"Death and Taxes"

As every Security Professional knows, phishing is a problem. Let's first take a step back. Phishing is the act of sending an email or placing a phone where the attacker pretends to be a legitimate company to get your information. You generally see emails like "Your Ebay account has been disabled. Click here and enter your account info to reactivate".When you click on it, it takes you to the attacker's site and he/she has your account info.

Well, those dirty attackers are at it again. This time they are posing as the IRS. here is a sample of an email you may receive:

After the last annual calculations of your fiscal activity we have determined that
you are eligible to receive a tax refund of $268.32.
Please submit the tax refund request and allow us 3-6 days in order to
process it.

A refund can be delayed for a variety of reasons.
For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here

Note: For security reasons, we will record your ip-address, the date and time.
Deliberate wrong inputs are criminally pursued and indicated.

Regards,
Internal Revenue Service

© Copyright 2007, Internal Revenue Service U.S.A. All rights reserved.

________________________________________________

Turns out, when you click on that link. It takes you to a Russian site. Last time i checked the IRS didn't have a Russian Branch.

Click here for the article.

New York subpoenas Facebook over user safety

State's attorney general says Facebook ignored complaints about sexual predators


How many of you know someone that is underage and use Facebook? I bet, over half of you do. It is one of the biggest growing online social networks. It is met to be for college students, but there are many users that are young and vulnerable to sexual predators. Facebook has apparently done nothing to make sure that children and young teens are not solicited by pediphiles. It also, contains many graphic pornographic images and videos readily at anyone who uses the network's disposal.
The attorney general of New York (Andrew Cuomo) and other law enforcement officials have been conducting investigations on these claims. They posed as children from ages 12 to 14 and made accounts. During their investigation they found that Facebook did not have any type of indentifying information to set up these accounts. They also were solicited by a number of adults thinking they were children. They found tons of pornographic images and videos that anyone could view, that had an account. Nobody has been able to get any comments from Facebook.
When they tried to contact Facebook posing as children that had been solicited by online predators and the parents of the children they recieve little response. When they did respond they took very long to do so. Once, they responded they took some of the images off the site, but did nothing about various pornography that was being hosted by users of the site or children being solicited by pedophiles.
Andrew Cuomo has issued a subpoena requiring Facebook to turn in all complaints that have been made about the material and solicitation of children. They also must now respond to these issues as well by law. Those of you who have children can image how important it is to take action against this issue. They could be the ones that are actually being solicited by sexual predators on Facebook, or looking at the junk the users put up there. And, if your a legitamate Facebook user that is of age, you will probably see more restrictions on what you can post and what is allowed to be in your profile. You may also have to provide credentials verifying your identity. Like in many cases there are going to be restrictions set, because people are not being responsible and abusing the site.

Mortgage data leaked over file network

A disgruntled employee strikes again... A former employee of ABN Amro
Mortgage Group put up a spreadsheet with more than 5,000 Social
Security Numbers on the file sharing network 'BearShare'. A Pittsburgh
based company called Tiversa Inc., discovered that the path came from
an ABN Florida computer that had ShareBear installed on it. It was
then discovered to be traced from the employees home computer. It is
now believed that identity theives have these SSN numbers and plan to
use them in their favor. ABN says that it plans to further investigate
the issue.

Future Mobile Phone Attacks Inevitable

Within the new technology rising in mobile phones, so is the possibility for an attack. According to researchers at McAfee, mobile malware attacks are not yet popular. The key word there was “yet”. The mobile phone industry really has hit a large boom in terms of smartphones. The phones most consumers and businessmen are using today are not the old-fashioned flip phone, but a device which can do more than just make telephone calls. Currently today Microsoft has a mobile platform called Windows Mobile. They just currently released a new version called Windows Mobile 6. Apple’s IPhone is a similar device offering web browsing, word document editing, and customers to purchase items through their phone. Researchers predict within the next few years the attacks will become large on mobile phones. Many of the phones right now have Wi-Fi built into them for fast internet browsing. This poses a threat in the same way a regular computer would be connected to the internet. Even though it is a mobile phone it is connecting to servers and getting information from another source. Right now this source is trusted, but cybercriminals are beginning to work on ways to hack important information from the mobile phone. Text messages, phone books, important spreadsheets are all types of information that could be intercepted and stolen. A good rule of thumb would be to know the websites you are visiting through the mobile web browser. This will allow the average user’s phone to remain safe, and always remember never give out important information to an unauthorized source.

Cough Up the Dough or Your Email Gets It

Jesse Sklar found himself in a predicament when he noticed that not only was he locked out of his hotmail account, but there was also someone holding it for ransom at one hundred dollars. While Sklar states that he no longer uses the email account on a regular basis, it contains many passwords and other crucial information dealing with his finances.

When it came to his account on Ticketmaster.com or Amazon.com and the like, Sklar soon came to realize that the credentials for these accounts and various others could be compromised and decided to change them immediately. While he implemented the security measures that hotmail has all users place, such as a security question and a backup email -- this was useless for Sklar due to having signed up for the hotmail service decades ago, as he recalls. All he really wants is for the email to be shutdown. Upon later inspection, the kidnapper asked Sklar to send the information via "Paypalll.tk" which is some sort of phishing scam that may result in Sklar losing more than one hundred dollars had he decided to give the money.

If there's anything to take out of Sklar's story, it is not to make the same passwords for everything, as well as not storing crucial information in your emails -- especially one that is a free service.

via WashingtonPost.com

Do not be a Victim of Social Engineering

In the past few months, not only was Monster.com attacked but also was Ameritrade. In both situations most of the information that was reported stolen by these companies were names and email addresses, not extremely confidential information but, a starting place for scammers out there that would love to steal your identity. In the case of Ameritrade, they found out their database has been breached by a few of their customers because they had received junk mail they felt was unusual to be receiving and reported it to the company. Once Ameritrade investigated it, they determined there was a breach in to their database exposing information about 6.3 million clients.
It is very important now for customers to be aware of the type of emails they get from Ameritrade and do not give out any additional information about themselves in these emails. In most cases, the cyber thieves will be trying to send phishing emails that look very real and will be trying to get the recipients of these emails to provide personal information to be used to try to steal their identity for the thieves’ individual use or to sell to others and make money. Ameritrade should be advising their clients never to give out personal information via emails but if they have not advised their clientele of these standards the client themselves needs to be very careful and call Ameritrade directly if they feel something is not right. Social engineering is very difficult to stop and anybody is capable of social engineer because it does not require technical knowledge so as the consumer you must be aware and careful to protect yourself against a social engineering attack.

New Zero-Day Hole in Windows XP

Brand new “zero-day” vulnerability has been discovered in XP. It hasn't been made official yet but a hole was discovered by Jonathan Sarba of GoodFellas Security Research Team. The hole is vulnerable to a buffer overflow attack that exploits an HP All-in-One Series Web Release software/driver installer (version 2.1.0) and an HP Photo & Imaging Gallery (version 1.1) program. The flaw is considered fairly critical because, when exploited, it could lead to a complete compromise of a PC. Microsoft was made aware of the hole back in June but is still investigating it further, so no patch or workaround has been released as of yet. If you are running either of these pieces of software on your PC or on your network, please be aware of any unusual activity and maybe stay away from using those versions of the HP drivers and programs.
For more information, check out the original article by clicking this hyper link http://blogs.pcworld.com/staffblog/archives/005477.html

The Assault on Privacy by Technology in Modern Times

The controversial issue of privacy is coming to the forefront more and more often in our modern civilization. As technology evolves, so does the need for redefining how privacy is handled by big business, government agencies, and individuals themselves. In this information and technology driven society, keeping your personal information private is more important than ever. Currently, personal information is being bought, sold, exchanged, and stolen in a public environment (at an alarming rate) with both good and bad intentions via the Internet. In the book Database Nation, Simson Garfinkel (who writes a monthly column for CSO Magazine and has a multitude of computer science degrees from MIT) discusses how the main issue of privacy involves the civil rights of people to be in charge of their own information about their life and to develop a system that protects that right of privacy. Garfinkel also agrees that without privacy protection, this country could slip into an “Orwellian” state of mind, whereas nothing about our lives will be private, not even our thoughts.
Conversely, that same right to privacy, that we enjoy so much, could also leave us vulnerable to terrorism by protecting terrorists’ rights of privacy. This would hinder or prevent our local and federal law enforcement agencies’ ability to investigate people who may be planning terrorism activities. Advocates on this side of the coin might say “Maybe if there was less privacy among citizens of the United States, then disasters such as 9/11 might not have ever happened?” This might be true, but for every one successful terrorist attack that slips through the cracks; there are hundreds of others that were foiled before they could carry out their plan.
As it stands, technology is one of the primary factors involved in the invasion of privacy. One of the most popular ways of invading someone’s privacy, using this technology, is to track their Internet surfing habits. This can tell you all that you need to know about that person. Just imagine if you are out on Saturday afternoon and you had to run some errands or do some shopping and you had someone following you around everywhere. They would have a pretty good idea of what type of buying habits and interests you might have. Then, they would collect this information and sell it to the highest bidder. This is where we’re heading to if we don’t nip this situation it in the bud, so to speak.
This same technology that can invade our privacy can also help to protect it. When your computer is filled with spy-ware, viruses, and Trojans, it’s almost as if you’ve been cyber-mugged. It’s no different than being mugged on the street. The thief can get away with your money, identity, and your privacy without ever having to leave their house. If you clean your computer’s cache on a daily basis, run an internal/external firewall, and have an up-to-date anti-virus and anti-spyware programs running at all times, you can avoid being tracked and mugged online. Now, the tables have turned as you can use some of the very same type of tools that were used to attack you can now be used to conceal and protect your privacy.
If we change one of our fundamental civil rights, then we are letting the terrorists know that they are succeeding. Their realization of this success may increase the volume and number of terrorists’ attacks. If we don’t do something about the protection of our privacy on the Internet; big business, smalltime hackers, and the government will enjoy an unregulated free-for-all with all of the private information that they are able to collect on us. If we choose to continue down this path, eventually we will get to a point where privacy will be a thing of the past and all of our hopes, dreams, and aspirations will be for sale to the highest bidder. So, Big Brother, how much private information would you like to buy today?

Judge Rules Against Parts of the Patriot Act

The government’s second attempt to rewrite the U.S. Constitution has failed. U.S. District Judge Victor Marrero has ruled against the rewritten USA Patriot Act, saying that it "offends the fundamental constitutional principles of checks and balances and separation of powers." The main area of concern is that the FBI is allowed to demand private customer records from businesses, without a court order, which is required for searches done by the United States government. This completely bypasses the judiciary branch of the government and is absolutely unconstitutional.
In an investigative situation, the government can order NSLs or national security letters which is an investigative tool that is used by the FBI to get businesses to turn over private customer information. The most controversial and sought after private customer information would be that of Internet service providers, telephone companies, and public libraries. Not only will the businesses have to turnover the private information but they would have “the right to remain silent” about informing their customers that it was turning over records to the government. The FBI is arguing that phone or Internet records are "relevant to an authorized investigation to protect against international terrorism or clandestine intelligence activities." That might be so but that is not a good enough reason to change the very values that this country was founded upon. Has anybody in the Executive Branch of the government even read the Constitution? Apparently they have not.
For more information, check out the original article by clicking this hyper link http://www.msnbc.msn.com/id/20624404/wid/11915829

Online crooks getting more professional

Computer criminals are making money be selling pre-made software to
other computer criminals. Symantic Corp. has reported that middlemen
are buying malicious software and spam in order to distribute it to
consumers in hopes, in some cases, to steal identities, and important
information. There programmers are getting contracts with the
middlemen in order to frequently distribute the software as soon as a
new program is created. On a lighter note, Symantic says that because
of the contracts, it may be easier to track the path from the
distributer,and perhaps even the creators of the software.

Google to call for web privacy shake-up

Millions of people use Google, everyday to conduct searches for websites, news, images, maps, and just about anything else you can find on the web. In the past they have had a bad reputation in the privacy area. What does this have to do with you? In the past it has been pointed out that they weren't keeping our (the average users) personal information too private. Well, they are now taking steps to ensure that our information doesn't fall into the wrong hands.
Friday, Google plans to propose that there be new international privacy laws made. This would help keep your personal information from the eyes of others. Google's global privacy counsel (Peter Fleischer), says that the OECD or some other international body, should develop new international privacy guidelines. The Organisation for Economic Co-Operation and Development is a international organisation that deals with issues having to do with economic growth.
Google is trying to restore the image they have had due to past criticism. Since, the European Union data protection bodies pointed out that Google stored your personal information for way to long. They were also criticised by Privacy International as being really bad in the department of keeping personal information, personal. Google also has made changes to the length of time they store personal information to 18 monthes. They are also working with Privacy International to regain face.
Fleischer is going to protest that the Internet privacy rules are out of date and need to be replaced with new ones. There hasn't been changes in it since 1995 which is 7 years ago so much innovation has happened since then. He is going to suggest that they use privacy rules Asian ministers established the Asia-Pacific Economic Co-operation conference in 2004 Of course these international rules would be more unspecific and would allow each nation to decide how to enforce them.
I don't know about you but if this plan is implemented and they update the privacy laws, I will feel a little more ease when using the Internet, with my personal information. This is one step in the battle of keeping you the customer safe from crimes such as identity theft, and other attacks on your information. Every time you go on the web at least some of your information is sent out to the world, what's to keep it from falling into the wrong hands? This is definitely a positive development for web users, no matter who you are.

You're Right, Your Computer Does Have a Mind of its Own

"Over the last few weeks, without user approval, Windows Update has updated nine small executable files in both Windows XP and Windows Vista"

Sure, I guess you could say this might be fine seeing as the updates are coming from a trusted site, and while it may be a little sketchy to update your computer without your consent it was for a good reason, right? Maybe so, but imagine if Microsoft's Windows Update feature was compromised by an a person of ill-intent.

The updates in question turned out to be critical updates for Windows Update to function properly, but this still left customers confused as to not having prior knowledge or ability to consent with their releases.

For an operating system that throws in a couple of mundane text bubbles and alerts for even the slightest event, this sure is un-Microsoft-like.

via InformationWeek

“There is a place in New Zealand called…”

Taumatawhakatangihangakoauauotamateaturipukakapikimaungahoronukupokaiwhenuakitanatahu. It’s also true that on September 10th the New Zealand government’s computer systems was breached.

From the article: “New Zealand Prime Minister Helen Clark confirmed Tuesday that foreign spies had tried to hack into government computers but said they had not found out any state secrets. The Dominion Post newspaper quoted Tucker saying government departments' websites had been attacked, information stolen and hard-to-detect software had been installed which could be used to take control of computer systems. There was evidence foreign governments were responsible for the attacks, he said, but did not name the countries concerned, although he did refer to comments by Canada's security service about Chinese spying activities. Reports have also alleged China hacked into government computer systems in the US, Germany and Britain.”

Pretty crazy, eh? I know when most people think about hacking they think about corporations getting attacked or maybe you hacking your buddy’s machine. But can you imagine government verses government attacks? Holy Government Espionage, Batman!

You’ll find the full article here.

Is your laptop as secure as it could be?

Currently most people not only have desktop computer but also laptops. For the most part our desktops are somewhat more secure than our laptops because they are in our homes and they in most cases are not wireless. Our laptops are like our cellular phone they go everywhere with us because we can do work at home, the office, traveling, or even coffee shops. Laptop theft is very common and here are a few tips to keep you from being a victim of theft. When I say theft, I mean it could involved the physical laptop being stolen or data extracted from you laptop.
One of the most important things never to do not only with laptops but also with any computer you use is leaving your password on or around the computer itself, do not leave a sticky note posted on it with your password. When you are using your laptop away from home, make sure that, you do not sit it down anywhere and accidentally forget it. Unfortunately people do make this mistake for instance when you go through security lines at the airport and you are trying to get all your bags sometimes important things such as your laptop get left behind. There are locks you can buy security cables to prevent help deter theft. Another important issue is that your data should be encrypted since there is always the possibility of the laptop being forgotten somewhere or even stolen like mentioned above. Many people have sensitive even classified information on their laptops and it needs to be secure. Many different software companies sell encryption software. The last tip would be to purchase tracking software, there are companies out there such as LoJack that you buy a yearly subscription and if the unfortunate happens and your laptop is stolen, these companies are able to track your computer and locate where it is working closely with the local police departments. These are reasonably easy things to do to keep your property safe. It is better to be safe than sorry.

You May Secure Your System, But Does the Goverment

Following 9/11, security became a major issue for the United States government. From airports to shipping ports, regulations were passed and scrutiny increased. However, cybersecurity, one of the biggest threats to national security, has been largely ignored. Every year 24 governmental organizations are graded based on their compliance with the Federal Information Security Management Act (FISMA). In 2006 the overall grade was a C-. While this was actually an improvement over the initial D given out in 2003, eight departments still received F’s and one, the Department of Veterans Affairs, didn’t even bother to submit an audit report. In fact the Department of Homeland Security itself only received a D in the 2006 audit.

The reason that these abysmal grades should matter to the general public is that it is their information and safety that is at risk. A study found that the Department of Homeland Security’s travel database, which contains sensitive personal information, has a number of significant security holes that leave all of its data open to attack, possibly without anyone ever knowing. However this is better than the Department of Energy, which sent classified information over the Internet.

These flaws have already resulted in major security breaches. The Department of State was hacked. The attackers installed remote access software and stole passwords and classified information. Attacks based out of China have also successfully infiltrated a number of departments including the Department of Commerce and just in the past week reports have indicated that the Chinese government was involved in an attack on the Pentagon’s computers. (http://www.securityfocus.com/news/11485). These are not isolated problems. There have been 844 significant incidents in the past two years alone. If the government truly wants to improve security, cybersecurity needs to become a focus.


See http://www.securityfocus.com/news/11472 for more information.

Pentagon email System Breached

Last week, the Pentagon released information stating that an unclassified email system had been hacked. The system was immediately taken off line, and did not fully come back for three weeks. There was a lot of speculation that the Chinese government, as well as the Chinese People's Liberation Army were responsible for the attack, though there is no evidence. A Beijing spokeswoman said that it is all speculation, and the Pentagon has not said anything one way or another. Though the information was not released until last week, the invasion happened last spring. It was also noted that there was no threat to the classified system. There was also a security hack with with information pertaining to the German government, who also claimed that China was responsible. China denied this claim as well. The Pentagon has attempted hacks everyday with many failures to get in. There was no information on how the hacker had gotten as far as they did.

Unsafe ATI Drivers

Earlier this week it was discovered that ATI’s most recent drivers loaded on to many different laptops worldwide, are causing a security-hole leaving Vista’s kernel wide open for attack. ATI created a kernel called “Astive” which essentially validates ATI drivers; bypassing Windows driver signing. Blackhat hackers soon discovered ways to exploit this bug, allowing them to send out their own drivers with a hidden payload. Windows could easily fix this problem with a simple patch, but they are refusing to do so. In order to fix the problem they would make thousands of laptops useless until their users find the appropriate drivers to install. Windows is not yet confident in the end users capability to install a driver. My question is that now that windows has put out over 20 different operating systems for users across the world; why haven’t we seen them rip of the package manager from Linux operating systems. They took the GUI from their Macintosh counterparts, but they couldn’t take something that actually does have a use for the end user? It would solve many different problems with their OS by keeping all of their end users drivers, applications, and OS up to date. It is the answer to their little end user problem.

Check out http://blogs.techrepublic.com.com/tech-news/?p=1035 to find out more.

Got Spam? What about full control?

For the past nine months there has been a vicious worm attacking Microsoft platform machines. This worm has been named the “Storm worm”. Storm worm is designed to turn computers of unsuspecting users into zombie machines. It does this by attracting people through bogus e-mail messages which include conformation messages, e-cards and even promising free MP3 downloads or free pornographic pictures and movies. Every time someone clicks on the provided link, the Storm worm downloads malware and turns their machine into a zombie machine.

It all started back in January with only a few thousand attacks registered. As of August 22, 2007 there has been a record of 57 million virus-infected messages sent across the internet. Ninety-nine percent of these messages were traced to the Storm Worm. It is estimated that there are between 5,000 and 6,000 zombie computers being used to send out all the spam messages, a fraction of the computers that have been compromised by the Storm worm.
The creator of the Storm worm is using these infected computers to build the world’s largest botnet. It is estimated that there are 50 million computers associated with this malicious computer grid. With this many computers tied together as one, the botnet could easily overpower the world’s top 500 supercomputers. Also, with this much power, the creator of the Storm worm could bring a country to its knees with ease by launching distributed denial of service attacks against its government, utilities companies and serve providers. These people could do catastrophic damage if they wanted to and is quite scary when you think that this much power is in the hands of criminals.

To make things even more difficult, the botnet knows when its network is being scanned with antivirus or anti-malware software. When the botnet senses that it is being scanned; it seeks out the system that is performing the scan and launches a massive denial of service attack on that computer or network. Again scary since we don’t have any defense against the Storm, but yet in a strange way, very ingenious. A malicious network that protects itself by attacking the attacker (anti-malware scans), it’s like sending a virus a virus but vice versa.

You can read all the articles about the Storm Worm at the following site: http://www.itnews.com.au/BriefingCentre/3,virus-alerts.aspx

Judge rules against FBI data-gathering tool

Wednesday, one of the key parts to the USA Patriot Act was shut down. This act was developed, so that the FBI could investigate anyone who was suspected to be a terrorist, after 9-11. Under this act the FBI could issue a National Security Letter, to a business to get records regarding their clients online activity, if they were suspected of terrorism,spying, or what not, they did not need a warrant to issue these letters, just suspicion, which can be abused. Judge Victor Marrero found that it is unconstitutional to intrude on people like that without evidence and that there needs to be checks and balances. This means that a judge must first issue the subpoena, before they can get information. This is a good thing, because now they cannot abuse this and look at personal information, without good reason. Before, they could have got our personal information for no reason at all if they wanted and now they cannot.

Bringing Technological Innovations to the Workplace: Headaches for IT

"Companies can't depend wholly on policy to maintain the level of security they need," states Brandel in The 8 Most Dangerous Consumer Technologies. Brandel identifies 8 technologies that have slowly crept into the workplace that could potentially be a threat to you and the business you work for (or own!).

The list ranges from instant messaging to web mail, as well as virtual worlds (such as Second Life) and VoIP services (i.e. Skype). Some insight into solutions for the problems have been from using third party instant messaging software to using an internal server dedicated to Instant Messaging or, for the hassles of VoIP control -- blocking a particular service altogether.

Regardless of the setting, the uses of the 8 mentioned risks could be harmful even when in use at your own home, on your own personal computer. In order to maintain your personal level of privacy, make sure to be educated and aware of threats that you are exposing yourself to, and how to mitigate them.

via ComputerWorld

Software companies can call software whatever they what.

What is wrong with calling “spyware” spyware? Absolutely nothing, according to the Communications Decency Act section 230. Section 230 of the Communications Decency Act states that “no service provider is liable for a good faith attempt to restrict access to something it deems objectionable.

Many security companies are being sued for just for that reason, calling certain pieces of software “spyware”. The companies that are creating this “spyware” are suing security companies for blocking or restricting access to their software, arguing that it is NOT spyware. However, if the service provider (Security Company) feels that the software is objectionable, then they can call the software whatever they what and get away with it.

Go to: http://www.techdirt.com/articles/20070830/003443.shtml to read the whole article.

Face Off

What will they think of next? NEC, a Japanese computer manufacturer, will be releasing two new laptops in late September with the latest in computer authentication: Facial Recognition. That’s right! These consumer laptops will use facial recognition to gain access to the machine. Insert technical jargon here: “NEC’s software, called "NeoFace," is a biometric system that uses a combination of eye zone extraction and facial recognition to identify the computer’s user. To program the system, a user sets up a profile with three photographs of their face. Then when a user tries to log on, an integrated 2.0 megapixel camera scans their facial characteristics.”

English please! What that was saying was that computer has a tiny camera that measures different parts of your face and uses those distances to come up with a “geometric” password. They say the system is smart enough to perform accurate matching even when people wear glasses and hats, have different haircuts or facial hair, and show different facial expressions.

What does this mean to me in the security field? I’ll tell you. We’ve all cracked a few passwords in our day. Fingerprint scanners are nice, but it’s still fairly easy to get someone’s print and make a cast of their finger. But how in the world do you get a hold of someone’s face!? Unless you go Sean Archer/Castor Troy on someone, this is incredibly secure.

Check out the full article here.

Facebook no longer private

Facebook is a social networking site used by high school and college students to keep in touch with friends they go to school with and friends at other schools. You also can meet people with similar likes and interests at other schools around the country. It has been considered more private than the more popular social networking site called MySpace. However, Facebook Inc. has decided to allow non-registered guests to be able to view profiles of members without actually providing your information to become a member. This opens the risk of people being able to get personal information about individuals registered on the Facebook site. Students using this service need to make sure and be careful about information they post since even more individuals will have easier access to whatever members post about themselves. Even scarier is the fact that Facebook Inc. engineer Philip Fung states that in the coming weeks not only will non members be able to access information they will be making profiles searchable through search engines such as Google and Yahoo. Individuals must be aware of these new changes and might want to consider changing their privacy settings that will make their profiles not searchable to everyone. Facebook feels that these new imp limitations will allow for a greater amount of people to reunite and make Facebook a larger community by the assumption that if people search and find others they know they will decide to join the Facebook population.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9034538&taxonomyId=17&intsrc=kc_top

Would You Give Your Email Password to Facebook.com? Most Users Would.

Debates over sites like facebook.com are common and something many people, especially the kids who love it and their parents, are familiar with. Newsweek recently ran a cover story[1] that covered everything from its “coolness” factor to the concerns that the online community is actually creating teenagers who are unable, or at least uninterested, in actual face-to-face social interaction. What is rarely discussed in relation to this site, and others like it however, is the security threat it can represent to its users.

Facebook, like a growing number of other respected websites, actually asks for both new users’ email addresses and email passwords as part of the registration process. They use the information to send invitations to other users and stress that providing the information is optional. What is scary is that in a study, 41 percent of the 200 users contacted willingly offered up not only their email information, but also their phone numbers and dates of birth. Considering that facebook.com profiles regularly contain cell phone numbers, employment information, and home addresses this probably shouldn’t be surprising but it should raise concerns. Kids are failing to learn basic security measures and are giving out information that used to be considered private to anyone who is interested. Facebook.com may be a respectable site but many others aren’t. Habits are hard to break, and it is important that the correct ones be formed before it is too late. It can be hard, if not impossible, to tell the difference between a legitimate site and one that is a scam looking for easy targets.

See http://www.eweek.com/article2/0,1895,2179213,00.asp for more information.
[1] http://www.msnbc.msn.com/id/20227872/site/newsweek/

Microsoft to release major Vista update

In the beginning of 2007, the latest operating system from Windows was
released, Windows Vista. Vista had received its fair share of
criticism due to the way the operating system was built, as well as
how there many reported glitches. But now, Windows will be offering
the first service pack for Vista within the first fiscal quarter of
2008. Microsoft says that it will begin to test the service pack soon,
and then plans to give it a limited release before 2008. Microsoft
will also be releasing the third service pack for XP, the OS that
precedes Vista, also in 2008. The Vista service pack is said to
improve the operating system's security, reliability and performance,
but it will not change the product's look or add any major features.

Hack hit embassy, government e-mail accounts worldwide

A freelance security consultant discovered usernames and passwords for email accounts belonging to embassies and government agencies worldwide. The login details for agencies such as Iran's foreign ministry, Kazakh and Indian emabassies in the U.S., and Russia's embassy in Sweden where found and posted on the Internet by Dan Egerstad. He claims he was conducting an experiment and accidentally stumbled upon the information. After, he found the logins and such he forwarded an email that was from a person declining an invitation to the Russian embassy, which was emailed to an employee, at the Russian embassy. Although, some of the agencies that were involved failed to comment on the breach in information security, the Russian embassy has confirmed that the leak has indeed occurred, and measures have been taking to fix the situation. There has been no specifics on where this list is actually posted for the obvious reasons. Let's just hope the parties that haven't admitted that they have been breached have also, taken the measures to remedy the weakness. If this information could be found so easily, do you really think that your information is safe? If, the government cannot keep its information safe then that, just shows you ours in not any safer. They I am sure have taken many measures to keep this from happening, much more than a typical user would, so do you feel your safe from this happening to you?

How to Remove Spyware From Your PC

With all of the trojens, viruses, and spyware (oh my!) that are out there, sometimes knowing how you were infected is not quite as important as getting rid of the unwanted intruders. In the article, “How to Remove Spyware from Your PC” Andrew Brandt of PC World dives into the wonderful world of malicious software removal. Lately, removing these uninvited guests has become somewhat more difficult because “some types of spyware download and install additional components, often hiding pieces of code from Windows to make removal even harder.” This “How to” type of article provides a blueprint for removing all types of malicious programs.

The first step is to “Make Sure It's an Infection” because all too often, slow computers will just simply have too many applications running with too little system memory available to use or have a full or fragmented hard drive. The next step is a “Manual Analysis” of any of the spyware programs that are left over from the initial removal scans. Essentially, you need to find out exactly what it is before you can remove it. And the final step is to “Remove the Reprobates” from your PC using the removal program Hijack This. This step must be done carefully because if you remove the wrong component, you can render your PC unbootable.

Prepare for the Courtroom

In this article, Greg Lawn of SC Magazine details the need to be prepared when any IT department is required to bring evidence to a courtroom for any sort of case.

He starts by noting that there has been a steady increase in the amount of corporate litigation in the past decade, and that it is still continuing. He also states that this trend has been accelerated and perhaps magnified in severity due to changes in the Federal Rules of Civil Procedure.

He goes into detail in regards to what steps you should take to help find a middle ground in certain cases where attorneys are involved. They may be required to view confidential files and the like, if the case requires them to be presented as evidence. Lawn describes to the reader how they should go about making these files presentable in the courtroom and to the attorneys.

Later on, Lawn discusses five points for IT managers to consider when preparing for such cases, and what you should remember about the data you are presenting.

Using this article, even an IT Professional entering the courtroom for the first time can make themselves seem like a seasoned veteran and more importantly, help you provide the information that is required in an orderly and timely manner.

More browser bugs, but less risk?

The title of this article when you look at it seems like it is hard to believe. In all reality it is possible that even if a browser has more bugs in it, it may be less of a risk for a target of attacks. There are far more options for browsers today on the market. Internet Explorer was the most widely known internet browser and then came along Mozilla Firefox which has gotten a lot of attention today in the market. Internet Explorer 6 SP2, Mozilla Firefox 1.5.0, and Opera Opera 8.0.0 were studied and all used about the same amount of time. It was rather interesting though, because there were about twice as many vulnerabilities for Firefox 1.5.0 than there was for Internet Explorer SP2. Internet Explorer was nearly comprised over 200 times while Mozilla and Opera were not touched at all. This just seems rather interesting since there were bugs found in the Firefox browser, but it was never invaded. Internet Explorer has a greater share in the market but in the near future Firefox could be a possible standard. With a large number of additions to it and the increased safety more people are starting to use this browser. A fully-patched version of Internet Explorer 6 visited 2,289 malicious, sites while the other browsers were not attacked. People should be aware of these types of vulnerabilities because an internet browser is something that everyone uses on a day to day basis, and by knowing the type of sophistication of the attacks or threats coming to it will help you protect your machine in the long run. The most current versions of browsers are Internet Explorer 7.0, Firefox 2.0.0.6, and Opera 9.23.