Security News

Computerworld: "Update: Heartland breach shows why compliance is not enough"
"Nearly a year after Heartland Payment Systems Inc. disclosed what turned out to be the biggest breach involving payment card data, the incident remains a potent example of how compliance with industry standards is no guarantee of security."

SearchSecurity: "Heartland breach shows PCI compliance is not enough"
"Heartland, one of the USA's s largest payment processors, had achieved PCI compliance. Yet the breach could be the largest ever, trumping that of TJX Cos. when 45 million credit and debit cards were pilfered by hackers who accessed the retailer's Wi-Fi systems."

Times Union: "Hacker steals $3M from Duanesburg schools"
"The thefts occurred between Dec. 18 and Dec. 21. The district's bank, NBT Bank, noticed the questionable money transfers on Dec. 22 and alerted the district, Superintendent Christine Crowley said."

SecurityFocus: "Zeus software behind one-in-ten botnets"
"Zeus, also referred to as Prg and Zbot, has become a popular amongst cybercriminals as a way to steal victims' financial information. Last month, a Zeus-based command-and-control server was found on a server instance hosted by Amazon cloud computing service, EC2. The discovery came a few days after one security firm warned Internet user that spammers where attempting to infect recipients with the Zeus bot."

KRVG.com: "Medical Records Found [in street]"
"Jose Diaz's walk to the grocery store led him to files with names of people, their address, phone number and social security numbers. Diaz was with his nephew walking down this street when he spotted the pile of papers blowing in the wind."

The Boston Globe: "Data breaches affect million state residents"
"One million Massachusetts residents - or 1 in 6 people - have had their credit card numbers, medical records, or other personal information leaked or stolen over the past two years, according to records provided to the Globe by state officials."

SC Magazine: "Waldec [botnet] spreading through fake New Year's e-cards"
"The botnet is spreading spam messages that contain the subject line "Happy New Year 2010" and provide a link for what the email claims to be a New Year's greeting card, Mikko Hyppõnen, chief research officer at anti-virus provider F-Secure, told SCMagazineUS.com on Thursday.  The campaign began early Thursday."

The Seattle Times: "Hacker may have accessed EWU student information"
"Eastern Washington University is trying to notify up to 130,000 current or former students whose names, Social Security numbers and dates of birth were on a computer network involved in a security breach."

USA Today: "Cybercrooks stalk small businesses that bank online"
"A rising swarm of cyber-robberies targeting small firms, local governments, school districts, churches and non-profits has prompted an extraordinary warning. The American Bankers Association and the FBI are advising small and midsize businesses that conduct financial transactions over the Internet to dedicate a separate PC used exclusively for online banking."

eSecurity Planet: "Penn State Latest University Plagued by Data Breaches"
"Penn State University gave its students an unwelcome gift over the holiday break, notifying some 30,000-plus students that a series of malware-induced data breaches at computers hosted at three different campus locations had exposed their personal information for an unknown period of time."

National Post: "Too much trust put in social networking sites..."
"Social media exploded in 2009 with Facebook alone amassing 350 million users this year. The report indicates social media will continue to grow in 2010, as businesses start to realize the value of engaging with social media. The newest threats are hackers who steal webmail or social networking accounts and then use contacts lists to extort money from other users, Mr. Stern said."

JusticeDept.com: "CDC Phishing Scam"
"Fraudulent emails referencing Centers For Disease Control (CDC) sponsored State Vaccination Program."

News4Jax.com: "Dentist's Account Missing Nearly $400K"
"I've been saving for 30 years of working and they wipe me out in a matter of weeks."

DarkReading: "Intel Website Hacked With SQL Injection"
"A Romanian hacker who goes by the handle "unu" has struck again: This time, he demonstrated how a SQL injection vulnerability left personal information in the form of passports exposed on an Intel Website. Unu, who previously exposed SQL injection vulnerabilities in The Wall Street Journal and Kaspersky Lab's Websites, this time focused on an Intel site that runs online registrations for channel partner events."

FayObserver.com: "N.C, Community College library server hacked"
"Nearly 51,000 people in North Carolina are finding out that about four months ago someone hacked into a library server containing their personal information.  Megen Hoenk, a spokeswoman for the state Community College System, said the hacker did not access Social Security numbers or driver's license numbers, which were stored on the server."

Idaho State Journal: "Phishing scam nets unwary E. Idaho bank customers"
"Citizens Community Bank officials say that on Thursday they discovered customers were being directed to a fake Web site that looked like the bank's official Web site. The bogus site asked customers to verify information by submitting their debit card number, expiration date, and personal identification number."

Security Fix: "Hackers exploit Adobe Reader flaw via comic strip syndicat"
"Rose Croke, brand development manager for King Features, said the malicious code was somehow injected into the company's Web server that handles content for its Comics Kingdom clients. Croke said the Comics Kingdom content is syndicated by roughly 50 different news sites, including Timesunion.com."

Wall Street Journal: "Insurgents Hack U.S. Drones"
"Militants in Iraq have used $26 off-the-shelf software to intercept live video feeds from U.S. Predator drones, potentially providing them with information they need to evade or monitor U.S. military operations. "

IDG News Service: "Heartland pays Amex $3.6M over 2008 data breach"
"Heartland Payment Systems will pay American Express $3.6 million to settle charges relating to the 2008 hacking of its payment system network. "

Washington Post: "House takes steps to boost cybersecurity"
"House leaders have asked the chamber's security officials to implement a new cybersecurity training regimen for aides and take additional measures to protect sensitive information from potential hackers."

Washington Post: "Hackers target unpatched Adobe Reader, Acrobat flaw"
"Adobe Systems Inc. said Monday it is investigating reports that attackers are exploiting a previously unidentified security hole in its Acrobat and PDF Reader software to break into vulnerable computers."

Security Focus: "SQL attacks take off in last year"
"In May 2008, IBM's customers encounters about 2,500 SQL injection attacks every day. By midsummer 2009, the technology giant's product were seeing 600,000 database attacks per day on average, said Tom Cross, a security researcher at IBM. "

Reuters: "Cisco, Juniper gear vulnerable to hacking: U.S. govt"
"The U.S. government has identified flaws in equipment from four companies, including Cisco Systems Inc (CSCO.O), that hackers can exploit to break into corporate computer networks."

Washington Post: "Paper-based data breaches on the rise"
"More than one quarter of data breaches so far this year involved consumer records that were jeopardized when organizations lost control over sensitive paper documents.  Experts say those incidents came to light in large part due to a proliferation of state data breach notification laws, yet current federal proposals to preempt those state measures would allow paper-based breaches to go unreported."

ZDNet: "Zeus crimeware using Amazon's EC2 as command and control server"
"Security researchers have intercepted a new variant of the Zeus crimeware, which is using Amazon's EC2 services for command and control purposes of the botnet. The cybercriminals appear to be using Amazon's RDS managed database hosting service as a backend alternative in case they loose access to the original domain, which would result in the complete loss of access to the compromised financial data obtained from the infected hosts."

Washington Post: "La. firm sues Capital One after losing thousands in online bank fraud"
"An electronics testing firm in Louisiana is suing its bank, Capital One, alleging that the financial institution was negligent when it failed to stop hackers from transferring nearly $100,000 out of its account earlier this year. "

DarkReading: "The IPS Goes Virtual"
"Intrusion protection system (IPS) technology is gradually adapting to virtual computing, as IPS vendors add to their product lines actual virtual IPSes as well as IPSes that protect virtual machines."

Computerworld: "HSBC exposed sensitive bankruptcy data"
"In notification letters made public Thursday, the bank said it had redacted sensitive information in Chapter 13 bankruptcy proof-of-claim forms that were filed electronically, but that the information turned out to be viewable "as a result of the deficiency in the software used to save imaged documents." "

Computer World: "Botnet continues massive H1N1 malware campaign"
"A massive spam campaign that poses as a message from the Centers for Disease Control (CDC) asking people to register for H1N1 vaccinations remains a big problem today, a security researcher said."

Security Fix: "DC businessman loses thousands after clicking on wrong e-mail"
"The latest victim to learn this was Nigel Parkinson, president of D.C.-based Parkinson Construction, a firm with an estimated $20 million in annual revenue that has worked on some of Washington's top gathering places, including the new D.C. Convention Center and the Nationals baseball stadium."

Washington Post: "Hackers attempt to take $1.3 million from D.C. firm"
According to this recent article by Brian Krebs cyber attackers appear to be focusing heavily on property management and real estate firms, and title companies.

Boston Globe: "Sandwich loses nearly $50k to hacker"
"Police believe the hacker used a virus to attack Treasurer Craig Mayen's computer and implant a logger that monitored any keystrokes he entered. With technology similar to what is known as a sniffer, a device that tracks computer information, the hacker was able to record Mayen's security code and password as he typed them, and used that information to make withdrawals from town bank accounts."

DarkReading: "New Exploit Masquerades As Flash Player Upgrade"
"Users who click on the link are taken to a Website that advises them to update to the latest version of the Macromedia Flash Player by downloading "flashinstaller.exe." This executable is actually a banking Trojan that is known to disable firewalls, steal sensitive financial data, and provide hackers with remote access capabilities..."

Bank Systems & Technology: "Worm Targets ING Direct iPhone App"
"A computer worm is targeting iPhone users who use an application to conduct online transactions with Dutch bank ING Direct, security experts say."

SC Magizine: "Report: Cyberattacks against the U.S. "rising sharply""
"A new report prepared for Congress found that the number of cyberattacks against the U.S. government is "rising sharply" in 2009, and many of the attacks are coming from Chinese state and state-sponsored entities"

Computerworld: "SSL flaw could have been used to hack Twitter"
"A flaw in the protocol used to secure communications over the Internet could have been used to hack Twitter accounts, according to an IBM security researcher."

DarkReading: "FBI Warns Of Spear Phishing Attacks On U.S. Law Firms and Public Relations Firms"
"The FBI assesses with high confidence that hackers are using spear phishing e-mails with malicious payloads to exploit U.S. law firms and public relations firms."

"SC Magazine: Survey finds Mac, PC users are equal cybercrime victims"
"Phishing attacks are just as effective on Macs, Linux, Windows, Solaris and any operating system since they rely on tricking the user and not on malicious software or any software vulnerabilities," Randy Abrams, director of technical education at ESET, said Monday in a blog post."The Mac offers no immunity to phishing attacks and so we see a virtually equal percentage of victim representation across the board."

"Computerworld: How hackers find your weak spots"
"A look at some of the ways hackers use social networking tools to gain access to victims' systems"

"Computerworld: Flash flaw puts most sites, users at risk, say researchers"
""The magnitude of this is huge," said Mike Murray, the chief information security officer at Orlando, Fla.-based Foreground Security. "Any site that allows user-uploadable content is vulnerable, and most are not configured to prevent this.""

"SecurityFix: Eight indicted in $9M RBS WorldPay heist"
"The 16-count indictment, which names individuals from Estonia, Moldova and Russia, is the first major break in a case federal investigators are calling "perhaps the most sophisticated and organized computer fraud attack ever conducted.""

"ComputerWorld: Firefox flaws account for 44% of all browser bugs"
"According to California-based Cenzic, Mozilla's browser had the largest percentage of Web vulnerabilities over the six-month span, while Apple's Safari had the dubious distinction of coming in second. Microsoft's Internet Explorer (IE) was third, while Opera Software's flagship browser took fourth place."

DarkReading: "Reactivation of Gumblar.cn domain could have ripple effect, researchers say"
"According to researchers at ScanSafe, a new iFrame injection is pointing once again to gumblar.cn -- the malware domain that originally earned Gumblar its name."

"SecurityFix: Business e-banking and the 6-figure password"
"Denny Naugle, operations director at American Realty, said the company is drafting papers to sue their bank."

IDG News Service: FBI warns of $100M cyber-threat to small business"
"Cyberthieves are hacking into small- and medium-sized organizations every week and stealing millions of dollars in an ongoing scam that has moved about $100 million out of U.S. bank accounts, the FBI warned Tuesday."

"SecurityFix: FDIC sees Uptick in 'money mule' scams"
"The Federal Deposit Insurance Corporation (FDIC) is warning financial institutions about an uptick in scams involving unauthorized funds transfers from hacked online bank accounts to so-called "money mules," people hired through work-at-home scams to help cyber criminals overseas launder money."

"SecurityFix: Cyber crooks stole $40M from U.S. small, mid-sized firms"
"According to the FBI and other fraud experts, the perpetrators have stuck to the same basic tactics in each attack. They steal the victim's online banking credentials with the help of malicious software distributed through spam. "

InfoSecurity.com: "FBI director almost fell for phishing attack"
"Mueller confessed in a speech at the Commonwealth Club of California that he had been halfway through responding to an apparently legitimate email purporting to come from his bank when he realised something was wrong and quit."

"ComputerWorld: Judge says TD Ameritrade's proposed security fixes aren't enough..."
"A federal judge's rejection of a proposed settlement by TD Ameritrade Inc. in a data breach lawsuit marks the second time in recent months that a court has weighed in on what it considers to be basic security standards for protecting data."

"ComputerWorld: CalOptima says data on 68,000 members may be compromised"
"Personally identifiable information on about 68,000 members of CalOptima, a Medicaid managed care plan serving Orange County, Calif., may have been compromised after several CDs containing the information went missing earlier this month. "

"IDG News Service: Trend Micro CEO: hackers hitting AV infrastructure"
"It's become an all-too-common scam: A legitimate Web site pops up a window that looks just like a real security warning. It says there's something wrong with the computer, and click here to fix it. A few clicks later, the victim is paying out US$40 for some bogus software, called rogue antivirus. "

"SC Magizine: Security report finds Chinese cyberspying threat growing"
"A new report prepared for the U.S.-China Economic and Security Review Commission has concluded that the Asian nation is likely using his sophisticated IT systems to spy on America. "

"SecurityFix: E-Banking on a Locked Down PC, Part II"
"In break-in after break-in, the perpetrators have shown their ability to slip past virtually all of the customer-dependent security barriers erected by online banks (e.g., passwords, secret questions, and token-generated one-time codes). "

"Bank Systems & Technology: Trojan Planted in Fake E-mail from IT Dept. Designed to Steal Info From Businesses"
"New York-based Trusteer, a customer protection company for online businesses, issued a security advisory that exposes and provides protection recommendations against a stealth new Zeus/Zbot phishing attack."

Security Fix: "Trojan Turns Smash & Grab Into Grab & Smash"
"Imagine being in charge of your organization's finances, and learning from your bank one morning that thieves had stolen tens of thousands of dollars from company coffers overnight using your online banking credentials. Now imagine your frustration when you go to log in to your PC to assess the damage, only to find that the computer you typically use to access the account has been kneecapped by the bad guys."

Bank Systems and Technology: "...85 percent of businesses have experienced a data breach."
"While traditional data breach threats like insider fraud and lost laptops remain, new breach threats like web application attacks and keylogging trojans are rising. As new techniques continue to emerge, no financial institution is immune. According to a recent Ponemon Institute U.S. Cost of a Data Breach Study, approximately 85 percent of businesses have experienced a data breach."

DarkReading: "Botnets Behind Most Modern Malware Infections"
"Botnets are networks of infected machines that are controlled by an attacker's command-and-control (C&C) that serves as the attack orders and a conduit for updating the malware on a victim's machine. This attack model has become a handy way for the bad guys to prevent their attacks from being detected or blocked, as well as to keep themselves hidden behind the bot army."

DarkReading: "Couple's Lawsuit Against Bank Over Breach To Move Forward..."
"An Illinois district court denied Citizens Financial Bank's request to dismiss a lawsuit that charges the bank was negligent in protecting a couple's bank account after their user name and password were stolen and used to pilfer $26,000 from their account."

eSchool News: "Computer virus steals $325K from district ..."
"The FBI is investigating what it is calling an online computer intrusion that siphoned several hundred thousands of dollars from at least one Chicago area school district's bank accounts, prompting the school district to beef up its IT network security."

Bank Systems and Technology: "At Least One Part of the Economy is Growing: Cybercrime ..."
"In case anyone thought it was getting easier to keep customer data safe, here are a few studies that will bring you back to reality."

Computerworld: "Organized Cybercrime Revealed..."
"Yes, the Mafia is formally involved in cybercrime, or so alleges the U.S. attorney for Florida, who filed charges against associates of the Bonanno crime family that included pilfering data from Lexis-Nexis."

Computerworld: "UNC data breach exposes 163,000 SSNs..."
"The University of North Carolina at Chapel Hill on Friday began notifying about 163,000 women about the potential compromise of their Social Security numbers and other personal information after a hacker breached a system containing the data."

Computerworld: "Construction firm sues after $588,000 online theft..."
"Over a week-long period in May, fraudsters made six transfers from the online bank accounts of Patco Construction Company, a family-owned developer in Sanford, Maine, according a copy of the lawsuit on the Washington Post's Web site."

Computerworld: "Microsoft unveils shield for critical Windows flaw as attack code looms..."
"With attack code that exploits a critical unpatched bug in Windows likely to go public soon, Microsoft wants users to run an automated tool that disables the vulnerable component."

TechRepublic: "Bank emails confidential information to wrong Gmail account!!!"
"According to various news reports and the court filing, a customer of Rocky Mountain Bank in Wyoming asked a bank employee to email loan statements to a third-party representative. Unfortunately, the bank employee sent the information to the wrong Gmail address."

Washington Post: "Data Breach Highlights Role Of 'Money Mules'..."
"The attack on Downeast Energy bears all the hallmarks of online thieves who have stolen millions from dozens of other businesses, schools and counties over the past several months. In every case, the thieves appeared more interested in quick cash than in pilfering their victims' customer databases. Nevertheless, the intrusions highlight an additional cost for victims of this type of crime: complying with state data breach notification laws."

SecurityFocus: "Miami man pleads guilty in TJX and Heartland breaches!"
"A 28-year-old Miami resident pleaded guilty on Friday to charges of conspiracy, computer and wire fraud, and aggravated identity theft stemming from the massive thefts of data from major commerce companies, such as retail giant TJX and payment processor Heartland Payment Systems."

Open Security Foundation: "Federal Data Breach Bill (H.R. 2221) Passes House"
"Yesterday, for the first time ever, a data breach notification bill actually came to a vote in the United States Congress. The House of Representatives passed by voice vote H.R. 2221, the Data Accountability and Trust Act. This bill and others have been introduced many times over the past several sessions of Congress, but unlike other similar bills and this bills' predecessors, H.R. 2221 not only came out of committee, but was voted on and passed."

Computerworld: "Seven Deadly Sins of Building Security"
"You've got a few security guards and your CCTV system is up to snuff. You've got your building security covered, right? Think again. While many organizations are taking the steps to ensure their building is secure, many are ignoring basic pieces of the puzzle that is physical security in and around a facility."

Washington Post: "European Cyber-Gangs Target Small U.S. Firms, Group Says"
"A task force representing the financial industry sent out an alert Friday outlining the problem and urging its members to implement many of the precautions now used to detect consumer bank and credit card fraud. "In the past six months, financial institutions, security companies, the media and law enforcement agencies are all reporting a significant increase in funds transfer fraud involving the exploitation of valid banking credentials belonging to small and medium sized businesses," the confidential alert says."

Washington Post: "Tighter Security Urged for Businesses Banking Online..."
"An industry group representing some of nation's largest banks sent a private alert to its members last week warning about a surge in reported cybercrime targeting small to mid-sized business. The advisory, issued by the Financial Services Information Sharing and Analysis Center, recommends that commercial banking customers take some fairly rigorous steps to secure their online banking accounts."

WSJ: "NJ U.S. Attorney Files Charges in 'Largest Reported Data Breach'"
"When it comes to criminal investigations and prosecution, the U.S. attorne's office in Manhattan may get the lion's share of the high-profile cases (See, e.g., Madoff, Dreier). But in terms of eye-popping filings, federal prosecutors in New Jersey have recently given the New Yorkers a run for their money. "

Security Fix: "Cyber Crooks Target Public and Private Schools..."
"On the morning of Aug. 17, hackers who had broken into computers at the Sanford School District in tiny Sanford, Colorado initiated a batch of bogus transfers out of the school's payroll account. Each of the transfers was kept just below $10,000 to avoid banks' anti-money laundering reporting requirements, and went out to at least 17 different accomplices or "money mules" that the attackers had hired via work-at-home job scams. "

SC Magizine: "Microsoft leads browsers in malware, phishing defense..."
"The browser, released in March with a number of enhanced phishing and anti-malware components, blocked an average of 81 percent of socially engineered malware and stopped 83 percent of suspected phishing sites -- topping four other major browsers, according to new tests conducted by NSS Labs. "

Computerworkd: "Microsoft knew of critical Office ActiveX bug in '07..."
"Three of the critical vulnerabilities Microsoft patched Tuesday in ActiveX controls for Office were first reported to the company two years ago, according to the security firm that alerted Microsoft of the flaws."

Computerworld: "Microsoft Fixes 19 Windows Security Flaws..."
"This month's batch of patches fix some fairly dangerous flaws. Redmond labels a security flaw "critical" if attackers could use it to seize control over a vulnerable system without any help from the victim. What's more, a dozen of the flaws earned the highest rating on Microsoft's "exploitability index," which is the software maker's best estimation of the likelihood that criminals will soon develop reliable ways to exploit them to break into Windows-based machines."

PC World: "Hardware Firewalls Bring Big Security to Small Businesses..."
"Think your business is too small for a serious security appliance? The truth may surprise you. For less than $500, a simple unified gateway device can protect even tiny offices from the very real threats posed by malware and hackers "

Washington Post: "How a denial-of-service attack works..."
"To picture a "denial-of-service" attack, think about what would happen if you and all your friends called the same restaurant over and over and ordered things you didn't even really want..."

Computerworld: "Mozilla shuts Firefox e-store after security breach"
"Mozilla shuttered its online store late Tuesday after finding out that the firm it hired to run the backend operations of the company's e-tailing business had suffered a security breach."

DarkReading: "Researcher Uncovers Massive, Sophisticated Trojan Targeting Top Businesses"
"The Trojan has already infected some businesses and extracted funds from accounts, Stewart says, often using unwitting "mules" whose PCs or accounts serve as intermediaries for funds transfer. The Washington Post reported one such incident involving Slack Auto Parts earlier this week."

Almost all Windows users may be vulnerable to Flash zero-day attacks
Computerworld: "More than 9 out of every 10 Windows users are vulnerable to the Flash zero-day vulnerability that Adobe won't patch until Thursday, a Danish security company said today."

Computerworld: Network Solutions warns merchants after hack
IDG News Service - "Criminals may have stolen more than half a million credit card numbers from merchant servers hosted by Networks Solutions, the Internet hosting company warned Friday."

Computerworld: Mozilla patches 11 vulnerabilities in Firefox 3.0
"Of the 11 flaws fixed in Firefox 3.0.12 -- the same number patched in the previous security update -- 10 were rated critical and one as "high" in Mozilla's four-step system."

Computerworld: "Hackers trawling for clues in Bugzilla tracker, say some Firefox developers"
"Mozilla is denying that a bug that crashes Firefox 3.5 is a security vulnerability, countering earlier reports that the company's latest browser contained a flaw even though it had just been patched."

The Washington Post: "The Growing Threat to Business Banking Online"
"Federal investigators are fielding a large number of complaints from organizations that are being fleeced by a potent combination of organized cyber crooks abroad, sophisticated malicious software and not-so-sophisticated accomplices here in the United States..."

CS Magazine: "Data attacks more frequent than CEOs think"
In a study of 213 CEOs and other senior executives, 92 percent of respondents said that their company's data has been attacked in the past six months.

WCVBTV Boston: "LexisNexis Warns 13,000 Of Possible Data Breach"
"Electronic publisher LexisNexis has told more than 13,000 people that a Florida man accused of helping run a racket for an organized-crime family may have gained access to their personal information through a former customer of a LexisNexis subsidiary."

DarkReading: "New Hardened Thumb Drive Self-Destructs When Breached"
"The new S200 device, which also uses hardware-based AES 256-bit strong encryption and includes anti-malware scanning and security management features, meets one of the federal government's highest security specifications, FIPS 140-2 Level 3, for storing top-secret data."

Computerworld: "Newest IE bug could be next Conficker, says researcher"
"The critical bug that Microsoft confirmed Monday but has yet to patch is a prime candidate for another Conficker-scale attack, a security researcher said."

WCVBTV Boston: "Federal Web Sites Shut Down By Cyber Attack"
"A widespread and unusually resilient computer attack that began July 4 knocked out the Web sites of several government agencies, including some that are responsible for fighting cyber crime, The Associated Press has learned."

New York Times: "U.S. and Russia Differ on a Treaty for Cyberspace"
"The United States and Russia are locked in a fundamental dispute over how to counter the growing threat of cyberwar attacks that could wreak havoc on computer systems and the Internet."

It's official: Microsoft to offer free anti-malware service.
According to SC Magazine "In announcing the release of its Microsoft Security Essentials (MSE), the software giant is going on the offensive ..."

Lawmakers Blast Internet Data Collection
According to the Wall Street Journal: "House Privacy Bill Would Give Consumers More Control Over Their Online Information..."

"Internet Pirates are Trying to Steal YOUR Personal Financial Information"
According to the FDIC "The Good news is you have the power to stop them".

Protecting Personal Information: A Guide for Business
Watch this informative and well done video sponsored by the FTC.  It explains data protection from a practical point of view....

FTC Shuts Down Notorious Rogue Internet Service Provider, 3FN Service Specializes in Hosting Spam-Spewing Botnets, Phishing Web sites, Child Pornography, and Other Illegal, Malicious Web Content
A rogue Internet Service Provider that recruits, knowingly hosts, and actively participates in the distribution of spam, child pornography, and other harmful electronic content has been shut down by a district court judge at the request of the Federal Trade Commission.

Gumblar attack worse than Conficker, experts warn !
ScanSafe contends that Gumblar is worse than Conficker, a worm that spreads via a hole in Windows through removable storage devices and network shares with weak passwords, as well as disabling security software and installing fake antivirus software....

Risk Management Framework (RMF) - FAQs and Quick Start Guides (QSGs) Now Available
NIST’s Computer Security Division has released Frequently Asked Questions (FAQs) and Quick Start Guides (QSGs) for Step 1 Categorize and Step 6 Monitor of the Risk Management Framework (RMF). The FAQs and QSGs for steps 2-5 are still in development and will become available when finalized. The RMF 6-step chart posted on the website contains links to NIST Special Publications (SP), Federal Information Processing Standards (FIPS), FAQs and QSGs associated with the respective steps in the RMF.

SC Magazine: "LexisNexis admits to another major data breach..."
"About 32,000 people are being notified that their personal information may have been compromised after a breach at consumer data provider LexisNexis resulted in identity theft and credit fraud, the company has disclosed."

The Wall Street Journal Reports: "Computer Spies Breach Fighter-Jet Project"
WASHINGTON -- Computer spies have broken into the Pentagon's $300 billion Joint Strike Fighter project -- the Defense Department's costliest weapons program ever -- according to current and former government officials familiar with the attacks

"What is the Definition of Personally Identifiable Information?"
With all the recent talk about data breaches and data breach laws you need to make sure you know what the terms mean.  The first thing ypu need to understand is what type of personal information the laws refer to.  As it turns out, the situation is more than a little vague, as this Legal-Beagle article verifies.

60 Minutes Reports: "The Internet Is Infected"
Lesley Stahl reports on computer viruses that propagate on the Internet and infect PCs, which enable their creators (often called "cyber gangs") to learn the information they need to electronically rob bank accounts.

IC3 2008 Annual Report on Internet Crime Released.
IC3 received a total of 275,284 complaints, a 33.1% increase over the previous year.  The total dollar loss linked to online fraud was $265 million, about $25 million more than in 2007.  The average individual loss amounted to $931.

In November of 2008 the FBI wrapped up a two-year undercover cyber operation.
The results were: 56 arrests worldwide, the prevention of $70 million in potential losses, and the confirmation that while there might be honor among thieves, in the end, they are still just thieves.

Should you trust flash drives to safeguard your data?
Bill O'Brien, Rich Ericson and Lucas Mearian of Computerworld Review 7 secure USB drive products.

Connecticut Department of Revenue Services (DRS) Laptop Stolden:
"Governor M. Jodi Rell today urged residents to be wary of callers offering credit or identity theft protection services in the wake of the announcement last week that a laptop computer containing taxpayer information was stolen from a Department of Revenue Services' (DRS) employee."

Wall Street & Technology Blog: "Merrill Lynch Reports Computer Theft"
"The personal information - including social security numbers - of 33,000 employees is believed to have been on the computer."

Security Fix: "New Attack Piggybacks on Microsoft's Patch Service"
"Security experts have been predicting that virus writers would find a way to hijack Microsoft's security patch delivery process to slip their software onto users' computers. They were right."

US-CERT: Vulnerability Summary for the Week of April 9, 2007
The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information.

Washington Post: "Cyber-Criminals and Their Tools Getting Bolder, More Sophisticated"
""These guys got everything, but all I knew was that my financial accounts were compromised," said the 66-year-old Fairfax engineer, who learned of the virus from a reporter who used forensic tools from computer-security firm Sunbelt Software in February to locate the Web server hosting Hoyler's private information."

Washington Post: "Wanted: Missing FBI Laptops"
If you lose your laptop, don't go crying on the shoulder of the Federal Bureau of Investigation. It has its own problems. The agency had at least 160 laptops lost or stolen over the past four years.

Bruce Schneier: "Apart from a $50,000 or $100,000 engineering effort" there is no way to tell whether a vendor's security is foolproof!
Read this thought provoking an inforative essay by security technologist and author Bruce Schneier.

The US Government established a site dedicated to tracking Cyber Crime.
It is called the Internet Crime Complaint Center (IC3). It is a partnership between the Federal Bureau of Investigation (FBI), the National White Collar Crime Center (NW3C), and the Bureau of Justice Assistance (BJA). 

IC3 accepts online Internet crime complaints from either the person who believes they were defrauded or from a third party to the complainant.  They can best process your complaint when they receive accurate and complete information. Therefore, you should provide the following information when filing a complaint:
* Your name
* Your mailing address
* Your telephone number
* The name, address, telephone number, and Web address, if available, of the individual
or organization you believe defrauded you.
* Specific details on how, why, and when you believe you were defrauded.
* Any other relevant information you believe is necessary to support your complaint.