ISDPodcast Episode 295 for January 7, 2011. Tonight’s podcast is hosted by Rick Hayes, Keith Pachulski, and Varun Sharma.
Announcements:
SANS Community:
Jason Lawrence, Management 414: SANS +S Training Program for the CISSP Certification Exam: http://www.sans.org/mentor/details.php?nid=23493
Wednesday, February 23, 2011 – Wednesday, April 27, 2011
Use the Discount Code: isdpod15 for a 15% discount.
Appalachian Institute of Digital Evidence (AIDE):
AIDE Winter Meeting, Marshall University Forensic Science Center, Huntington, WV
When: February 17 – 18, 2011
http://aide.marshall.edu/default.htm
THOTCON:
Where: Chicago, IL
When: Friday, April 15th, 2011
http://www.thotcon.org
DerbyCon:
http://www.derbycon.com/
Intro/Outro Music provided by JimmyZ (http://soundcloud.com/jimmyz)
Stories:News: http://techcrunch.com/2011/01/04/hacker-defaces-website-of-kenya-police-in-tribute-of-mark-zuckerberg
A hacker has apparently defaced the website of Kenya’s law enforcement body (kenyapolice.go.ke), according to Nairobi, Kenya-based business reporter Larry Madowo.
Sure enough, it appears the hacker did this in tribute of Facebook CEO Mark Zuckerberg.
The clearly unintentional welcoming message on the website homepage (the rest of the site seems to function fine) currently reads:
“Got in and all i could think about was zuckerberg!!! This’ for you Mark!”
Amusingly, the title tag for the page has also been ‘updated’, now reading “I’m CEO, BITCh!.”
News: http://pastebin.com/1eWf9LCg (Thanks to Geordy for providing the story, not the information)
Install the latest Snow Leopard update(10.6.6). Sign into the new App Store (in your dock). Download Twitter, it’s free. Then go to Applications folder, locate Twitter, right click, Show Package Contents, navigate to Contents folder and copy _CodeSignature, _MASReceipt and CodeResources.
Download Angry Birds ( http://bit.ly/gy9wzk ).. run the dmg file.. drag Angry Birds into the Applications folder. right click, Show Package Contents, navigate to Contents folder and delete _CodeSignature, _MASReceipt and CodeResources. Now paste in the files you copied from the Twitter.app .
Done. Enjoy Angry Birds and any other .app file from the new Mac App Store that you can find online 
News: http://www.yomiuri.co.jp/dy/national/T101223003277.htm
The Japanese Justice Ministry is planning to criminalize the creation of computer viruses and submit a bill to revise the Penal Code and other related laws accordingly at an ordinary Diet session next year, it has been learned.
According to sources, the ministry has decided to clamp down on Internet-related crime because an increasing number of government offices and private companies have recently suffered from cyberattacks and leaks of important information.
The ban also will harmonize domestic laws with the Convention on Cybercrime, a treaty Japan signed in 2001 under which signatory countries cooperate to tackle Internet-related crime. The government plans to ratify the treaty, the sources said.
The government also will speed up its efforts to deal with the global spread of Internet-related crime.
Under the current legal system, the government is unable to directly punish people for creating or possessing Internet viruses. In 2008, police for the first time arrested a man who created a computer virus and distributed it via the Internet. In the end he was convicted of violating the Copyright Law as he had attached animation footage to the virus.
A bill to revise the Penal Code was submitted to the Diet in 2004 to outlaw the creation of computer viruses.
However, a stipulation regarding conspiracy in the bill sparked objections from opposition parties and the bill was eventually scrapped.
News: http://www.bankinfosecurity.com/articles.php?art_id=3220
There have been 58 reported banking-related data breaches in 2010, according to the Identity Theft Resource Center — slightly fewer than the total of 62 breaches in 2009. But it is possible that additional 2010 breaches will be reported after the new year.
Of the 58 breaches tracked by the ITRC:
* 9 are related to insider theft; * 6 are related to missing paper documents; * 8 were linked to card skimming attacks; * 5 resulted from stolen or missing hardware; * 8 are blamed on cyberattacks or outside network intrusions; * 4 are related to the exposure of data on the Web; * 6 are linked to an accidental breach; * 3 were of unknown origin.While some breaches were accidental or related to sloppy security, such as the improper disposal of paper files and documents, many involved a malicious or criminal element. Whether linked to an insider, a cyberattack or an ATM skimming device, the incidents prove criminals continue to target financial institutions — and for good reason.”It comes down to the old Willie Sutton line, ‘Why do you rob banks? Well, that’s where the money is,’” says Steve Kenneally, vice president of the Center for Regulatory Compliance within the Financial Policy and Regulatory Affairs division of the American Bankers Association. “I think that was illustrated with all those recent reports in corporate account takeover.”Beyond corporate account takeovers and breaches, whether perpetrated via ACH or card skimming, for instance, is identity theft — a crime that continues to pay for fraudsters, says Jay Foley, executive director of the ITRC.
News: http://english.yonhapnews.co.kr/national/2010/12/30/53/0301000000AEN20101230008100315F.HTMLA
A USB memory drive containing military secrets has been missing for months, but authorities are refusing to launch an investigation and trying to keep the case under wraps, inside sources said Thursday.
An Army major at a front-line battalion in Gangwon Province lost the portable drive in July, according to the sources. He lied to his superiors, saying that he found the USB drive, but it was severely damaged and had to be discarded, they said.
The Defense Security Command (DSC) admitted that they had been told of the missing USB drive from an anonymous informant.
“We received the information on Dec. 13. It was dismissed because we thought the anonymous informant had little credibility,” an official from the command said.
News: http://wiredworkplace.nextgov.com/2010/12/next_steps_for_telework.php
President Obama signed the 2010 Telework Enhancement Act into law, meaning agencies must now establish telework policies for all eligible employees and create training programs for teleworkers and telework managers. The Telework Exchange on Tuesday released a report that provides some tips on how to get started.
The report identifies five key steps agencies can take when establishing their telework programs: build management support; define essentials to demonstrate return-on-investment and overcome resistance; train managers and measure productivity; supply secure, effective and affordable telework technology; and enhance continuity of operations plans.
These findings are based on a two-fold survey of nearly 200 federal and private sector employees working in human resources or information technology jobs. Participants contributed to an online survey and to a crowdsourcing session to identify telework challenges and share best practices for addressing them.
Participants cited several cultural challenges to implementing telework, with 68 percent identifying “building management support” as a hurdle and 67 percent saying “resistance to change” was an obstacle. The report recommends agencies overcome such challenges by launching workforce training that emphasizes teaching managers and employees to function as team members rather than individuals and to use collaboration tools effectively. It also recommends agencies create a 90-day or 120-day pilot program that emphasizes mentoring and identifies potential issues.
Providing effective and affordable technology also will play a key role, and agencies should hold training sessions to introduce new technologies and establish processes for monitoring and upgrading resources, the report notes. Agencies also should explore mobile technology, begin migrating to cloud computing and adopt encrypted hard drives, remote desktops, collaboration systems and thumb drives to support telework programs, the report states.
News: http://ssl.entrust.net/blog/?p=398
The latest betas of Firefox 4.0 indicate that Mozilla has removed the https lock icon from the browser. Different forms of the lock icon have been used since the earliest commercial releases of Netscape and Internet Explorer browsers. The lock icon is currently used in all major desktop browsers: IE, Firefox, Chrome, Safari, and Opera. It is also promoted as a symbol of security by many web-sites; just do a Google image search on SSL lock or SSL padlock and see for yourself.
Mozilla’s rationalization for dropping the lock icon is that it is a misunderstood symbol and doesn’t indicate that the user is safe. That is, although you have a secure SSL connection, it may not be safe if you don’t know who you are connected to. My thinking is although you may not know who you are connected to, at least the lock icon indicates that you are safe from third-party hackers.
Mozilla does offer other indicators to the left of the address bar. These include a blue button highlighting the domain name for site with domain validated (DV) or organization validated (OV) SSL certificates; or a green button for EV SSL certificates. In both cases, if you click on the button, you will get more information about the web-site and SSL certificate.
News: http://nakedsecurity.sophos.com/2011/01/07/you-are-what-you-tweet/
Two of the four stories on the front page of today’s Sydney Morning Herald relate to abuse delivered via social networking sites, notably Twitter. (The third is one of those “exclusive” stories dredged from the WikiLeaks files, whilst the central article laments Australia’s extended hammering by a rampantly victorious England cricket team.)
Social networking debacle number onesurrounds Aussie entrepreneur Gerry Harvey, who was one of the heavy hitters behind an aggressive campaign by Australian retailers – including Harvey’s own massive Harvey Norman chain – to persuade the government to enforce tax on on-line sales from overseas. Local retailers must add a 10% Goods and Services Tax (GST) onto most products; imported goods under $1000 are GST-exempt.
There is scant public sympathy for Harvey’s position, not least because he is one of Australia’s elite ultra-rich, despite that 10% GST. As a result, Twitter has been awash with scathing comments about the campaign.
Harvey has now withdrawn from the campaign, having taken the tweets personally, telling the Herald that he feels hurt by the avalanche of criticism and complaining that people see him and fellow mega-rich retailer Solomon Lew as “greedy, ugly, old, out-of-date c—s”.
Harvey has a point, since he’s copped some genuine abuse along just those lines on Twitter. Wiseguy Twitterer Dr. Mike Hunt (who obviously loves old jokes more than he likes ageing retailers) went so far as to start a campaign of his own, called #c–toftheweek, promptly nominating Gerry Harvey for the first award.
(On the other hand, Harvey clearly can’t take his own advice. In 2008, following complaints over a remark in which he compared the Irish economic crisis to the 1850s potato famine, he is reported to have said, “it doesn’t say much about a people when they can’t take something like that on the chin and get on with it.”)
Debacle number two concerns troubled rock-chick Courtney Love, who is currently being sued by a fashion designer over a 2009 Twitter rant in which she allegedly said some rather OTT things about the fashionista in a dispute over money. Yesterday the case came up in court and was postponed to February.
According to the Hollywood Reporter, the complainant intends to call a social media expert to testify on “what kind of credibility is given to statements made in a casual forum like Twitter”.
It seems astonishing that anyone has had the time to become a social media expert already, given the short lifetime – and ever-changing landscape – of the entire social media phenomenon.
But if this witness – named by The Reporter as Jessie Stricchiola, who also seems to be a player in the Search Engine Optimisation (SEO) marketplace – is accepted as an expert by the court, this case may end up being as much a landmark in Twitter’s brief history as in the troubled Love’s somewhat longer one.
Be careful what you tweet. The lawyers are watching, so it probably matters a lot more than you might think when you’re at the pub with a few mates.
No comments
Trackbacks/Pingbacks