IMAGES: World's 10 most famous hackers

Last updated on: September 28, 2011 09:28 IST

While ethical hackers attack a security system to find out vulnerabilities that a malicious hacker could use to his advantage, unethical hackers discreetly wreck havoc on computer systems and steal confidential information.

In the 1970s, the United States government used groups of experts called red teams to hack its own computer systems.

Today, many companies hire ethical hackers to safeguard their vital computer systems.

Here's a look at the world's most famous hackers...

1. Gary McKinnon

Gary McKinnon, a Scottish systems administrator has been accused of the biggest military computer hacking exercise of all times by the US government.

McKinnon is also accused of copying data, account files and passwords into his own computer.

US authorities pegged the cost of tracking and rectifying the problems caused by his hacking at over $700,000.

Image: Gary McKinnon.
Photographs: Reuters.
Last updated on: September 28, 2011 09:28 IST

2. Robert Tappan Morris

Robert Tappan Morris is an American computer scientist, known for creating the first computer worm on the Internet called the Morris Worm in 1988.

He became the first person convicted under the Computer Fraud and Abuse Act.

He is a professor in the department of Electrical Engineering and Computer Science at the Massachusetts Institute of Technology.

Click NEXT to read more...
Image: Robert Tappan Morris. Last updated on: September 28, 2011 09:28 IST

3. Kevin David Mitnick

Kevin David Mitnick is a computer security consultant, author, and hacker. In the late 20th century, he was convicted of various computer-related crimes.

When he was 12 years old, Mitnick used social engineering to bypass the punchcard system used in the Los Angeles bus system.

Click NEXT to read on . . .

Image: Kevin David Mitnick. Last updated on: September 28, 2011 09:28 IST

4. Kevin Poulson

Kevin Lee Poulsen, a former black hat cracker, works as senior editor at Wired News.

He is well known for hacking all the telephone lines for Los Angeles radio station KIIS-FM, to make sure that he would be the 102nd caller and win the prize of a Porsche 944 S2.

Click NEXT to read on . . .

Image: Kevin Poulson. Last updated on: September 28, 2011 09:28 IST

5. Jonathan James

Jonathan Joseph James who passed away in May 2008, was an American hacker.

He was the first juvenile to be imprisoned for cybercrime in the United States. He died as a result of a self-inflicted gunshot wound.

Click NEXT to read more...
Image: Jonathan James. Last updated on: September 28, 2011 09:28 IST

6. Adrian Lamo

Adrian Lamo a threat analyst gained popularity by hacking into several high-profile computer networks, including those of The New York Times, Yahoo!, and Microsoft. He was arrested in 2003.

Click NEXT to read more...
Image: Adrian Lamo. Last updated on: September 28, 2011 09:28 IST

7. Vladimir Levin

Vladimir Levin, a businessman is known for his involvement in attempting to fraudulently transfer $10.7 million via Citibank's computers.

Currently, he does business in Lithuania.

Click NEXT to read on . . .

Image: Vladimir Levin. Last updated on: September 28, 2011 09:28 IST

8. Raphael Gray

Raphael Gray was just 19 when he hacked computer systems around the world in 1999 as part of a multi-million pound credit card mission.

He published credit card details of over 6,500 cards to point out the weak security in consumer web sites.

Click NEXT to read on . . .

Image: Raphael Gray. Last updated on: September 28, 2011 09:28 IST

9. Deceptive Duo

A 20-year-old man from California was suspected of being a hacker and called himself, 'the Deceptive Duo'.

He faces several charges on hacking into government computers and defacing government websites.

In April 2002, the Deceptive Duo claimed to be a hacking group working to expose the lack of security within the US government's networks and other private-sector computer systems.

Click NEXT to read on . . .

Image: Deceptive Duo. Last updated on: September 28, 2011 09:28 IST

10. Michael Calce

Also known as MafiaBoy, Michael Calce, a high school student from West Island, Quebec launched a series of highly publicised denial-of-service attacks in February 2000 against large commercial websites including Yahoo!, Amazon.com, Dell, Inc, eBay, and CNN.

Image: Michael Calce.

View the original article here

Hackers may have had head start on Ottawa during January cyber-attack: documents

OTTAWA - Hackers may have had a four-day head start when they broke into government systems in January in an attack that continues to leave many employees without full Internet access and revealed flaws in the security of federal computers.

Documents obtained by The Canadian Press say the Treasury Board and Finance departments were notified of "harmful activity" on Jan. 24 by the agency that oversees communications security in Canada.

The departments, whose networks are linked, began to remove infected computers and institute a series of rolling Internet outages to get to the root of the attack.

"I received the report, nothing major," Luc Parson, chief of information technology security for the Treasury Board, wrote in a Jan. 25 email. "We were already doing all the recommendations except for like 1."

However, Communications Security Establishment Canada went back to the departments on Jan. 28, a followup that provided "our first realization of the severity of the problem," according to a draft action plan written by the agency after the incident.

Exactly what damage the hackers managed to do was censored in the hundreds of pages of emails, reports and other documents released under the Access to Information Act. But a Jan. 31 note says the attack was serious.

"Indications are that data has been exfiltrated and that privileged accounts have been compromised," the incident report says.

Meetings between CSEC and the two departments on Jan. 28 triggered a more drastic Internet shutdown that partially continues to this day and threw information-technology staff in both departments into crisis mode as officials scrambled for a fix without clear guidelines as to who was in charge.

"Governance around the crisis needs to change," wrote Marie McDonald, a senior bureaucrat within Treasury Board in the aftermath of the attacks.

When the attacks became public, then-Treasury Board President Stockwell Day acknowledged the hackers were after financial records, but said nothing was compromised.

Government employees in a number of departments had been repeatedly warned only a week earlier that someone was trying to break into their computers. Attempts to infiltrate the system had begun in December, the documents suggest.

A security bulletin said the danger came from spoof email addresses purporting to be from senior government officials but contained "a malicious link, which if 'double clicked' may lead to the exfiltration of data."

"The emails have been socially engineered and tailored to target different audiences within each department and contained a link to a malicious zip file hosted on an external (non government) website," said the bulletin, first circulated Jan. 14.

Three days later, there were fears about the email accounts of senior Finance Department officials being targeted. A bulletin sent Jan. 21 noted "the risk of loss of sensitive information resulting from these targeted emails is HIGH."

As the CSEC and officials from Finance and Treasury scrambled to contain the threat, it appears the Public Safety Department remained in the dark.

Asked Jan. 30 if Public Safety had been briefed, the Treasury Board's Parson wrote: "We were asked not to."

It's not clear who did the asking.

Public Safety was formally brought into the loop the next day. By Feb. 1, the government had activated its cyber-triage unit, which includes officials from the RCMP, Canadian Security Intelligence Service and Defence.

Government employees were formally notified the next day that Internet use was being reined in because the government had been hacked.

Public Safety has refused to answer questions about why its officials were apparently not informed of the attack at an early stage, and whether notification procedures have since changed.

However, the records indicate the mysterious digital assault prompted departments to draft a new protocol soon after for handling such events.

Last year the Conservatives announced a new cyber-security strategy, which set aside $90 million over five years, and $18 million in continuing funding toward beefing up existing systems.

But the records suggest a request for better software that could have helped detect and prevent the spread of the January attack had been languishing in a bureaucratic maze.

When the attack was first reported Jan. 24, Treasury Board seized on the crisis to fast-track a request for better tools, asking that the procurement be considered a matter of protecting national security.

Once the story began to hit the media, officials began receiving the replies they were after.

The attacks took a toll on government IT workers, as time stamps on emails show they were dealing with the issue almost round-the-clock in the early part of February.

One raised concern about staff burnout, while another sought to mobilize volunteers for the weekends to help get the system up and running again.

After the initial shutdown, government employees were allowed access to internal sites, but in order to see external sites they had to submit specific requests for approval.

The documents show employees wanted access to news, travel bookings and the search engine Google. News and travel were allowed, but not Google.

But in order to keep the government moving, Internet kiosks with full access were set up — and they remain in place.

"We're still following procedures to protect the integrity (of the system)," said Jack Aubry, a Finance spokesman.

A spokeswoman for the Treasury Board said the department "has taken the necessary measures to ensure that employees have access to the information and tools needed to meet business requirements."

She declined to comment further on the incident.

The hackers have never been publicly identified. There have been unconfirmed reports they were based in China.

View the original article here

MySQL.com hacked for second time in a year

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

The MySQL.com website has been struck by cybercriminals, who hacked their way in to serve up malicious code to visiting computers.

Simply visiting the home page of the website, initiated a Java exploit that downloaded and executed malicious code on visiting Windows computers. No user interaction was required for PCs to become infected.

The hack was first publicly reported by security researchers at Armorize, and appears to no longer be present.

Brian Krebs reports that just a few days ago he noticed on a Russian underground website that a hacker was offering to sell admin rights to MySQL.com for $3000.

The attraction for malicious hackers is obvious - MySQL.com reportedly receives almost 12 million visitors a month (nearly 400,000 a day), meaning that there is a steady stream of potential victim computers visiting the site which could become infected through a drive-by download.

Sophos products detects malware served by the MySQL.com website as Troj/WndRed-C and Troj/Agent-TNV. However, because the malware pointed to by the cybercriminals could be changed at any time it is possible that other malicious software was distributed during the time when the website was compromised.

The infection is embarrassing to MySQL.com, which suffered another hack earlier this year. On that occasion, hackers exploited an SQL injection vulnerability to expose usernames and poorly chosen passwords.

Inevitably there will be speculation that a similar vulnerability may have allowed hackers access to the website on this occasion too.

For a website to suffer one hack may be regarded as a misfortune. To suffer twice in less than a year begins to look like carelessness.

http://twitter.com/gcluley

View the original article here

Hackers hijack USA Today's twitter account

Hackers victimized another American media outfit this week, briefly hijacking the Twitter account of USA Today and allegedly sending false tweets.

USA Today acknowledged the hack early Monday (Manila time) and said it managed to work with Twitter to wrest back control of its micro-blogging account.

?@usatoday was hacked and as a result false tweets were sent. We worked with Twitter to correct it. The account is now back in our control," it said.

It also apologized for any ?inconvenience or confusion" caused by the incident, but did not elaborate.

?We apologize for any inconvenience or confusion caused to our readers and thank you for reading @usatoday," it said.

Computer security firm Sophos noted USA Today was the latest high-profile Twitter account to have fallen victim to the hackers, who called themselves ?The Script Kiddies."

It said The Script Kiddies had claimed responsibility for the hack, which involved posting a series of messages to the official USA Today Twitter account.

?Fox News, Wal-mart, Unilevel, Pfizer, NBC and now USA Today. who?s next? Vote now! [LINK]," Sophos quoted one of the group?s messages as saying.

?Please like The Script Kiddies on Facebook! You could choose our next target!" it added.

Earlier this month, the group claimed responsibility for hacking into the Twitter account of NBC News, and posted a fake story of an attack on the 10th anniversary of the 9/11 terrorist attacks.

It also defaced the Facebook page of Pfizer and hacked into FoxNews? Twitter account to post a bogus announcement about the assassination of President Barack Obama.

The Federal Bureau of Investigation is now investigating the Twitter hack on the account of NBC News. ? RSJ, GMA News

View the original article here

Authenticity of Web pages under attack by hackers - USA Today

The keepers of the Internet have become acutely concerned about their ability to protect the most sensitive personal information such as account logons and credit card numbers.

USA TODAY

Hackers cracked three companies that work with the most popular Web browsers to ensure the authenticity of Web pages where consumers type in sensitive information.

The hacked firms are among more than 650 digital certificate authorities (CAs) worldwide that ensure that Web pages are the real deal when displayed by Microsoft's Internet Explorer, Firefox, Opera, Apple's Safari and Google's Chrome.

A hacker gained access to digital certificate supplier DigiNotar this summer and began issuing forged certificates for dozens of marquee companies.

Unable to cope with the fallout, the Dutch company filed for bankruptcy last week. Two other digital certificate companies, New Jersey-based Comodo and Japanese-owned GlobalSign, were similarly hacked this summer, exposing a glaring weakness in the Internet's underpinnings.

"The infrastructure baked into the Internet, which is based on trust, is starting to fall apart," says Michael Sutton, research vice president at security company Zscaler.

CAs digitally certify account sign-ins, shopping and other pages where consumers type sensitive data. This sets up an encrypted connection to the Web browser, which displays the form for the consumer to fill out. The browser trusts only digitally signed pages.

A counterfeiter issued valid DigiNotar certificates for 531 faked pages. Some of the pages were crafted to expertly impersonate online properties of Google, Microsoft, Skype, Equifax, Twitter, Facebook and the CIA, among others, according to consulting firm Fox-IT.

This touched off a scramble to cut off the faked pages, which were difficult for consumers to spot as faked.

The successful hacks demonstrated that it is possible to "impersonate any site on the Internet," says Josh Shaul, chief technical officer at security company AppSec.

No banks or payment-service websites were targeted, says Mikko Hypponen, chief researcher at anti-virus company F-Secure. The hackers seem much more interested in harvesting personal data from e-mail services, social networks, credit bureaus, blogging sites and anonymity services.

The pressure is on CAs and browser makers to do more to identify and quickly eradicate counterfeit certificates and faked Web pages, security experts say. "No one knows where the next breach will occur," says Jeff Hudson, CEO of digital certificate management company Venafi.

Microsoft, maker of Internet Explorer, declined to comment, as did Apple, maker of the Safari browser. "The security of the Web is our collective responsibility," says Johnathan Nightingale, Mozilla's director of Firefox engineering.

For more information about reprints & permissions, visit our FAQ's. To report corrections and clarifications, contact Standards Editor Brent Jones. For publication consideration in the newspaper, send comments to letters@usatoday.com. Include name, phone number, city and state for verification. To view our corrections, go to corrections.usatoday.com.

View the original article here

Hackers hijack Twitter accounts of Chavez critics

Fabiola Sanchez, Associated Press, On Tuesday September 27, 2011, 1:43 pm EDT

CARACAS, Venezuela (AP) -- Over months, Venezuelan TV soap opera writer Leonardo Padron built a Twitter following of about 250,000 people by posting more than a dozen messages a day, many of them skewering President Hugo Chavez.

On Aug. 29, Padron issued a typical shot: "Chavez knows of the immense death toll that there is in this country, so why such indifference to the subject of insecurity?"

Three days later, however, the tweets picked a new target: Padron himself. "In no way have I contributed to combat racism, discrimination, cultural alienation," one note read. "My soap operas feed these evils in our society."

Padron had fallen victim to an unknown hacker or group of hackers who have hijacked the accounts of at least nine well-known Chavez critics, posting curse-filled insults, threats and slogans such as "Long live Chavez."

One late-night post called a journalist a homosexual, and another threatened a Chavez opponent: "I'm going after you little by little, Damned Narco." Doctored photos show opponents wearing red berets of the sort favored by the socialist leader.

The burst of Twitter hacking has opened a new battlefield in Venezuela's heated political wars. Some Chavez critics say their email accounts have also been compromised.

A group calling itself "N33" has claimed responsibility for the Twitter attacks, and those targeted have had "N33" appear on their Twitter profiles.

All sorts of theories have been circulating about who is behind N33, ranging from Chavez allies to opponents trying to make the government look bad. Some wonder if it could be a single young hacker trying to make a statement.

Padron heard from an acquaintance that his account was sending out insults. He had been wondering why he wasn't able to sign in to Twitter. Suddenly, it was clear: Someone had stolen his password and shut him out.

"It's an invasion, a humiliation. It's as if you're about to go into your house and the door doesn't open with your key, and you sense there's someone inside posing as you," Padron told The Associated Press in an interview.

"You don't imagine that your 2.0 life is going to be stolen, that your voice is going to be expropriated," Padron said. "Of course, I began to have a very strong feeling of indignation."

Other victims of the attacks this month have included an activist, a humorist, three journalists, a TV show host, an ex-diplomat and a former Chavez supporter, all of them openly critical of Chavez.

Some of the victims have complained to authorities. Attorney General Luisa Ortega Diaz said that two prosecutors are collecting evidence and will talk to witnesses.

Both Twitter and Google say the attacks most likely involved phishing, a form of Internet fraud in which victims are tricked into revealing passwords or other personal information through emails with links to pages that appear to be authentic. Once a victim enters a password for Twitter or an email account on a fraudulent page, hackers are able to use it to take over the real account and change the password.

About 2 million Venezuelans, or 8 percent of the population, are Twitter users, according to figures by the local research company Tendencias Digitales. That gives Venezuela the second highest Twitter penetration in the region, after Uruguay.

Chavez's opponents regularly use the social networking site to spread critical commentary, while the government goes on Twitter to promote its policies and attack opponents. Chavez's Twitter account, chavezcandanga, reached the milestone of 2 million followers on Aug. 31.

That very day, the attacks by N33 began. In a Sept. 2 statement posted on the Internet, it called itself a group without links to "any government entity."

The statement was read aloud on state television by the host of the late night talk show La Hojilla, or "The Razor," a program that often denounces Chavez opponents.

In the statement, N33 said it had hijacked accounts to retaliate for "improper use of Twitter" and for attacking Chavez while he undergoes cancer treatment. It said Chavez's "convalescence hasn't been enough of a reason for these opposition characters ... to diminish their load of rage and bad intentions."

N33 has also taken over Gmail accounts, usually at night, stealing personal messages and photos and posting them on Twitter.

While the attacks on Twitter accounts died down after the first week of September, N33 continued posting items extracted from email accounts on a Twitter account, Cain--Supremo, until that account was suspended by Twitter. Another account has since appeared purporting to represent N33.

Activist Rocio San Miguel, whose Twitter account was taken over, also saw her personal photos and documents as well as insults and threats against her appear on the N33 Twitter feed.

"It's a feeling of powerlessness," San Miguel told the AP. "Without a doubt, they want to frighten and intimidate."

San Miguel leads an organization focused on national security and defense issues, and she likened the attacks to a sort of terrorism, saying they seem aimed at making an example of certain government critics to inhibit others.

Padron said it took him three days to block his own account. He also had to recoup email accounts that had been seized.

One of pirate posts on Padron's Twitter account sent greetings to the website "Table of Scorpions," a similarly mysterious, unsigned blog that has posted recorded phone conversations of opposition politicians.

Venezuelan law imposes prison sentences for cyber-spying or accessing others' accounts, and one 17-year-old Venezuelan was arrested four years ago for hacking into government websites. He was later released and the status of his case is unclear.

Twitter said that phishing schemes are a leading hazard.

"Most attempts to gain access to accounts target users by sending them fraudulent messages meant to trick them into sharing their passwords," Twitter spokeswoman Kristen Hawley said in an email. "A personal email account that's compromised is the second most likely way an intruder gains access to Twitter accounts."

Rafael Nunez, a Venezuelan online security expert who has experience as a hacker, noted that while N33 describes itself as a group, many of its messages are written in the first person. One such message on Twitter boasted: "I've got you going crazy."

"It's a single virtual speaker, but behind that speaker there could be collaborators," said Nunez, who heads the Venezuelan information security company Clean Perception.

Nunez was imprisoned in the United States for more than eight months in 2005 for hacking a Defense Department website and was later released. He calls himself an "ethical hacker" who saw hacking as a challenge and now uses his knowledge to improve online security.

After studying some of the latest attacks, Nunez said N33 apparently gained access to Gmail accounts by phishing for passwords or using software that enabled keystroke logging.

Nunez said he doesn't know of other countries where Twitter accounts have been similarly taken over in such a systematic way.

As for who might be behind it, Nunez said there are only theories for now.

"The language is very immature," Nunez said. "It's like a kid."

Associated Press writer Christopher Toothaker contributed to this report.

View the original article here

Hackers grab Goldman CEO's personal data - CBS News

(CNET) 

Hackers today released personal information for Goldman Sachs Chief Executive Officer Lloyd Blankfein.

The document, posted to the Pastebin Web site, includes the CEO's age, recent addresses, details of litigation he has been involved in, as well as registration information for businesses, but no sensitive information such as financial data.

Goldman Sachs representatives did not immediately respond to a call seeking comment.

A group using the handle "CabinCr3w" took credit for the data dump, but did not say why Blankfein was targeted. Goldman Sachs benefited from the U.S. government's bailout of insurance giant American International Group and is accused of practices that contributed to the economic crisis.

Michael Moore helps to "Occupy Wall Street

On Monday, CabinCr3w released information about a New York police officer who is seen in videos spraying pepper spray into the faces of women protesters who are penned behind a police barricade net at the "Occupy Wall Street" demonstrations. The officer, identified as Deputy Inspector Anthony Bologna via videos and close-up photos of his face and name on his badge, appears to walk over to the group of women and spray them directly in the face unprovoked.

A case of false arrest and civil rights violations is pending against Bologna in a claim brought by a protester involved in the 2004 demonstrations at the Republican National Convention, The Guardian reported.

New York Police representatives have not responded to a CNET request for comment on the pepper spray allegations, but told The New York Times that the pepper spraying was appropriate and alleged that the video was edited, a claim that legal advocacy group USLaw.com, which analyzed the video in slow motion, denies.

In a Tweet yesterday, CabinCr3w says "To the people asking...we are part of anonymous [SIC] just a group of like minded people taking on the world."

Hundreds of people have camped out in Zuccotti Park and 1,000 or more, including filmmaker Michael Moore and actress Susan Sarandon, have joined in protests and street marches as part of the Occupy Wall Street movement. The group, whose protests are in their second week, is calling for an end to the "monied corruption of our democracy" in the U.S. and is borrowing a page from the Arab Spring uprisings that overturned several regimes earlier this year.

The Occupy Wall Street organizers claim that the protests are spreading to more than 50 U.S. cities and span at least three continents.

Comment reply The posting of advertisements, profanity, or personal attacks is prohibited. By using this Web site you agree to accept our Terms of Service. Click here to read the Rules of Engagement.

View the original article here

For Hackers, the Next Lock to Pick - New York Times

A growing number of companies, including start-ups and big names in computer security like McAfee, Symantec, Sophos and AVG, see a business opportunity in mobile security — protecting cellphones from hacks and malware that could read text messages, store location information or add charges directly to mobile phone bills.

On Tuesday, McAfee introduced a service for consumers to protect their smartphones, tablets and computers at once, and last week the company introduced a mobile security system for businesses. Last month, AT&T partnered with Juniper Networks to build mobile security apps for consumers and businesses. The Defense Department has called for companies and universities to come up with ways to protect Android devices from malware.

In an indication of investor interest, one start-up, Lookout, last week raised $40 million from venture capital firms, including Andreessen Horowitz, bringing its total to $76.5 million. The company makes an app that scans other apps that people download to their phones, looking for malware and viruses. It automatically tracks 700,000 mobile apps and updates Lookout whenever it finds a threat.

Still, in some ways, it’s an industry ahead of its time. Experts in mobile security agree that mobile hackers are not yet much of a threat. But that is poised to change quickly, they say, especially as people increasingly use their phones to exchange money, by mobile shopping or using digital wallets like Google Wallet.

“Unlike PCs, the chance of running into something in the wild for your phone is quite low,” said Charlie Miller, a researcher at Accuvant, a security consulting company, and a hacker who has revealed weaknesses in iPhones. “That’s partly because it’s more secure but mostly because the bad guys haven’t gotten around to it yet. But the bad guys are going to slowly follow the money over to your phones.”

Most consumers, though they protect their computers, are unaware that they need to secure their phones, he said, “but the smartphones people have are computers, and the same thing that can happen on your computer can happen on your phone.”

Cellphone users are more likely than computer users to click on dangerous links or download sketchy apps because they are often distracted, experts say. Phones can be more vulnerable because they connect to wireless networks at the gym or the coffee shop, and hackers can surreptitiously charge consumers for a purchase.

There have already been harmful attacks, most of which have originated in China, said John Hering, co-founder and chief executive of Lookout.

For example, this year, the Android market was hit by malware called DroidDream. Hackers pirated 80 applications, added malicious code and tricked users into downloading them from the Android Market. Google said 260,000 devices were attacked.

Also this year, people unwittingly downloaded other malware, called GGTracker, by clicking on links in ads, and on the Web site to which the links led. The malware signed them up, without their consent, for text message subscription services that charged $10 to $50.

Lookout says that up to a million people were afflicted by mobile malware in the first half of the year, and that the threat for Android users is two and a half times higher than it was just six months ago.

Still, other experts caution that fear is profitable for the security industry, and that consumers should be realistic about the small size of the threat at this point. AdaptiveMobile, which sells mobile security tools, found that 6 percent of smartphone users said they had received a virus, but that the actual number of confirmed viruses had not topped 2 percent.

Lookout’s founders are hackers themselves, though they say they are the good kind, who break into phones and computers to expose the risks but not to steal information or behave maliciously. “It’s very James Bond-type stuff,” Mr. Hering said.

A few years ago, he stood with a backpack filled with hacking gear near the Academy Awards red carpet and discovered that up to 100 of the stars carried, in their bejeweled clutches and tuxedo pockets, cellphones that he could break into. He did not break into the phones, but publicized his ability to do so.

He started Lookout in 2007, along with Kevin Mahaffey and James Burgess, to prevent such intrusions. It has free apps for Android, BlackBerry and Windows phones, but not for iPhones. They are less vulnerable to attacks, security experts say, because Apple’s app store, unlike Android’s, screens every app before accepting it. Also, Android is the fastest-growing mobile platform, so it is more attractive to hackers.

View the original article here

Austrian Hacker Group Publishes Police Data - RTT News

(RTTNews) - A group of Austrian hackers has published the names and home addresses of nearly 25,000 police officials, triggering fears that the move might compromise the personal security of the officers.

According to Austrian officials, the data published as a searchable database on Twitter contained private information of more than 24,938 law enforcement officials ranging from beat officers to senior commanders.

Police union official Walter Scharinger said Monday that the hackers' move poses risks to officers as they might now become targets of revenge attacks by criminals they have encountered earlier.

Austrian authorities said the police data was published by a domestic hacker group known as 'AnonAustria', the Austrian branch of the global hacker collective 'Anonymous.'

The group said in a statement posted on its Twitter account that the move was to protest against a proposed law that would force telecommunications companies to save the details of all their telephone and internet traffic for a period of six months and provide them to the police, if required.

Austria's State Office of Criminal Investigation has launched an investigation into the leak of the police data.

Anonymous had come into prominence late last year after breaching websites belonging to several Internet services and online payment providers who cut their ties with whistle-blower WikiLeaks, including MasterCard and PayPal.

WikiLeaks, a website that publishes leaked classified information online, had earlier published thousands of confidential cables sent by U.S. embassies across the world as well as secret documents relating to wars in Iraq and Afghanistan.

Many members of Anonymous as well as allied hacker groups have already been arrested on both sides of the Atlantic in a crackdown involving European and US enforcement agencies. In response to those arrests, Anonymous called on its supporters to stop using PayPal accounts for making online payments

by RTT Staff Writer

For comments and feedback: editorial@rttnews.com

View the original article here

SSL authenticity evolution

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

I had the good fortune to recently attend GrrCON (pronounced "Grrrr Con"), one of the larger Midwestern United States information security and hacking conferences.

Moxie Marlinspike kicked off the event with his keynote presentation titled "SSL And The Future Of Authenticity."

He gave the same presentation at DEFCON, which my colleague Chester Wisniewski detailed in a fascinating article last month.

Marlinspike opened his talk by telling the tale of how a Certificate Authority (CA), which - according to Netcraft - signs roughly 20% - 25% of SSL certificates, was attacked. Not an everyday hack against a CA, but an act of war.

The CA wasn't prepared for cyberwarfare and how could they be?

They are a business and conduct security practices as a business. Only countries engage in warfare as they stated on their blog.

The moral of the story? Trust is an important part of SSL authenticity. When the trusted authorities are compromised, then where do we go?

Marlinspike continued through his presentation covering the main components of information security; secrecy, integrity and authenticity.

All of these components require equal thought and consideration in their implementation.

When SSL was designed back in the mid-90s, the authenticity component was given the least thought and as Marlinspike put it, "with a bit of a hand wave."

With the barrage of attacks on CAs, the hand wave is clearly useful for the flies circling what's left of authenticity; see Operation Black Tulip.

Marlinspike's approach (which builds upon the Perspectives Project with his project called Convergence) to solving the SSL authenticity problem is by replacing authorities with trust notaries.

Trust notaries are used to compare an SSL certificate downloaded by the endpoint with an SSL certificate the notary downloads. If they are a match then you know you're not on the receiving end of a man-in-ihe-middle (MITM) attack.

The notaries are owned and operated by the computing community. Anyone willing to act as a trust notary can download and install Convergence and off you go. I'll be building a notary this weekend.

The browser extension is currently in beta for Firefox. After adding the extension to Firefox, you now have a comfortable feeling knowing that you have "trust agility."

Trust agility means that you control who you trust and can change your mind at any time.

I'm also a fan of the Verification Threshold options Convergence provides. You can control how many notaries need to agree. The options are only one notary, a notary majority or a notary consensus. At the risk of sounding like Rachael Ray, "how awesome is that?"

The solution to eliminate the current method of trusting a single entity or multiple entities in the same scope is appealing. By this I mean the user is enabled to change notaries when they need to without compromising security or losing a quarter to a fifth of the Internet.

Having trust agility is absolutely a must have in this decade. Especially in the more recent example of DigiNotar and the complexities involved with revoking the digital certificates that were compromised.

A couple of kinks to work out with Convergence is how to address the issue of a website that has 100 different certificates for the same domain. Also, utilizing additional protocols, such as DNS, for endpoints that are in captive portals like those commonly found when registering for Internet access in an airport or hotel.

I leave you with this to ponder. When I asked Moxie Marlinspike what he would like to share with Naked Security readers in a context of authenticity, he replied that you need to ask yourself, "Who do I have to trust?…and for how long?"

Until text time, stay safe and secure online.

Follow @dschwartzberg

View the original article here

Austrian hackers publish private police data

VIENNA (AP) — An Austrian hackers group has published the names and home addresses of nearly 25,000 police officials, a move critics say compromises the individuals' personal security.

Police say the data hacked by AnonAustria contains private information for more than 24,938 law enforcement officials, ranging from beat officers to senior commanders.

Police union official Walter Scharinger said Monday the situation is worrying for officers who might be targets of revenge by criminals they've encountered.

Austria's State Office of Criminal Investigation is looking into the case.

View the original article here

For Hackers, the Next Lock to Pick

SAN FRANCISCO -- Hackers have broken into the cellphones of celebrities like Scarlett Johansson and Prince William. But what about the rest of us, who might not have particularly salacious photos or voice messages stored in our phones, but nonetheless have e-mails, credit card numbers and records of our locations?

A growing number of companies, including start-ups and big names in computer security like McAfee, Symantec, Sophos and AVG, see a business opportunity in mobile security -- protecting cellphones from hacks and malware that could read text messages, store location information or add charges directly to mobile phone bills.

On Tuesday, McAfee introduced a service for consumers to protect their smartphones, tablets and computers at once, and last week the company introduced a mobile security system for businesses. Last month, AT&T partnered with Juniper Networks to build mobile security apps for consumers and businesses. The Defense Department has called for companies and universities to come up with ways to protect Android devices from malware.

In an indication of investor interest, one start-up, Lookout, last week raised $40 million from venture capital firms, including Andreessen Horowitz, bringing its total to $76.5 million. The company makes an app that scans other apps that people download to their phones, looking for malware and viruses. It automatically tracks 700,000 mobile apps and updates Lookout whenever it finds a threat.

Still, in some ways, it's an industry ahead of its time. Experts in mobile security agree that mobile hackers are not yet much of a threat. But that is poised to change quickly, they say, especially as people increasingly use their phones to exchange money, by mobile shopping or using digital wallets like Google Wallet.

"Unlike PCs, the chance of running into something in the wild for your phone is quite low," said Charlie Miller, a researcher at Accuvant, a security consulting company, and a hacker who has revealed weaknesses in iPhones. "That's partly because it's more secure but mostly because the bad guys haven't gotten around to it yet. But the bad guys are going to slowly follow the money over to your phones."

Most consumers, though they protect their computers, are unaware that they need to secure their phones, he said, "but the smartphones people have are computers, and the same thing that can happen on your computer can happen on your phone."

Cellphone users are more likely than computer users to click on dangerous links or download sketchy apps because they are often distracted, experts say. Phones can be more vulnerable because they connect to wireless networks at the gym or the coffee shop, and hackers can surreptitiously charge consumers for a purchase.

There have already been harmful attacks, most of which have originated in China, said John Hering, co-founder and chief executive of Lookout.

For example, this year, the Android market was hit by malware called DroidDream. Hackers pirated 80 applications, added malicious code and tricked users into downloading them from the Android Market. Google said 260,000 devices were attacked.

Also this year, people unwittingly downloaded other malware, called GGTracker, by clicking on links in ads, and on the Web site to which the links led. The malware signed them up, without their consent, for text message subscription services that charged $10 to $50.

Lookout says that up to a million people were afflicted by mobile malware in the first half of the year, and that the threat for Android users is two and a half times higher than it was just six months ago.

Still, other experts caution that fear is profitable for the security industry, and that consumers should be realistic about the small size of the threat at this point. AdaptiveMobile, which sells mobile security tools, found that 6 percent of smartphone users said they had received a virus, but that the actual number of confirmed viruses had not topped 2 percent.

Lookout's founders are hackers themselves, though they say they are the good kind, who break into phones and computers to expose the risks but not to steal information or behave maliciously. "It's very James Bond-type stuff," Mr. Hering said.

A few years ago, he stood with a backpack filled with hacking gear near the Academy Awards red carpet and discovered that up to 100 of the stars carried, in their bejeweled clutches and tuxedo pockets, cellphones that he could break into. He did not break into the phones, but publicized his ability to do so.

He started Lookout in 2007, along with Kevin Mahaffey and James Burgess, to prevent such intrusions. It has free apps for Android, BlackBerry and Windows phones, but not for iPhones. They are less vulnerable to attacks, security experts say, because Apple's app store, unlike Android's, screens every app before accepting it. Also, Android is the fastest-growing mobile platform, so it is more attractive to hackers.

Google says it regularly scans apps in the Android Market for malware and can rapidly remove malicious apps from the market and from people's phones. It prevents Android apps from accessing other apps and alerts users if an app accesses its contact list or location, for instance.

Lookout also sells a paid version for $3 a month, which scans apps for privacy intrusions like accessing a user's contact list, alerts users if they visit unsafe mobile Web sites or click on unsafe links in text messages, backs up a phone's call history and photos, and lets people lock or delete information from lost devices.

T-Mobile builds Lookout into its Android phones, Verizon uses its technology to screen apps in its app store and Sprint markets the app to customers. The cellphone carriers and Lookout share the revenue when a user upgrades to the paid version.

"In mobile security circles, you never wait on it to become a problem and it's too late," said Fared Adib, vice president of product development at Sprint.

Meanwhile, because mobile phone attacks are still relatively rare, Lookout's free app includes tools, including a way to back up a user's contacts and a feature that enables users to turn on an alarm on their phone when it is lost.

"You're way more likely to just leave it in a cab than you are going to be attacked by a hacker," said Mr. Miller, the security researcher.

And in addition to collecting money from paying subscribers, Lookout plans to sell the service to businesses. It has a chance because consumers are increasingly bringing their own technologies into the workplace, and Lookout's app is consumer-friendly, said Chenxi Wang, a security analyst at Forrester Research.

"It's something a lot of I.T. guys are worried about because they have no control over what consumers are doing and what these apps are doing," Ms. Wang said.

Giovanni Vigna, a professor at the University of California, Santa Barbara who studies security and malware, said it was only a matter of time before mobile security was as second nature to consumers as computer security.

"The moment malware starts using text messages and expensive minutes people have to pay for, things will move a lot faster," he said.

First published on September 28, 2011 at 12:00 am

View the original article here

Facebook cookie complaints get the wrong end of the stick

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

The news wires are awash with stories about Facebook, cookies and privacy. The source of all this concern seems to be an article written by self-proclaimed "serial entrepreneur, writer and hacker" Nik Cubrilovic of Wollongong, New South Wales, Australia.

(Old-school network hackers will no doubt remember Wollongong from the University of Wollongong's eponymous and once-widespread TCP/IP software stack.

Newer-school hackers will remember Wollongong as the home of Ashley Towns, author of the first in-the-wild iPhone virus.)

Cubrilovic has enjoyed dramatic media success with his concerns about Facebook cookies, but I think he's been barking up the wrong tree.

The criticisms he makes against Facebook could - and perhaps should, though I don't intend to argue that issue here - be levelled against any website operator that sets long-lived cookies aimed at identifying repeat visitors.

Indeed, cookies are text-based key-value data pairs which are included in HTTP traffic precisely so that web servers can keep track of a a user's browsing session.

By design, HTTP is a stateless protocol. So, if you visit my web page twice in a row, those two requests are entirely independent.

By setting a unique cookie in your browser, which your browser will insert into all subsequent request headers, I can tie those two requests together on my server.

I might not know your identity, but I know it's the same person - or at least the same browser on the same PC - coming back for more. So I can target the content I serve based on your previous browsing history. It might not be you, but it very probably is.

Cookies also permit the concept of a website login: the cookie very conveniently acts as a temporary access ticket to your account, so you don't need to resubmit your login information on every page.

Cubrilovic's critique of Facebook cookies seems to boil down to this: when you login, Facebook sets a bunch of cookies which identify your user ID and authenticate you to act as that user for the current session.

But when you logout, Facebook doesn't unset all of the cookies set at login, so - argues Cubrilovic - you continue to identify yourself to Facebook in all subsequent traffic, even after you've logged out.

So what?

Any website which sets a long-lived unique cookie when you first visit the site can do just the same thing.

Try visiting Apple's website, for example. (I don't mean to criticise Apple, just to pick them as an example because I'm an Apple user, and I have an AppleID.)

On your first visit, Apple will set a browser cookie called s_vi, valid for five years, containing a random-looking string of hexadecimal digits. The value of this cookie is - at least as far as I can tell - unique to each brand-new visitor.

So, next time you login with your AppleID, Apple's backend systems can now tie your general-purpose s_vi cookie to your AppleID.

In other words, Apple "knows" who you are every time you subsequently visit using the same browser on the same PC, even if you never log in again. (More precisely, Apple knows who last logged in to its site from your browser, which very likely was you.)

Cubrilovic has therefore rediscovered that long-lived anonymous cookies, once they've been associated with an exact identity, stop being anonymous.

So, if you're worried about this sort of thing, routinely delete all cookies from your browser. This means that you dispose of all your no-longer-anonymous cookies.

Your favourite websites will no longer have cookie-based history about you, so you'll get newly-generated anonymous cookies next time you visit each of those sites.

Most browsers - Firefox, Chrome, Opera and Internet Explorer, for instance - have an "automatically delete cookies on exit" option. I recommend using it: you don't have to keep remembering to delete old cookies by hand.

Follow @duckblog

View the original article here

Facebook's ticker privacy scare, and what you should do about it

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Amongst the recent new changes to appear on Facebook, there is a "ticker" (a rolling real time list of what your friends are doing).

Not everyone has received it yet, because it's on a staggered rollout, but millions have already seen it.

You'll find it on the right hand side of your Facebook page, in the collapsible chat bar.

It's smashing if you want to keep fully up-to-date with your friends' activity, but there is a problem with it.

The ticker makes it very simple for you to eavesdrop when one of your Facebook friends says something to someone you've never heard of - and even see what the stranger originally wrote too.

Testing shows that your privacy settings are working the same as they did before, providing you used them in the first place.

The appalling enforced eavesdropping in the ticker (your friend said something to someone you've never heard of) is the result of the lax or non-existent settings of your friends, so here's the deal..  
What happens is this:

1. You have "friends of friends" or "public" as the privacy setting for your posts.
2. One of your Facebook friends comments on your post, or clicks "Like".
3. As well as all the people commenting on the thread seeing what has been posted (this much is normal), Facebook also tells all *their* friends what was said.
4. Your friend's settings *cannot* stop this from happening, *your* settings can protect your friends' privacy, in this instance.

The ticker has just made it much easier to eavesdrop on what were probably intended to be more private conversations.
So, do this - and make your friends do it too:

* Stop using the "Friends of friends" setting. This is what is broadcasting so widely.

* If you use the "Public" setting, explain that you are doing so. Then people can decide if they want *all* of their friends to be informed of their comments.

* "Limit" all previous posts you have made via the privacy settings (unless you had "friends only" or specific lists already) - this will change everything to "friends" only and will stop people you deleted but did not block, people who sent you friend requests that you ignored, and friends of friends from seeing your activity (yes they can, if you are not on "Friends" or lists).

* Use lists to decide who you want to see things (use the privacy controls in the top right of your posts).
* Encourage your friends to restrict their setting to "friends" or custom lists too. This is the important bit.

* Inform strangers or the connecting friend when strangers show up in your feed. It is their settings that made them show up. This will illustrate to them why they also need to change their settings.
It is not just your settings that control what goes in your Facebook newsfeed and appears on your friends' tickers. Anyone's posts which have privacy set to more than "Friends" will go to all the friends of all the commenters. This is a fact! We've tested it!

Still baffled?  Don't worry.  The problem is complicated to explain, but the solution is simple.  If you want to stop strangers from seeing everything you do, you and your friends need to change your privacy settings to "Friends" or custom lists.  That's it.

The hard part is getting your friends to do it.  
If you find your friends aren't understanding the issue, forget about explaining the details and "copy and paste" this to your status:

"If you don't want your actions broadcast to everyone via the ticker/News Feed please set your privacy to "Friends" and ask your friends to do the same.  Pass it on."

What *not* to tell your Facebook friends
Now, there is also a piece of advice being circulated which reads like this:

"Please do me a favor and move your mouse over my name here, wait for the box to load and then move your mouse over the "Subscribe" link. Then uncheck the "Comments and Likes". I would really rather that my comments on friends and families posts not be made public, thank You! Then re-post this if you don't want your every single move posted on the right side in the "Ticker Box" for everyone to see!"

This appears to be the most commonly suggested solution on Facebook, and it's rubbish! It still doesn't stop *your* posts being broadcast. It's an illusion. This option stops you seeing when other people have broadcast a message to a wide audience. It does *not* stop your actions being broadcast by your friends!
You have to do this for every single one of your friends. Time consuming *and* it does not solve the problem - it just stops you from seeing it.

Please don't spread this advice, as it is confusing people and stopping the real problem from being fixed.

How to tell if a post will broadcast to all your friends:
Under each post (on the right) there is an icon which will tell you who it was shared with:

Public
The globe icon means that the post is going to be public.

That means, if you comment your friends will be shown the comment immediately and that everyone on Facebook (except those people you have specifically blocked) can see it.

Friends
The icon showing two heads means that the post is shared with friends only.

It should be safe to comment, with no threat of exposure to strangers via the ticker/news feed.

Custom or Friends of Friends
A gear icon can actually mean one of two things - either Custom or Friends of Friends. You will have to hover your mouse over the icon to see which.

Custom means that the post will be safe to comment on with no leakage to strangers via the ticker/news feed.

Friends of Friends, however, can be considered unsafe - as all your friends and all of their friends will be shown the comment immediately via the ticker/news feed.
You can check your own posts easily that way if you want to make sure that your settings are right.

And don't forget - next time you leave a comment on someone else's Facebook post, don't say something that you may later regret.

If you're on Facebook, consider joining the Sophos Facebook page, where you can keep up-to-date on the latest rogue applications, scams and malware attacks threatening Facebook users.

View the original article here

Hackers hit Syrian government websites

**FILE** Syrian President Bashar Assad (Associated Press)

Hackers supporting Syria’s anti-government protesters attacked 10 websites belonging to central or local government ministries, spreading the six month-long bloody rebellion against the dictatorship of Bashar al-Assad into cyberspace over the weekend.

They replaced the websites’ home pages with caricatures of Mr. Assad, videos of protesters, an interactive map showing the names of protesters killed by the Syrian military and links to a page with tips on how to avoid online surveillance by Syria’s intelligence agencies.

“These were beautifully done, skillful hacks,” Jillian C. York, director for international freedom of expression at the Electronic Frontier Foundation, told The Washington Times.

The home pages of the Syrian labor and transportation ministries were replaced by a caricature of Mr. Assad, with a snakelike neck and the caption in Arabic:

“Don’t let Bashar monitor you online.”

The page also contained a link to a set of tips for protesters on avoiding online surveillance by the regime.

Caricatures of Mr. Assad - like most forms of political expression - are illegal under Syria’s emergency law.

The home page of the Ministry of Culture on Sunday showed amateur videos, including one of a popular singer with his throat cut, and another of a respected political cartoonist whose hands were broken. Both attacks were reportedly carried out by pro-government thugs.

The home pages of the seven largest municipalities in Syria were all replaced with an interactive map with the names of more than 2,300 protesters reportedly killed by the regime since the protests began in March.

By Monday afternoon, the central government websites had been repaired and the municipal ones taken off-line altogether.

Ms. York said that, because of the “impeccable English” and high levels of technical skills used by the hackers, “I strongly suspect they had coordinated support from outside Syria.”

“They were definitely executed with more sophistication” than similar hacks on Tunisian government sites earlier this year during the protest wave in that country, she said.

She added that the Syrian attacks looked to her like the work of “people skilled in graphic design, not just hacking.”

The hacks, carried out Sunday, were claimed by the online collective known as Anonymous. Members of the group are being hunted by the FBI and European law enforcement agencies for their illegal hacking activities.

Last year, for instance, the group launched online hacking campaigns in support of the anti-secrecy group WikiLeaks, targeting financial and government websites in Europe and the United States.

Story Continues ?

View Entire Story © Copyright 2011 The Washington Times, LLC. Click here for reprint permission.

Shaun Waterman is an award-winning reporter for the Washington Times, covering foreign affairs, defense and cybersecurity. He was a senior editor and correspondent for United Press International for nearly a decade, and has covered the Department of Homeland Security since 2003. His reporting on the Sept. 11 Commission and the tortuous process by which some of its recommendations finally became ...

View the original article here

Are you in danger of 'drive-by' hacking? - CNN

Who is hacking who? Smart phones can be used to hack other electronic devices without detectionDrive-by download attacks can come from mallicious emails or web pages An Android app can turn a smart phone into a hacking device within minutesPersonal information can then be a riskInformation security experts say many don't see smart phones as at risk

(CNN) -- All the talk of phone-hacking this summer has brought the thorny issue of mobile device security to the forefront of the news agenda.

But even the most scurrilous hack of Fleet Street would be amazed at the talents of the some of the dedicated hackers of cyberspace, who are now targeting mobile devices with great audacity.

iPhones, iPads, BlackBerrys, Windows 7 phones and Android users routinely use shared networks in public places, which leaves them all susceptible to infiltration. Unless these networks have been properly secured, freely available browser add-ons and apps can help hackers seize control of personal data at the touch of a button.

Meanwhile so-called "drive-by download" attacks lie invisibly in wait on web-pages or in malicious emails then compromise the machine of anyone unfortunate enough to visit.

Your Facebook account could be hijacked with someone using little more than a cheap second-hand phone from eBay.
Steve Lord, infosec professional

It means that the person using a laptop in a coffee shop may look like they are just checking their Facebook page, but they might just as easily be accessing yours. They could also be flicking through your contacts book, copying your email, or seizing your online banking details.

At 44Con, a recent security conference in London, a talk by Josh Pennell, the founder of the computer security consultancy IOActive, carried the teaser: "They watch you sleep, they watch you work, they hold all your personal and professional data, and they sacrifice security for performance and usability. Your mobile devices present attackers with a 24/7 threat surface (and don't think the hackers haven't noticed)."

None of the most popular devices are immune. In 2009, for instance, a hack resulted in 145,000 BlackBerry users having their email forwarded to servers in the United Arab Emirates. Pennell also described an attack on the network of an airport in Israel, which threatened anyone using Bluetooth in the terminal.

Pennell showed a battery charger that had been modified to serve as a hacking device, and even spoke of an attack to iPhone and iPad users that came through malicious coding attached to bonus levels of Angry Birds.

According to a recent report, the success of Google's Android operating system has resulted in a 400% increase in Android-specific malware since 2010.

Furthermore a commonly distributed app for Android called FaceNiff actually makes hacking possible through the handset itself.

After a simple download, a FaceNiff user can hijack any number of social media profiles over a Wi-Fi connection in a process that takes less than two minutes.

"Your Facebook or YouTube account could be hijacked with someone using little more than a cheap second-hand phone from eBay," said information security professional Steve Lord.

For all the exceptional sophistication of attacks on mobile devices, however, sometimes the greatest risks to data leakage remain the most prosaic.

Typically users haven't learned to regard their mobile devices as the same risk as computers.
Matt Adams, Deloitte security analyst

"We've seen executives leave laptops on buses or in the back of taxis," said Matt Adams, a manager in Deloitte's security and resilience team. "What they're doing now is potentially leaving their mobile device behind, and those devices now can carry just as much data as the laptop did."

Adams advises businesses on the specific challenges encountered when an executive buys a smart phone or an iPad and begins using it for business as well as pleasure.

Companies will usually have tightly managed internal networks, with firewalls, encryption, etc. for ensuring security of their data. But once executives begin using their own device, and accessing networks elsewhere, the threats multiply significantly.

A recent YouGov study, for instance, found that only around 6% of mobile devices have even basic anti-virus software installed.

"Typically users haven't learned to regard their mobile devices as the same risk," Adams said.

In addition to the simple education of users, Adams advises businesses to develop clear policies governing user-owned devices to avoid difficult confrontations with staff if a device is lost, stolen or compromised.

"If users use a device that contains their personal phone book and treasured photos, and that device also contains sensitive business data, who gets the call on whether the whole of that device is erased?" he said. "That's quite a tricky question in hindsight unless you've addressed it."

Security experts have touted the idea of "split personality" phones, with an inbuilt division between personal and business data. Adams also ran through the pros and cons of mobile device management software, such as Mobile Iron, which allow businesses to keep a permanent inventory and track their registered handsets.

Such systems can manage passwords and encryptions, and even cut down on expenses by finding the best roaming charges for devices overseas. However some employees may feel that their privacy is jeopardized by software that essentially tracks their movement across the globe.

"It is a significant but manageable problem," said Adams, adding that businesses are slowly beginning to talk more seriously about the key issues.

"I just hope we don't see too many major security breaches caused by a failure to manage or use mobile devices properly."

View the original article here

Pentagon Extends Program to Defend Cyber Networks - ABC News

By LOLITA C. BALDOR Associated Press WASHINGTON September 26, 2011 (AP)

The Pentagon is extending a pilot program to help protect its prime defense contractors, an effort the Obama administration can use as a model to prevent hackers and hostile nations from breaching networks and stealing sensitive data.

The move comes as cybersecurity officials warn of increasingly sophisticated cyberattacks against U.S. defense companies, including data related to critical Pentagon weapons systems and aircraft.

Officials at the Department of Homeland Security are reviewing the program, with an eye toward extending similar protections to power plants, the electric grid and other critical infrastructure.

Efforts to better harden the networks of defense contractors come as Pentagon analysts investigate a growing number of cases involving the mishandling or removal of classified data from military and corporate systems. Intrusions into defense networks are now close to 30 percent of the Pentagon's Cyber Crime Center's workload, according to senior defense officials. And they say it continues to increase.

The Pentagon's pilot program represents a key breakthrough in the Obama administration's push to make critical networks more secure by sharing intelligence with the private sector and helping companies better protect their systems. In many cases, particularly for defense contractors, the corporate systems carry data tied to sensitive U.S. government programs and weapons.

Computer hard drives, from closed criminal cases, sit on a shelf waiting to be wiped of information at the Department of Defense Cyber Crime Center in Linthicum, Thursday, Aug. 11, 2011. Hackers and hostile nations are launching increasingly sophisticated cyberattacks against U.S. defense contractors. And the Pentagon is extending a program to help protect its prime suppliers, while serving as a possible model for other government agencies. Pentagon analysts are investigating a growing number of cases involving the mishandling or removal of classified data from military and corporate systems. Defense officials say intrusions into defense networks are now close to 30 percent of the Pentagon's Cyber Crime Center's workload. (AP Photo/Cliff Owen) Close

So far, the trial program involves at least 20 defense companies. It will be extended through mid-November amid ongoing discussions about how to expand it to more companies and subcontractors.

"The results this far are very promising," said William Lynn, the deputy secretary of defense who launched the program in May. "I do think it offers the potential opportunity to add a layer of protection to the most critical sectors of our infrastructure."

He said the program has been able to block hundreds of intrusions into the defense companies, including some that were very sophisticated.

Lynn, who will leave office in early October, said the Pentagon is reviewing the costs of extending the program and so far it does not seem to be prohibitive. He said the government should move as quickly as possible to expand the protections to other vital sectors.

A senior DHS official said no decisions have been made, but any effort to extend the program — including to critical infrastructure — faces a number of challenges.

The official, who spoke on condition of anonymity because the program review is ongoing, said it would be helpful if Congress would pass legislation that explicitly says DHS is responsible for helping private sector companies protect themselves against cyberattack. Also, the legislation should say that companies can be protected from certain privacy and other laws in order to share information with the government for cybersecurity purposes, the official said.

Senior U.S. leaders have been blunt about the escalating dangers of a cyberattack, and have struggled to improve the security of federal networks while also encouraging the public and corporate America to do the same.

"Cyber actually can bring us to our knees," said Adm. Mike Mullen, chairman of the Joint Chiefs of Staff, adding that at some point the Pentagon may need to develop some type of governing structure similar to how the U.S. and allies monitor and limit nuclear weapons.

View the original article here