|
Network Security
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
FW: Security In The News - March 9, 2004
- From: Howell, Paul
- Date: Tue Mar 09 16:55:29 2004
Title: Message
Security In The News
LAST UPDATED: 3/9/04
This report is
also available on the Internet at http://news.ists.dartmouth.edu/todaysnews.html
,
Homeland Security & Infrastructure Protection
America's Flimsy Fortress
- Wired
Magazine, 3/9/04
DHS prepares to consolidate wireless
communications efforts
- GovExec.com,
3/8/04
Cooperation with companies a challenge,
homeland officials say
- Government
Executive, 3/8/04
Cybercrime-Hacking
Jury: Man hacked cop radio
- The
Capital Times, 3/5/04
Politics-Legislation
TSA teaches privacy
- Federal
Computer Week, 3/8/04
Malware
Virus war of words falls silent
- vnunet.com, 3/9/04
Technology
New service aims to ease FISMA
compliance
- Government
Computer News, 3/9/04
Inside the DoD's crime lab
- Network
World Fusion, 3/8/04
New security appliance with no static
rules
- SearchSecurity,
3/9/04
Vulnerabilities & Exploits
Internet banking 'no longer safe'
- The
Advertiser, 3/9/04
Analyst claims additional security
layers in Windows add to risk
- Computer
Weekly, 3/9/04
Civil & Consumer Issues
Matrix Expands to Wisconsin
- Wired
News, 3/9/04
One File Swapper, One Lawsuit
- Wired
News, 3/8/04
ICANN president denies group is a
regulator
- Network
World Fusion, 3/8/04
Homeland Security & Infrastructure Protection
- Title: America's Flimsy Fortress
- Source: Wired Magazine
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- An opinion piece by Bruce Schneier regarding homeland security efforts.
The rarity of terrorist attacks makes the probability of any given
individual falling victim to one next to zero. Further, terrorists have a
wide scope of potential targets: airplanes, sports stadiums, water
reservoirs, power plants, chemical storage facilities, and other critical
infrastructures. This makes locking down air transportation ineffective,
since its is impossible to protect every target. Treating every person as a
suspect is similarly ineffective, since the proportion of false leads is too
high. Mr. Schneier argues that intelligence and detective work are the best
tools against terrorists; and that disruption of al Qaeda finances and
communications has done more to protect the country than guards and airport
security measures. Security means making trade-offs, but most of the
government's new security efforts have significant costs in money, time,
convenience, and liberties, with little improvement in security.
- http://www.wired.com/wired/archive/12.03/view.html?pg=2?tw=wn_tophead_8
- Title: DHS prepares to consolidate wireless
communications efforts
- Source: GovExec.com
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- The Department of Homeland Security (DHS) plans to create a program
management office to oversee the movement of all levels of government to
interoperable wireless communications. One of the office's primary missions
will be to develop standards for state and local governments to follow when
purchasing or deploying wireless systems. Charles McQueary, DHS
undersecretary for science and technology, says the Department will not
issue unilateral standards, but work with agencies and companies to define
"core principles." The office will include Project SAFECOM, a wireless
e-government initiative regarding wireless communications for local, tribal,
state and federal public safety officials.
- http://www.govexec.com/dailyfed/0304/030804c1.htm
- Title: Cooperation with companies a challenge,
homeland officials say
- Source: Government Executive
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- Officials from the Department of Homeland Security (DHS) say they are
having difficulties convincing private sector companies to share company
information to help protect cyberspace. Speaking at a two-day DHS industry
summit, Douglas Maughan, cybersecurity program manager for the Homeland
Security Advanced Research Projects Agency (HSARPA), says that a lack of
real data has stopped the agency from testing network security prototypes.
Mr. Maughan says DHS can act as a "marriage broker" between companies and
researchers to evaluate private data. DHS plans to research privacy,
information security benchmarks, and wireless security in 2005, with an
expected $18 million in funding, the same as given in fiscal year 2004.
- http://www.govexec.com/dailyfed/0304/030804tdpm1.htm
Cybercrime-Hacking
- Title: Jury: Man hacked cop radio
- Source: The Capital Times
- Date Written: March 5, 2004
- Date Collected: March 9, 2004
- A federal jury has found Rajib Mitra, 25, a former graduate student at
the University of Wisconsin-Madison, guilty on two counts of blocking police
radio communications in 2003. Mr. Mitra's attorney argued that the
prosecution had only circumstantial evidence against Mr. Mitra, since police
never found the device he built to block communications. Assistant U.S.
Attorney Tim O'Shea said that enough indirect evidence pointed to Mr. Mitra:
the areas of interference from January to August 2003 were in his
neighborhood; Mr. Mitra claimed he only wanted to build a device to monitor
police communications, yet purchased transmitting components; rather than
gathering information on the police radios from the Motorola website, Mr.
Mitra consulted Russian hacker sites; and Mr. Mitra even broadcast
pornographic sounds on police channels, which police tracked to his
apartment. Mr. Mitra faces the possibility of twenty years imprisonment at
his sentencing hearing May 12.
- http://www.madison.com/captimes/news/stories/69518.php
Politics-Legislation
- Title: TSA teaches privacy
- Source: Federal Computer Week
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- The Transportation Security Administration (TSA) has launched a series
of employee training programs regarding privacy issues, focusing on the
requirements of the Privacy Act of 1974. The series is delivered as
web-based multimedia classes; the first week's class is entitled "Respecting
Privacy, Preserving Freedom," and discusses the handling or airline
passenger data. The classes are one part of a five-part plan regarding
privacy issues, including appointing an external privacy advisory board,
disseminating a privacy statement specific to the tasks at TSA, enforcing
specific internal controls on use of private information, and hiring a
privacy officer.
- http://www.fcw.com/fcw/articles/2004/0308/web-tsa-03-08-04.asp
Malware
- Title: Virus war of words falls silent
- Source: vnunet.com
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- New virus variants, Netsky.J and Bagle.K, have begun circulating in the
wild, but the verbal warfare between the two virus writers has calmed
somewhat. Bagle.K code contains vulgar messages insulting the author of
Netsky, but they match the messages of older variants, suggesting the author
recycled code. Bagle.K masquerades as an e-mail informing users that a
complaint has been made against them for improper e-mail use, and asks users
to open a password protected .zip file attachment to reactivate their
account. Netsky.J is spreading more quickly than the new Bagle. Netsky.J is
a repackaged version of Netsky.D, with minor adjustments to sneak past
antivirus filters.
- http://www.vnunet.com/News/1153373
Technology
- Title: New service aims to ease FISMA
compliance
- Source: Government Computer News
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- NetSec, a Herndon, Virginia based company that provides managed security
services to nine Cabinet agencies, will begin offering the FISMA (Federal
Information Security Management Act) Enterprise Tracking and Reporting (ETR)
service to help agencies meet FISMA reporting requirements. The service uses
data gathered in NetSec services to automate reports of certification
progress and action plans for fixing weaknesses identified by the Office of
Management and Budget (OMB). FISMA ETR can be accessed via the web portal
used for other NetSec services or purchased as a standalone system. NetSec
plans to modify the service to meet regulatory requirements in other
markets.
- http://www.gcn.com/vol1_no1/daily-updates/25211-1.html
- Title: Inside the DoD's crime lab
- Source: Network World Fusion
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- Deborah Radcliffe tours the Defense Computer Forensics Lab (DCFL), a
Defense Department organization tasked with examining cyber evidence from
crime scenes involving the military. Military crimes can involve the same
crimes as found among civilians--homicide, child pornography, identity
theft, and so on--but with unique problems in gathering evidence, such as
hard drives with bullet holes or recovered from the sea, and classified
government data. The lab uses a modified Linux tool called DCFL Data Dump to
ensure the integrity of digital data and its admissibility in court. iLook,
a data extraction tool licensed by the Treasury Department, helps sift
through large amounts of data, which can amount to terabytes. The DCFL also
tracks down hackers who attempt to access Defense computer systems.
- http://www.nwfusion.com/research/2004/0308dod.html
- Title: New security appliance with no static
rules
- Source: SearchSecurity
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- Two researchers at the University of North Carolina at Charlotte have
developed a plug-and-play appliance called Access Enforcer to guard against
network attacks and contain malware outbreaks, even against undocumented
threats. Access Enforcer monitors network traffic and shuts down unusual
behavior, based on risk thresholds. One of the researchers, Yuliang Zheng,
does not believe Access Enforcer will replace intrusion detection systems or
firewalls, but considers it a supplement to guard against novel threats.
Access Enforcer would have let the SQL Slammer worm enter systems, but would
also stop it from leaving once it tried to replicate itself. The first
version will be released in the middle of 2004.
- http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci954250,00.html
Vulnerabilities & Exploits
- Title: Internet banking 'no longer
safe'
- Source: The Advertiser
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- Professor Bill Caelli warns home users that the personal computer was
not designed for online banking or other sensitive transactions, and advised
users "Do not use it, it's no longer safe." The Australian Computer
Emergency Response Team (ACERT) reports a growing trend of e-mail based
phishing scams, a sort of social engineering attack designed to trick users
into revealing their bank account details to spoofed websites. The
Australian Banking Association (ABA) called Prof. Caelli's remarks "not
appropriate" given the level of cybercrime. "It is like telling people to
stop driving their cars because the roads are not safe," according to ABA
chief executive David Bell. Mr. Bell argued that users have a responsibility
to protect themselves against cybercrime.
- http://www.theadvertiser.news.com.au/common/story_page/0,5936,8912876^421,00.html
- Title: Analyst claims additional security
layers in Windows add to risk
- Source: Computer Weekly
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- Dan Blum, senior vice-president and research director at Burton Group,
warns users that each additional layer of security Microsoft adds to Windows
operating systems creates new security risks. Most applications use the
Win32 interface, which has no code access control, allowing any component
software to invoke any other component software; a rogue Win32 program could
thus subvert add-on security measures. A Burton Group report on Windows
vulnerabilities recommends that developers avoid the Win32 interface in
favor of the .Net architecture, which reduces the effect of programming
errors. Many users are shying away from Windows Server 2003 in favor of
Linux and Unix platforms, which have fewer dependencies and are easier to
reconfigure.
- http://www.computerweekly.com/articles/article.asp?liArticleID=128907
Civil & Consumer Issues
- Title: Matrix Expands to Wisconsin
- Source: Wired News
- Date Written: March 9, 2004
- Date Collected: March 9, 2004
- The state of Wisconsin has signed on with the Multistate Anti-Terrorism
Information Exchange (Matrix), an interstate database system run by the
Florida Department of Law Enforcement and hosted by private data firm
Seisint. Matrix contains such government records as driver's license
photographs, addresses, professional licenses, and domain-name
registrations, and also records from commercial databases. According to
Florida's Chief of Investigation Mark Zadra, the system allows police
officers faster access to data they already are cleared to see. Privacy
advocates warn that the system could be used to conduct electronic searches
of citizens or in data-mining dragnets, reminiscent of the now-defunct Total
Information Awareness project. Mr. Zadra assures the public that no
predictive data-mining is involved. Matrix originally had thirteen
participant states, but seven pulled out for privacy, legal, and cost
concerns.
- http://www.wired.com/news/privacy/0,1848,62564,00.html?tw=wn_tophead_1
- Title: One File Swapper, One Lawsuit
- Source: Wired News
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- A federal judge in Pennsylvania has ruled that the Recording Industry
Association of America (RIAA) may not sue 203 file-sharers in a single suit,
but must sue each of them individually. A previous ruling found that the
RIAA could not subpoena customer data from Internet service providers (ISPs)
under the DMCA (Digital Millennium Copyright Act), forcing the trade group
to resort to "John Doe" lawsuits, identifying alleged pirates only by their
Internet addresses. The court allowed a suit against John Doe #1, since the
RIAA had sufficient evidence against that individual, but still requires
individual lawsuits against the 202 remaining John Does. Jason Schultz, an
attorney for the Electronic Frontier Foundation, praised the judge's
decision saying that individuals have the right to their own trial. The RIAA
would not comment on its next move.
- http://www.wired.com/news/digiwood/0,1412,62576,00.html?tw=wn_tophead_7
- Title: ICANN president denies group is a
regulator
- Source: Network World Fusion
- Date Written: March 8, 2004
- Date Collected: March 9, 2004
- ICANN (Internet Corporation of Assigned Names and Numbers) has a limited
function according to president and chief executive Paul Twomey. The ICANN
charter only specifies responsibility for Internet Protocol (IP) address
allocation, protocol identifier assignment, the domain name system, and root
server management. However, as the Internet grows, many have looked to ICANN
to rule on other issues that were unexpected when the Internet was founded,
such as governance. This has led to conflict--VeriSign sued ICANN for
overstepping its charter when it forbade VeriSign's controversial Wait
Listing Service (WLS) for expired domain names. Others see the organization
as serving the interests of North Americans only. Mr. Twomey plans to
internationalize ICANN as demand picks up elsewhere, and maintain the
balance of the network. Mr. Twomey takes a bottom-up approach to such
issues, arguing that "We don't want to give too much power to anyone -- the
governments, or the registries, or the ISPs -- or else the network won't
grow."
- http://www.nwfusion.com/news/2004/0308icannpres.html
To change your delivery preferences please go
to:
http://news.ists.dartmouth.edu/cgi-bin/change.cgi
If you wish to
stop receiving the 'Security in the News' service please go
to:
http://news.ists.dartmouth.edu/substop.html
The Institute for
Security Technology Studies (ISTS) accepts no responsibility for any error
or omissions in this e-mail. The information presented is a compilation of
material from various sources and has not been verified by staff of the
ISTS. Therefore, the ISTS cannot be made responsible for the factual
accuracy of the material presented. The ISTS is not liable for any loss or
damage arising from or in connection with the information contained in this
report. It is the responsibility of the user to evaluate the content and
usefulness of this information. References in this e-mail to any specific
commercial products, processes, or services by trade name, trademark,
manufacturer, or otherwise, does not constitute or imply endorsement,
recommendation, or favoring by the ISTS. ISTS is a research, not
operational, organization, and makes its Security in the News e-mail
available as a public service on a best-effort basis. Security in the News
will be sent out on most business days, but not all.
Institute for
Security Technology Studies
Dartmouth College
45 Lyme Road, Suite
200
Hanover, NH 03755
Tel: (603) 646 0700
E-mail:
dailyreport@ists.dartmouth.edu
|
|
|
