Monthly Archive for October, 2008

Virtual Heist Nets 500,000+ Bank, Credit Accounts

A single cyber crime group has stolen more than a half million bank, credit and debit card accounts over the past two-and-a-half years using one of the most advanced strains of computer spyware in existence, according to research to be published today. The discovery is among the largest stolen data caches ever recovered. Researchers at RSA's FraudAction Research Lab unearthed the massive trove of purloined data while tracking the activities of a family of spyware known as the "Sinowal" Trojan, designed to steal data from Microsoft Windows PCs. RSA investigators found more than 270,000 online banking account credentials, as well as roughly 240,000 credit and debit account numbers and associated personal information on Web servers the Sinowal authors were using to set up their attacks. The company says the cache was the bounty collected from computers infected with Sinowal going back to February 2006. "Almost three years is a very,

GAO: Localities Expose Social Security Numbers Online

Many county governments across the U.S. are providing citizen's full or partial Social Security Numbers available online or in bulk to prviate companies, according to a Government Accountability Office report released last week. At a time when states are seeking additional laws to punish businesses that inadvertently leak their citizens' personal and financial data, the GAO's findings would appear to highlight an overlooked area of consumer protection, as states weigh trade-offs between open-records laws, privacy, and the potential income that the sale of consumer records can generate. Roughly 85 percent of counties nationwide make the records available, and only 16 percent of counties place any restrictions on the types of entities that can obtain those records. As the GAO notes, public records -- such as birth, marriage and death certificates, civil and criminal court case files, and property liens -- that used to be accessible only in the county recorder's

ICANN De-Accredits EstDomains for CEO’s Fraud Convictions

The entity responsible for overseeing the Internet's domain name system said Tuesday that it was revoking the right of registrar EstDomains.com to process new domain names, citing the company CEO's recent conviction on cyber crime charges. The move by the Internet Corporation for Assigned Names and Numbers (ICANN), comes less than two months after Security Fix published a report translated from Estonian into English showing that EstDomains CEO Vladimir Tsastsin (pictured at right) was convicted in February of credit card fraud, document forgery and other cyber crime charges -- and that EstDomains was a haven for cyber criminals who wanted to register Web sites that supported a range of criminal activity. Apparently, a section of the legal contracts that all registrars must sign with ICANN states: "Thou Shalt Not Have a Cyber Crook As Your CEO." Okay, it doesn't quite say it like that. Here's what ICANN did say, in

Java Update Promises to Remove Older Versions

Sun Microsystems has released another version of its Java software client. The update, JRE6 Update 10, contains no new security fixes to the most recent version, JRE6 Update 7, but it does appear to fulfill a promise the company made long ago to stop littering users' PCs with outdated, insecure versions of the software. Readers of this blog know I am no fan of Java. It's a huge, extremely powerful program that frequently needs updating to protect users from evil sites that might wish to leverage the program's interactivity and power to do bad things. Another reason I've railed against Java is that Sun's updates don't remove old versions. As a result, if you've been keeping up with the Java security updates, chances are you have at least three or four previous versions of Java on your system -- each taking up more than 100MB worth of disk space. While

Microchip-Cancer Connection

Could a microchip implant like the VeriChip cause cancer? A French Bulldog named Léon was the catalyst for new questions about the safety of RFID implants.

One year ago, Léon’s owner contacted me with startling news. She believed that her dog’s cancerous tumor and his untimely death might have been caused by a microchip implant.

This was not just idle talk by a grieving dog owner grasping at straws to figure out why she had been robbed of her constant companion. This was a gutsy lady who refused to allow the vet to simply cremate the evidence.

This lady prefers to be known only by her first name of “Jeanne,” so the Associated Press couldn’t credit her properly as the original source for some of the explosive information in its article “Chip Implants Linked to Animal Tumors,” but I have the leeway in this forum to share the behind-the-scenes story.

Jeanne spent a small fortune trying to cure her ailing French bulldog, Léon, after he was diagnosed with cancer in 2004. When medical interventions failed and Léon passed away, she decided to hunt for the reason the fatal tumor in his body was attached to the glass-encapsulated microchip that had been injected into his neck for identification purposes.

Jeanne located a team of researchers in Italy who agreed to test tissue samples

Read Rest

RFID tags: Big Brother

Could we be constantly tracked through our clothes, shoes or even our cash in the future?

I’m not talking about having a microchip surgically implanted beneath your skin, which is what Applied Digital Systems of Palm Beach, Fla., would like to do. Nor am I talking about John Poindexter’s creepy Total Information Awareness spy-veillance system, which I wrote about last week.

Instead, in the future, we could be tracked because we’ll be wearing, eating and carrying objects that are carefully designed to do so.

The generic name for this technology is RFID, which stands for radio frequency identification. RFID tags are miniscule microchips, which already have shrunk to half the size of a grain of sand. They listen for a radio query and respond by transmitting their unique ID code. Most RFID tags have no batteries: They use the power from the initial radio signal to transmit their response.

You should become familiar with RFID technology because you’ll be hearing much more about it soon. Retailers adore the concept, and CNET News.com’s own Alorie Gilbert wrote last week about how Wal-Mart and the U.K.-based grocery chain Tesco are starting to install “smart shelves” with networked RFID readers. In what will become the largest test of the technology, consumer goods giant Gillette recently said it would purchase 500 million RFID tags from Alien Technology of Morgan Hill, Calif.

Read Rest

Implantable Cardio Defibrillators

SANTA ANA, Calif.–(BUSINESS WIRE)–June 4, 1999–

Use of Implantable Cardio Defibrillators Growing at an Annual

Rate Exceeding 20 Percent

Microsemi Corp. (Nasdaq:MSCC) Friday announced that it has
introduced a new high voltage MOSFET for implantable cardio
defibrillator (ICD) applications that provides a size reduction of 40%
over currently available devices.

Component size is critical in the design of implantable electronic systems.

Designated the MSAFA1N100D, the new device is the first to be
developed jointly by Microsemi, a leader in discrete semiconductors for
human implantable electronics, and Advanced Power Technology, Bend,
Ore., a leader in advanced high power, high voltage MOSFET design.

This joint venture project was completed in only eight weeks as
part of the recently announced agreement between the two companies that
allows Microsemi to serve the implantable medical market with APT’s
patented Power MOS V MOSFET technology.

The Microsemi device will be used as an overvoltage protection
circuit in the next generation of implantable cardio defibrillators.
These implants must withstand high voltages induced either by the ICD
itself or by external defibrillation in emergency room and other
treatment procedures.

New types of multiple-phase high voltage therapies are driving
broader use of implantable cardio defibrillators, which can require 10
MOSFETs each. It is estimated that this market will grow at an annual
rate of more than 20%, with nearly 70,000 such implants last year alone.

Although much smaller than prior implantable MOSFETs, the new
Microsemi device provides equivalent electrical performance. In
addition to meeting the required specifications of 1,000 Volts and 13.5
Ohms at body temperature (37C), Microsemi’s new device provides ICD
designers with the ability to reduce battery drain by taking advantage
of the MSAFA1N100D’s gate charge spec of less than 20nC.

“For implantable devices that must function five to seven years, or
more, from a single Lithium Ion battery, the MSAFA1N100D provides a
significant advance for next-generation ICD designs,” reported Manuel
Lynch, worldwide marketing director at Microsemi.

Data-Stealing Trojan Exploiting Just-Patched Windows Flaw

Microsoft Windows users who have not yet applied the security update that Redmond released yesterday should take a minute to do that now: Security experts are warning that at least one Trojan horse program with apparent spreading capabilities is in circulation, and that we are likely to see additional malware exploiting the flaw in the coming days. The ThreatExpert Blog has the skinny on Gimmiv.A, a Trojan that appears to have worm-like ability to spread to other systems on a network. This is likely to be more of a threat for large, enterprise networks than for individual home users. On an unpatched corporate network, all it would take is for an employee to plug an infected laptop into the network, and without firewalls enabled on each machine inside of the network or some type of host-based intrusion detection software running, that network could be in real trouble very quickly. Oddly

Microsoft to Issue Emergency Security Update Today

Microsoft said late Wednesday that it plans to break out of its monthly patch cycle to issue a security update today for a critical vulnerability in all supported versions of Windows. Redmond rarely releases security patches outside of Patch Tuesday, the second Tuesday of each month. The software giant isn't providing many details yet, but the few times it has departed from its Patch Tuesday cycle it has always done so to stop the bleeding on a serious security hole that criminals were using to break into Windows PCs on a large scale. By Security Fix's count, this would be the fourth time since January 2006 that Microsoft has deviated from its monthly patch cycle to plug security holes. As shown by the stories in the linked examples above, Microsoft has fixed problems, each time, that were being actively exploited by bad guys to break into PCs. Microsoft's advanced notification