Friday 02/13/09

MSRT Removing Srizbi
February 12, 2009
Microsoft has added Srizbi to their Malicious Software Removal Tool.

This free tool runs on every PC just after the monthly patches are distributed.

----------

The Law and Technology:
Authors Guild Digs Itself In Deeper Concerning Kindle Text-To-Speech

We were among many different sites that laughed at the ridiculous assertions by Authors Guild executive director Paul Aiken's attempt to rewrite copyright law concerning the "right" for people with a legally purchased ebook to have a Kindle ebook reader with text-to-speech read the book aloud. Aiken said:

"They don't have the right to read a book out loud. That's an audio right, which is derivative under copyright law."

This is, of course, incorrect. To demonstrate how incorrect it was, we applied it to other scenarios: such as reading to your kids at night. This wasn't to suggest that we actually thought Aiken meant you couldn't read to your kids at night, but to show how wrong the original comment was. Amusingly, the Authors Guild seems to have thought we actually believed this, and has issued an attempted clarification, which only serves to make things worse.

----------

How tech will benefit from stimulus plan
Sam Diaz: Already, there are those who are criticizing the plan's investment in tech as being too complex or favoring big corporations over small businesses. But others see the tech industry comes out a winner.
READ FULL STORY

----------

A reward of $250,000 (£172,000) has been offered by Microsoft to find who is behind the Downadup/Conficker virus.
http://news.bbc.co.uk/2/hi/technology/7887577.stm

----------

Entertainment Industry Lawyer Predicts The Demise Of Free Culture

----------

The lawyer above seems to follow this - Douglas Adam's old saying:

1) everything that's already in the world when you're born is just normal;

2) anything that gets invented between then and before you turn thirty is incredibly exciting and creative and with any luck you can make a career out of it;

3) anything that gets invented after you're thirty is against the natural order of things and the beginning of the end of civilisation as we know it until it's been around for about ten years when it gradually turns out to be alright really.

----------

From the FBI:
The New Face of Organized Crime

La Cosa Nostra is no longer the only game in town—read about our efforts to combat Eurasian and Asian crime groups. Story

----------


Pump & Dumper Made $21 Million, SEC Says
PHILADELPHIA (CN) - A Toronto man made $21 million by manipulating the stock of four companies he controlled - Avicena Group, Neutron Enterprises, Hydrogen Hybrid Technologies and Northern Ethanol - through pump-and-dump schemes and other ruses, the SEC says in Federal Court. The SEC sued George Georgiou, suspended trading in the shares, and, the Commission said, federal prosecutors have charged him criminally.

----------

Massachusetts data security law compliance extended
Dan Kaplan February 12, 2009
The deadline to comply with the stringent Massachusetts data security regulations, which mandate the encryption of all portable devices, such as laptops, has been extended from May 1 until Jan. 1, 2010.

----------


FTC revises online privacy guidelines
Chuck Miller February 12, 2009
The Federal Trade Commission has issued revised guidelines on how online advertisers should protect consumers' privacy when collecting information about their online activities.

----------

Los Alamos computers go missing
Angela Moscaritolo February 12, 2009
At least 69 computers are missing from the Los Alamos National Laboratory, a national security research institution in New Mexico.

-----------

Obama orders 60-day cybersecurity review

----------

In Spy Case, Obama's Justice Department Holds Fast to State Secrets Privilege
The Obama administration on Thursday invoked the state secrets privilege for the second time in a week, this time in a closely watched spy case weighing whether a U.S. president may bypass Congress and establish a program of eavesdropping on Americans without warrants.

----------

Stolen Wallets, Not Hacks, Cause the Most ID Theft? Debunked
A new report from Javelin Research is getting attention for its extraordinary claim that data breaches are responsible for only a tiny minority of identity theft cases, compared to lost wallets and other low-tech exposures. But a closer look at Javelin's numbers casts serious doubt on the company's conclusions.

----------

Users warned to avoid Android's web browser

----------

$7.2 Billion Broadband Stimulus Almost Finalized$350 million to mapping, network neutrality language preserved...01:52PM Friday Feb 13 2009 by Karl Bode

For those interested in what $789 billion will buy you these days, you can check out what should be the final infrastructure stimulus plan here (hat tip to Stacey Higginbotham). While the $7.2 million dedicated to broadband retains network neutrality language, all of the speed-specific language we've talked about previously has been stripped from the bill, after cable-industry lobbyists complained that the 100Mbps watermark was too fast, and others claimed that Verizon would net a huge $1.6 billion payday for doing virtually nothing differently. Grants for rural deployment will be doled out by the NTIA ($4.7 billion) and the Department of Agriculture’s Rural Utilities Service ($2.5 billion), both of whom have a mixed track record on getting the money where it's needed, and actually getting broadband deployed. $350 million will be reserved for the mapping of broadband penetration in the United States.

----------

How to steal $9M from ATMs in 30 minutes
How did hackers execute one of the most frightening well-coordinated heists police have ever seen? Cisco security expert James Heary explains.

How did the hackers steal $9 million in one 30-minute time period using only 100 ATM cards you ask? That shouldn’t be possible given the daily limits (usually about $500/day) placed on all ATM cards. Well it turns out that the hackers applied military like precision to old ATM Scam techniques and added a touch of devious ingenuity to pull this one off. Here is a look at how the theft was perpetrated.

First, the bad guys had to obtain the ATM cards. To accomplish this they hacked into RBS WorldPay and stole at least 100 payroll cards. According to RBS WorldPay, “Payroll cards are used by a growing number of U.S. firms to pay wages to employees. A payroll card is a reloadable stored value card that can be used at any point of sale that accepts credit and debit cards.”

Second, the bad guys had to figure out how to reload the cards. To accomplish this they hacked into RBS WorldPay’s systems once again. Once this was done they had the power to reload the payroll cards with new fake deposits that they could turn into cold hard cash via an ATM withdrawal.

Third, the bad guys had to clone the card info they stole into thousands of real ATM payroll cards. This is easily and cheaply done using various over the counter card printing devices. Given that this market is completely non-regulated, anyone can buy all of the gear necessary to make your very own credit, ATM, Bank, etc. Cards.

Fourth, the bad guys needed to recruit an Army of “cashers” to physically go to an ATM machine with the newly minted counterfeit (but valid) payroll cards and withdrawal cash. Cashers is the name given to the street-level thugs that do the actual cash withdrawals at ATMs. It is hypothesized that there were dozens of them recruited for this scam.


----------

Apple Claims That Jail-Breaking Is Illegal

----------

The Doghouse: Raidon's Staray-S Encrypted Hard Drives
Turns out the algorithm is linear.
When you're buying security products, you have to trust the vendor. That's why I don't buy any of these hardware-encrypted drives. I don't trust the vendors.

----------

The Microsoft Security Response Center (MSRC)
Conficker Activity Update

First, today we’re making public, the work we and many other industry and academic partners have been doing behind the scenes to help combat the Conficker worm.

Second, we’ve provided additional information from our research to our Microsoft Active Protections Program (MAPP) partners and our Microsoft Security Response Alliance (MSRA) partners and posted it to the MSRC weblog in an effort to help customers and other researchers.

Finally, we have announced a US$250,000 reward for information that results in the arrest and conviction of those responsible for illegally launching the Conficker worm.

----------

Canadian judge: No warrant needed to see ISP logs

----------

Major Vendors Propose Interoperability Standard For Key Management Feb 12,2009
IBM, HP, RSA head up list of vendors supporting guidelines designed to ease deployment and management of encryption

----------

Researchers Hack Faces In Biometric Facial Authentication SystemsFeb 12,2009
Vietnamese researchers have cracked facial recognition technology in Lenovo, Asus, and Toshiba laptops; demonstration planned for Black Hat DC next week

----------

New Vulnerability Found In BlackBerry's Web Application LoaderFeb 11,2009
Flaw could allow attackers to gain control of the device, researchers warn

----------

Romanian Hacker Breaches Third Security Vendor Site Feb 12, 2009
F-Secure joins Kaspersky, BitDefender as victim of SQL injection attack MORE KEYHOLE

----------

Geek news:
Today is Friday the 13th, and also the day when we reach the symbolic 1234567890th second of Unix time. This will occur at 11:31:30pm UTC on Feb 13, 2009.

----------

And finally, this one does nto tie in with Security news but I found it interesting:

Court sides with science, says no vaccine-autism link
about 6 hours ago - by Matt Ford Posted in: Nobel Intent
The special court overseeing the US National Vaccine Injury Compensation Program has ruled against three families who claim that thiomersal and the MMR vaccine are responsible for their children's autism.
Read more