Daily Report - December 31, 2009

Top Story - Executive Order - Classified National Security Information. From the White House: "This order prescribes a uniform system for classifying, safeguarding, and declassifying national security information, including information relating to defense against transnational terrorism. Our democratic principles require that the American people be informed of the activities of their Government. Also, our Nation's progress depends on the free flow of information both within the Government and to the American people. Nevertheless, throughout our history, the national defense has required that certain information be maintained in confidence in order to protect our citizens, our democratic institutions, our homeland security, and our interactions with foreign nations. Protecting information critical to our Nation's security and demonstrating our commitment to open Government through accurate and accountable application of classification standards and routine, secure, and effective declassification are equally important priorities."

View the full text of the Executive Order.

See full text of Memorandum for the Heads of Executive Departments and Agencies below.

Presidential Memorandum - Implementation of the Executive Order, "Classified National Security Information"

Today I have signed an executive order entitled, "Classified National Security Information" (the "order"), which substantially advances my goals for reforming the security classification and declassification processes. I expect that the order will produce measurable progress towards greater openness and transparency in the Government's classification and declassification programs while protecting the Government's legitimate interests, and I will closely monitor the results. I also look forward to reviewing recommendations from the study that the National Security Advisor will undertake in cooperation with the Public Interest Declassification Board to design a more fundamental transformation of the security classification system. To further assist in fulfilling the goal of measurable progress toward greater openness and transparency, I hereby direct the following actions.

1. Initial Implementation Efforts.

Successful implementation of the order requires personal commitment from the heads of departments and agencies, as well as their senior officials. It also requires effective security education and training programs, self-inspection programs, and measures designed to hold personnel accountable.

In accordance with section 5.4 of the order, the head of each department and agency that creates or handles classified information shall provide the Director of the Information Security Oversight Office (ISOO) a copy of the department or agency regulations implementing the requirements of the order. Such regulations shall be issued in final form within 180 days of ISOO's publication of its implementing directive for the order. The Director of ISOO shall consider agency actions to implement the requirements of section 5.4 of the order as a key element in planning oversight of agencies. Each senior agency official designated under section 5.4(d) of the order shall provide ISOO with updates concerning agency plans and other actions to implement the requirements of the order. The Director of ISOO shall publish a periodic status report on agency implementation.

2. Declassification of Records of Permanent Historical Value.

Under the direction of the National Declassification Center (NDC), and utilizing recommendations of an ongoing Business Process Review in support of the NDC, referrals and quality assurance problems within a backlog of more than 400 million pages of accessioned Federal records previously subject to automatic declassification shall be addressed in a manner that will permit public access to all declassified records from this backlog no later than December 31, 2013. In order to promote the efficient and effective utilization of finite resources available for declassification, further referrals of these records are not required except for those containing information that would clearly and demonstrably reveal: (a) the identity of a confidential human source or a human intelligence source; or (b) key design concepts of weapons of mass destruction.

The Secretaries of State, Defense, and Energy, and the Director of National Intelligence shall provide the Archivist of the United States with sufficient guidance to complete this task. The Archivist shall make public a report on the status of the backlog every 6 months.

3. Delegation of Original Classification Authority.

Delegations of original classification authority shall be limited to the minimum necessary to implement the order and only those individuals or positions with a demonstrable and continuing need to exercise such authority shall be delegated original classification authority.

Accordingly, heads of departments and agencies with original classification authority shall commence a review to ensure that all delegations of original classification authority are so limited and otherwise in accordance with section 1.3(c) of the order. Each department and agency shall submit a report on the results of this review to the Director of ISOO within 120 days of the date of this memorandum.

4. Promotion of New Technologies to Support Declassification.

Striking the critical balance between openness and secrecy is a difficult but necessary part of our democratic form of government. Striking this balance becomes more difficult as the volume and complexity of the information increases. Improving the capability of departments and agencies to identify still sensitive information and to make declassified information available to the public are integral parts of the classification system.

Therefore, I am directing that the Secretary of Defense and the Director of National Intelligence each support research to assist the NDC in addressing the cross-agency challenges associated with declassification.

5. Publication. The Archivist of the United States is authorized and directed to publish this memorandum in the Federal Register.

# # #

December 30, New York Times – (National) Obama curbs secrecy of classified documents. The President declared on Tuesday that “no information may remain classified indefinitely” as part of a sweeping overhaul of the executive branch’s system for protecting classified national security information. In an executive order and an accompanying presidential memorandum to agency heads, the President signaled that the government should try harder to make information public if possible, including by requiring agencies to regularly review what kinds of information they classify and to eliminate any obsolete secrecy requirements. “Agency heads shall complete on a periodic basis a comprehensive review of the agency’s classification guidance, particularly classification guides, to ensure the guidance reflects current circumstances and to identify classified information that no longer requires protection and can be declassified,” the President wrote in the order, released while he was vacationing in Hawaii.

Source: http://www.nytimes.com/2009/12/30/us/politics/30secrets.html?ref=us

December 30, IT Business Edge – (International) Laptop theft puts MBNA customers at risk. MBNA has confirmed that customer data has been compromised following the theft of a laptop from the offices of credit and finance firm NCO Europe. According to SC Magazine, the laptop contained some personal details, but no PIN numbers. An MBNA spokesman said they believe that none of the details had been used fraudulently. Still, the company is offering affected customers free access to CreditExpert from Experian for the next 12 months.

Source: http://www.itbusinessedge.com/cm/community/news/sec/blog/laptop-the...

December 29, Anchorage Daily News – (Alaska) Source of stolen credit card information was a restaurant. The source of the debit and credit card data stolen from hundreds of Anchorage residents in a sophisticated hacking attack was Little Italy, a family-owned restaurant in South Anchorage, its owner said Tuesday. Police say anywhere from 150 to 1,000 card numbers were stolen and used in the attack, which started generating reports of fraudulent purchases about a month ago. The scammers, in what appears to be a nationwide, organized effort, have spent thousands of dollars on the East Coast with the stolen data, according to police. According to the owners, the hack was actually perpetrated against a third-party network run by a nationwide corporation they would not name. The chief technology officer for Digital Securus, a local firm that has been helping examine the network at Little Italy, said his group found hacker programs on the point-of-sale terminals at the restaurant. “So what the bad guys did was, instead of trying to intercept that encrypted transmission, which they knew was futile, they came in and they installed a hacker program on the point-of-sale machines that actually intercepted that card number as it was being swiped,” he said. Both the restaurant and police say the breach has been fixed and the system is again secure. Police, however, are continuing to work with federal authorities to figure out who is behind the attack. Investigators suspect the stolen numbers were sold to third parties, who made fake cards with the information, an APD cyber crimes detective said last week.

Source: http://www.adn.com/front/story/1073062.html

December 29, WTVC 9 Chattanooga – (Georgia) Bank scam hits Chickamauga hard. A bank account draining scam unfolded in Chickamauga the day after Christmas. It was a calculated “phishing” scam. A man’s recorded message claiming to be from the Bank of Chickamauga informed customers their ATM cards were restricted and gave them a number to call. After an unknown number of actual Bank of Chickamauga customers have been ripped off, the Federal Trade Commission has now taken over that number: 1-888-557-7512. A message on that number informs callers they have fallen victim to a scam. A bank executive says the number could be more than one hundred people. The bank’s vice president said, “Do not give information to anyone.” He added that if a customer did not initiate the phone call, then the customer must not divulge any information. From what WTVC-TV found out, this was a very widespread, random call. It appears they just used the prefix “375” and called all kinds of numbers in Chickamauga. This scam is not protected by the Federal Deposit Insurance Corporation. The bank’s executive vice president explains why. “Because it is fraud originated by a third party,” he said. The vice president of the bank says each case will be dealt with individually. But in all likelihood, customers lost whatever was in their account. Chickamauga police and the FBI are also aware of this scam. Investigators suspect this is a scam originating from another country. The bank would not reveal how much money was stolen, but it was all withdrawn electronically.

Source: http://www.newschannel9.com/news/bank-987486-chickamauga-hard.html

December 29, SCMagazine – (National) Parties agree to settlement over Countrywide data breach. A federal judge in Kentucky has granted preliminary approval to settle a class-action lawsuit relating to a data breach that pinned millions of Countrywide Financial customers against the mortgage company. Last week’s settlement, which still must undergo a final approval hearing, would provide free credit monitoring for up to 17 million people whose personal data was exposed, according to published reports. To be eligible, victims must have used Countrywide before July 1, 2008. In addition, participants are eligible to receive up to $50,000 per incident of identity theft, though Countrywide representatives have denied that anyone fell victim to fraud. A spokeswoman for Bank of America, which now owns Countrywide, did not respond to a request for comment on Tuesday. Some 35 lawsuits resulted from the breach before class-action status was granted, according to reports.

Source: http://www.scmagazineus.com/parties-agree-to-settlement-over-countr...

December 29, U.S. Department of Justice – (National) Major international hacker pleads guilty for massive attack on U.S. retail and banking networks. A man from Miami pleaded guilty Tuesday to conspiring to hack into computer networks supporting major American retail and financial organizations, and to steal data relating to tens of millions of credit and debit cards. The man, aka “segvec,” “soupnazi” and “j4guar17,” pleaded guilty to two counts of conspiracy to gain unauthorized access to the payment card networks operated by, among others, Heartland Payment Systems, a New Jersey-based card processor; 7-Eleven, a Texas-based nationwide convenience store chain; and Hannaford Brothers Co. Inc., a Maine-based supermarket chain. The plea was entered in federal court in Boston. The case is one of the largest data breaches ever investigated and prosecuted in the United States. According to information contained in the plea agreement, he leased or otherwise controlled several servers, or “hacking platforms,” and gave access to these servers to other hackers, knowing that they would use them to store malicious software and launch attacks against corporate victims. Malware used against several of the corporate victims was also found on a server controlled by the man. He tested malware by running multiple anti-virus programs in an attempt to ascertain if the programs detected the malware. According to information in the plea agreement, it was foreseeable to the man that his co-conspirators would use malware to steal tens of millions of credit and debit card numbers, affecting more than 250 financial institutions.

Source: http://www.justice.gov/opa/pr/2009/December/09-crm-1389.html

December 30, Associated Press – (International) Dutch to use full body scanners for US flights. The Netherlands will immediately begin using full body scanners for flights heading to the United States to prevent future terrorist attacks like the foiled Christmas Day attempt. In a preliminary report on Wednesday, the Dutch government said the plan to blow up the Detroit-bound aircraft was professional but called its execution “amateurish.” A Dutch official said the terrorist apparently assembled the explosive device, including 80 grams of PETN, in the aircraft toilet, then planned to detonate it with a syringe of chemicals. Amsterdam’s Schiphol has 15 body scanners, but their use has been limited because of privacy objections that they display the contours of the passenger’s body. Neither the European Union nor the U.S. have approved the routine use of the scanners. New software, however, eliminates that problem by projecting a stylized image onto a computer screen, highlighting the area of the body where objects are concealed in pockets or under the clothing and alerting security guards. Two scanners have been experimentally using that software since late November and the Dutch said those will be put into use immediately. All scanners will be upgraded within three weeks so they can be used on flights to the United States.

Source: http://www.forbes.com/feeds/ap/2009/12/30/general-us-airliner-attac...

December 29, Foster’s Daily Democrat – (New Hampshire) In wake of privacy breach, fed agency finds WDH records are currently protected. Spurred by complaints over Wentworth-Douglass Hospital’s in Dover, New Hampshire, handling of a privacy breach, a federal agency’s investigation found the hospital has a system in place that protects patients’ information and ensures accurate record-keeping. A spokeswoman for the Centers for Medicare and Medicaid Services, which authorized state health investigators to conduct an unannounced survey of hospital operations on December 10, said “the hospital was found to be currently in compliance with the federal standards of patients’ rights and medical records.” The spokeswoman said investigators focused on whether patients’ records could be improperly accessed and “that situation no longer exists.”

Source: http://www.fosters.com/apps/pbcs.dll/article?AID=/20091229/GJNEWS_0...

December 30, Associated Press – (Pennsylvania) Penn State warning 30,000 of privacy breach. Pennsylvania State University says the Social Security numbers of nearly 30,000 individuals may have been exposed because of a privacy breach caused by infected university computers. A school spokeswoman said yesterday that there was no evidence the information had been accessed by unauthorized parties, but that the university was being cautious in notifying people their information was on an infected computer. The school announced December 23 that the computers had been hit by “malware,” or malicious software

Source: http://www.philly.com/philly/news/pennsylvania/80324417.html

December 29, Associated Press – (Indiana) 75 computers stolen at Purdue; 29 more were packed to go. Purdue University is beefing up security at the campus’ computer labs following the theft of 75 computers from two buildings. Officials said 60 computers were taken Saturday from Stanley Coulter Hall and 15 computers were taken December 18 from the Civil Engineering Building. After Saturday’s thefts, police discovered that 29 computers had been placed in bubble wrap but had not been removed from another building, Heavilon Hall. A Purdue spokesman says campus police are stepping up patrols and working with officials from the school’s information technology department to prevent more thefts. A University spokeswoman says the computer labs are locked unless someone is staffing the location. She says the buildings that house the labs are sometimes left open.

Source: http://www.journalgazette.net/article/20091229/NEWS07/912299963/100...

December 27, PC World – (International) Good guys bring down the Mega-D botnet. For two years, a researcher with security company FireEye worked to keep Mega-D bot malware from infecting clients’ networks. In the process, he learned how its controllers operated it. Last June, he began publishing his findings online. In November, he suddenly switched from defense to offense. And Mega-D — a powerful, resilient botnet that had forced 250,000 PCs to do its bidding — went down. He and two FireEye colleagues went after Mega-D’s command infrastructure. His team first contacted Internet service providers that unwittingly hosted Mega-D control servers; his research showed that most of the servers were based in the United States, with one in Turkey and another in Israel. The FireEye group received positive responses except from the overseas ISPs. The domestic C&C servers went down. Next, the researchers contacted domain-name registrars holding records for the domain names that Mega-D used for its control servers. The registrars collaborated with FireEye to point Mega-D’s existing domain names to nowhere. By cutting off the botnet’s pool of domain names, the antibotnet operatives ensured that bots could not reach Mega-D-affiliated servers that the overseas ISPs had declined to take down. Finally, FireEye and the registrars worked to claim spare domain names that Mega-D’s controllers listed in the bots’ programming. The controllers intended to register and use one or more of the spare domains if the existing domains went down — so FireEye picked them up and pointed them to “sinkholes” (servers it had set up to sit quietly and log efforts by Mega-D bots to check in for orders). Using those logs, FireEye estimated that the botnet consisted of about 250,000 Mega-D-infected computers. MessageLabs, a Symantec e-mail security subsidiary, reports that Mega-D had “consistently been in the top 10 spam bots” for the previous year. The botnet’s output fluctuated from day to day, but on November 1 Mega-D accounted for 11.8 percent of all spam that MessageLabs saw. Three days later, FireEye’s action had reduced Mega-D’s market share of Internet spam to less than 0.1 percent, MessageLabs says.

Source: http://www.pcworld.com/article/185122/good_guys_bring_down_the_mega...

The abstracts above are selected from today's DHS Daily Open Source Infrastructure Report (Daily Report). The Daily Report is collected each week day as a summary of open-source published information concerning significant critical infrastructure issues. Each Daily Report is divided by the critical infrastructure sectors and key assets defined in the National Infrastructure Protection Plan. Items selected by Cybercrime.TV are drawn from Banking and Finance, Information Technology, and Communications, as well as other sectors when an item is computer-related.