
More Mark Fiore brilliance.
Via The San Francisco Chronicle.
Enjoy.
- ferg
A crackdown by the Chinese government on anonymous domain name registrations has chased spammers from Chinese registrars (.cn) to those that handle the registration of Russian (.ru) Web site names, new spam figures suggest. Yet, those spammy domains may soon migrate to yet another country, as Russia is set to enforce a policy similar to China’s beginning April 1.More here.
In mid-December 2009, the China Internet Network Information Center (CNNIC) announced that it was instituting steps to make it much harder to register a Web site anonymously in China, by barring individuals from registering domains ending in .cn. Under the new policy, those who want to register a new .cn domain name need to hand in written application forms, complete with a business license and an identity card.
Chinese authorities called the move a crackdown on phishing and pornographic Web sites, but human rights and privacy groups marked it as yet another effort by Chinese leaders to maintain tight control over their corner of the Internet. Nevertheless, the policy clearly caught the attention of the world’s most profligate spammers, who spam experts say could always count on Chinese registrars as a cheap and reliable place to buy domains for Web sites that would later be advertised in junk e-mail.
According to data obtained from two anti-spam experts, new registrations for sites advertised in spam began migrating from .cn to .ru just a few weeks after the Chinese domain policy took effect.
A federal judge on Wednesday said the George W. Bush administration illegally eavesdropped on the telephone conversations of two American lawyers who represented a now-defunct Saudi charity.More here.
The lawyers alleged some of their 2004 telephone conversations to Saudi Arabia were siphoned to the National Security Agency without warrants. The allegations were initially based on a classified document the government accidentally mailed to the former Al-Haramain Islamic Foundation lawyers. The document was later declared a state secret and removed from the long-running lawsuit weighing whether a sitting U.S. president may create a spying program to eavesdrop on Americans’ electronic communications without warrants
“Plaintiffs must, and have, put forward enough evidence to establish a prima facie case that they were subjected to warrantless electronic surveillance,” U.S. District Judge Vaughn Walker ruled, in a landmark decision. Even without the classified document, the judge said he believed the lawyers “were subjected to unlawful electronic surveillance” (.pdf) in violation of the Foreign Intelligence Surveillance Act, which requires warrants in terror investigations.
It’s the first ruling addressing how Bush’s once-secret spy program was carried out against American citizens.
Ten million Americans a year are victims of identity theft. It's a growing problem in the United States, but fighting it doesn't appear to be a priority, a new report says.More here.
A report by the Justice Department Inspector General released Tuesday cites the wide-ranging costs and dangers of ID theft. Although the report has no new numbers, the financial losses are believed to be substantially higher than the $15.6 billion documented in 2005.
Inspector General Glenn Fine found the effort to combat the problem, however, has lagged since the President's Task Force on ID Theft was established in 2007.
"We found that to some degree identity theft initiatives have faded as priorities," said Fine. He said the Justice Department has not developed a coordinated plan to combat ID theft and that some recommendations of the President's Task Force have not been addressed. No one has been appointed to oversee the efforts, the report says.
A Ukrainian national who traded on insider information he obtained by hacking into a secure computer network was ordered by a U.S. judge to forfeit $580,000 in profits, interest and civil penalties, U.S. securities regulators said on Monday.More here.
The U.S. Securities and Exchange Commission had accused Oleksandr Dorozhko of gaining access to material nonpublic information about IMS Health Inc's third-quarter 2007 earnings by infiltrating the computer network of Thomson Financial. IMS had planned to announce negative earnings after the market closed that day.
Minutes after the hack and just before IMS's earnings release, Dorozhko purchased 630 put options on IMS's common stock, the SEC said in a statement.
After IMS's stock dropped a record 28 percent the next day, Dorozhko sold the put options and pocketed $287,346, the SEC said.
A hacker who helped TJX hacker Albert Gonzalez and others gain access to corporate networks was sentenced to 7 years and one day on Monday .More here.
Christopher Scott, 27, pleaded guilty to breaching the wireless access points of several retailers between 2003 and 2007 to siphon credit and debit card numbers, which he then passed to Gonzalez. Prosecutors say that together the men pilfered nearly 20 million credit and debit cards, which retailers say led to $200 million in losses from fraud.
They used the cards to obtain cash advances from ATMs or sold the account information to other carders, who encoded the data to blank and counterfeit bank cards for fraudulent use. Scott’s take from the crimes was at least $400,000, according to prosecutors. He was paid in cash and with pre-paid bank cards and used the money to rent limos and partied with up to 10 women at a time, prosecutors say, and later bought a car, jewelry and $400,000 house.
The government is seeking forfeiture of $400,000, nine computers and an array of other electronic goods from Scott. Restitution will be determined at a future hearing.
Network engineers from Yahoo are pitching what they admit is a "really ugly hack" to the Internet's Domain Name System, but they say it is necessary for the popular Web content provider to support IPv6, the long-anticipated upgrade to the Internet's main communications protocol.Major 'Net players mulling IPv6 "whitelist".More here.
Yahoo outlined its proposal for changes to DNS recursive name resolvers at a meeting of the Internet Engineering Task Force (IETF) held here this week.
Yahoo says it needs a major change to the DNS -- which matches IP addresses with corresponding domain names -- in order to provide IPv6 service without inadvertently cutting off access to hundreds of thousands of visitors. Under Yahoo's proposal, these visitors would continue accessing content via IPv4, the current version of the Internet Protocol.
The reason Yahoo is seeking this change to the DNS is that a significant percentage of Internet users have broken IPv6 connectivity. Web content providers say they need mechanisms to discover that a user's IPv6 connectivity is broken and to switch these users to IPv4 on the fly. Yahoo views DNS as the best place to make this switch.
On the same day that Google Inc. and the GoDaddy Group Inc. complained about China to a congressional committee, U.S. Navy Admiral Robert Willard appeared before the U.S. House Armed Services Committee with an even stronger warning about cyber-threats posed by China.More here.
Willard's comments about China received little press attention but were stronger than anything said by either company.
"U.S. military and government networks and computer systems continue to be the target of intrusions that appear to have originated from within the PRC (People's Republic of China)," said Willard.
He said that most of the intrusions are focused on acquiring data "but the skills being demonstrated would also apply to network attacks."
Security researchers on Friday unveiled an open-source device that captures the traffic of a wide variety of wireless devices, including keyboards, medical devices, and remote controls.More here.
Keykeriki version 2 captures the entire data stream sent between wireless devices using a popular series of chips made by Norway-based Nordic Semiconductor. That includes the device addresses and the raw payload being sent between them. The open-source package was developed by researchers of Switzerland-based Dreamlab Technologies and includes complete software, firmware, and schematics for building the $100 sniffer.
Keykeriki not only allows researchers or attackers to capture the entire layer 2 frames, it also allows them to send their own unauthorized payloads. That means devices that don't encrypt communications - or don't encrypt them properly - can be forced to cough up sensitive communications or be forced to execute rogue commands.
At the CanSecWest conference in Vancouver, Dreamlab Senior Security Expert Thorsten Schroder demonstrated how Keykeriki could be used to attack wireless keyboards sold by Microsoft. The exploit worked because communications in the devices are protected by a weak form of encryption known as xor, which is trivial to break. As a result, he was able to intercept keyboard strokes as they were typed and to remotely send input that executed commands on the attached computer.
A China-based root DNS server associated with networking problems in Chile and the U.S. has been disconnected from the Internet.More here.
The action by the server's operator, Netnod, appears to have resolved a problem that was causing some Internet sites to be inadvertently censored by a system set up in the People's Republic of China.
On Wednesday, operators at NIC Chile noticed that several ISPs (Internet service providers) were providing faulty DNS information, apparently derived from China. China uses the DNS system to enforce Internet censorship on its so-called Great Firewall of China, and the ISPs were using this incorrect DNS information.
That meant that users of the network trying to visit Facebook, Twitter and YouTube were directed to Chinese computers instead.
In Chile, ISPs VTR, Telmex and several others -- all of them customers of upstream provider Global Crossing -- were affected, NIC Chile said in a statement on Friday. The problem, first publicly reported on Wednesday, appears to have persisted for a few days before it was made public, the statement says.
Hacker Albert Gonzalez, who participated in a cybercrime ring that stole tens of millions of credit and debit card numbers, was sentenced to 20 years in prison today.More here.
The sentence imposed by U.S. District Court Judge Douglas P. Woodlock was for Gonzalez's role in a hacking ring that broke into computer networks of Heartland Payment Systems, which processed credit and debit card transactions for Visa and American Express and retailers Hannaford Supermarkets and 7-Eleven.
The sentence will run concurrently with two other 20-year sentences meted out Thursday, also in the U.S. District Court for the District of Massachusetts by a different federal judge, Patti B. Saris. Gonzalez pleaded guilty in all three cases last December, with the U.S. Department of Justice agreeing to seek no more than 25 years in prison in each case, with all sentences to run concurrently.
Acceleration in the use of electronic medical records may lead to an increase in personal health information theft, according to a new study that shows there were more than 275,000 cases of medical information theft in the U.S. last year.More here.
Unlike stealing a driver's license or a credit card, data gleaned from personal health records provides a wealth of information that helps criminals commit multiple crimes, according to Javelin Strategy & Research, a Pleasanton, California-based market research firm.
Information such as social security numbers, addresses, medical insurance numbers, past illnesses, and sometimes credit card numbers, can help criminals commit several types of fraud. These may include: making payments from stolen credit card numbers and ordering and reselling medical equipment by using stolen medical insurance numbers.
A key finding from the report is that fraud resulting from exposure of health data has risen from 3% in 2008 to 7% in 2009, a 112% increase.
Computer-security researchers say new "smart" meters that are designed to help deliver electricity more efficiently also have flaws that could let hackers tamper with the power grid in previously impossible ways.More here.
At the very least, the vulnerabilities open the door for attackers to jack up strangers' power bills. These flaws also could get hackers a key step closer to exploiting one of the most dangerous capabilities of the new technology, which is the ability to remotely turn someone else's power on and off.
The attacks could be pulled off by stealing meters — which can be situated outside of a home — and reprogramming them. Or an attacker could sit near a home or business and wirelessly hack the meter from a laptop, according to Joshua Wright, a senior security analyst with InGuardians Inc. The firm was hired by three utilities to study their smart meters' resistance to attack.
These utilities, which he would not name, have already done small deployments of smart meters and plan to roll the technology out to hundreds of thousands of power customers, Wright told The Associated Press.
There is no evidence the security flaws have been exploited, although Wright said a utility could have been hacked without knowing it. InGuardians said it is working with the utilities to fix the problems.
A Dutch researcher won $10,000 in the Pwn2Own hacking contest this week for hacking Internet Explorer 8 on a Windows 7 machine -- bypassing built-in anti-exploit features in the operating system.More here.
Independent researcher Peter Vreugdenhil waged a heap overflow attack on IE 8 and used a zero-day vulnerability he discovered in the browser to bypass Windows 7's built-in anti-exploit features, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR).
Other successful hacks in the annual contest held at CanSecWest in Vancouver were a non-jailbroken iPhone, Firefox on Windows 7, and Safari on Snow Leopard, each conducted by other researchers who also won the big cash prize. A hacker known as "Nils" hacked Firefox on Windows 7 -- also bypassing DEP and ASLR with an exploit of his own, the details of which were not available at the time of this posting.
Vreugdenhil used a two-part exploit: First he located a specific .dll file to evade ASLR, and then used that information to trigger an exploit that disabled DEP. He used a heap overflow attack to get the address of the .dll file, he said in a paper [.pdf] describing the attack. He would not reveal the vulnerabilities in IE 8 that he exploited, however: "But I might disclose them someday when Microsoft has them patched," he wrote.