Author: admini

High-tech border pass raises alarm

Posted on by admini

US-VISIT uses biometric information from photos and fingerprints taken from non-Canadians at border crossings to track residents from other countries who enter the U.S. Travellers required to use the technology include landed immigrants living in Canada, Canadian citizens who are either engaged to a U.S. citizen or who have applied for a special business visa. They’ll have to carry the wireless devices as a way for border guards to access the electronic information stored inside a document about the size of a large index card. Visitors to the U.S. will get the card the first time they cross the border and will be required the carry the document on subsequent crossings to and from the States.

Border guards will be able to access the information electronically from 12 metres away to enable those carrying the devices to be processed more quickly.

Kimberly Weissman, spokeswoman for the US-VISIT program at the U.S. Department of Homeland Security told The Whig-Standard yesterday that the new devices can’t be tracked outside the border crossing area. “The UHF frequency that we’ve chosen makes it impossible to locate a specific person.”

But the use of the wireless technology raises alarm bells for Queen’s University law professor and privacy expert Art Cockfield. “Often these technologies are introduced in a fairly minor form and then the technology is extended.What would be very troubling to me would be the tracking of visitors after they’ve crossed the border.” Cockfield, who’s part of a Queen’s research group called the Globalization of Personal Data Team, said he’s so alarmed by these new devices that his team will likely investigate them further after learning about them yesterday.

Though the new devices don’t violate Canadian law, because visitors are under the jurisdiction of American law once inside the U.S., Cockfield said their use raises disturbing questions about how the technology may be used in the future. “If we think we’re subject to government surveillance, that immediately changes our behaviour,” he said. Sam Laldin of Kingston and District Immigrant Services also agrees that requiring non-Canadians to carry such electronic devices may deter some people from travelling to the U.S.

http://www.thewhig.com/webapp/sitepages/content.asp?contentID=119603&catname=Local+News

Read more

The Next Big Corporate Benefit: Identity Theft Protection

Posted on by admini

Like any other critical enterprise risk, identity theft has reached a point where it makes sense for companies to provide a corporate benefit to protect employees and the company itself. As anyone who has had his or her identity stolen can relate, the experience is both memorable and rehabilitating. It has become so pronounced that volunteer programs in some states, like California, have set up centers whose full-time role is to help people get back on their feet. One of these organizations, the ID Theft Resource Center, recently identified a new and vicious type of theft: identity theft of children.

It is a growing concern as an underage child is typically not in the market for credit lines, and so the problem could go undiscovered until the child applies for that first car loan or school loan. Their credit could be permanently damaged, creating serious problems for them much later on in life. For adults identity theft can mean weeks and months of time spent closing bogus accounts, contacting creditors, and correcting credit reports. During this time, the adult, who is typically also someone’s employee, is clearly not focused on his or her job or much of anything else. Remember, until the ID issue is cleared up, their home may be at risk, their cars could be repossessed, and they may be unable to effectively pay bills. There will be no higher priority for them and, from the viewpoint of their company, they are just as unavailable, perhaps even more so, then if their home was lost or they had critically ill family member.

It is part of a corporation’s responsibility is to ensure the continued productivity of its workforce and healthcare benefits certainly speaks to that. In 2003, the Identity Theft Resource Center published a detailed report noting the impact of identity theft. The organizations that the victim must turn to often seem to treat that victim very poorly.

Financial Identity Theft: This is where a victim’s social security number is stolen and used to open a series of fraudulent accounts ranging from loans (particularly lines of credit and credit cards), leases (cars and apartments), checking accounts, and telephone services.

Criminal Identity Theft: This is where the identity is stolen and used by a criminal in place of their own so the crime tracks back to the victim not the criminal.

Identity Cloning: In this scenario, the identity thief actually uses the victim’s identity to get paperwork, credit lines and pay rent. The thieves are often used illegal immigrants, felons, people avoiding judgments (like child support), and anyone hoping to leave their ‘old life’ behind.

http://www.securitypipeline.com/166402571

Read more

Microsoft enlists security partner in IE update

Posted on by admini

Microsoft released a beta version of the new browser, also known as IE7, this week to a select group of testers. The company plans to release a second beta version for the general public to test before shipping the final version.

WholeSecurity, which is privately held, is helping Microsoft assemble and maintain a list of verified phishing sites, also known as a blacklist. When people try to visit a Web site on the list, IE7 automatically warns them via a dialog box that the site is fraudulent and suggests they “not continue to this Web site.” At that point, people can close the Web page, or continue on if they choose.

WholeSecurity, via a project called the Phish Report Network, has thousands of Web sites in its blacklist and adds more all the time from the hundreds of new sites that contributors flag daily, said John Ball, senior product manager at WholeSecurity. Microsoft helped the company launch the Phish Report Network in February, along with Visa, eBay and eBay’s PayPal unit, which all help to build and maintain the list.

Microsoft isn’t the first company to build antiphishing features into a Web browser, nor is it the first to tap an outside security company for help with the task. America Online’s Netscape unit introduced a new version of the Netscape browser in May with a similar feature. The company has compiled its own blacklist with the input of parent AOL, nonprofit privacy group Truste, VeriSign and security software company Paretologic.

A U.K.-based browser company called Deepnet Technologies claims to have been the first to incorporate antiphishing mechanisms into a browser when it released Deepnet Explorer in December.

But with close to 90 percent market share in the United States, Microsoft is certainly the biggest browser company to attack phishing. Yet, the company doesn’t expect its latest efforts to bring an end to these scams. “Does having a police force wipe out crime?” said Gary Schare, Microsoft’s director of IE product management. “It’s a tall order to say this will wipe out phishing.”

Other browser companies applauded Microsoft’s antiphishing moves and agreed that it’s a hard problem to tackle. The Mozilla Foundation has decided not to incorporate antiphishing technology into its increasingly popular Firefox browser, opting instead to focus on the e-mail side of the problem. An upcoming version of Mozilla’s Thunderbird e-mail program is designed to alert users to messages containing links to phishing sites, said Chris Hofmann, director of engineering at the Mozilla Foundation. E-mail is the way most phishers lure people to their sites.

Microsoft is doing something similar with its Hotmail service. If a suspicious e-mail arrives, the test version of Hotmail does not display the e-mail but rather warns users that the e-mail appears to be potentially fraudulent and asks if they want to block or allow e-mails from the sender of the message.

The Thunderbird program will rely on a tool that automatically analyzes the attributes of links, rather than on a blacklist, Hofmann added. “The large volume of content, and the dynamic nature of the Web, make managing a list of potential phishing sites an incredibly hard job,” he said.

That challenge is one reason Microsoft has signed up with WholeSecurity to manage the blacklist for IE7, Schare said. It will also encourage browser customers to report suspicious sites directly to Microsoft via a button in the new browser. The company has the ability to update the list every 20 minutes, he added. That’s critical, because phishing attacks often come and go within a matter of hours.

Microsoft is assembling a “whitelist” of legitimate sites, too, that the browser won’t bother sniffing out on a regular basis, which should save on network cycles. But phishers are already learning how to work around some of the simpler methods being used to thwart them, said Deepnet Chief Executive Yurong Lin. For instance, more phishers are registering domain names for their sites rather than using numeric Web addresses, he said. Lin believes it’s a response to the fact that Deepnet’s browser has been warning people that sites lacking domain names are suspicious. “The phishers will find some other way,” Lin said. “There are antispam programs, and spam still exists. We have anti-spyware, and spyware still exists.”

http://news.com.com/Microsoft+enlists+security+partner+in+IE+update/2100-1029_3-5809417.html?part=rss&tag=5809417&subj=news

Read more

Survey: Hackers Target Flawed Backup Software

Posted on by admini

More than 422 significant new Internet security vulnerabilities emerged in the second quarter of 2005, the cybersecurity research organization found, an increase of 11 percent from the first three months of the year.

Particularly troubling are holes in backup software made by Computer Associates International Inc. and Veritas Software Corp., which together account for nearly one-third of the backup-software market, said Ed Skoudis, founder of the security company Intelguardians. Fixes are available for all the problems outlined in the SANS report, but many of the new flaws aren’t fixed as quickly as older ones.

Administrators take an average of 62 days to fix backup software and other software inside their firewall, compared to an average of 21 days for e-mail servers and other products that deal directly with the Internet, said Gerhard Eschelbeck, chief technical officer of business-software maker Qualsys.

Home users typically take even longer to fix problems, said SANS chief executive Allan Paller. Many of the new flaws were found on products popular with home users. Flaws in media players like Apple Computer Inc.’s iTunes and RealNetworks Inc.’s RealPlayer could enable a hacker to get into a user’s computer through a poisoned MP3 file. Users of Microsoft’s Internet Explorer Web browser could be compromised simply by visiting a malicious Web site, SANS said. Even the open-source Mozilla and Firefox Web browsers, which has gained in popularity thanks to security concerns, had flaws as well, Paller said.

http://www.eweek.com/article2/0,1895,1840577,00.asp

Read more

Security holes add up in second quarter

Posted on by admini

This represents an increase of 10.8 percent compared with the number found in the first quarter, and a jump of 20 percent compared with the second quarter of last year, the institute said in its quarterly report.

If companies and individuals don’t take corrective action, the agency warned, their systems could be used by remote hackers for identity theft, industrial espionage, and distribution of spam and pornography.

In order to be included on the quarterly list, the vulnerabilities must affect a large number of users, the SANS Institute said. Additionally, they must allow an attacker to take control of a PC remotely, and they must remain unpatched on a substantial number of systems. Information sufficient to let people exploit the flaws must be available on the Net.

Among the flaws are serious vulnerabilities in popular data backup products used by enterprises, while home users face increased risk from holes in iTunes and RealPlayer, as well as Internet Explorer. “These include backup software, management software, licensing software, etc. Flaws in these programs put critical resources at risk, as well as having a potential to compromise the entire enterprise.”

http://news.zdnet.com/Security+holes+add+up+in+second+quarter/2100-1009_22-5803078.html?part=rss&tag=feed&subj=zdnn

Read more

USB Devices Can Crack Windows

Posted on by admini

The buffer-overflow flaw is in device drivers that Windows loads whenever USB devices are inserted into computers running Windows 32-bit operating systems, including Windows XP and Windows 2000, said Caleb Sima, chief technology officer and founder of SPI Dynamics. The company will be demonstrating the vulnerability at this week’s Black Hat Briefings hacker conference in Las Vegas, but will not release details of the security hole, Sima said.

A spokesperson for Microsoft’s Security Response Center confirmed that the company has not received a vulnerability report from SPI.

For example, an attacker who knows of a vulnerability in a USB device driver can program one USB device—say a portable memory stick—to pose as the kind of device that uses the vulnerable driver, then plug the device into the host system and trigger the exploit when the host system loads the flawed driver, said Darrin Barrall, another SPI researcher.

Companies like Microsoft are just beginning to consider the security threat from peripheral devices, even as developments like the USBIF’s Wireless USB standard will make it possible to remotely connect to PCs using high-speed, USB-based technology, Sever said.

At Baptist Memorial Healthcare Corp., in Memphis, Tenn., IT administrators turned to Safend after some departments in the hospital network, such as Human Resources and Risk Management, started using portable USB “jump” drives to make backup copies of sensitive data after the hospital introduced new desktop systems that did not have floppy drives, said Lenny Goodman, director of the desktop management group at Baptist.

http://www.eweek.com/article2/0,1895,1840141,00.asp

Read more