NewsBits for May 5, 2003 sponsored by, Southeast Cybercrime Institute - www.cybercrime.kennesaw.edu ************************************************************ SCO Web site slammed by Net attack An avalanche of data blocked access to the SCO Group's Web site for several hours Friday, said the company, which has come under fire from Linux fans for an ongoing lawsuit against IBM. At 10:45 a.m., the Unix and Linux seller was hit by a distributed denial-of-service attack (DDoS) that hampered its Internet operations, said SCO spokesman Blake Stowell. In a DDoS attack, numerous computers simultaneously send so much data across a network that the targeted system slows to a crawl trying to keep up with the traffic it's receiving. http://zdnet.com.com/2100-1105_2-999584.html - - - - - - - - - - AG cracks down on 'Net scams Stop Net scams Attorneys general in 28 states, including Idaho, are cracking down on Internet auction scams. Idaho Attorney General Lawrence Wasden says he's joined with the Federal Trade Commission investigation, called Operation Bidder Beware. Wasden said two Idaho residents allegedly participated in the scams. Authorities say Bradley Bottum of Hayden advertised digital cameras on e-Bay, an online auction site. Bottum allegedly accepted payment for the goods and then did not send the cameras. http://www.crime-research.org/eng/news/2003/05/Mess0503.html - - - - - - - - - - Air Force Sgt. sentenced to 10 months for child porn In an 11th Wing courtroom at Bolling April 15, Staff Sgt. Douglas Marcy was found guilty of possessing child pornography on his home personal computer and was sentenced under the Uniform Code of Military Justice to 10 months' confinement, a bad conduct discharge and a reduction in rank to E-1. In March, Marcy's girlfriend discovered images of child pornography on his computer. She copied some of these images to disk and delivered the evidence to the Fairfax County, Va., Police Department. Police obtained a search warrant and discovered hundreds of similar images on Marcy's computer. He was then arrested by Fairfax County Police. http://www.dcmilitary.com/airforce/beam/8_17/local_news/22900-1.html - - - - - - - - - - Child porn man jailed Fellow villagers of jailed pervert Peter Jones today said he deserved more than one year behind bars for downloading thousands of indecent images of children. The former Conservative district council candidate, who lived in Park Road, Spixworth, was snared in Operation Ore, an investigation involving UK police targeting users of pay per view websites from the United States. http://www.eveningnews24.co.uk/content/News/story.asp?datetime=29+Apr+2003+12%3A44&tbrand=ENOnline&tCategory=NEWS&category=News&brand=ENOnline&itemid=NOED29+Apr+2003+12%3A45%3A22%3A763 - - - - - - - - - - Mich. man pleads guilty to soliciting sex on Web A Muskegon, Mich., man will be sentenced in June after recently pleading guilty to charges that he used the Internet to solicit a minor. Joseph Perri, 25, pleaded guilty Monday to one count each of accosting children for immoral purposes and using a computer to commit a crime. Both charges are felonies. According to investigators, the sheriffs office had received a report of an online communication between a juvenile and a child-sex solicitor. Deputy Rick Richardson, who heads the departments Internet Crimes Unit, reviewed the electronic data that revealed that a 15-year-old male from Scipio Township allegedly had been solicited by Perri, who asked the boy to meet him. Authorities continued to monitor the conversation online, and when Perri arrived at the teens house March 23, police arrested him. http://www.toledoblade.com/apps/pbcs.dll/article?Date=20030503&Category=NEWS03&ArtNo=305030003&Ref=AR - - - - - - - - - - Men Convicted On Porn Charges An Auckland man has been convicted on child pornography charges, involving pictures of young girls aged between four and 10. Earl William Duffell Internann, from Auckland's North Shore, pleaded guilty to trading and possessing the pictures. They showed the children in explicit poses and being abused by men. Internal Affairs says the case highlights the true nature of Internet child pornography. Internal Affairs spokesman Keith Manch says Intemann had been dealing in the images for about two months, and his offending was at the early end of the spectrum. http://xtramsn.co.nz/news/0,,3882-2340730,00.html - - - - - - - - - - Police say man had sex with boys A North Canton man is accused of having sex with several teen-age boys he met on the Internet. William C. Harris, 25, of North Main Street, was arraigned this week in Barberton Municipal Court on charges of unlawful sexual contact with a minor sexual imposition and possession of criminal tools. He was released after posting 10 percent of a $50,000 bond. Summit County sheriff's Capt. Larry Momchilov said Harris, a civil engineer, is accused of meeting at least three boys ages 12-17 on the Internet and arranging sexual encounters. One of the boy's parents contacted investigators last month after seeing an e-mail Harris allegedly sent to their son at their Green home. Harris and the boy had sex on three occasions, Momchilov said. http://www.ohio.com/mld/ohio/news/5776716.htm - - - - - - - - - - Major child porn find Investigators are continuing to look into what one says is a sickening case of child pornography. James Richard Ayre, 35, Midland, was arraigned April 23 for the felony of possessing sexually abusive material involving children. Midland County Prosecutor Norm Donker said Ayre was found with a massive library of pornographic photographs involving children clearly under the age of 5. "They are the most vile images that you can possibly imagine," Donker said, adding detectives who are working to inventory the photographs can only work for about half an hour before becoming physically ill. The materials found include compact discs, each filled with photos, and computer equipment. Donker did not know how many photos there are. "How much can you put on a CD?" he asked. http://www.ourmidland.com/site/news.cfm?newsid=7908886&BRD=2289&PAG=461&dept_id=472542&rfi=6 - - - - - - - - - - Trinity told to hand over records in porn case A judge ordered Trinity University officials Monday to turn over documents related to an internal investigation into allegations that one of its students had child pornography on his dorm computer. The order came after university officials declined to allow the school's dean of student affairs, David Tuttle, to respond to a grand jury subpoena. Assistant District Attorney Tony Reyes was hoping Tuttle would shed some light on the investigation he oversaw regarding the allegations. Prosecutors are presenting evidence to a grand jury in hopes of obtaining an indictment against the student. http://news.mysanantonio.com/story.cfm?xla=saen&xlb=180&xlc=987941 - - - - - - - - - - Apple Squashes E-Store ID Bug Apple Computer said it fixed a security flaw at its online store late last week that could have enabled attackers to hijack customers' accounts and place fraudulent orders. The flaw, discovered by an anonymous Canadian security researcher who uses the nickname "Null," potentially allowed malicious users to change Apple Store customers' passwords and gain control of the victims' account data. Information stored by Apple includes customers' names, mailing addresses, telephone numbers, order histories and credit card information. http://www.wired.com/news/privacy/0,1848,58718,00.html - - - - - - - - - - G8 countries 'need good co-ordination' to fight Internet child porn, The scourge of child pornography will continue unless countries work together to solve the problem, Solicitor General Wayne Easter said yesterday as he prepared to discuss the issue with security and justice ministers from other G8 nations. "We need good co-ordination if we're really going to attack the issue of child pornography," Mr. Easter said from Paris. "We have to have strategies in place to do it worldwide." Mr. Easter and Justice Minister Martin Cauchon are in France for today's meeting, which will also focus on the fight against terrorism and other international criminal justice matters. http://canada.com/national/story.asp?id=1C882EF4-1BC2-4A44-911D-2E7288CBCCD8 - - - - - - - - - - Making It Harder for Prying Eyes A bill in the California state legislature would protect the anonymity of Internet users by requiring Internet service providers to send customers copies of subpoenas seeking to learn their identities. If passed, California's Internet Communications Protection Act would become the second state law requiring that consumers be alerted when an ISP is issued a subpoena to find out an anonymous Internet user's true identity. Virginia passed a similar statute last year. http://www.wired.com/news/politics/0,1283,58720,00.html - - - - - - - - - - Canadian Privacy Law Deadline Approaching U.S. companies must comply by first of the year The clock is winding down for U.S. companies that exchange data with other businesses and subsidiaries in Canada to comply with a law providing broad privacy protections for Canadian citizens. Beginning Jan. 1, 2004, all companies that collect, use or disclose personal information about Canadian citizens during the course of commercial activities will have to comply with Canada's Personal Information Protection and Electronic Documents Act. http://computerworld.com/securitytopics/security/story/0,10801,80949,00.html - - - - - - - - - - Terror attack mock-up has a cyber angle The Homeland Security Department and dozens of federal, state and local agencies will launch a simulated five-day terrorist attack on May 12 designed to include a small role for cyberwarfare, officials said this afternoon. The game will involve a hypothetical attack by a radiological "dirty bomb" in Seattle and a biological attack via infectious pneumonic plague in Chicago, officials said. HSD Secretary Tom Ridge announced the exercise today at a news conference with officials of the State Department, the two cities and HSD's Office of Domestic Preparedness. http://www.gcn.com/vol1_no1/daily-updates/22003-1.html - - - - - - - - - - Software Bullet Is Sought to Kill Musical Piracy Some of the world's biggest record companies, facing rampant online piracy, are quietly financing the development and testing of software programs that would sabotage the computers and Internet connections of people who download pirated music, according to industry executives. The record companies are exploring options on new countermeasures, which some experts say have varying degrees of legality, to deter online theft: from attacking personal Internet connections so as to slow or halt downloads of pirated music to overwhelming the distribution networks with potentially malicious programs that masquerade as music files. The covert campaign, parts of which may never be carried out because they could be illegal under state and federal wiretap laws, is being developed and tested by a cadre of small technology companies, the executives said. (NY Times article, free registration required) http://www.nytimes.com/2003/05/04/business/04MUSI.html Report: Labels back software sabotage http://zdnet.com.com/2100-1105_2-999612.html Internet anti-piracy laws criticized as too broad http://www.nandotimes.com/technology/story/877698p-6119553c.html - - - - - - - - - - The slow war against rogue Rx sites Online firms that fill prescriptions without exams targeted. Dr. Carlos Gustavo Levy practices osteopathic medicine in Sunrise, Fla., more than 3,000 miles away from California. But that didnt stop him writing some 1,570 prescriptions for Californians. He made his diagnoses via an online questionnaire, prescribing medicines without ever seeing his patients. http://www.msnbc.com/news/909570.asp - - - - - - - - - - Military battling rise in child-sex cybercrimes He molested his teenage stepdaughter and downloaded dozens of child-porn images to his computer. For his crimes, the Yokota airman in February earned five years in the brig. His wasnt the first nor is it the last child sexual-abuse case at Yokota. In fact, military prosecutors here say they are preparing more cases for court. But the problem isnt Yokotas alone: The Internet has spawned an onslaught of U.S. online- pedophilia and child pornography-possession cases. And military criminal investigators in Japan are battling a similar trend. We see it on a smaller scale because of our numbers, said Special Agent Brian Taylor, a computer crimes investigator for the Air Forces Office of Special Investigations, 62nd Field Investigations Squadron, Yokota Air Base. http://www.crime-research.org/eng/news/2003/05/Mess0401.html - - - - - - - - - - Voicemail hacking on the rise Voicemail can cost you. Just ask K.C. Hatcher, a San Francisco-based graphic artist. AT&T wants her to pay $12,000 in long-distance charges rung up by a hacker who apparently changed Hatcher's voicemail message to accept third-party billed calls to Saudi Arabia and the Philippines. ``I am totally obsessing about this,'' said Hatcher, whose normal long-distance bill runs $35 a month. ``I'm getting married in June. I want to buy a house, and I'm worried that this fraud is going to ruin my credit.'' http://www.siliconvalley.com/mld/siliconvalley/5782700.htm - - - - - - - - - - Is spam behind a cell-phone virus? Some AT&T Wireless subscribers believe a text message masquerading as spam is on the loose and damaging cell phones in the United States. The subscribers reporting the problem each owned a Siemens S46 cell phone and said they received the e-mail this week. Even when they did not open the e-mail, which began "Need Help With International Dialing," what some say could be malicious software hidden inside wiped out the cell phones' address book and e-mail capabilities. http://zdnet.com.com/2100-1105_2-999558.html - - - - - - - - - - Finding Solution to Secret World of Spam There probably isn't a "Wendy" behind the e-mail offering a way to "lose 30 pounds in 30 days." And it seems unlikely that the real vendor of the "Iraqi most-wanted playing cards" is really named "DocHoliday." Most unwanted bulk e-mail, or spam, is sent under forged names and addresses, making it hard to track down the real senders. At a three- day forum that just ended here on spam, sponsored by the Federal Trade Commission, there was a consensus that spam was increasing rapidly this year. But there was little certainty about who was behind it. (NY Times article, free registration required) http://www.nytimes.com/2003/05/05/technology/05SPAM.html Best way to stop spammers? Make them pay! I spent last week at the Federal Trade Commission's three-day spam summit, where hundreds of people, fed up with the skyrocketing amount of unsolicited bulk e-mail, gathered to figure out how to stop it. The suggestions were predictable: As they have each year since 1997, with nothing to show for it so far, members of Congress vowed to enact a law restricting spam. People selling spam blockers touted their products, and so-called e-mail marketers complained that their bulk messages were being unfairly tossed in the trash. Poor things. http://zdnet.com.com/2100-1105_2-999671.html Internet service providers join forces against spam http://www.nandotimes.com/technology/story/877949p-6120572c.html Congress moving to combat spam e-mail http://www.nandotimes.com/technology/story/877654p-6119347c.html The Not-So-Peaceful Anti-Spam Crusade http://www.washingtonpost.com/wp-dyn/articles/A15290-2003May5.html - - - - - - - - - - Scanning for security Allen Tien needed secure computers. The elderly patients in his company's research program had to fill out confidential surveys, and he wanted to keep them confidential. So the Towson medical software consultant turned to biometrics -- the science that identifies people by turning their physical characteristics into a unique set of numbers. http://www.usatoday.com/tech/news/computersecurity/2003-05-05-spyware_x.htm - - - - - - - - - - Internet Explorer's dumbest bug ever revealed BORED OF CREATING buffer overflow possibilities and security gaps an electronic elephant could walk through, Microsoft's Internet Explorer development team has turned its attention to good old HTML. Thankfully, this bug just crashes IE. Embarrassingly for the Vole, it's done with just one malformed line of HTML. http://www.theinquirer.net/?article=9288 - - - - - - - - - - Windows Server 2003 Security: Jury's Still Out Security solution providers offered mixed reviews of the security of Microsoft's recently released Windows Server 2003. Microsoft has touted the security of the new software, which ships with more than 20 services turned off by default and includes other protective functions. Security has been Microsoft's mantra since it launched its Trustworthy Computing initiative nearly 18 months ago. http://www.internetweek.com/breakingNews/showArticle.jhtml%3Bjsessionid=2W4DLI4ZBBFSKQSNDBCCKH0CJUMEYJVN?articleID=9400435 - - - - - - - - - - Madonna's Borderline MP3 Tactics The material girl's foul-mouthed revenge on music traders could be interpreted as a deceptive trade practice, or even outright fraud. Virginia's new anti-spam law makes it a criminal offense to send e-mail with inaccurate and deceptive source or header information. The new PROTECT Act signed by President Bush similarly makes it a federal offense for online pornographers to obtain or use misleading domain names to induce individuals to surf unwittingly to porn sites. At the same time, the U.S. Federal Trade Commission filed a series of civil complaints against "porn-spammers" alleging that spoofed source information and misleading subject lines constitutes a deceptive trade practice. Can this mean that Madonna goes to jail? http://www.theregister.co.uk/content/55/30559.html - - - - - - - - - - Auditing Web Site Authentication, Part Two Inadequate user security is a problem that Web developers must address. Perhaps it is lack of standards. Perhaps it is a lack of auditing. This is the second part of an article addressing both of those issues by establishing a standard audit procedure by which to measure your own security. Test this list of questions against your own Web site's authentication scheme and see how it stands. The first article focused on issues surrounding usernames and passwords. This article will explore issues surrounding user privacy, session authentication, user security, and cookies. http://www.securityfocus.com/infocus/1691 Auditing Web Site Authentication, Part One http://www.securityfocus.com/infocus/1688 - - - - - - - - - - 'Smart Park' Is Keeping Watch Surveillance cameras, infrared sensors and other high-tech gadgets help monitor facilities. To civic planners in Glendale, Palmer Park has everything a recreation area needs kiddie swings, walking trails and infrared sensors concealed in the shrubbery. If someone scales the fence after the park closes at 10 p.m., more than a dozen electronic sentries whirl into action. One foot on the manicured lawn triggers the sprinklers, while the sensors set off alarms at the park rangers' headquarters. (LA Times article, free registration required) http://www.latimes.com/technology/la-me-parks5may05,1,5409626.story - - - - - - - - - - Report: Too Many Watch Lists Congressional investigators urge the government to combine twelve different surveillance databases into one. While errors in the Transportation Security Administration's "no-fly" list have famously raised the ire of innocent air travelers misidentified as terrorists, it's far from the only government watch list in use. In a report released this week, the General Accounting Office, Congress' investigative arm, counted no less than 12 different government databases cataloging purportedly dangerous people, maintained by nine different federal agencies and accessed by 50 others -- a tangled web of largely incompatible systems that the GAO would like to see merged into one. http://www.theregister.co.uk/content/55/30558.html *********************************************************** Computer Forensics Training - Online. An intense, 150 hour, instructor lead program that teaches you computer forensics and helps prepare you for the Certified Computer Examiner exam. For more information see; www.cybercrime.kennesaw.edu *********************************************************** Search the NewsBits.net Archive at: http://www.newsbits.net/search.html *********************************************************** The source material may be copyrighted and all rights are retained by the original author/publisher. The information is provided to you for non-profit research and educational purposes. Reproduction of this text is encouraged; however copies may not be sold, and NewsBits (www.newsbits.net) should be cited as the source of the information. Copyright 2000-2003, NewsBits.net, Campbell, CA.