Archive for iPhone

Episode 126 and 127 – April 10, 2010

Posted in Breach, Court Cases, criminal forensics, eMail Security, Podcast, Show Notes, The CyberJungle, Vulnerabilities, web server security with tags , , , , , , , on April 11, 2010 by datasecurityblog

Interviews:  Peter Schlampp, VP of Marketing and New Products, from Solera Networks, who discussed a new approach to uncovering the source of attacks:  network forensics.  Stuart Staniford Chief Scientist from FireEye, who discussed research to help counter the attacks that bypass firewalls and antivirus.  And world famous white-hat hacker Charlie Miller talks with us about Apple Security, how he won the CanSec West PWNtoOwn contest… and the security implications of Apple’s announcement about location-aware advertising, and  multitasking on the iPhone OS 4 platform. Dr. Miller is also a researcher at Security Evaluators. The full show can be streamed with via the Flash player here:

Download the Episode 127 MP3 file here or visit the Listening Options page for more ways to hear the program.

Episode 126 is the su root version of The CyberJungle.  It features only these three unedited versions of the interviews with these three men. We have also featured partial versions of the interview along with all the other regular content  in the full version of the show. Listen via the Flash player here:

Download the Episode 126 MP3 file here or visit the Listening Options page for more ways to hear the program.

Our Take on This Week’s News

Class action suit against Countrywide Financial: Plaintiffs ask $20 million after Countrywide employee stole and sold tens of thousands (or millions?) of customer records.

Another inside job: Bank of America Employee Charged With Planting Malware on ATMs.

German Government Pays Hacker For Stolen Bank Account Data Gov pays cybercriminals for data stolen from banks in tax haven countries, and uses the info to catch tax cheats.

Computer Hacker Sentenced to 37 Months in Prison in Manhattan Federal Court for Scheme to Steal and Launder Money from Brokerage Accounts.  This guy got three years for perpetrating something that sounds like the Zeus attack… in addition to credit card fraud and other counts.  No wonder cybercrime is proliferating.

Phishing Attacks on Taxpayers Rise in the Weeks Leading up to April 15th IRS Tax Filing. Sonic wall offers an online quiz to test your phishing IQ.  Ten questions. It’s actually harder than you think, but it’s fun. We recommend you give this quiz to employees, bosses, family… anyone who might benefit from learning the difference between legitimate email and a phishing attack.

Looking for Tiger Woods’ Nike advert could lead to users  into visiting malicious sites.

Sierra Nevada Infragard announcement:

InfraGard Sierra Nevada April Lunch Event

KEYNOTER: Stuart Staniford, Chief Scientist with security firm FireEye has a long history in the intrusion detection field, starting in the research arena at UC Davis back in 1994. He was conducting a variety of research projects with government contractor Silicon Defense before joining FireEye.

WHERE: The Washoe County Regional Public Safety Training Center, 5190 Spectrum Blvd. Room 105, in Reno, Nevada.

WHEN: Thursday, April 15, 2010; 11:15am-1PM, includes lunch

DONATION: $10 for InfraGard members with advanced purchase before April 13th, 2010;

$15 at the door and for non-members.

To register for the Infragard lunch event, please follow this link

If you heard Ira Victor live on The John Sanchez Show (the live program that follows The CybeJungle on KKOH.com), Ira mentioned the web site to report phishing and other scams:

Episode 125 – April 3, 2010

Posted in Breach, Court Cases, darkweb, Legislation, Show Notes, The CyberJungle, Vulnerabilities, web server security with tags , , , , , , , , , on April 3, 2010 by datasecurityblog

Interviews, Episode 125:  Big Batches of Patches! Following huge releases on Patch Tuesday from Microsoft, Apple, Sun/Java, Mozilla Firefox, and Mozilla Thunderbird, we talk with patch management expert Jason Miller. He’s Data and Security Team Manager from Shavlik Technologies. Jason’s interview starts about 22 minutes into the program.

We also talked with Randy Sarafan, the Author of 62 Projects to Make With a Dead Computer.  Fun stuff.  Interview starts about 53 minutes into the show. You can download the file from our XML feed, from iTunes, and other sites. See the Listening Options page, or use the flash player below:

Our Take on This Week’s News

CNN presents a glowing story about the success of airport whole body scanners, which have found drugs and other junk in people’s pockets. The TSA plans to roll out 1000 more of the machines.  Meanwhile, the Electronic Privacy Information Center posted this doc, in which the TSA contradicts itself to congress regarding the ability of the machines to store and transmit images. See item # 8, where they claim that the airport scanning machines are not capable of transmitting images, BUT, the images they transmit to remote viewing facilities are encrypted.

A new web service allows businesses to monitor the social networking communications of their employees. Facebook and Twitter users, you should probably just assume that what you post publicly is being monitored by your employer. Employers, you should probably assume that your employees post a lot of stuff that shouldn’t be shared.

Quip app security hole shares private photos. People who used a free service to send naked photos of themselves were exposed. Hey wait a minute… doesn’t the Apple app store performed extensive reviews before they accept a product?

iPad is coming to the office, and we found some security applications for it.  iTeleport: Jaadu VNC is encrypted remote access allows a secure connection between the iPad and a desktop comupter.  ALSO — in PC World, Tom Bradly Reports another option from Array Networks: “One app that is not yet available, but has significant promise for leveraging the iPad to connect with Microsoft Windows systems is Array Networks Desktop Direct.

Report: 64% of all Microsoft vulnerabilities for 2009 mitigated by Least Privilege accounts.

Way cool! Open PDF Links Directly In Google Docs Viewer

Whole Foods Scam on Facebook. Free gift cards worth $500 for the first 12,000 users. Uh-huh.

Cleveland Plain Dealer exposes identity of community leader who posts anonymous comments. Starts debate about privacy versus the public’s right to know. We wonder why just anyone at the newspaper can look at the email registry.

Episode 123 – March 27, 2010

Posted in Breach, Conference Coverage, Court Cases, criminal forensics, darkweb, ediscovery, Exclusive, Show Notes, Vulnerabilities with tags , , , , , , on March 28, 2010 by datasecurityblog

Episode 123 features two interviews, and the show is 72 minutes long.

First — an amazing story about a scareware company that sold hundreds of millions worth of fake antivirus. A big, big, business with offices across the globe, 650 employees, and a tech support operation for the “customers” who bought the fake software. Writer Jim Giles tells the story. Jim’s interview starts about 21 minutes into the show. His article for New Scientist is featured here.

Later in the show – we talk to the Director of Global Electronics Systems Engineering at Ford Motor Company, Jim Buczkowski. Ford has put a firewall between the dashboard, where you jack in with your mobile device, and the car’s computer systems.  The thinking is, if your device is infected,we  wouldn’t want it to cause break failure or something like that! Ford is ahead of the game on this. Ford’s Sync system is multi-functional communication system in the dashboard. Here’s hoping it lives up to its promise. The interview starts approximately 58 minutes into the show.

Our Take on This Week’s News:

Lead story? This article in the U.K.Telegraph touts “typeprint analysis” as as if it were a hot new development, and reports that British researchers are looking for a grant to study it further as a way to monitor whether there are pedophiles online, chatting with the kids. Is anyone else sick of pedophilia and other sex crimes as a frame on which to hang funding requests and tax increases? This article doesn’t read well, and it certainly doesn’t break any technology news. The researchers mention that there are private sector uses for their work. All well and good, particularly since positive ID for banking transactions is among them. So why hide behind the pedophiles?  And why did the reporter not dig deeper into what’s new and different about this use of an established technology?

It’s tax season, and of course, the cybercriminals are focused on whatever preoccupies the rest of us. A new email scam features a fake IRS email notice… which leads to a zeus attack. NOTE TO EMPLOYERS AND I T ADMINS: This could show up in your employees’ inbox as an email from your company…. as in: “we have overcalculated your social security tax, and we need to fix it before April 15.” Or some such nonsense. You should write a memo immediately, alerting employees that they are to ignore any email that induces them to action regarding taxes.

Federal employees have received 12 months probation and community service as punishment for viewing (collectively) 900 confidential passport applications. Nobody appears to have been fired for this. At least the justice department press release doesn’t mention any firings.

Here’s a story we picked up at RSA in San Francisco. Tom Murphy, Chief Strategy Officer of  Bit9,  discusses (among other things) targeted attacks that are narrower than spam, viruses and botnets. They are customized to specific organizations to steal specific information. Bit9 has some free security tools that could help.

CanSecWest hacking contest: The predictions were correct. iPhone fell first (it took 20 seconds). Then Apple Safari. Then IE8 on Windows 7. See references below.

iPhone: http://blogs.zdnet.com/security/?p=5836&tag=col1;post-5846

Apple OSX and Apple Safari: http://blogs.zdnet.com/security/?p=5846&tag=col1;post-5855

Windows7 IE8: http://blogs.zdnet.com/security/?p=5855&tag=content;col2

Nonetheless, your employees will be bringing their new iPads to work. Tony Bradley offers a lot of security questions businesses need to ask. Ask them this week, before the iPad hits the stores. (Tony Bradley is co-author of Unified Communications for Dummies . He tweets as @Tony_BradleyPCW . You can follow him on his Facebook page , or contact him by email at tony_bradley@pcworld.com) .

Security training can be – well – boring. The employees sit in a seminar and listen to abstract descriptions of attacks. And they never get a chance to practice what they learn. So that’s why researchers at Carnegie Mellon University decided to try training that includes “microgames.” Little games employees can play in a few minutes. The objective is to teach them about phishing attacks…. How to discern a “good URL” from a “bad URL.” Then the researchers measured whether the gamers retained the information. And most did. The fun interaction with the phishing lesson made a difference. CMU’s Dr. Jason Hong directed the research. We have posted an interview with him on the conference notes page. His team is marketing their training games now. The company is called Wombat Security.

Virtual Machines – an attractive solution in these times when money is tight. But before you virtualize, update your security plan. Here are some tips from F5 Netorks.

Hate to say we told you so…. Airport worker given police warning for ‘misusing’ body scanner. If by “misusing” you mean “taking a picture of your co-worker as she walks through it.”

March 20, 2010 – Episode 121

Posted in Breach, Conference Coverage, Court Cases, criminal forensics, eMail Security, Exclusive, Show Notes, web server security with tags , , , , , , , , on March 20, 2010 by datasecurityblog

Episode 121 is 70 minutes long. Our interview segment is a major highlight- not to be missed! Patrick Peterson, Cisco Fellow, explains how modern web attacks work, amd why anti-virus and firewalls are failing. The interview is about ten minutes long, and it starts about 22 minutes into the show. You may go to listening options to download the program or find other options to hear the program; or you may stream the program using the flash player below:

Our Take on This Week’s News:

MySpace user data is offered for sale on InfoChimps.org. This lengthy blog post on ReadWriteWeb contemplates the state of “big data.”  PC world reports it, too.

Annual report from the internet crime complaint center (IC3) was released this week. The FBI’s cybercrime investigation unit – which was launched in 2000 — reports that complaints were up 22 percent in 2009 over 2008… and that the loss from all cases referred was more than half a billion dollars… descriptions of top scams start on page 13 of the report.

Madoff’s computer programmers indicted.

Ponemon Institute study on the level of trust in the banks by commercial customesr. A wakeup call to the banking industry: Get serious about Zeus or you customers will walk.

CanSecWest (Canadian Security conference) starts Wednesday: Microsoft’s Internet Explorer 8 will be easily penetrated in the Pwn2Own hacking challenge.

Plus Chmapion hacker Charlie Miller says he has 20 vulnerabilites to bring down Apple Safari browser on Mac OS X.

Hancock Fabrics – Bad guys swap PIN pads at cashier desks. Here’s a letter from the President and CEO of the stores:

Vodafone distributes Mariposa botnet attack.

Remember the former auto dealership employee who hacked the remote communication system and started disabling customer vehicles?   We interview executives from the company that makes the system,  Pay Technologies.  Jim Kreuger and David Ronisky are the co-founders.

Teen hacks code for Walmart public address system, makes racially charged announcement to customers.

Episodes 114 and 115 – February 27, 2010

Posted in Conference Coverage, Court Cases, criminal forensics, darkweb, ediscovery, Podcast, Show Notes, Vulnerabilities with tags , , , , on February 28, 2010 by datasecurityblog

The CyberJungle episode 115 features an interview with Simon Bransfield-Garth, CEO of CellCrypt on the growing potential for cell phone eavesdropping; also, an interview with information activist John Young, whose website cryptome.org was shut down on orders from Microsoft attorneys after he posted a document the company considers proprietary.Bransfield-Garth’s interview starts approximately 21 minutes into the podcast.  Young’s interview can be found approximately 53 minutes into the podcast.

We have posted a separate, unedited version of the Simon Bransfield-Garth interview, as our “su root” edition this week. The su root interview is always longer and more technically sophisticated than the podcast versions, which have been edited for radio. This su root offering is labeled episode 114.

Click Here to Listen to Episode 115. Shownotes below.

The Chuck Norris attack… so named because of references to the action film star in the code…. It’s targeting the D-Link router.

Wyndham Hotels Breached for the third time – And the Wyndam Privacy and Security Policy indicates privacy and security might not be a top priority… also reveals the large number of brand name hospitality establishments owned by Wyndam.

Inventory documents from the Department of Homeland Security show that 985 computers were lost by the Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP) in fiscal 2008. In addition the departments lost hundreds of night vision scopes, computer switchers worth $92,000 apiece, and an international harvester truck. All of this loss was considered by the feds to be within acceptable loss limits.

Eric Schmidt, privacy hypocrite: We’re ordering a T-shirt for Google CEO Eric Schmidt, who famously proclaimed in a recent CNBC interview that “if you have something you don’t want anyone to know, maybe you should be doing it in the first place.” Schmidt apparently had his employees take down a blog from Google Blogspot, in which his mistress made numerous references to him. So fortunate that he runs the company where his privacy was breached. His new motto will be “Privacy for me, but not for thee.” Thanks to Valley Wag for this delicious morsel.

Just in case you’ve been living under a rock, parents of high school students in Lower Merion School District are suing after the district activated the cameras in school-issued laptops and spied on the kids while they were at home. The lawsuit slaps the district with violations of all of the following laws:

Electronic Communications Privacy Act, The Computer Fraud Abuse Act, the Stored Communications Act, a section of the Civil Rights Act, the Fourth Amendment of the U.S. Constitution, the Pennsylvania Wiretapping and Electronic Surveillance Act and Pennsylvania common law.

Not so fast, says Orin Kerr, law professor at George Washington University, and regular contributor to the Volokh Conspiracy. Kerr’s analysis shows how specific these laws are, and how tough it is to prosecute violations of federal computer protection laws. The only real case against the school district, says Kerr, is a Fourth Amendment case.

Data Security Podcast Episode 83, Nov 30 2009

Posted in Breach, Court Cases, criminal forensics, darkweb, ediscovery, Legislation, Podcast, Vulnerabilities with tags , , , , , , on November 29, 2009 by datasecurityblog

30 minutes every week on data security, privacy, and the law…..(plus or minus ten)

On this week’s program:

* New highly damaging attack plays on the very fear of being attacked

* Stopping insider attacks with the right internal controls

* Our take on this week’s news.

–> Stream This Week’s Show with our Built-In Flash Player:

–> Scroll down to see links and show notes for this week’s show

–> Stream, subscribe or download Episode 83 – Listen or subscribe to the feed to automatically get the latest episode sent to you to your Google, Yahoo, iTunes, or other popular sites.

–>Tune into the show directly on iTunes, you can also subscribe to the program on iTunes.

–> A simple way to listen to the show from with stricter firewalls: Listen from Odeo. This site works better if you are behind a more restrictive enterprise firewall.

Please visit our sponsors, and be sure to let them know you heard about them on The Data Security Podcast:

  • Vipre Anti-Virus, the complete Antimalware solution by Sunbelt Software. If you TRY the enterprise version, you get the home version for FREE! Go to: http://www.testdrivevipre.com .
  • GamaSec Web App Scans: Spots cyber-hazards on your web site, and has advanced zero-day protection. GET YOUR FREE BASIC WEB APP SCAN, plus a special offer just for listeners to The Data Security Podcast. Go here to sign up, and add the offer code: Podcast.
  • SonicWall;  Get the super fast UTM firewall that’s rated Five Stars (the Best rating) by Secure Computing MagazineData Clone Labs is the premier SonicWall Medallion Partner for all your security needs.
  • DeviceLock; Software that controls, manages and helps encrypt USB drives and other removable media. Get a free trial on their site, and be sure to let them know you heard about them on The Data Security Podcast.

Show Notes for Episode 83 of the Data Security Podcast

* Ira has a conversation with Cheryl Traverse President/ Chief Executive Officer with Xceedium, a company that provides centralized, secure IT operations management.  Ira and Cheryl talk about the controls that protect against insider threats, and help put organizations in compliance with data security and privacy mandates.

* Tales From The Dark Web:  Bank attacks hides in ‘software update’ links. This attack combines the fear of not properly patching with attacks that empty business bank accounts. Hat tip to the story in Darkreading.com .

* From Out Take on The News: Reuters news story on the under-reporting of cyber attacks.

What Happens In Vegas...Goes Where??

* From Our Take on The News: Las Vegas Metro Police admits to large databreach of background check data.  Hat tip to excellent work by The Las Vegas Sun newspaper.

*  From The Wrap: We comment on the news that the Ikee worm author gets job at iPhone app firm, as posted by Graham Cluley.

Follow

Get every new post delivered to your Inbox.

Join 1,126 other followers