Posts belonging to Category Security News

IBM distributes malware-infested freebies at AusCERT

IBM “pulls a Telstra,” red faces everywhere…

By Patrick Gray

May 21, 2010

Risky.Biz has confirmed IBM staff distributed malware-infected USB drives at the AusCERT security conference this week.

In a highly embarrassing admission, the company has sent a broadcast e-mail to all AusCERT attendees warning them of the security lapse.

“At the AusCERT conference this week, you may have collected a complimentary USB key from the IBM booth,” the message reads. “Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected.”

IBM is not the first company to distribute malware at AusCERT — Australian telco Telstra did exactly the same thing in 2008.

Risky.Biz confirmed the authenticity of the e-mail message with IBM.

For more on AusCERT, visit Risky.Biz

Stolen Hard Drive Puts Data from 5,418 Patients at Risk

On April 1st a hard drive was stolen from the mammography suite of The Medical Center at Bowling Green. The missing drive contained information on 5,418 patients who had undergone bone density testing between 1997 and 2009–including names, addresses, birth dates, physician names, medical records, and possibly Social Security numbers.

Of course the data was not encrypted or protected on the drive itself, placing it at risk of exposure to anyone who happens to examine the contents of the drive. The medical center managed the investigation internally for 17 days before notifying authorities and turning the case over as a criminal incident. At that point, it also began to notify the affected patients.

Looking at the positive side of the incident “Since the theft occurred, hospital officials have taken steps to strengthen the security of patient information and that includes linking to a secure network eliminating the need for computer hard drives, such as the one that was stolen.”

This entry was posted on Friday, April 30th, 2010 at 10:02 am and is filed under Security Breaches & Data Loss Incidents.

For more, visit Zecurion

Facebook, MySpace caught releasing user data

— Brett Michael Dykes is a national affairs writer for Yahoo! News.

Fri May 21, 5:47 pm ET

In a seemingly never-ending string of damaging disclosures about its users’ privacy concerns, Facebook has reportedly been releasing user data to ad companies that hadn’t even asked for the info.

Facebook isn’t alone this time: rival social-media site MySpace has also been called out in Friday’s Wall Street Journal report by Emily Steel and Jessica E. Vascellaro — together with the content-sharing sites Livejournal and Digg.

The report says that the companies have delivered user data to major online advertising companies such as Google’s DoubleClick and Yahoo!’s Right Media, despite explicit pledges to protect such information. The released material includes user names and ID numbers, together with data that could be used to accumulate a host of additional information on individual users, such as where they live, their names, occupations, incomes and places of employment.

Read more at Yahoo! News.

Facebook fixes bug that allowed friend deletion

By Robert McMillan  –  May 21, 2010 08:21 PM ET

IDG News Service – Facebook has fixed a flaw that let hackers delete Facebook friends without permission.

The flaw was reported Wednesday by Steven Abbagnaro, a student at Marist College in Poughkeepsie, New York. It was patched Friday afternoon, Pacific time, after the IDG News Service notified Facebook of the issue.

The bug was a variation of an earlier vulnerability that Facebook learned about last week, which affected a range of features on the Web site. Hackers could have leveraged Abbagnaro’s bug to delete all of a victim’s contacts, one by one, but it does not appear that anyone ever exploited it in a malicious way.

For Abbagnaro’s attack to work, however, a user would have to have been tricked into clicking on a malicious Web link while still logged into Facebook.

For more  visit Robert McMillan at

Judge Permanently Shuts Down ISP Catering to Spam, Porn

By Grant Gross, IDG News

A U.S. district court judge has ordered the permanent closure of an Internet service provider long accused of hosting and distributing spam, spyware, child pornography and other illegal content, at the request of the U.S. Federal Trade Commission.

Judge Ronald Whyte of the U.S. District Court for the Northern District of California in San Jose has ordered that the computer servers and other assets owned by Pricewert, doing business as, be sold by a court-appointed receiver. Whyte also ordered the company to turn over US$1.08 million in illegal profits to the FTC, according to court documents.

Whyte’s orders, dated April 8, were made public by the FTC Wednesday.

Several security experts supported the FTC’s case against 3FN, Whyte wrote in a disgorgement order. “These experts had analyzed data derived from internet searches which establish that defendant, an internet service provider, was engaged in widespread illegal activity,” he wrote. “There seems to be little doubt from the information provided that Pricewert functioned primarily as an internet service provider for illegal activity.”

There were a “relatively small number of apparently legitimate customers” of the company, Whyte wrote.

For more, visit PC

Facebook identifies hacker selling 1.5 million accounts

17 May 2010

Reports are coming in that Facebook has identified the self-proclaimed hacker who was offering to sell batches of 1000 Facebook accounts – up to 1.5 million in total – and it appears that the Russian hacker was wildly overstating the account numbers.

Weekend newswire reports say that the hacker, who is known as Kirllos, had succeeded in hacking into a number of Facebook accounts, which he planned to sell via online hacker forums.

However Facebook has told reporters that the Russian hacker was significantly overstating his account haul.

Robert McMillan of the IDG newswire quoted a Facebook spokersperson as saying: “We have determined Kirllos’ identity through IP addresses, online accounts, and other information and believe that he’s very likely a low-level actor.”

McMillan says that Kirllos had been selling batches of 1000 accounts at between $25 and $45 a batch.\

For more, visit

Nov. 10-11, 2010

Sheraton New York Hotel & Towers, New York City

Malware is as stealthy and dangerous as it has ever been. Vectors for data leakage continue to increase by the day. Compliance demands are growing in prevalence and, often, complexity. Budgets remain tight as the economy struggles to regain its form.

What is an information security professional to do? Here to help is the pre-eminent conference and expo for IT security pros, back for its third year.

The SC World Congress, to be held Nov. 10 and 11 at the Sheraton New York Hotel & Towers in Manhattan, will bring together security practitioners to discuss the emerging risks they face and the solutions to help solve those threats. Attendees will walk away with technical tips and practical documents and templates that they can immediately apply to their organization.

So stay tuned, right here, for more details!

In the meantime, our call for papers is now open: Learn how to be a presenter or speaker.

And if you are interested in exhibiting, take a gander at the conference brochure.

In addition the Security Innovators Throwdown is back – find out more HERE

For more information, visit SC Magazine online

Symantec Will Centralize Encryption with Acquisitions

Mark Long, – Fri Apr 30, 2:44 pm ET

Symantec said Thursday it will pay $370 million in cash to acquire encryption technology providers PGP and GuardianEdge Technologies, with the deals expected to close during the company’s June quarter. Symantec sees its acquisition of standards-based encryption capabilities from the two firms as a natural extension of its strategy for securing and managing information on any device — across both the enterprise and consumer segments as well as in the cloud, said Symantec CEO Enrique Salem.

“With PGP and GuardianEdge’s encryption solutions for full-disk, removable media, e-mail, file, folder and smartphones, Symantec will have the broadest set of integrated data-protection capabilities,” Salem said. “We will be able to address the encryption needs of all customer segments from the largest enterprises and governments to small businesses and individuals.”

Expanded Opportunities

Together, PGP and GuardianEdge are expected to significantly expand the addressable security market that Symantec can serve, Salem told investors during a Thursday conference call. “State and national governments are enacting more stringent mandates, driving the need to encrypt sensitive information and protect an individual’s privacy,” Salem said. “Also, the increased costs and frequency of data breaches are driving the adoption of encryption as companies strive to mitigate risk and protect their critical information from cybercriminals.”

Read the full article at Yahoo! News

Jury convicts on 2 charges in Palin e-mail hacking

Apr 30 03:48 PM US/Eastern – By BILL POOVEY – Associated Press Writer

KNOXVILLE, Tenn. (AP) – The son of a Democratic Tennessee lawmaker was convicted Friday on two charges in the hacking of Sarah Palin’s e-mail account while she campaigned on the Republican presidential ticket in 2008.

The federal court jury reached its verdict against David Kernell, 22, after four days of deliberation. He was found guilty of obstruction of justice and unauthorized access to a computer, but was acquitted on a charge of wire fraud.

The jury deadlocked on a charge of identify theft. Prosecutors reserve the right to have a new trial on that charge. The charge of obstructing an investigation carries a maximum 20-year prison sentence and unauthorized access to a computer is a misdemeanor that carries a maximum one-year sentence.

Kernell’s defense attorney maintained the hack amounted to college prank, not a crime. Kernell was a student at the University of Tennessee at the time. Prosecutors argued it was a more serious effort to damage Palin’s political campaign.

Continue reading at

Apple iPad Used As Scam Bait

Cybercriminals are sending out malicious e-mail that targets iPad users, a sure sign that the device has been selling well.

By Thomas Claburn –  InformationWeek – April 26, 2010 01:57 PM

Apple’s continuing success as a company is encouraging more cybercriminals to try to exploit the popularity of the company’s products to distribute malware.

The latest such scam involves spam e-mail messages addressed to iPad users. The messages direct recipients — who may or may not be iPad users — to click on a Web link that appears to host an iTunes update and to install the update.

The text isn’t so poorly written as to be farcical. Even so, the use of the passive voice in the first sentence and the awkward wording suggests that the note’s author doesn’t work as a marketing professional at Apple or anywhere else.

“There were released updates for software installed on your iPad device,” the message begins. “It is very important to keep the software on your iPad updated for best performance, newer features and security.”

Read the full article at