wongentube

Wednesday, September 8, 2010

DHS Cybersecurity Watchdogs Miss Hundreds of Vulnerabilities on Their Own Network

Kevin Poulsen writes on Threat Level:

The federal agency in charge of protecting other agencies from computer intruders was found riddled with hundreds of high-risk security holes on its own systems, according to the results of an audit released Wednesday.

The United States Computer Emergency Readiness Team, or US-CERT, monitors the Einstein intrusion-detection sensors on nonmilitary government networks, and helps other civil agencies respond to hack attacks. It also issues alerts on the latest software security holes, so that everyone from the White House to the FAA can react quickly to install workarounds and patches.

But in a case of “physician, heal thyself,” the agency — which forms the operational arm of DHS’s National Cyber Security Division, or NCSD — failed to keep its own systems up to date with the latest software patches. Auditors working for the DHS inspector general ran a sweep of US-CERT using the vulnerability scanner Nessus and turned up 1,085 instances of 202 high-risk security holes [.pdf].

“The majority of the high-risk vulnerabilities involved application and operating system and security software patches that had not been deployed on… computer systems located in Virginia,” reads the report from assistant inspector general Frank Deffer.

More here.

Report: RBS WorldPay Hacker Gets Four Years' Probation

Robert McMillan writes on PC World:

The mastermind behind one of the biggest hacking paydays in history has been sentenced to four years' probation and an US$8.9 million fine, according to published reports.

Victor Pleshchuk, 28, was sentenced to four years' probation on Wednesday, according to Bloomberg News. He is considered the leader of a group of criminals who organized a 2008 precision strike on RBS WorldPay, the payment processing division of the Royal Bank of Scotland.

In addition to the reduced sentence of probation, Pleshchuk must also pay back more than 275 million rubles ($8.9 million) to RBS WorldPay, Bloomberg reports.

Russia is trying to fight a reputation for being soft on cybercrime, but this light sentence won't do much to change that perception. Security experts say that Pleshchuk falls into the same category of highly accomplished cybercriminals as Albert Gonzalez, best known for hacking into retailer TJX Companies and the Heartland Payment Systems payment processing network. In March, Gonzalez was sentenced to 20 years in federal prison.

More here.

After Google Incident, Wi-Fi Data Collection Goes on

Robert McMillan writes on PC World:

Four months ago, amidst a backlash from government regulators and privacy advocates, Google stopped collecting Wi-Fi data with its Street View cars.But that doesn't mean Google has stopped collecting wireless data altogether, and neither have other companies such as Apple.

Instead of sending out cars to sniff out wireless networks, Google is now crowdsourcing the operation, with users of its Android phones and location-aware mobile applications doing the reconnaissance work for it. In the past few months, Apple has quietly started building a similar database, leveraging its large base of users to log basic Wi-Fi data. There are others: A Boston company, Skyhook Wireless, has been logging wireless access points for years, as has its competitor, Navizon of Miami Beach, Florida.

It's a trend that's been spurred by the intense interest in applications such as FourSquare and Facebook Places. As it becomes increasingly important for programs that run on your phone to know exactly where you are -- to be location-aware in industry parlance -- having a way of figuring out exactly where you are becomes critical. But the companies collecting this data haven't come under much scrutiny, many users do not understand how the data is being collected or why, and security experts are just now starting to discover some of the ways that this information could be misused.

More here.

Raquel Welch top gallery

US 1967 - Raquel Welch

Raquel Welch

Welch Raquel - Photo - Raquel

Raquel Welch Picture

Raquel Welch

Raquel Welch Address and

Tuesday, September 7, 2010

New Lawsuit to Challenge Laptop Searches at U.S. Border

Ellen Nakashima writes in The Washington Post:

Criminal defense lawyers, press photographers and a university student are challenging the Obama administration's search policy permitting officers at U.S. borders to detain travelers' laptop computers and examine their contents even without suspecting the traveler of wrongdoing.

In a federal lawsuit to be filed Tuesday in the Eastern District of New York, the plaintiffs allege that the Department of Homeland Security policy violates constitutional rights to privacy and free speech.

At issue is the government's contention - upheld by two federal appeals courts - that its broad authority to protect the border extends to reviewing information stored in a traveler's laptop, cellphone or other electronic device, even if the traveler is not suspected of involvement in criminal activity. In the government's view, a laptop is no different than a suitcase.

After the Sept. 11, 2001, terrorist attacks, the George W. Bush administration took an expansive view of the government's authority at the border in an effort to stop terrorists from entering the country, and to find evidence of terrorist plots.

The Obama administration has followed suit, the plaintiffs said, with a pair of DHS policies issued by U.S. Customs and Border Protection (CBP) and U.S. Immigration and Customs Enforcement in August 2009 that reaffirmed the policy of suspicionless searches at the border.

More here.