Author: admini

Bills could make businesses do more to prevent ID theft

Posted on by admini

The Wall Street Journal reported recently that security breaches exposing customer data have triggere
d lawsuits across the country. The Federal Trade Commission says 9 million Americans had their identities stolen last year, costing businesses and consumers $50 billion a year in fraudulent spending.

Last month, U.S. Rep. Artur Davis, D-Birmingham, co-sponsored the Consumer Data Security and Notification Act of 2005, along with Democratic Reps. The bill provides stronger consumer protections and enforcement against credit-card fraud and identity theft by expanding federal protections against improper collection and sale of sensitive consumer information. It also provides consumers with advance warning when their personal information is at risk. Davis was joined at a recent press conference at Birmingham Police headquarters by several attorneys general who outlined the challenges they face fighting ID theft. Among Davis’ supporters was Birmingham Police Chief Annetta Nunn, who said someone recently stole a credit card mailed to her home and ran up thousands of dollars in charges. “Congress needs to strengthen federal standards to provide more rigorous safeguards against the rising problem of identity theft,” Davis said.

Also in July, a Senate Commerce Committee unanimously approved a bill that would clamp down on how corporations handle consumers’ personal information. The Identity Theft Protection Act would require nonfinancial companies, such as data brokers, that handle sensitive personal information to ensure its security and confidentiality with safeguards specified by the Federal Trade Commission. If the security is breached and the company determines it creates a “reasonable risk” of identity theft, the company would have to notify affected consumers or face fines of up to $11,000 per consumer. Ted Stevens, R-Alaska, who chairs the commerce committee, said the full Senate will not vote on the Identity Theft Protection Act until he completes negotiations on a jurisdictional dispute with Senate Banking Committee Chairman Richard Shelby, R-Tuscaloosa.

The Alabama Republican has asserted jurisdiction over sections of the Senate Commerce bill that deal with the Fair Credit Reporting Act. The American Banker recently reported that Shelby is drafting a bill that sources speculate may bar financial services companies from using service providers that do not follow strict data security standards. Gardner said recent high-profile data security breaches have exposed the vulnerability at many U.S. companies. “Identity theft is a major problem and businesses must adjust to prevent it,” he said.

http://www.al.com/business/birminghamnews/index.ssf?/base/business/11243568066180.xml&coll=2

Read more

Hackers’ Prowess on Display at Defcon Conference

Posted on by admini

Defcon is a no-man’s land where customary adversaries — federal agents vs. digital mavericks — are supposed to share ideas about making the Internet a safer place.

This year’s hot topics included a demonstration of just how easy it may be to attack supposedly foolproof biometric safeguards, which determine a person’s identity by scanning such things as thumb prints, irises and voice patterns.

Banks, supermarkets and even some airports have begun to rely on such systems, but a security analyst who goes by the name Zamboni challenged hackers to bypass biometrics by attacking their backend systems networks.

Radio frequency identification tags that send wireless signals and that are used to track a growing list of items including retail merchandise, animals and U.S. military shipments– also came under scrutiny. A group of twentysomethings from Southern California climbed onto the hotel roof to show that RFID tags could be read from as far as 69 feet (21 meters). That’s important because the tags have been proposed for such things as U.S. passports, and critics have raised fears that kidnappers could use RFID readers to pick traveling U.S. citizens out of a crowd.
RFID companies had said the signals didn’t reach more than 20 feet (six meters), said John Hering, one of the founders of Flexilis, the company that conducted the experiment.

An annual highlight of the conference is the “Meet the Feds” panel, which this year included representatives from the FBI, NSA and the Treasury and Defense departments. Morris and other panel members said they would love to hire the “best and brightest” hackers but cautioned that the offer wouldn’t be extended to lawbreakers. During the session, Agent Jim Christy of the Defense Department’s Cyber Crime Center asked the audience to stand.

Some federal agents were indeed taking careful notes, though, when researcher Michael Lynn set the tone for the conference by publicizing earlier in the week a vulnerability in Cisco routers that he said could allow hackers to virtually shut down the Internet. That flaw was patched in April, but Lynn showed that Cisco hadn’t quite finished the repair job — that the same technique could be used to exploit other vulnerabilities in Cisco routers. Cisco and ISS went to court to try to stop Lynn from going public, but Lynn quit ISS and spoke anyway.

“We’re never going to secure the Net if we don’t air and criticize vulnerabilities,” said David Cowan, a managing partner at venture capital firm Bessemer Venture Partners.

During a session on ATM machines, Morris said thieves have been able to dupe people out of their bank cards and passwords by changing the software in old ATM machines bought off eBay for as little as $1,000 and placing the machines out in public venues.

http://www.technologyreview.com/articles/05/08/ap/ap_080405.asp

Read more

Government, Financial Top Targets Of Security Attacks

Posted on by admini

The government sector was the most targeted industry, with more than 54 million attacks, while manufacturing ranked second with 36 million attacks, financial services was third with approximately 34 million, and healthcare was hit with more than 17 million attacks – accounting for more than 137 million of all attacks this year.

IBM has seen a resurgence of targeted phishing attacks for money laundering and identity fraud purposes, believed to be largely driven by criminal gangs that have become more astute in the creation and delivery of such attacks.

According to its latest Global Business Security Index, in the first half of the year, there were more than 35 million phishing attacks launched to steal critical data and personal information for financial gains. Spawns of phishing threats such as ‘spear phishing’ – highly targeted and coordinated attacks at a specific organisation or individual designed to extract critical data – increased more than ten-fold since January of this year alone.

Unlike in previous years, when viruses were mainly created and launched to slow down and cripple IT systems, these types of ‘customised’ attacks have shown their potential to defraud businesses, steal identities and intellectual property and extort money, while damaging the brand and eroding customer trust.

The ratio of spam to legitimate email continuously decreased over the course of the last six months, from 83 percent in January to 67 percent in June 2005, while virus-laden email increased fifty percent over the same period. At first glance what appears to be good news, the levelling off of massive outbreaks that cripple IT environments on a regional or global basis in the past six months seemingly indicates that hijacking computers to send spam is no longer the network disruption of choice.

“IBM advises its clients to rapidly adopt a holistic, enterprise-wide approach to security and risk management,” said John Lutz, general manager, Financial Services Sector, IBM. “To protect their critical data, infrastructure, brands, and money, IBM advises businesses to rethink how they protect their operations, business processes and governance structures.

http://www.ebcvg.com/articles.php?id=825

Read more

Apple adopts controversial security chip

Posted on by admini

The computer that ships in the kit features a security chip called the Trusted Platform Module (TPM). The TPM is an open industry standard governed by the Trusted Computing Group, a non-profit organisation which develops security standards. Apple did not respond to questions about the TPM in time for this story’s posting.

The chips inclusion with the new Apple hardware doesn’t come as a complete surprise. It has been previously suggested that Apple could use the TPM to prevent that computer users install the OS X operating system on a non-Mac PC such as a models made by Dell or HP.

“The TPM is going to be the barrier for moving the Macintosh software to any PC,” Martin Reynolds, a research fellow with analyst firm Gartner told vnunet.com. Each TPM chip contains an encrypted serial number that allows the operating system to verify if it’s running on Apple made hardware. Hackers in theory could forge the serial number, said Reynolds, fooling the software into believing that its running on Mac hardware even when it isn’t.

The security chips currently are included with some PCs for the enterprise market from IBM/Lenovo and HP. They use the TPM to security store passwords or encrypt data.

The upcoming Windows Vista relies on the TPM for a technology dubbed Secure Startup, which blocks access to the computer if the content of the hard drive is compromised. This prevents a laptop thief from swapping out the hard drive, or booting the system from a floppy disk to circumvent security features.

In the future software developers could also use the chip as an anti piracy device, Reynolds suggested. The vendor then would link the TPM identification number to the software registration key. But the TPM has also gained notoriety because it is seen as a way to invade the user’s privacy. The identifying number build into the chip can be used to limit the fair use of digital media by enforcing digital rights management technologies, or could track users online. The fear of such scenarios however is overstated, said Reynolds. Privacy infringing schemes are uncovered sooner or later at great expense to the computer maker. “There are things that manufacturers could do with the TPM that is very much against the interest of the user. But in practice, the manufactures have found that it is best not to do that.”

http://www.vnunet.com/vnunet/news/2140687/apple-embraces-controversial

Read more

Fighting The New Face of Fraud

Posted on by admini

“There are a couple of drivers that are convincing the banks to start rethinking some of their fraud management strategies,” Garcia says.

While some “new” fraud simply relies on technology to commit old types of fraud in different or faster ways – for example, the use of e-mail rather than traditional mail to commit “Nigerian banking fraud” – new technology-enabled scams also are emerging. One method that banks are adopting to battle such fraud is multiple-layer authentication, according to Bill Harris, chairman of PassMark Security in Redwood City, Calif. “The banking industry has spent the past year-and-a-half determining what is the biggest problem – keylogging, phishing, e-mail or something else,” he says. “Traditional authentication methods aren’t enough,” he asserts.

As a result, banks are using a greater array of information and multifactor analysis to lock down systems when fraud schemes are detected, Harris adds. User names and passwords should be supported in Internet banking transactions with new and better ways of authenticating genuine customers and identifying fraud artists trying to take over bank accounts, according to the summer update on identity theft from the Federal Deposit Insurance Corp. The extra security for online accounts often takes the form of multifactor authentication, which is used in addition to traditional passwords. The added security layers often include tokens issued to customers that generate new, random passwords every 60 seconds; software that can identify the computer from which a user is attempting to access an online account; or contacting customers by phone to make sure they legitimately are attempting to access their accounts.

In bust-out schemes, perpetrators wait until the victims have built up a significant credit profile with their banks, then use stolen ID information to “bust out” with an auto loan or some other type of credit and leave town, explains Garcia.

http://www.securitypipeline.com/167100429;jsessionid=U0KPRT5ITUVFWQSNDBCCKHSCJUMEKJVN

Read more

Mixed reaction to New Zealand spam bill

Posted on by admini

Norris also says only 10% of spam originates in New Zealand and the bill is aimed at reinforcing international law.

Internet New Zealand’s Executive Director Pete Macaulay says with around 80% of emails being spam, it is important to free up the internet. But he says the bill puts an unfair emphasis on Internet Service Providers for enforcement.

http://tvnz.co.nz/view/page/411419/600773

Read more