Monday, 02. December 2002
Lax Security: ID Theft Made Easy
Victims of one of the largest identity theft cases in the United States agree with industry experts that limp security policies at credit bureaus made it easier for the criminals to do their dirty work. By Michelle Delio. [Wired News]
EverQuest battles cheat software
A battle is being fought between the overseers of the popular online game EverQuest and some of its keenest players. [BBC News Online]
Security Firm Deserts Users
A company that once promised to find stolen corporate laptops is now itself missing in action. And left behind are countless customers stuck for the prepaid service and saddled with a software agent that not only resists being disabled but can still transmit sensitive data over the Internet.
Lucira Technologies Inc. has been defunct since August, when it filed for Chapter 7 bankruptcy protection in Boston, federal court records show. Nearly two dozen users contacted by eWeek, however, say they've never been notified that the managed service has been terminated. All telephones to the company's Boston headquarters have been disconnected, Lucira's corporate Web site has been shuttered, and the company's landlord said the firm moved out several months ago leaving no forwarding address.
The company, which was founded in 1999 as CyberTrak Systems Inc., marketed a service alternately called MobileSecure or SecurePC. At the heart of Lucira's service is a technology dubbed Pinpoint, which makes regular, automatic checks to a Lucira server when a client computer is logged on to the Internet. When a machine is reported stolen, the software could be used to log trace routes and locate the machine for recovery by police. A Lucira official once bragged in published reports that the company's client-side software agent was so robust that the only way to defeat it once installed was to physically remove the laptop's hard disk drive.
[Help Net Security]
Niederländische Spione ausspioniert
[Backdoors in dutch survillance equippment]
Die Überwachungsausrüstung des niederländischen Geheimdienstes und rund die Hälfte der Ausrüstung der dortigen Polizei ist unsicher. Informationen über abgehörte Telefonate oder Internetverbindungen können über Hintertüren nach außen dringen, nämlich nach Israel, berichtet die niederländische c't und beruft sich dabei auf informierte Kreise im niederländischen Geheimdienst.
Die Lücken sollen von der Firma eingebaut worden sein, die die Systeme installiert hat: Verint mit Sitz in Israel. Das Unternehmen hieß bis vor einem halben Jahr Comverse-Infosys. Es sei schnell umbenannt worden, nachdem die Ermittler des FBI der Firma auf die Spuren gekommen sei. Einige Mitarbeiter von Verint seien wegen "E-Spionage" inhaftiert worden.
Dabei hätte die niederländische Regierung gewarnt sein können, denn schon vor drei Jahren soll sie Hinweise auf mögliche Hintertüren bekommen haben und auch die niederländische c't wies im Juni 2001 auf das Problem hin. Aufgedeckt worden seien die Missstände im Zusammenhang mit dem Gerichtsverfahren gegen den Vorsitzenden des kurdischen Exilparlaments Huseyin Baybasin, der aufgrund von Informationen beschuldigt worden sei, die die türkischen Behörden von israelischen Stellen bekommen haben und die wiederum vom niederländischen Geheimdienst stammen sollen.
[heise]
Irish ISP blocks web site over dispute
UTVInternet (UTVi), the all-Ireland ISP, stopped its subscribers from accessing Irish auction site ebid.ie last week. The action was taken in response to commercial dispute between the two companies, UTVi told Irish journalist Fergus Cassidy.
UTVi barred the way to ebid.ie for "a week or two", removing the block last Friday afternoon. Entirely coincidentally, Cassidy, a columnist on The Sunday Tribune, got on the case last week. [The Register]
Forensic skills bring hackers to justice
Most firms have strategies to prevent their systems being attacked, but they should also develop policies on what to do in the event of a security breach to preserve evidence and prosecute the culprits, according to experts.
The need for successful prosecutions to deter attacks is growing, say many security experts. The increasing threat is shown by the fact that for the first nine months of this year, almost 75,000 security breaches were reported to the security service Cert. This compares with about 52,000 for the whole of 2001 and fewer than 22,000 during 2000.
Laws are widely believed to lag behind advances in technology, but some firms do not report crimes because they lack usable evidence, thus making the job of the police all the more difficult. This is where good policies and digital forensics can help.
Preserving evidence
Security specialist @Stake has said many firms are not adequately prepared to deal with the aftermath of attacks. In many instances, firms believe they must choose between quickly getting systems up and running again or preserving digital evidence of attacks.
But firms can take steps to do both. Phil Huggins, @Stake's managing security architect, said the problem is that businesses are often unaware of what to do in the event of a breach, and this results in evidence being inadvertently deleted.
"Without adequate incident response, the investigation stage cannot take place," he said. "Or systems are put back in such a way that the digital forensic stage won't provide enough information to get to the root of the problem. The correct steps have to be taken so that the evidence is preserved. The more prepared an organisation is for an incident, the faster it can respond."
Companies therefore need to develop better strategies for dealing with attacks, in addition to their business continuity plans. These strategies should include steps to preserve evidence, and should stipulate the data that should be recorded before, during and after each attack to ensure a thorough investigation.
[...]
[Kill-HUP.com]
Russian DVD pirates turn violent
The head of a Russian anti-piracy task force has accused DVD pirates of attempted murder after shots were fired at his car following recent raids on unlicensed DVD producers. New rules require all DVD and CD producers apply for a license from the Press Ministry - the same government department behind recent attempts to censor the mainstream media .
But several blocks from his office, along a route [Konstantin V. Zemchenkov] took every day to get home, an unidentified gunman fired... [zem]
Bellcore threatens 2600 with lawsuit over Busy Line Verification item
THE FOLLOWING CERTIFIED LETTER HAS BEEN RECEIVED BY 2600 MAGAZINE. WE WELCOME ANY COMMENTS AND/OR INTERPRETATIONS.
Leonard Charles Suchyta General Attorney Intellectual Property Matters
Emanuel [sic] Golstein [sic], Editor 2600 Magazine P.O. Box 752 Middle Island, New York 11953-0752
Dear Mr. Golstein:
It has come to our attention that you have somehow obtained and published in the 1991-1992 Winter edition of 2600 Magazine portions of certain Bellcore proprietary internal documents.
This letter is to formally advise you that, if at any time in the future you (or your magazine) come into possession of, publish, or otherwise disclose any Bellcore information or documentation which either (i) you have any reason to believe is proprietary to Bellcore or has not been made publicly available by Bellcore or (ii) is marked "proprietary," "confidential," "restricted," or with any other legend denoting Bellcore's proprietary interest therein, Bellcore will vigorously pursue all legal remedies available to it including, but not limited to, injunctive relief and monetary damages, against you, your magazine, and its sources.
We trust that you fully understand Bellcore's position on this matter.
Sincerely,
LCS/sms
[The 2600 article in question will not appear
in RISKS, for the obvious reasons. PGN] [Emmanuel Goldstein <emmanuel@well.sf.ca.us> via risks-digest Volume 13, Issue 67]
disLEXia, a research project by Maximillian Dornseif
 |  |  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
   |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |  |  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||