Wednesday News items

March 18, 2008 NATO to strengthen cyber defence role
http://www.crime-research.org/news/18.03.2008/3256/



Hannaford, Security Industry Hunt for Cause of Massive Breach - 3/18/2008 6:07:00 PM Speculation runs rampant as grocery retailer attempts to find out how 4.2 million credit card records were stolen



Get-em-one-way-or-another:
FTC Deal Suggests Enterprises Could Be Liable for Poor Security - 3/17/2008 5:50:00 PM ValueClick found negligent when Commission discovers vulnerabilites contrary to privacy policies promising encryption and 'reasonable security measures'



Apple Patches 93 Security Holes
Apple issues mega-monster security update Just a day after a remarkably large Safari update, Apple released a "frighteningly large" security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems. Read more...




Hackers vs. Windows, Mac, Linux next week in big money contest




Pennsylvania pulls plug on voter site after data leak




Seattle man gets 51 months in jail in ID theft case




Hackers vs. Windows, Mac, Linux next week in big money contest





Beijing Olympics Face Another Issue - Too Many Squat Toilets
aol.com.au — The Beijing Olympics are being hit with another problem, at least by Western standards. The issue came up over the weekend when the San Diego Padres played the Los Angeles Dodgers at the new Olympic baseball venue. The portable toilets trucked in were the squat variety, the style used widely in Asia. More…




Comcast: FCC lacks any authority to act on P2P blocking
arstechnica.com — Comcast says the FCC has no jurisdiction over its traffic-shaping practices. Is the company engaging in legal saber rattling, or would it really sue the FCC if the agency moved to protect broadband consumers?More…





March 2008 MS08-014 Re-releasePosted Wednesday, March 19, 2008 7:40 AM by MSRCTEAM
Hello, this is Tim Rains.
Very quickly, I wanted to let you know that we've just re-released MS08-014 for Microsoft Office Excel 2003 Service Pack 2 and Service Pack 3 only.
The original version released on March 11, 2008 did fully protect against the security issues discussed in the bulletin. However, after release we discovered that the security update caused a calculation error in Microsoft Excel 2003 when a Real Time Data source was used in a user-created Visual Basic for Applications solution (in other words a custom-built VBA function). For additional details, please refer to KB950340.

If you're not running Microsoft Excel 2003, this re-release doesn't apply to you and you don't need to take any action.
If you are running Microsoft Excel 2003 Service Pack 2 or Service Pack 3, you should use the guidance provided in Knowledge Base article KB950340 to deploy the new update. It is being released through all the same distribution channels as the original MS08-014 security update. It is also supported by the same detection and deployment tools as the original update.




VMware has announced a new security advisory that includes a set of updates for VMware Workstation, Player, Server, ACE, and Fusion (VMSA-2008-0005), resolving this vulnerability plus a few other relevant security issues:
a. Host to guest shared folder (HGFS) traversal vulnerability (CVE-2008-0923)
b. Insecure named pipes (CVE-2008-1361, CVE-2008-1362)
c. Updated libpng library to version 1.2.22 to address various security vulnerabilities (CVE-2007-5269)
d. Updated OpenSSL library to address various security vulnerabilities (CVE-2006-2940, CVE-2006-2937, CVE-2006-4343, CVE-2006-4339)
e. VIX API default setting changed to a more secure default value
f. Windows 2000 based hosted products privilege escalation vulnerability (CVE-2007-5618)
g. DHCP denial of service vulnerability (CVE-2008-1364)
h. Local Privilege Escalation on Windows based platforms by Hijacking VMware VMX configuration file (CVE-2008-1363)
i. Virtual Machine Communication Interface (VMCI) memory corruption resulting in denial of service (CVE-2008-1340)
The latest versions are:
VMware Workstation 6.0.3
VMware Workstation 5.5.6
VMware Player 2.0.3
VMware Player 1.0.6
VMware ACE 2.0.3
VMware ACE 1.0.5
VMware Server 1.0.5
VMware Fusion 1.1.1
Update as soon as possible!





Kerberos Multiple Vulnerabilities - Highly critical - From remoteIssued 11 hours ago. Some vulnerabilities have been reported in Kerberos, which can be exploited by malicious people to disclose potentially sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system.




German court tightens up ISP, phone data retention rules
Germany's Constitutional Court ruled this week that access to e-mail and phone records should only be granted in serious investigations. It has also struck down indiscriminate license plate scanning and put curbs on police spyware.
March 19, 2008 - 02:14PM CT - by Nate Anderson

Israel rebukes US: Our copyright laws are fine, thanks
The Israeli government defends its copyright laws against content industry critics in the US who say that they don't go far enough.
March 18, 2008 - 09:40PM CT - by Nate Anderson

Yahoo offers peek into crystal ball to justify bigger payday
In this game of high-stakes poker, Microsoft might win in the end, but the victory won't come cheap. Yahoo! just upped the ante again with an investor presentation that paints a rosy financial outlook for the company.
March 18, 2008 - 11:45AM CT - by Anders Bylund

Why Would The Gov't Hide Documents About A .xxx Domain?
from the please-explain dept
The back and forth over the potential for a .xxx domain reserved for porn has been discussed at length, though, it's still rather amusing to see one set of politicians who believe it's a good thing, as it would keep porn away from children, and another set of politicians who believe it's a bad thing because it somehow "legitimizes" porn (this would be known as the "head-in-sand" position, considering that porn online hardly needs to be "legitimized" at this point). Either way, the Bush administration came down on the "head-in-sand" side after receiving pressure from family groups. That resulted in pressure on ICANN who, despite claiming independence from the US gov't, rejected the proposal after originally being for it. The folks behind the .xxx proposal were (understandably) livid, and have filed Freedom of Information requests to find out what kind of discussions the gov't had in determining its position. Oddly, while some documents were released, the State Department and Commerce Department withheld many documents relating to discussions over the .xxx domain. A lawsuit was quickly filed, and a court has now ruled that the government doesn't have to reveal all the documents unless it's been shown that it blocked .xxx for "nefarious purposes." I had no idea that was a component of making FoIA decisions. Having a separate .xxx domain seems totally unnecessary (and just a way for registrars to soak up some extra money), but that still doesn't explain why the government felt the need to not release certain documents explaining its position. Kind of ironic that this comes out during Sunshine Week, which is supposed to highlight gov't openness.
52 Comments Leave a Comment..

Is It Time For Computer Security Experts To Get Jobs In The Medical Device Arena?
from the dance,-heart-patient,-dance! dept
Last week, one of the stories that got a few headlines and made the rounds concerned the news that some popular heart monitors could be hacked, potentially in a way that would provide powerful shocks to to the heart of someone who had such a device implanted. The reports made it very clear that the likelihood of such a hack was incredibly slim, as it would require a tremendous amount of access. So, this isn't something to worry about today, but it does suggest one area where it may pay for medical device makers to start thinking a little bit more about security. There was a report, about two years ago, that also warned of something similar, which we played down as a bit of fear-mongering (it had no real details, just suggesting that pacemakers would become a hacking target). It still seems like this is not going to be a huge threat any time in the near future, but that doesn't mean that those who design medical devices, especially those with connections to the outside world, shouldn't at least think through the potential security concerns and design these devices with security in mind from the beginning. That seems a lot safer than having to fix all of the installed devices down the road.
6 Comments Leave a Comment..

Reported Zero-Day in CA Software
Tuesday March 18, 2008 at 3:18 pm CSTPosted by Karthik Raman
No CommentsPermanent Link
Here’s a quick post about a claimed zero-day vulnerability in CA BrightStor ARCserve Backup, software that provides backup functionality for Windows systems. Proof-of-concept exploit code for this vulnerability is public.
A specially crafted Web page could trigger a stack overflow in the AddColumn() method in the ListCtrl Active X Control. For an attack to occur, a user would have to be tricked into visiting a malicious Web site. The exploit writer states that he has successfully run his attack code against CA BrightStor ARCserve Backup r11.5, with Internet Explorer 6 running on Microsoft Windows XP SP2 (the Polish edition).
McAfee Avert Labs is analyzing the flaw. As an aside, our research database reveals that the last known vulnerability in CA BrightStor ARCserve Backup was disclosed on November 26, 2007: CVE-2007-5328. CA worked with the discloser to release a patch for the vulnerability on the same day.

Breach of Britney Spears patient data highlights health care security shortfalls
Jim Carr March 19, 2008
Reports this week that the UCLA Medical Center has moved to fire 13 employees and suspended six others for unauthorized access to confidential medical records of pop star Britney Spears is a sign that training and regulations may not be working in some hospitals, experts told SCMagazineUS.com.

The Technology That Toppled Eliot Spitzer
By John BorlandWednesday, March 19, 2008
Anti-money-laundering software scrutinizes bank customers' every move, no matter how

Pro-Tibet groups bombarded with abusive calls, virusesAFP - Wed Mar 19, 12:11 PM ET
BEIJING (AFP) - Pro-Tibet activists said Wednesday they have been bombarded with abusive phone calls and virus emails as they try to contact witnesses in Tibet and nearby amid a clampdown following anti-Chinese riots.

Ding dong: 3Com, Bain, Huawei deal is dead

Tuesday News items

Malicious subtitle file could trip up media player



State agency moves to plug USB flash drive security gap
The Division of Child Support collects about $700 million annually in child-support payments form noncustodial parents. The agency, part of the state's Department of Social and Health Services, manages 350,000 active child-support cases annually, noted Main.




FTC Deal Suggests Enterprises Could Be Liable for Poor Security - 3/17/2008 5:50:00 PM ValueClick found negligent when Commission discovers vulnerabilites contrary to privacy policies promising encryption and 'reasonable security measures'




Supermarket Chains Hit By Data Theft
Retailers Hannaford Brothers and Sweetbay admit to being the targets of a massive credit-card data theft disclosed Monday. 18-Mar-2008
Data thieves broke into computers at supermarket chains Hannaford Brothers and Sweetbay, stealing an estimated 4.2 million credit and debit card numbers, Hannaford said Monday.

The Boston Globe's Ross Kerber today writes that Hannaford is still investigating the specifics of how the data was taken, but that the company's chief executive said the data "was illegally accessed from our computer systems during transmission of card authorization." Translation: The hackers snatched the credit/debit card data sometime between when the customer swiped their card in the reader at the register and when that transaction was approved.



Microsoft hits milestone with long-awaited Vista SP1 release
Microsoft has officially announced the availability of Service Pack 1 for Vista. The English, French, German, Japanese, and Spanish version are available now.
March 18, 2008 - 12:19PM CT - by Emil Protalinski

After many rumors as to when Windows Vista would get its much-anticipated first service pack looked improbable, Microsoft has finally dropped SP1 on the masses. SP1 rolls together 23 security updates and 550 hotfixes into a 434.5MB download (726.5MB for the 64-bit version). Apart from improvements brought by individual updates that are now part of SP1, changes that SP1 brings by itself to Microsoft's flagship OS are numerous. Significant changes include:
File copying should no longer have an ETA of hundreds of years
UAC has been altered slightly, including fewer prompts in specific scenarios
DirectX has been updated to support not only DirectX 9 and 10 hardware, but the backwards-compatible 10.1 as well
WGA has been tweaked to address two of the most popular exploits
Further support has been added for third party search solutions

Trend Micro Details Its Recent Failed Web Attack TechWeb - Fri Mar 14, 2:30 PM ET
The code inserted in some Web pages of its site was meant to redirect the visitor to a malicious server that would download malware capable of stealing passwords.

State Supreme Court LimitsOnline Access To Legal Records
By CARA WYNN
OKLAHOMA CITY (CN) - The Oklahoma Supreme Court is cutting off Internet access to court records, for the stated goal of protecting people from identity theft. The court's March 11 order states that the Supreme Court adopted the rules "in an effort to balance the rights of privacy of individuals who use Oklahoma's court system and public access to court documents, and are applicable to all documents filed in the district courts and the Oklahoma Supreme Court."

E-Voting Firm Threatens Ed Felten If He Reviews Its E-Voting Machine
from the well-that's-comforting dept
Many of the folks around here are surely aware of the name Ed Felten, the Princeton professor who runs the fantastic blog Freedom To Tinker, and who has been involved in a number of important technology news stories over the years. One of the first that brought him to much wider attention in the tech community happened back in 2001. The recording industry had set up a contest, asking anyone to try to hack its SDMI DRM offering. The idea was to prove that SDMI was a perfectly good DRM. But, of course, like every other DRM, it had its faults, and Felten and some of his researchers figured them out. That's where things got ridiculous. Despite the fact that the recording industry had told people to try to hack SDMI, when Felten went to present the paper, he was threatened with a lawsuit for breaking the anti-circumvention clause of the DMCA. Eventually, after a ton of public pressure, the recording industry backed down, but Felten's name was cemented in the minds of many in the tech industry as a fighter for freedom of speech and, more importantly, the freedom to tinker.

Police Blotter: Murderer nabbed via tracking, Web search

What: Woman, sentenced to 25 years in prison for murdering her husband, appeals on Fourth Amendment grounds. Conviction based in part on GPS tracking and her Internet searches.
When: Texas appeals court rules on March 13.
Outcome: Sentence upheld.

Daily News Feed

The time has finally arrived where Microsoft has spent the time and energy to provide us all with a useful Event Viewer. Windows Vista and Windows Server 2008 come with a revamped Event Viewer, as well as some additional tools that really make using the Event Viewer something that is easy to manage. In addition to the new subscription option that Event Viewer now possesses, there is a new command line utility, WEVTUTIL, which allows you to control nearly every aspect of the Event Viewer logs.
http://www.windowsecurity.com/articles/WEVTUTIL-Manage-Event-Logs.html



Spam doesn't pay: man faces 26 year sentence for spamming
A spammer who is already on the hook for millions of dollars in unpaid judgments to Microsoft and an Oklahoma ISP is now facing a couple of decades in prison after pleading guilty to three charges relating to his spam operations.
March 16, 2008 - 11:01PM CT - by Eric Bangeman

Google adds a new layer of security to Google Apps
Security and authentication company Arcot Systems announced today that it will be partnering with Google to offer two-factor authentication for Google Apps Premier Edition subscribers.
March 14, 2008 - 01:01PM CT - by Joel Hruska

Retail Vista SP1 and final XP SP3 expected this week

Spam gets ZippedMarch 12, 2008Spammers resort to Zip attachments in their efforts to defeat spam filters

Videos Of Tibetan Protest Get YouTube Banned In China
from the onto-the-list-it-goes dept
We can now add China to the axis of NoTube as it has blocked all of YouTube after videos from news reports concerning the protests in Tibet began to show up on the video hosting site. What's interesting is that this comes just a few months after new rules went into place in China, demanding that all video hosting sites be approved by the government (and also be state-owned or controlled). However, given the uproar from a number of local video hosting sites, the government decided to ignore its own rules for the time being. However, given the itchy trigger finger on taking down any site or content that the government deems questionable, it's no surprise that this has happened again.
8 Comments Leave a Comment..

Craigslist Isn't Liable For Illegal Ads, Court Rules
CHICAGO (CN) - Craigslist won a free-speech victory with a 7th Circuit ruling that granted immunity to the online classified advertising site, dismissing a discrimination claim brought two years ago by the Chicago Lawyers' Committee for Civil Rights Under Law.

Deaf Pilot Caused Crash, Cessna Passengers Say
By JOE HARRIS
ST. LOUIS - Poor communication with a deaf pilot caused a Cessna airplane to crash, and a field engineer hurt in the crash claims in Federal Court that his injuries ended his career. Deaf pilots can only fly in good visibility and must use airports without control towers so radio communication is not required.

Uncle Sam Tells Valueclick To Knock It Off
LOS ANGELES (CN) - Federal prosecutors demand that Valueclick, Hi-Speed Media and E-Babylon stop sending deceptive commercial emails that falsely tell the recipients they have won prizes. The defendants operate out of one address in Westlake Village and use their deceptive scheme to hawk credit cards and loans, and the victims don't really win prizes even if they buy stuff the defendants are pushing, Uncle Sam says.

Follow Up To Yesterday’s Mass Hack Attack
Thursday March 13, 2008 at 2:04 pm CSTPosted by Craig Schmugar
9 Comments;Permanent Link
Yesterday we uncovered a newer mass hack affecting over 10,000 web pages. That number has since doubled. Today, I took a look at another recent mass attack, which was similar to those reported by Dancho Danchev, but reference a JS file rather than an IFRAME.
The attack seems to have started more than a week ago, and nearly 200,000 web pages have been found to be compromised, most of which are running phpBB. This contrasts yesterday’s attack in that the vast majority of those were active server pages (.ASP). The ASP attacks are different than the phpBB ones in that the payload and method are quite different. Various exploits are used in the ASP attacks, where the phpBB ones rely on social engineering. phpBB mass hacks have occurred in the past, including those done by the Perl/Santy.worm back in 2004.

Click-fraud trojan targeting Yahoo, Google: Symantec
Jim Carr March 14, 2008
Security researchers at Symantec have uncovered a click-fraud trojan targeted to the online advertising networks of Google, Yahoo and Baidu.com, China's largest independent internet search engine.

Identifying Manipulated Images
By Erica NaoneMonday, March 17, 2008
New tools that analyze the lighting in images help spot tampering.

Botnet scams are exploding USATODAY.com - Mon Mar 17, 7:06 AM ET
SEATTLE - Largely unnoticed by the public, botnets have come to inundate the Internet. On a typical day, 40% of the 800 million computers connected to the Internet are bots engaged in distributing e-mail spam, stealing sensitive data typed at banking and shopping websites, bombarding websites as part of extortionist denial-of-service attacks, and spreading fresh infections, says Rick Wesson, CEO of Support Intelligence, a San Francisco-based company that tracks and sells threat data.

The Anatomy of a Vishing Scam
A series of well-orchestrated wireless phone-based phishing attacks against several financial institutions last week illustrates how scam artists are growing more adept at fleecing consumers by exploiting security holes in seemingly unrelated Internet technologies.
The scams in this case took the form of a type of phishing known as "vishing," wherein cell-phone users receive a text message warning that their bank account has been closed due to suspicious activity, and that they need to call a provided phone number to reactivate the account. Victims who called the number reached an automated voice mail box that prompted callers to key in their credit card number, expiration date and PIN to verify their information (the voice mail systems involved in these sorts of scams usually are run off of free or low-cost Internet-based phone networks that are difficult to trace and shut down).

http://blogs.washingtonpost.com/securityfix/

Phone "swatter" gets 30 monthsNews Brief, 2008-03-14A federal judge in Texas sentences a Washington man for using spoofed telephone numbers and social engineering to convince police SWAT teams to show up at victims' doors.

The Other iframe attack
Published: 2008-03-15,Last Updated: 2008-03-15 21:37:08 UTCby Kevin Liston (Version: 2)
A lot of readers are sending in this link from Dancho Danchev's fabulous blog thinking it's linked to the 2117966.net campaign: http://ddanchev.blogspot.com/2008/03/more-cnet-sites-under-iframe-attack.html
We're also getting this sent in from McAfee's Avert Labs blog: http://www.avertlabs.com/research/blog/index.php/2008/03/13/follow-up-to-yesterdays-mass-hack-attack/
The 2117966.net campaign affected approximately 13,800 ASP pages. No php pages.
This other attack is reported to have affected around 200,000 phpBB pages.
It's a bigger attack and very important, you should read Dancho's blog, it has IP addresses and domains to look for in your logs as well as what traffic an infected system will generate.
If you're a website administrator, also take a close read of his 04-MAR-2008 entry: http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html
Pay particular attention to how they're inserting the code into the site (from Dancho's Blog):
"(The sites) themselves aren't compromised, their SEO practices of locally caching any search queries submitted are abused. Basically, whenever the malicious attacker is feeding the search engine with popular quaries, the sites are caching the search results, so when the malicious party is also searching for the IFRAME in an "loadable state" next to the keyword, it loads. Therefore, relying on the high page ranks of both sites, the probability to have the cached pages with the popular key words easy to find on the major search engines, with the now "creative" combination of the embedded IFRAME, becomes a reality if you even take a modest sample, mostly names."
This is important. It's not obvious to me how to fix the problem-- I'm hoping that someone can explain this better.

Government Audit to Reveal Continued FBI Privacy Abuses
The FBI improperly obtained personal information about Americans as part of terrorism investigations in 2006, but steps were taken by the agency to prevent future privacy abuses, an upcoming Justice Department report says. The long-anticipated audit, to be released Thursday, is expected to show a fourth consecutive year of privacy breaches by FBI agents using so-called national security letters to gain access to telephone, e-mail, and financial records of Americans and foreigners without a judge's approval.
Audit to Cite FBI Privacy Abuses, Associated Press, March 13, 2008.
Posted by EPIC on March 13, 2008.Permanent link to this item.

Hacking Vista's Smart Cards - 3/14/2008 5:45:00 PM Former Microsoft security team member will demonstrate how his new fuzzer hacks smart card plug-in

News Feed

Just-patched Excel makes calculation mistakes



Harvard grad students hit in computer intrusion



Hackers launch massive IFrame attack

Daily News Items

NEWS

How software helped nail Eliot Spitzer, prostitution ring

blogs.zdnet.com — New York Governor (for now) Eliot Spitzer’s prostitute scandal is all the big news here in New York, but the lesser known tale is how an information system–the U.S. Treasury’s Financial Crimes Enforcement Network–played a role in his downfall.More… (Security)

34 Comments Share

Bury

mklopez made popular 1 hr 33 min ago

Postscript: The Wall Street Journal in its Wednesday edition reports that Capital One’s North Fork unit is at least one of the banks that flagged Spitzer’s transactions. The Journal notes that banks monitor the financial transactions of politically connected people–legislators, judges and their relatives–to probe for ill-gotten gains.

Wow! It is already the 2^nd Tuesday of the month, and with it comes the announcement of some new bulletins! This is Tami Gallupe, MSRC Release Manager, and I just wanted to let you know that we just posted our March 2008 Bulletins. We released four bulletins today, all are for Office and all have a maximum severity rating of Critical. Here is a quick list of what we released:

MS08-014: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution. Note that this Excel bulletin addresses the issue highlighted in Microsoft Security Advisory (947563).

MS08-015: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution

MS08-016: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution

MS08-017: Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution

Our team also plans to post some additional in-depth technical information about today’s release on the Security Vulnerability Research & Defense blog. It will be available this afternoon, and I think it will be worthwhile to stop by and check it out.

http://blogs.washingtonpost.com/securityfix/

Posted at 02:30 PM ET, 03/11/2008

Microsoft Patches 12 Office Security Holes

Microsoft today issued four updates to fix at least a dozen security vulnerabilities in its Office software products. All of the updates earned Microsoft's "critical" label, meaning attackers could exploit the flaws to break into Windows systems with little or no help from users.

Included in today's Patch Tuesday roundup are fixes for just about every Office suite or stand-alone product that Microsoft currently supports -- going back to Office 2000 and including Office for Mac software and various Office Viewer components.

One of the updates, which mends at least seven flaws in different Office titles, patches a security hole that hackers were exploiting as early as last week, according to reports from US-CERT and the SANS Internet Storm Center.

Interestingly, that patch and one other address security holes found in Office 2007, a product that underwent rigorous code review in an attempt to minimize the kinds of security weaknesses that were found to be pervasive in older versions of Office.

RFID-Hack Hits 1 Billion Digital Access Cards Worldwide

A warning is issued that some security access cards that use RFID technology are vulenarble to hack attacks. 12-Mar-2008

Pointsec Full Disk Encryption cracked

"This simple attack takes advantage of the FireWire protocol and its ability to directly access and modify the RAM of a target machine with a FireWire port installed. Using a simple and readily available forensics software tool, it is possible to connect a FireWire cable to a computer, and within seconds bypass the Windows authentication and log in as a local administrator.

This attack is made possible because the operating system on the computer loads and boots directly into Windows without first asking for a Pointsec ‘preboot authentication’ password. Normally, with whole disk encryption, a user is required to enter a password immediately upon turning the machine on. That password is what unlocks the decryption key and allows the rest of the operating system to load and execute. This FireWire attack would not be successful in that case, because the attack requires that Windows already be up and running. In the circumstance of a properly configured encrypted computer, a stolen system that is powered off would be well protected from unauthorized access and this type of attack."

Hacking Medical Devices

Okay, so this could be big news:

But a team of computer security researchers plans to report Wednesday that it had been able to gain wireless access to a combination heart defibrillator and pacemaker.

They were able to reprogram it to shut down and to deliver jolts of electricity that would potentially be fatal -- if the device had been in a person. In this case, the researcher were hacking into a device in a laboratory.

The researchers said they had also been able to glean personal patient data by eavesdropping on signals from the tiny wireless radio that Medtronic, the device’s maker, had embedded in the implant as a way to let doctors monitor and adjust it without surgery.

There's only a little bit of hyperbole in the New York Times article. The research is being conducted by the Medical Device Security Center, with researchers from Beth Israel Deaconess Medical Center, Harvard Medical School, the University of Massachusetts Amherst, and the University of Washington. They have two published papers:

• "Security and Privacy of Implantable Medical Devices," Daniel Halperin, Thomas S. Heydt-Benjamin, Kevin Fu, Tadayoshi Kohno, and William H. Maisel, IEEE Pervasive Computing, January 2008.
• "Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses," Daniel Halperin, Thomas S. Heydt-Benjamin, Benjamin Ransford, Shane S. Clark, Benessa Defend, Will Morgan, Kevin Fu, Tadayoshi Kohno, and William H. Maisel, IEEE Symposium on Security and Privacy, May 2008.

This is from the FAQ for the second paper (an ICD is a implantable cardiac defibrillator):

As part of our research we evaluated the security and privacy properties of a common ICD. We investigate whether a malicious party could create his or her own equipment capable of wirelessly communicating with this ICD.

Using our own equipment (an antenna, radio hardware, and a PC), we found that someone could violate the privacy of patient information and medical telemetry. The ICD wirelessly transmits patient information and telemetry without observable encryption. The adversary's computer could intercept wireless signals from the ICD and learn information including: the patient's name, the patient's medical history, the patient's date of birth, and so on.

Using our own equipment (an antenna, radio hardware, and a PC), we found that someone could also turn off or modify therapy settings stored on the ICD. Such a person could render the ICD incapable of responding to dangerous cardiac events. A malicious person could also make the ICD deliver a shock that could induce ventricular fibrillation, a potentially lethal arrhythmia.

Of course, we all know how this happened. It's a story we've seen a zillion times before: the designers didn't think about security, so the design wasn't secure.

The researchers are making it very clear that this doesn't mean people shouldn't get pacemakers and ICDs. Again, from the FAQ:

We strongly believe that nothing in our report should deter patients from receiving these devices if recommended by their physician. The implantable cardiac defibrillator is a proven, life-saving technology. We believe that the risk to patients is low and that patients should not be alarmed. We do not know of a single case where an IMD patient has ever been harmed by a malicious security attack. To carry out the attacks we discuss in our paper would require: malicious intent, technical sophistication, and the ability to place electronic equipment close to the patient. Our goal in performing this study is to improve the security, privacy, safety, and effectiveness of future IMDs.

For all our experiments our antenna, radio hardware, and PC were near the ICD. Our experiments were conducted in a computer laboratory and utilized simulated patient data. We did not experiment with extending the distance between the antenna and the ICD.

I agree with this answer. The risks are there, but the benefits of these devices are much greater. The point of this research isn't to help people hack into pacemakers and commit murder, but to enable medical device companies to design better implantable equipment in the future. I think it's great work.

Of course, that will only happen if the medical device companies don't react like idiots:

Medtronic, the industry leader in cardiac regulating implants, said Tuesday that it welcomed the chance to look at security issues with doctors, regulators and researchers, adding that it had never encountered illegal or unauthorized hacking of its devices that have telemetry, or wireless control, capabilities.

"To our knowledge there has not been a single reported incident of such an event in more than 30 years of device telemetry use, which includes millions of implants worldwide," a Medtronic spokesman, Robert Clark, said. Mr. Clark added that newer implants with longer transmission ranges than Maximo also had enhanced security.

[...]

St. Jude Medical, the third major defibrillator company, said it used "proprietary techniques" to protect the security of its implants and had not heard of any unauthorized or illegal manipulation of them.

Just because you have no knowledge of something happening does not mean it's not a risk.

Another article.

The general moral here: more and more, computer technology is becoming intimately embedded into our lives. And with each new application comes new security risks. And we have to take those risks seriously.

Posted on March 12, 2008 at 10:39 AM • 18 Comments • View Blog Reactions

UN backs out of virtual protest against Internet censorship

Reporters Without Borders organized today's Online Free Expression Day and accompanying cyber-protests, but was dismayed when a UN agency backed out of sponsoring the event at the last minute.

March 12, 2008 - 12:25PM CT - by Nate Anderson

Study: amount of digital info > global storage capacity

A study conducted by IDC has determined that the total volume of digital content has surpassed the total storage capacity supplied. The digital universe has grown to 281 billion gigabytes.

March 12, 2008 - 10:30AM CT - by Ryan Paul

Airplanes Produce Dangerous Turbulence

Turbulence is never desirable whenever talking about airplanes, however it is an effe... [read >>]

in Nano-Biotechnology, 12 March, 15:57 GMT

R.E.M. Puts New Album Online Via iLike

from the a-step-in-the-right-direction dept

R.E.M. is the latest big name band to take a step in the right direction, as it's making its new album available via iLike, the popular social networking app, even before it releases the actual album. As R.E.M.'s Michael Stipe said:

"I think you can either go with it or sit back and watch it happen, and I would rather be out on the field than in the bleachers."

This one is interesting, as the band is still on a major label (Warner Music), unlike many of the other, more radical, experiments we've been seeing. The band had also made news a few weeks ago by allowing fans to create videos of the first single off the album. It's not entirely clear why they are doing this through iLike. It never makes sense to me to focus on one app or system. After all, the music can go anywhere, so why not make it available however people want it? Either way, it's certainly a step (if just a small one) in the right direction, especially from a big name artist on a major label.

3 Comments | Leave a Comment..

Library of Congress Photos on Flickr

By Kate Greene | 01/22/2008 | 0 Comments

http://www.baselinemag.com/index2.php?option=content&task=view&id=4536&pop=1&hide_ads=1&page=0&hide_js=1

Is There Really an IT Labor Shortage?
By Ericka Chickowski
2008-03-05

Despite what you've been told about the IT skills shortage, there's a multitude of evidence that suggests that line of reasoning is a self-serving myth. Baseline cuts in to the belly of the IT shortage debate.

ICANN recommendations on fast-flux hosting not tough enough: experts

Jack Rogers March 12, 2008

Security experts have expressed skepticism that recent recommendations from ICANN for combatting fast-flux hosting will do much to stop the practice, which is utilized by criminal bot herders to mask their activities.

Exploit code created for hole in RealPlayer

Dan Kaplan March 11, 2008

The researcher who discovered a zero-day vulnerability in the widely deployed RealPlayer has developed a working exploit for it, he told SCMagazineUS.com on Tuesday.

Spam Takes a Vacation - 3/11/2008 5:50:00 PM South sea islands account for more spam per capita than anyplace else in the world

FTP Hacking on the Rise - 3/11/2008 4:20:00 PM First it was stolen FTP server admin privileges. Now it's spam messages with bot-infected FTP links

Australian Government Systems Under Attack - 3/10/2008 6:00:00 PM Officials not ready to say China is the source

U.S. kicks off second cyber war game
News Brief, 2008-03-11
The United States aims to learn more about weaknesses in its critical infrastructure with Cyber Storm II, an international exercise that pits imaginary enemies against private and public defenders.

"Intel has confirmed plans to ship a new line of solid-state drives for laptop and notebook PCs with storage capacities of 80GB to 160GB. While it did not lock in a ship date, Intel told Computerworld that the drives would be available in the second quarter. From the story: 'An aggressive move into the laptop and PC notebook flash disk drive business would catapult Intel into direct competition with hard drive manufacturers such as Toshiba Corp. and Samsung Electronics Co. that are trying to spark demand before their SATA-based offerings are released in the coming months.'"

Here are the answers to your questions for Major General William T. Lord, who runs the just-getting-off-the ground Air Force Cyber Command. Before you ask: yes, his answers were checked by both PR and security people. Also, please note that this interview is a "first," in that Generals don't typically take questions from random people on forums like Slashdot, and that it is being watched all the way up the chain of command into the Pentagon. Many big-wigs will read what you post here -- and a lot of them are interested in what you say and may even use your suggestions to help set future recruiting and operational policies. A special "thank you" goes to Maj. Gen. Lord for participating in this experiment, along with kudos to the (necessarily anonymous) people who helped us arrange this interview.

· Judge Rules Against Accused Spyware Distributor PC World - Mon Mar 10, 5:20 PM ET

The U.S. Federal Trade Commission gets a judgment against a company accused of distributing spyware and adware onto people's computers.

Japan To Outlaw Child Porn Possession

Date: March 11, 2008
Source: Allheadlinenews.com
By: Vittorio Hernandez

Tokyo, Japan (AHN) - Japan is drafting legislation to ban possession of child pornography, but the prohibition reportedly exempts manga comics and animated film. The draft law is in response to international pressure.

Among G8 countries, Japan and Russia still have yet to ban owning pornographic images of children, as long as the owner does not intend to sell or distribute the images on the Internet. In 1999, Tokyo forbade the production, sale and distribution of pornographic images of children under 18. But, despite the law, Japan remains one of the top suppliers of underage pornography and second biggest consumer after the United States.

Yuka Saito of the Unicef Japan office told Guardian Unlimited it wanted to include manga in the ban, but it was encountering difficulties. "We keep encountering arguments about freedom of expression, but if the U.S. and other countries can ban that kind of material, why does Japan continue to tolerate it?" Saito asked.

Even Japan's legal system is less tough when it comes to printed materials. The October arrest of the U-15 magazine on child prostitution and pornography charges resulted to indictment of the suspects to a less serious charge of violating the Child Welfare Law.

The Tokyo district prosecutor explained, "While the DVDs qualify as child pornography, we have determined that compared to magazine s and other materials being sold, the pornographic content is not very high."

RealID continues to gain acceptance. Federated authentication is an interesting security idea.

Here on Blogger, there is a choice on posting security.


Who Can Comment? (4 choices)
Anyone - includes Anonymous Users
Registered Users - includes OpenID
Users with Google Accounts
Only members of this blog

http://www.websudoku.com/ is a fun spot to waste time. This is a test to see how the blogging software handles hyperlinks. If this works out I will put my security news posts here.

Eric