NewsBits for August 4, 2003 sponsored by, Southeast Cybercrime Institute - www.cybercrime.kennesaw.edu ************************************************************ Hacker Prevents Access to Microsoft The software company's site was unavailable for an hour and 40 minutes, possibly delaying efforts to download a patch. A hacker attack on Microsoft Corp. left its corporate Web pages unavailable to visitors for an hour and 40 minutes Friday afternoon in the first successful denial-of-service campaign against the company in at least nine months. The attack sent requests for information to the Web site from many computers, overwhelming its servers but causing no lasting damage, said Microsoft spokesman Sean Sundwall. http://www.latimes.com/technology/la-fi-msft2aug02,1,6661646.story http://www.vnunet.com/News/1142786 - - - - - - - - - - Student accused of hacking into school's system A graduate student is accused of hacking into the University of Michigan's computer system and using information from more than 60 students and professors to forge e-mails and get copies of final exams. In one case, Ning Ma, 24, is accused of sending an e-mail from a professor's account to a female student, telling her that she was failing. Ning then offered to tutor the woman in hopes of obtaining sexual favors in return, the attorney general's office said. The student rebuffed Ning's attempts. http://www.cnn.com/2003/TECH/internet/08/02/accused.hacker.ap/index.html - - - - - - - - - - Four-month sentence for child porn teenager A CAMBRIDGE teenager guilty of downloading child pornography from the internet has been put behind bars for four months. Christopher Dunn, from Iver Close in the city, was sentenced yesterday at Cambridge Crown Court after admitting 16 charges of downloading indecent images onto two computers. The court heard Dunn, 19, had been working as an IT administrator at accounts company Imperial Costing in Burleigh Street when he started using a computer there to download pictures. Sara Walker, prosecuting, said Dunn's work colleagues alerted the police, who visited his home and found more images stored on his home computer. http://w3.cambridge-news.co.uk/news/story.asp?StoryID=33558 - - - - - - - - - - Dallas man convicted in online child sex sting A San Antonio jury has convicted a Dallas businessman for soliciting sex from a child. In doing so, the panel rejected his claim that his only intention was to counsel the ``teen'' against meeting with older men on the Internet. A judge is expected to sentence 37-year-old Patrick Hubbard next month. Hubbard could face up to 10 years in prison. For nearly three months, Hubbard chatted with a vice detective who portrayed himself as a 14-year-old virgin who loved swimming, hiking and who had a keen curiosity for sex. In the chats, Hubbard repeatedly worried about being caught. At one point he asked the ``teen'' if she was a police officer. http://www.kxxv.com/main.cfm?ID=1&NewsID=2948&Type=Full - - - - - - - - - - Admitted Child Porn Peddler Awaits Sentencing A De Soto man awaits his fate after pleading guilty to child pornography charges. James Michael Douglas was arrested in a sting operation by postal inspectors and federal agents. Prosecutors say he took part in a Yahoo! Internet group which allowed its members to trade and sell pornography online. Douglas allegedly responded to an e-mail offer of pornography. Douglas will be sentenced in October and faces a possible sentence of up to 25 years in prison and a $750,000 fine http://www.ksdk.com/news/news_article_lc.asp?storyid=44787 - - - - - - - - - - 4 accused of preying on teens Four more men have been charged with trying to solicit sex from people they thought were 13-year-olds they met through the Internet. The teens turned out to be state criminal investigators posing as children to catch sexual predators. The arrests bring to 11 the number of men charged in Central Texas since May through the work of the Texas attorney general's Internet Bureau, spokesman Tom Kelley said Friday. The men were arrested separately in unrelated incidents. http://www.statesman.com/metrostate/content/auto/epaper/editions/today/metro_state_f3b2168bc30d717500a0.html - - - - - - - - - - LP firefighter charged in viewing child porn online A longtime LaPorte firefighter turned himself in to LaPorte City Police Friday afternoon on sex charges for allegedly using the fire department's computer to look at naked images of children. LaPorte Fire Department Training Officer Phillip Logan, 53, of 3706 S. Ind. 104, is charged with child exploitation, a Class C felony, and possession of child pornography, a Class D felony. According to a probable-cause affidavit, Todd McCoy, computer network administrator at the LaPorte County Sheriff's Department and also a part-time employee at Computech Systems, which provides computer maintenance and support to the fire department, discovered the images on the fire department computer's hard drive. http://www.heraldargus.com/content/story.php?storyid=3284 - - - - - - - - - - Former LSU employee turns himself in on pornography charges A former LSU public relations employee turned himself in Monday on allegations of having child pornography and indecent behavior with a child, according to university police. Ron Brown was booked into East Baton Rouge Parish Prison, more than a month after warrants were issued for his arrest and he was declared a fugitive, LSU Police said. Investigators said Brown, 59, left his Denham Springs home the same day authorities searched the home and seized two personal computers and electronic media. He later contacted his wife and told her she could find their Toyota minivan in a Natchez, Miss., mall parking lot, an arrest warrant said. Before the search at Brown's home, investigators seized Brown's office computer and storage disks. An examination uncovered two deleted images of pre-pubescent girls from the hard drive and more image and video files that were encrypted to restrict access, the warrant said. http://www.2theadvocate.com/stories/080403/new_brown001.shtml - - - - - - - - - - Details released in child porn case A Waltham man will face a U.S. federal court judge tomorrow on charges he attempted to purchase two child pornography videotapes from a federal postal officer. According to a sworn affidavit signed by U.S. Postal Inspector Richard Irvine, Daniel Parece, a 49-year-old Waltham resident, attempted to buy child pornography and possessed on his home computer 19 downloaded Internet files of children in illicit sexual acts. http://www.dailynewstranscript.com/news/local_regional/walt_parece08042003.htm - - - - - - - - - - CHILD PORN DJ GETS KIDDIES' RADIO SHOW A RADIO DJ sacked for Internet child porn offences has landed a new job presenting a show for schoolkids, The People can reveal. Pervert Chris Branscomb, 27, was convicted of possessing indecent photos of children after a disgusting image of a youngster was found on his work computer. Cops raided his home and discovered more sickening pictures of boys engaged in sex acts with men. But he was still hired by Hertbeat FM to front the 3-7pm "School Run" show - popular with pupils on their way home. Amazingly, when we tracked down Branscomb he was proudly wearing a badge supporting the NSPCC's Full Stop campaign against child cruelty. http://www.people.co.uk/homepage/news/page.cfm?objectid=13250176&method=thepeople_full&siteid=79490 - - - - - - - - - - Dad says photos of teen are art Nude and nearly nude photographs of a McNairy County teenager taken by her father and posted on the Internet are the subject of a federal court trial. Steven Joseph Yurick, a 33-year-old heating and air-conditioning worker from Selmer, faces nine counts of possessing and producing child pornography of his daughter, now 15. Conviction carries five to 20 years in prison on each count, and $2 million in fines. Father and daughter testified Friday that the photographs are art, and were never meant to suggest sex. http://www.gomemphis.com/mca/local_news/article/0,1426,MCA_437_2153217,00.html - - - - - - - - - - Is it a bird? A plane? No, it's a Windows Trojan While one of the sneakiest viruses to date began spreading rapidly across the Internet at the weekend, antivirus software vendor Panda Software detected a Trojan that exploits, you guessed it, another Windows vulnerability. Its actions leave affected computers at the mercy of hackers, the company warns. The Trojan Autorooter (the term is based on security lingo for successfully cracking and gaining privileged access to a machine) is hidden in a file called WORM.EXE, which we have to admit, is a bit of a giveaway. http://www.theregister.co.uk/content/56/32152.html Microsoft Warns About 'Worm' Virus http://www.siliconvalley.com/mld/siliconvalley/news/editorial/6446052.htm http://www.vnunet.com/News/1142804 http://www.pcw.co.uk/News/1142786 http://zdnet.com.com/2100-1105_2-5059087.html http://www.itweb.co.za/sections/internet/2003/0308041217.asp http://www.pcpro.co.uk/?http://www.pcpro.co.uk/news/news_story.php?id=45601 http://www.washingtonpost.com/wp-dyn/articles/A17797-2003Aug4.html http://www.msnbc.com/news/947145.asp http://www.newsfactor.com/perl/story/22025.html http://www.theregister.co.uk/content/56/32136.html http://computerworld.com/securitytopics/security/story/0,10801,83711,00.html Microsoft Downplays Mail Worm http://www.wired.com/news/technology/0,1282,59887,00.html Security experts fear major attack on Windows systems http://www.infoconomy.com/pages/news-and-gossip/group83286.adp http://zdnet.com.com/2100-1105_2-5059263.html - - - - - - - - - - Senator Wants to Limit Patriot Act U.S. Senator Lisa Murkowski (R.-Ala.) introduced legislation Friday designed to rollback certain provisions of the Patriot Act, including requiring a court order for U.S. law enforcement agencies to conduct electronic surveillance. According to Murkowski, her bill would not repeal any portion of the Patriot Act, but would curb some the police powers granted under the legislation. The Patriot Act was passed in the immediate aftermath of the Sept. 11, 2001, terrorist attacks. http://dc.internet.com/news/article.php/2243881 - - - - - - - - - - US court okays malware in hunt for Web paedos A US appeals court last week gave tacit approval to the use of Trojan horse viruses as a tool in investigating crimes on the Net. The federal appeals panel ruling stems from a case in which a hacker "uploaded a file to a child porn newsgroup that made it possible to track who downloaded files from the service", News.com reports. http://www.theregister.co.uk/content/55/32151.html - - - - - - - - - - DHS Set to Appoint Cyber-Security Chief The Department of Homeland Security is close to finalizing a selection for the vacant job as the head of the department's Cyber Security Division. Department officials have sent a name to the White House for consideration and hope to have the person at work in the near future, according to comments made by Secretary of Homeland Security Tom Ridge Sunday. "That name has been submitted to the White House and it should be filled shortly," Ridge said on "Meet the Press." http://www.eweek.com/article2/0,3959,1209896,00.asp - - - - - - - - - - India plans to block 'gambling and other negative websites' IRNA, The Islamic Republic News Agency, reported that Mumbai police are warming up its Internet monitoring and censorship activities on Internet access and usage in India. An order issued by India's department of information technology empowers a proposed committee headed by bureaucrats with sweeping powers to police and decide which website content and services Indians can access. The Cert-In committee would comprise of bureaucrats and officials from department of information technology and the law or home ministry. http://www.onlinecasinonews.com/ocnv2_1/article/article.asp?id=3782 - - - - - - - - - - "Do not spam" lists find customers, skeptics Pointing to Web sites with names like remove.org and globalremoval.com, the messages promise for a nominal fee to stop spam at its source by placing their addresses on a "do not spam" registry. The services say they have hit on a novel and cheap way to reduce spam, and point to bulging customer lists as proof. Government and private-sector experts say such "do not spam" services are not likely to work because marketing firms are under no obligation to comply. http://www.usatoday.com/tech/news/techpolicy/2003-08-04-anti-spam-lists_x.htm - - - - - - - - - - Handhelds 'easy to hack' Security experts have issued a warning against the common practice of storing passwords or pin numbers in handheld devices. Hand-held computers used to store phone numbers, medical and credit-card information leave millions of gadget lovers fully exposed to identity-theft and other crimes, security experts said on Saturday. http://news.zdnet.co.uk/hardware/mobile/0,39020360,39115469,00.htm - - - - - - - - - - Survey: Firms mum on hacker attacks FBI seeks to ease fears on reporting. As many as half of all businesses suffered break-ins from hackers last year, but most didn't say a peep about it to law enforcement, a recent government report shows. Only one-third of 530 companies surveyed by the Computer Security Institute said they reported hacking attacks to law enforcement. CSI interviews companies about security issues each year. http://www.denverpost.com/Stories/0,1413,36~33~1550174,00.html - - - - - - - - - - A racket that thugs can't get enough of Anything goes on the Internet these days, and the feds are clueless about controlling the raging high-tech crime wave and egregious privacy violations of every kind. Was anyone surprised when Web thugs revealed the name of the 19-year-old who allegedly was sexually assaulted by Kobe Bryant? Was anyone surprised that one Web site even printed bogus topless pictures of the young woman? The harsh truth is that many lanes on the information highway have become dangerous back alleys of crime and corruption. http://www.nydailynews.com/front/story/106223p-96038c.html - - - - - - - - - - CERT to Lead Project to Promote Sharing of Security Information Carnegie Mellon University's CERT Coordination Center, security event management software vendor ArcSight Inc. and three universities are teaming up to help improve information sharing among security organizations. The group will undertake what it's calling the Cyber Security Information Sharing Project. Its purpose is to conduct research and development aimed at improving companies' ability to identify and respond to cyberattacks using information gathered from throughout the security community. http://computerworld.com/securitytopics/security/story/0,10801,83678,00.html - - - - - - - - - - Security Experts Tighten Grip on Flaws Process A proposed voluntary plan for handling vulnerability disclosures is drawing fire from security researchers and other critics, even as new research shows that such a plan is sorely needed to help protect networks. The guidelines are the work of the Organization for Internet Safety, a group of security companies and software developers, and define a process for notifying vendors of flaws, disclosing them to the public and dealing with exploit code. The document has been warmly received by many in the security community. http://www.eweek.com/article2/0,3959,1209009,00.asp Vendors Offer Plan for Disclosing Software Security Holes Security researchers say their concerns were ignored, slam vendor 'loopholes'. A multivendor team led by Microsoft Corp. last week released new guidelines for security vulnerability reporting and response. But critics of the effort faulted it for its lack of nonvendor buy-in. http://computerworld.com/securitytopics/security/story/0,10801,83688,00.html - - - - - - - - - - Linux approved for use on most-sensitive computers Linux software has been approved for use on the most sensitive computers in corporations and the federal government, including those inside banks and the Pentagon, an important step for software widely considered the top rival to Microsoft Corp. The Common Criteria organization, an international technology standards body, certified Linux for the first time on "mission critical" computers, including those in America's top-secret spy agencies and those used to deliver ammunition, food and fuel to soldiers. The certification is akin to the technology industry's seal of approval. http://www.securityfocus.com/news/6609 - - - - - - - - - - Encryption Mandate Puts Strain on Financial IT Efforts by retail, banking industries to upgrade ATMs and servers will take years, cost billions. A mandate by credit card companies and related funds- transfer networks to upgrade the security of electronic transactions will cost the banking and retail industries billions of dollars in hardware and software and require several years of intensive work to complete. http://computerworld.com/securitytopics/security/story/0,10801,83685,00.html - - - - - - - - - - Hacking contest promotes security The U.S. government continues to talk tough on computer crime, but here in the desert, hackers--including some from federal agencies--are learning about defending networks by breaking into computers. The exercise is part of a Capture the Flag-like game that's known as Root Fu. The annual contest pits eight teams at the DefCon conference against each other in a test of network defense and hacking skills. Each team has to defend their own server and applications while trying to break into the servers of the seven other teams. http://news.com.com/2100-1009_3-5059827.html http://www.lasvegassun.com/sunbin/stories/business/2003/aug/01/515421769.html - - - - - - - - - - IBM gives nod to Wave security tools Wave Systems' push to pull in corporate customers for its security software got a lift from IBM, which has given the thumbs-up to two of the company's new products. The software maker, based in Lee, Mass., said Monday that Big Blue had recognized its Document Manager Vault and SmartSignature releases under its Independent Software Vendor (ISV) program. http://news.com.com/2100-1012_3-5059673.html - - - - - - - - - - RIAA's scare tactics bound to backfire The Recording Industry Association of America's efforts to scare peer-to-peer users who violate copyright laws began with a promising start exactly one year ago. Last August, the RIAA asked a federal court in Washington, D.C., to force Verizon Communications to divulge the identity of a Kazaa user, kicking off a legal tussle that ended with the RIAA winning a stunning victory. At about the same time, key members of Congress wrote a letter that asked the U.S. Department of Justice to begin criminal prosecutions of P2P users who "allow mass copying," while an RIAA ally on Capitol Hill simultaneously introduced a bill to allow copyright holders to attack computers on P2P networks used for piratical purposes. http://zdnet.com.com/2100-1107_2-5059612.html http://www.vnunet.com/News/1142797 FTC alert issued on file-sharing http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2003/08/04/BU189629.DTL - - - - - - - - - - Finding Bad Spam Delights Geeks When freelance Web developer Joe Stump first installed the e-mail filtering program SpamAssassin, he and a friend started a competition. Each day, the two would look through their junk e-mail and try to find the missive that SpamAssassin had assigned the highest score. "It was always a little contest between the two of us," says Stump. "We were always trying to tweak and modify the settings to get it just right. I finally won the contest when I got a spam with a score of 43." http://www.wired.com/news/culture/0,1284,59859,00.html - - - - - - - - - - Smart cards, ID cards, nice, nasty, inevitable? ID cards come in two quite distinct flavours - the nasty one, where they use the cards to police you, and the nice one, which you use to establish and protect your rights and identity. Simple? Actually, I lie when I say they're distinct flavours; in reality nice isn't absolutely nice, the two bleed most horribly into one another, and what we should really be busying ourselves with is establishing clear lines of distinction then defending them. http://www.theregister.co.uk/content/6/32148.html - - - - - - - - - - Betting on Malware DARPA's plan to create a futures market for terrorist activities is dead, but the concept is a natural for predicting viruses and worms. The fun folks at DARPA were at it again last week, cooking up projects at the nexus of security and the war and terror that somehow manage to offend everyone. First there was the Total Information Awareness project. Next came the misnamed Combat-Zones-that-See, a scheme to use artificial intelligence and thousands of cameras hooked to PCs to track the comings and goings of your auto. http://www.securityfocus.com/columnists/176 - - - - - - - - - - Demonstrating ROI for Penetration Testing (Part Two) There are two camps when it comes to demonstrating ROI for security initiatives. One camp believes it is absolutely impossible, ridiculous and suggests you should not even try. The other camp believes it is not only possible but important and absolutely necessary. Somewhere in the middle is a plausible methodology for demonstrating ROI for many security initiatives, including penetration testing. http://www.securityfocus.com/infocus/1718 Demonstrating ROI for Penetration Testing (Part One) http://www.securityfocus.com/infocus/1715 - - - - - - - - - - Word of mouse How did a Metallica spoof turn into a hugely effective viral marketing campaign for an obscure Canadian rock band? Gary Marshall explains. When news of Metallica's latest lawsuit hit the web, music fans across the globe were outraged. Already notorious for their legal action against file- sharing network Napster, the rock band were seemingly trying to stop musicians from using the guitar chords E and F. http://www.guardian.co.uk/online/news/0,12597,1012053,00.html - - - - - - - - - - Maricopa starts on criminal data network As part of a new system for criminal justice data, Maricopa County, Ariz., has begun using common case numbers to track criminal cases. The Arizona county is in its first phase of an integrated criminal justice information system (ICJIS) for several county agencies, including sheriff, county attorney, county clerk, public defender and Superior Court. The new case numbers will tell them the status of cases. In the past, a case may have had several different numbers from the various agencies. http://www.fcw.com/geb/articles/2003/0804/web-ariz-08-04-03.asp - - - - - - - - - - Animation lets murder victims have final say Forensic reconstructions of dead people's faces from skeletal remains are about to become much faster and more lifelike. A novel 3D graphics program not only speeds up the laborious process of recreating a face from a skull, but also allows the dead to frown or smile realistically. Today, when the police find a skeleton or skull, they turn to forensic artists to build a model of what the dead person might have looked like. The artist makes a plaster cast of the skull and covers it with clay to mimic flesh. http://www.newscientist.com/news/news.jsp?id=ns99994005 *********************************************************** Computer Forensics Training - Online. An intense, 150 hour, instructor lead program that teaches you computer forensics and helps prepare you for the Certified Computer Examiner exam. For more information see; www.cybercrime.kennesaw.edu *********************************************************** Search the NewsBits.net Archive at: http://www.newsbits.net/search.html *********************************************************** The source material may be copyrighted and all rights are retained by the original author/publisher. The information is provided to you for non-profit research and educational purposes. Reproduction of this text is encouraged; however copies may not be sold, and NewsBits (www.newsbits.net) should be cited as the source of the information. Copyright 2000-2003, NewsBits.net, Campbell, CA.