>The dumpster was full of files. Most of them were taken away by garbage collectors. We are shredding the few we took for our story.<br><span style="font-style: italic;">[Evan] The files were taken away by garbage collectors?&nbsp; I wonder how much confidential information a person could find at the dump (landfill)?</span><br><br><span style="font-weight: bold;">Commentary:</span><br>It may just be the context of the owner's remarks, or it may just be me, but the owner seems to be oblivious to the risk of throwing confidential customer information out with the garbage. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/18/tics.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 08:41:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/dumpster">dumpster</category>
      <category domain="http://securityratty.com/tag/sensitive confidential information">sensitive confidential information</category>
      <category domain="http://securityratty.com/tag/personnel information">personnel information</category>
      <category domain="http://securityratty.com/tag/confidential customer information">confidential customer information</category>
      <category domain="http://securityratty.com/tag/dumpster dive">dumpster dive</category>
      <category domain="http://securityratty.com/tag/files">files</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <source url="http://breachblog.com/2008/06/18/tics.aspx">Insurance claims and policy information in the dumpster</source>
    </item>
    <item>
      <title><![CDATA[Employment records in a New Mexico dumpster]]></title>
      <link>http://securityratty.com/article/25d92f598bfb284603de4aa74724a145</link>
      <guid>http://securityratty.com/article/25d92f598bfb284603de4aa74724a145</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/3/08

Organization
State of New Mexico

Contractor/Consultant/Branch
Department of Workplace Solutions

Victims
Employees and job applicants

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/nmdeptws.jpg" align="right" height="125" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/3/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.newmexico.gov/">State of New Mexico</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.dws.state.nm.us/">Department of Workplace Solutions</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Employees and job applicants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"employment records with names and Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"ROSWELL, N.M.—State documents with names and Social Security numbers were thrown into a trash bin behind the state Department of Workforce Solutions office in Roswell."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.lcsun-news.com/ci_9464120">The Associated Press via Las Cruces Sun-News</a> <br><a href="http://www.roswell-record.com/main.asp?SectionID=49&amp;SubSectionID=112&amp;ArticleID=28641&amp;TM=864.584">Roswell Daily Record</a> <br><a href="http://www.krqe.com/global/story.asp?s=8431184">KRQE Channel 13 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Roswell Daily Record<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Four boxes of manilla folders with documents containing names and social security numbers were mistakenly thrown into a trash bin Monday behind the New Mexico Department of Workforce Solutions office near Main and Bland streets. <br><span style="font-style: italic;">[Evan] New Mexico does not currently have a data breach disclosure law on the books.&nbsp; The state is one of eleven that do not.&nbsp; The others are Alaska, South Dakota, Iowa, Missouri, Kentucky, West Virginia, Virginia, Mississippi, Alabama, and South Carolina.</span><br style="font-style: italic;"><br>Employees at Savedra's Tienda, a nearby business, contacted County Commissioner Dick Taylor and Magil Duran of the New Mexico Department of Workforce Solutions to help remove the documents from the bin.<br><span style="font-style: italic;">[Evan] This is what a model citizen does.&nbsp; How many people are model citizens?</span><br style="font-style: italic;"><br>papers were flying out of the Dumpster they were inside.<br><br>Duran said the Roswell office of the Department of Workforce Solutions recently moved to a new location and a janitor inadvertently threw the documents in the bin on Monday. <br><span style="font-style: italic;">[Evan] Not a good excuse.</span><br><br>"It was a misunderstanding," Duran said.<br><br>After arriving at the scene, Duran and Taylor sifted through the bins and retrieved the files. <br><br>Duran said he would shred the files immediately.<br><span style="font-style: italic;">[Evan] The files should be inventoried and their destruction should be certified.</span><br><br>Taylor said the files looked like employment records with hours worked along with names and social security numbers printed on them. <br><br>"That's the bad thing," Taylor said. "They should have been shredded and not dumped in the trash. The state needs to be more careful with records like that."<br><br>"We do have a standard procedure," said Carrie Moritomo of the department. "We are currently reevaluating that and making sure all of our field staff offices are aware of what that policy is."<br><span style="font-style: italic;">[Evan] A "standard procedure" ain't worth the paper it's written on if nobody knows about it or follows it.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I doubt that this is an isolated incident and I doubt that the agency has a sound information security strategy. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/05/nmdeptws.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 19:32:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bin">bin</category>
      <category domain="http://securityratty.com/tag/trash bin monday">trash bin monday</category>
      <category domain="http://securityratty.com/tag/mexico">mexico</category>
      <category domain="http://securityratty.com/tag/trash bin">trash bin</category>
      <category domain="http://securityratty.com/tag/roswell">roswell</category>
      <category domain="http://securityratty.com/tag/employment records">employment records</category>
      <category domain="http://securityratty.com/tag/mexico department">mexico department</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/roswell daily record">roswell daily record</category>
      <source url="http://breachblog.com/2008/06/05/nmdeptws.aspx">Employment records in a New Mexico dumpster</source>
    </item>
    <item>
      <title><![CDATA[Whats a Phlash?]]></title>
      <link>http://securityratty.com/article/54a712601efc14c04e4462442b3f0c49</link>
      <guid>http://securityratty.com/article/54a712601efc14c04e4462442b3f0c49</guid>
      <description><![CDATA[So instead of taking over the computer, you just have it trash itself? It would be messy for sure. No software to run. Jeez


clipped from www.darkreading.com
Permanent Denial-of-Service Attack...]]></description>
      <content:encoded><![CDATA[<div > So instead of taking over the computer, you just have it trash itself?<br/>It would be messy for sure. No software to run.<br/>Jeez. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/0D578D18-BA76-48FC-8B17-4CA383A8ED80/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/26318524-9b7c-46a9-9bae-9117b62b1b3b/0D578D18-BA76-48FC-8B17-4CA383A8ED80/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.darkreading.com/document.asp?doc_id=154270&#038;WT.svl=news1_1" href="http://www.darkreading.com/document.asp?doc_id=154270&#038;WT.svl=news1_1" style="font-size: 11px;">www.darkreading.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.darkreading.com/document.asp?doc_id=154270&#038;WT.svl=news1_1 --><H2 class="headline">Permanent Denial-of-Service Attack Sabotages Hardware</H2></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.darkreading.com/document.asp?doc_id=154270&#038;WT.svl=news1_1 --><FONT>Smith will demonstrate how network-enabled systems firmware is susceptible to a remote PDOS attack &#8212; which he calls “phlashing” &#8212; this week at the <A target="new" href="http://www.eusecwest.com/agenda.html">EUSecWest</A> security conference in London. He’ll also unveil a fuzzing tool he developed that can be used to launch such an attack as well as to detect PDOS vulnerabilities in firmware systems.<br />
</FONT></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.darkreading.com/document.asp?doc_id=154270&#038;WT.svl=news1_1 --><P><br />
<FONT>The danger with embedded devices is that they are often forgotten. They don’t always get patched or audited, and they can contain application-level vulnerabilities, such as flaws in the remote management interface that leave the door open for an attacker, according to Smith. And remote firmware updates aren’t typically secured, but rather set up to occur by default.<br />
</FONT></P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/0D578D18-BA76-48FC-8B17-4CA383A8ED80/blog/" title="blog or email this clip"><img src="http://content8.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Tue, 20 May 2008 15:49:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/attack sabotages hardware">attack sabotages hardware</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/remote pdos attack">remote pdos attack</category>
      <category domain="http://securityratty.com/tag/detect pdos vulnerabilities">detect pdos vulnerabilities</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <category domain="http://securityratty.com/tag/remote management interface">remote management interface</category>
      <category domain="http://securityratty.com/tag/remote firmware">remote firmware</category>
      <category domain="http://securityratty.com/tag/firmware systems">firmware systems</category>
      <category domain="http://securityratty.com/tag/systems firmware">systems firmware</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=457">Whats a Phlash?</source>
    </item>
  </channel>
</rss>
