NewsBits for May 26, 2005 ************************************************************ Teen hacker goes down down under A 15 YEAR old Kiwi hacker has been sentenced to three months in a juvenile detention centre and his mum ordered to pay $1496.50 in reparations. The youth was charged with accessing a computer for a dishonest purpose, causing loss by deception, and theft. http://www.theinquirer.net/?article=23505 - - - - - - - - - - Federal Law Enforcement Announces Operation D-Elite, Crackdown on P2P Piracy Network. Acting Assistant Attorney General John C. Richter of the Criminal Division, Homeland Security Assistant Secretary for Immigration and Customs Enforcement Michael J. Garcia, and Assistant Director Louis M. Reigel of the FBI's Cyber Division today announced the first criminal enforcement action targeting individuals committing copyright infringement on peer-to-peer (P2P) networks using cutting edge file-sharing technology known as BitTorrent. http://www.fbi.gov/dojpressrel/pressrel05/bittorrent052505.htm - - - - - - - - - - Kids nurse charged with child porn A FORMER nurse at the only dedicated children's hospital in Perth has been charged with possessing child pornography. Following a raid on the Beaconsfield home of a 44-year-old man in February, forensic analysis of his computer led police to lay the charges this morning. If convicted, the man will have to provide his details to the state's pedophile register. http://www.heraldsun.news.com.au/common/story_page/0,5478,15415739%5E1702,00.html - - - - - - - - - - TV exec arrested on suspicion of receiving, distributing child porn A 62-year-old television executive was arrested Wednesday on suspicion of receiving and distributing child pornography over the Internet, officials said. Agents with the Immigration and Customs Enforcement Agency served a search warrant at the Van Nuys apartment of Anthony Logan, a partner with Beverly Hills-based CineVision and the writer and director of the live art auction show "Fine Art Treasures." http://www.dailynews.com/Stories/0,1413,200~20954~2888685,00.html - - - - - - - - - - Police seize computer Investigators seized a computer from a Provo residence Wednesday and said they have identified a man they believe secretly recorded the online activities of Brigham Young University students who used four campus computers last month. The computer seized Wednesday morning does not belong to the man, who hasn't been contacted by police, campus police Lt. Arnie Lemmon said. "We have developed a suspect," Lemmon said. "We will be interviewing that suspect next week." http://deseretnews.com/dn/view/0,1249,600136721,00.html - - - - - - - - - - RIAA takes new shots at Internet2 swappers The Recording Industry Association of America filed lawsuits against people at 33 university campuses accused of using the high-speed Internet2 network to swap music files, the group said Thursday. The actions follow a first set of lawsuits focusing on this network last month. The group also said it had filed an additional 649 lawsuits against people making music files available on traditional file- swapping networks. http://news.com.com/2110-1027_3-5721864.html - - - - - - - - - - Witty worm traced to Europe A year after the Witty worm infected over 12,000 servers worldwide in just 75 minutes, researchers say they have discovered where the worm started and that the attack might have been an inside job. Witty hit the Internet on March 19, 2004, taking 'advantage of a flaw in products from Internet Security Systems (ISS), including RealSecure and BlackIce. Its payload was malicious, corrupting the information on a system's hard drive. The worm crashed nearly half the systems it infected. http://news.zdnet.com/2100-1009_22-5721261.html - - - - - - - - - - GAO: DHS cybersecurity plans need more work The U.S. Department of Homeland Security must do more to protect the nation's critical information infrastructure, according to a report released today by the Government Accountability Office. While the agency has begun efforts to fulfill its cybersecurity duties, "it has not fully addressed any of the 13 [primary] responsibilities, and much needs to be done," the GAO said. http://computerworld.com/securitytopics/security/story/0,10801,102049,00.html http://www.govexec.com/dailyfed/0505/052605tdpm1.htm - - - - - - - - - - Sweden's Parliament OKs Anti-Piracy Law Sweden's Parliament on Wednesday made it illegal to download copyright material from the Internet and approved measures to discourage people from burning copies of CDs and DVDs. The law, which takes effect July 1, also bans technology and software used to circumvent protections on copyright material, including music, movies and games. http://www.washingtonpost.com/wp-dyn/content/article/2005/05/25/AR2005052501623.html - - - - - - - - - - Hacker Hunters An elite force takes on the dark side of computing In an unmarked building in downtown Washington, Brian K. Nagel and 15 other Secret Service agents manned a high-tech command center, poised for the largest-ever roundup of a cybercrime gang. A huge map of the U.S., spread across 12 digital screens, gave them a view of their prey, from Arizona to New Jersey. It was Tuesday, Oct. 26, 2004, and Operation Firewall was about to be unleashed. The target: the ShadowCrew, a gang whose members were schooled in identity theft, bank account pillage, and the fencing of ill- gotten wares on the Web, police say. http://www.businessweek.com/magazine/content/05_22/b3935001_mz001.htm - - - - - - - - - - Microsoft's Own Tool May Impede Windows' Anti-Piracy Effort Microsoft's anti-piracy program, Windows Genuine Advantage, can be easily sidestepped, perhaps frustrating the Redmond, Wash.-based developer's plans to check the use of unlicensed copies of Windows. http://www.informationweek.com/story/showArticle.jhtml?articleID=163700821 - - - - - - - - - - Phishing flaw catches Xbox 360 site Microsoft has patched a potentially dangerous flaw on its www.xbox360.com website after security experts warned the software giant of a cross-site scripting vulnerability which could be exploited by hackers to launch phishing attacks. http://www.vnunet.com/vnunet/news/2135612/phishing-flaw-catches-xbox-360-site - - - - - - - - - - ZoneLabs Multiple Products Vet Engine Heap Overflow Vulnerability A critical vulnerability was identified in multiple ZoneLabs products, which may be exploited by remote attackers to execute arbitrary commands. This flaw is due to a heap overflow error in the Vet Antivirus engine (VetE.dll) when analyzing the OLE stream and processing malformed VBA macro object headers, which may be exploited by remote attackers to execute arbitrary commands by sending a specially crafted VBA project name record to a vulnerable application. http://www.frsirt.com/english/advisories/2005/0597 Net-SNMP Fixprox Insecure Temporary File Creation Vulnerability http://www.securityfocus.com/bid/13715 Computer Associates Vet Library Remote Heap Overflow Vulnerability http://www.securityfocus.com/bid/13710/solution/ IPswitch IMail Bugs Let Remote Users View Files and Execute Arbitrary Code http://www.securitytracker.com/alerts/2005/May/1014047.html Cisco ACNS Can Be Crashed With Specially Crafted Compressed DNS Data http://securitytracker.com/alerts/2005/May/1014046.html - - - - - - - - - - Photos to Fight Phishing? In a bid to stave off phishing attacks, Bank of America is offering a new service that allows online customers to verify that they are indeed at the bank's official site by displaying an image that the customer supplies in advance. The free service, called SiteKey and developed by Passmark Security of Redwood City, Calif., lets customers pick any image they have, then write a brief phrase and select three "challenge questions." http://blogs.washingtonpost.com/securityfix/2005/05/your_mugshot_ca.html Bank of America takes on cyberscams http://news.zdnet.com/2100-1009_22-5722035.html Bank of America takes on cyberscams http://news.com.com/2100-1029_3-5722035.html Banks Alert Customers Of Data Theft http://www.washingtonpost.com/wp-dyn/content/article/2005/05/25/AR2005052501777.html Egg questions security plan http://www.vnunet.com/computing/news/2135643/egg-questions-security-plan - - - - - - - - - - Device drivers filled with flaws, threaten security The uneven skills of driver programmers have left a legion of holes in software that ships with Windows and Linux, security experts say. Operating system vendors and hardware makers should commit more resources toward systematically auditing Windows and Linux device-driver code for flaws, security researchers say. http://www.securityfocus.com/news/11260 - - - - - - - - - - CIA war game simulates major Internet attack The CIA is conducting a cyber-war game this week geared to simulate a major Internet attack by enemy computer hackers, an intelligence official said today. Dubbed Silent Horizon, the three-day unclassified exercise is based on a scenario set five years in the future and involves participants from government and the private sector. http://computerworld.com/securitytopics/security/story/0,10801,102065,00.html - - - - - - - - - - IBM Transmits Info Under Cover IBM has created new software that helps companies share information without revealing its origin, a breakthrough at a time when protecting user identities remains a major challenge. DB2 Anonymous Resolution helps customers share records or documents with other organizations while protecting the identity of individuals involved in a data exchange. http://www.internetnews.com/bus-news/article.php/3507546 - - - - - - - - - - HP aims to help governments check IDs Hewlett-Packard launched a product on Friday that helps governments check the digital identity of citizens. The technology, called the HP National Identity System, is designed to be used in conjunction with a number of Microsoft products, including its .Net line of server, database and middleware programs. The companies plan to jointly develop, market and offer training for the authentication system. The product can be used to authenticate visitors to government Web sites, to control access to services and manage citizens' online identity, HP said. http://news.zdnet.com/2100-1009_22-5722206.html - - - - - - - - - - Technology's no protection against malcontents Hardware and perimeter defenses will not protect an organization from a vengeful or greedy hacker, according to Steven Branigan, former Bell Communications senior systems engineer and founding member of the New York City Electronic Crimes Task Force. http://computerworld.com/securitytopics/security/story/0,10801,102028,00.html - - - - - - - - - - Passwords are history as school rolls-out fingerprint registration A school in Stockholm has reduced the time students spend logging on to computer systems in class by up to 50 per cent, by introducing a fingerprint registration system. More than 450 students and teachers can access the school's computer network faster using the system, by reducing the amount of time lost during a 40- minute lesson by teachers having to find out children's passwords. http://www.vnunet.com/computing/news/2135650/passwords-history-school-rolls-fingerprint-registration Get used to biometrics, travelers told http://news.zdnet.com/2100-1009_22-5722264.html - - - - - - - - - - Honeynet traps the unwary Some people just won't learn, according to the University of Washington's David Dittrich, a speaker at this week's AusCERT security conference on the Gold Coast. In his 15 years with the university, Mr Dittrich has had a lot of experience with security incidents but didn't expect computer users to be so reticent to learn about the dark side of computing. http://www.smh.com.au/news/Next/Honeynet-traps-the-unwary/2005/05/23/1116700623833.html - - - - - - - - - - Bluetooth Security Review, Part 2 In part 1 of this article, we introducted Bluetooth and some of its security and privacy issues, including how it is detected and some implementation issues from various mobile phone vendors. Now in part 2 we look at Bluetooth viruses, several unpublished vulnerabilities in Symbian based phones, and then moves on to discuss "Blue tag" tracking, positioning, and privacy issues. http://www.securityfocus.com/infocus/1834 *********************************************************** Search the NewsBits.net Archive at: http://www.newsbits.net/search.html *********************************************************** The source material may be copyrighted and all rights are retained by the original author/publisher. The information is provided to you for non-profit research and educational purposes. Reproduction of this text is encouraged; however copies may not be sold, and NewsBits (www.newsbits.net) should be cited as the source of the information. Copyright 2000-2005, NewsBits.net, Campbell, CA.