Thursday, March 20, 2008

Thursday Daily News

Microsoft acquires rootkit-catching security company
With the deal, announced today, Microsoft plans to add Komoku's technology into its Forefront and Windows Live OneCare products. Forefront is Microsoft's suite of enterprise security software that includes malware protection for PCs, security tools for Exchange and SharePoint servers, and gateways that secure remote access to corporate data.



Reports: U.S. to name head of new cybersecurity center
March 20, 2008 (IDG News Service) WASHINGTON — Tech entrepreneur and author Rod Beckstrom will be named to run the new National Cyber Security Center at the U.S. Department of Homeland Security, according to news reports.
Beckstrom, founder of Cats Software and co-founder of Twiki.net, a company that offers an open-source wiki software system, would head the center, created by President George Bush in a January directive, according to reports in The Washington Post and The Wall Street Journal. The Bush administration has largely been silent about the cybersecurity center.




RFID tech turned into spy chips for clandestine surveillance
March 20, 2008 (Computerworld) An employee looking to steal confidential information from his employer sneaks into what should be a secure back room after hours. He pulls charts and files from a top-level financial meeting and slides them into his briefcase before heading back out.
What the insider doesn't know is that his shoes picked up hundreds of tiny radio frequency identification (RFID) chips that had been scattered across the floor. As he passes by an RFID reader near the front door of his office building, security will be alerted that he had accessed a secure area. The evidence is all over the soles of his shoes.
Sound a little like a scene from a James Bond movie? It's not.



After threats, NJ clerks call for e-voting investigation
March 20, 2008 (IDG News Service) A group representing county clerks in New Jersey has asked the state's attorney general to step in and investigate voting discrepancies observed in e-voting machines used in last month's presidential primary election.




Consultant Sentenced to Prison for E-Rate Fraud
A former education consultant from California has been sentenced to serve seven and a half years in prison for rigging bids and defrauding a U.S.... {more} Comments (0)




Computerworld: Patient Charged in Computer Theft from Indiana VA Center
A one-time patient at the Richard Roudebush VA medical center in Indianapolis has been charged with stealing a hospital computer last November that contained confidential... {more} Comments (0)




US Firms Brace for Cyber War - 3/20/2008 5:50:00 PM Last year's cyber attack on Estonia was the shape of things to come, warns expert




March 2008 MS08-014 Re-release






NY Law Would Restrict Tracking of Web Users
After reading about how Internet companies like Google, Microsoft and Yahoo collect information about people online and use it for targeted advertising, one New York assemblyman said there ought to be a law. So he drafted a bill, now gathering support in Albany, that would make it a crime — punishable by a fine to be determined — for certain Web companies to use personal information about consumers for advertising without their consent. And because it would be extraordinarily difficult for the companies that collect such data to adhere to stricter rules for people in New York alone, these companies would probably have to adjust their rules everywhere, effectively turning the New York legislation into national law.
A Push to Limit the Tracking of Web Surfers’ Clicks, New York Times, March 20, 2008.
Posted by EPIC on March 20, 2008.Permanent link to this item. --> -->




Maryland DNA Bill Faces Strong Opposition
A measure to expand the collection of DNA samples from people arrested for violent crimes and burglary has run into strong resistance from the NAACP and members of the Maryland Legislative Black Caucus, who walked out of a House caucus meeting Tuesday in frustration. Opponents are fighting the bill because they say it's too broad and requires DNA collections from innocent people who haven't been convicted of any crimes. Initially the bill, which is one of Gov. Martin O'Malley's priorities this session, would have required that DNA samples be kept by law enforcement, even if people ended up being exonerated. The measure has been amended so that authorities would have to inform someone of the right to expunge the sample, if the charges are dropped or the person is acquitted.
Maryland DNA Bill Runs Into Opposition, Associated Press, March 19, 2008.
Posted by EPIC on March 20, 2008.Permanent link to this item.




More Threat Modeling at Microsoft
This is another excellent series of posts on threat modeling, this time from Microsoft's Adam Shostack. (I already blogged this series by Larry Osterman.)






Hardware: Google a "Happy Loser" In Spectrum Auction
Posted by kdawson on Thursday March 20, @05:48PMfrom the status-quo-pretty-much-ante dept.

Large cell service providers won almost all of the licenses in the recently concluded FCC spectrum auction. Google didn't get any and won't be entering the wireless business. Verizon Wireless was the big winner, laying out $9.4 billion for enough regional licenses in the "C" block to stitch together nationwide coverage, except for Alaska. On this spectrum Verizon will have to allow subscribers to use any compatible wireless device and run any software application they want. AT&T paid $6.6 billion, Qualcomm picked up a few licenses, and Paul Allen's Vulcan Spectrum LLC won a pair of licenses in the "A" block. One analyst called Google a "happy loser" because it got the openness it had pushed for. The AP's coverage does some more of the numbers.





Florida botnet herder sheared by cops, faces 10 years in pen
A 21-year-old hacker from Florida has admitted to controlling a botnet that cost at least one company over $150,000 to fix. He now faces prison time and up to $250,000 in fines.
March 20, 2008 - 11:50AM CT - by Jacqui Cheng

E-voting vendor blocks security audit with legal threats
New Jersey election officials have scrapped plans to hire a Princeton University computer science professor for a voting machine security review after receiving legal threats from the the vendor, Sequoia Voting Systems. Sequoia says that unauthorized independent review would violate the county's license agreement and jeopardize Sequoia's intellectual property.
March 20, 2008 - 09:01AM CT - by Ryan Paul



My Community recently had pipes ripped out of the ground because of this:
No Fair, Junk Dealers Tell California City
WOODLAND, CALIF. (CN) - High copper prices have led to an epidemic of metal thefts across the nation. In response, the City of Woodland enacted an unconstitutional law that prohibits scrap metal dealers from buying stuff with cash, forces them to hold property for 5 days before selling it, and forces them to "comply with ambiguous and unintelligible new record keeping requirements upon pain of the threat of loss of their license to conduct business, and under the threat of selective prosecution," the dealers complain in Yolo County Court.






Illegal Downloads Cost Man $23,500
By CAMERON LANGFORD
HOUSTON (CN) - A federal judge ordered a Houston man to pay $23,250 in damages to five record companies for illegally downloading 31 songs and making them available on the peer-to-peer file sharing network Kazaa.com. The Recording Industry of America sued Abner Anderson on behalf of Atlantic, Arista, Sony BMG, and Capitol Records. The RIA has filed 28,000 such lawsuits since 2003.






StealthMBR Rootkit Enhances Its Capabilities
Wednesday March 19, 2008 at 6:28 pm CSTPosted by Aditya Kapoor
No Comments
Yesterday we received new variants of the StealthMBR rootkit from the field. The basic strategy of overwriting the master boot record and hooking the IRP table of \\driver\disk to protect itself is still the same as we explained in our original StealthMBR blog. However, from the perspective of cleaning this threat, the rootkit has been modified to better protect itself from being removed.
A very common self-protection technique exhibited by various malware in user-land is to execute a “watcher” thread that continuously polls its various components, memory, and registry entries for changes by the user or any anti-virus products. StealthMBR has taken this technique into kernel space, where it executes watcher threads in the system processes’ context. StealthMBR’s thread continuously checks for any attempt to restore the original MBR or remove its memory protection hooks. If they are modified, it patches the MBR and hooks right back.






Linksys, Trend Micro Pair Security Software with RoutersPC World - 1 hour, 33 minutes ago
Linksys will offer Trend Micro's ProtectLink Gateway to help smaller businesses ward off spam, phishing, and viruses, while allowing control over what sites are visiting, including blocking of known unsafe sites.

No comments: