Daily Report - January 13, 2010

Top Story - Governor Martin O'Malley Releases Plan to Make Maryland Nation's Epicenter for Cyber Security -- Governor unveils first comprehensive inventory of any State's cyber security assets. Addressing the growing global threat of cybercrime, Governor Martin O’Malley today joined Maryland’s Congressional Delegation, federal and military officials and business leaders at the National Institute of Standards and Technology (NIST) in Gaithersburg to unveil an aggressive policy report that calls for establishing Maryland as the nation’s epicenter for cyber security. Developed with guidance from more than 50 public and private sector information technology and security experts, CyberMaryland highlights the State’s key role in supporting President Barack Obama’s national cyber initiative and is the first comprehensive inventory of any State’s cyber security assets. Over the last year, Maryland has led the nation in the creation of computer systems design jobs, growing by 6.6 percent.

“Cyber security touches everything we do – from grocery shopping to banking, to heating our homes and talking on cell phones. With 50,000 new computer viruses emerging every day and hackers becoming increasingly advanced, the need to protect our country, our companies and our families has never been more urgent,” said Governor O’Malley, who serves as co-Lead on Homeland Security for the National Governors’ Association Public Safety Task Force and sits on the U.S. Homeland Security Advisory Council.

O’Malley continued, “Maryland is poised to lead the nation’s war on cyber crime. From the innovative work being conducted at NIST, our universities and Maryland companies both large and small, to our highly-educated IT workforce, we have a duty to ensure the safety and security of every American citizen against this growing threat.”

Cyber threats have surged in the last year, with significant jumps in the number of consumers reporting financial fraud, malware infection and password detection, according to the 2009 CSI Computer Crime and Security Survey, which surveyed more than 400 organizations in July 2009. On average, identity theft cost each organization surveyed more than $700,000, while losses from financial fraud cost $450,000.

“Our nation is at risk. Cyber raids and cyber attackers are at work every day and everywhere trying to steal our secrets and bring down our systems,” said Senator Mikulski, a member of the Senate Select Committee on Intelligence. “The good news is Maryland has the knowledge, know-how, and can-do spirit to lead the way in cyber security. Our world-class facilities - NIST, NASA and soon-to-be DISA - combined with our vibrant and growing private sector and talented universities uniquely position Maryland to lead the way in cybersecurity.”

Key among the report’s recommendations is the creation of a National Center of Excellence for Cyber Security in Maryland, which calls for a partnership between federal and State government, the private sector and academic institutions and includes an incubator; cyber security testing laboratories; information sharing about vulnerabilities in hardware, software and IT systems; education and training; and Cyber security/IT Law Council to advise the Governor and State leadership.

“Maryland’s Congressional Delegation has taken a leadership role in protecting the nation from the attacks that plague our computer networks,” said Lt. Governor Anthony G. Brown. “These efforts have been invaluable to ensuring that this threat to our nation’s security and economic viability receives the attention it deserves and that we have the proper defenses in place to keep our networks safe.”

The recommendations also include launching an aggressive effort to brand Maryland as a hub of cyber intelligence, which would help the State to attract both national and global information technology companies; continuing to focus Maryland’s academic efforts on science, technology, engineering and math (STEM) to meet the ever increasing workforce needs of the cyber and IT industry; and aligning the State’s cyber security best practices with those of the federal government to ensure a cohesive and consistent vision.

“Cyber security is a growing and robust global industry, as more financial service companies, universities and retailers address their security needs and government agencies work to safeguard our nation’s most vital networks,” said Maryland Department of Business and Economic Development Secretary Christian S. Johansson. “With our unparalleled IT assets and a highly-skilled workforce of more than 126,000, Maryland is best prepared to lead the cyber security charge and tap into what is expected to be a more than $800 billion global IT industry in 2010.”

“NIST has a longstanding comprehensive program in cyber security research and standards and we're proud to be hosting this event,” said NIST Director Patrick Gallagher. “Our efforts are greatly strengthened through collaborations with the state and private sector, and I welcome Gov. O'Malley's strong leadership in this area.”

“The economic well being and safety of our nation in the global environment requires comprehensive cyber security approaches that address policy, operations, technology, leadership, workforce and budget,” said Rosemary Budd, Booz Allen Hamilton Principal and President of the Fort Meade Alliance. “Governor O’Malley’s push to establish a National Center of Excellence for Cyber Security in Maryland, and the implementation of recommendations in the CyberMaryland report, call for collaboration between federal, state, research, academia, and private industry. Through our work together, we can provide critical advancements in cyber security solutions.”

Maryland is home to more than 50 key federal facilities and 12 major military installations, including the National Security Agency, the Army’s Communication and Electronics Command (CECOM), which will soon be locating at Aberdeen Proving Ground, and the Defense Information Systems Agency, which is slated to move to Maryland from Virginia in 2011, bringing 4,300 advanced technology jobs. Combined, these facilities and installations employ nearly 200,000 well-educated, highly-skilled government employees and contractors in cutting-edge research and development and scientific, medical and technological innovations, not counting the estimated 60,000 jobs coming to Maryland as a result of the Base Realignment and Closure process. Maryland is also home to many of the nation’s top defense contractors and has a growing cluster of private sector companies specializing in cyber security. In total, Maryland has one of the highest concentrations of technology jobs in the nation, with 10 percent of jobs classified as technology-related and led the nation in 2009 with the largest growth in computer systems design jobs.

The State is also a leader in research and development, ranking first in federal R & D obligations per capita, and second in federal R & D investment at $12.2 billion. Maryland is home to several of the nation’s top research universities, including Johns Hopkins and University of Maryland, College Park, the University of Maryland, Baltimore and the University of Maryland, Baltimore County, which combined conduct nearly $1 billion in funded research annually.

To support the cyber industry, Maryland also has the nation’s top rated public school system and is developing an education pipeline to produce highly-skilled workers trained in Science, Technology, Engineering and Math (STEM); has more than 20 colleges and universities that offer computer science degrees, including six State universities that are certified by the NSA as Centers of Academic Excellence; and is home to the nation’s first business accelerator – the Chesapeake Innovation Center – for government innovation, homeland, national and cyber security initiatives.

Download the CyberMaryland report

January 11, IDG News Service – (Maryland) Maryland aims to be cybersecurity ‘epicenter’. Maryland officials want the state to be the U.S. “epicenter” for fighting cyber attacks, and on January 11 they launched an effort to bring more cybersecurity research and jobs to the state. Maryland has several resources that make it the perfect place to be a national — and world — leader in cybersecurity, said the Governor, speaking at a kick-off event at the U.S. National Institute of Standards and Technology (NIST) in Gaithersburg, Maryland. In addition to the NIST, Maryland is home to the U.S. National Security Agency, 12 major military installations, world-class schools such as Johns Hopkins University and dozens of top cybersecurity vendors, the governer and other officials said. Cybersecurity leadership and innovation is needed at a time when the U.S. is getting attacked from all sides, said a Maryland Democratic senator. “Cybersecurity is all-hands-on-deck and all-agencies-on-deck,” she said. The governor’s administration on January 11 released a 32-page report, called CyberMaryland, focused on ways to improve cybersecurity efforts in the state. The report calls for the state to work with the U.S. government to establish a national center of excellence in cybersecurity in the state, including a cybersecurity business incubator and an education and training center.

Source: http://www.computerworld.com/s/article/9143823/Maryland_aims_to_be_...

January 11, U.S. Nuclear Regulatory Commission – (National) NRC and the North American Electric Reliability Corporation coordinate their responsibilities for cyber security requirements. The U.S. Nuclear Regulatory Commission and the North American Electric Reliability Corporation (NERC) have signed a Memorandum of Understanding (MOU) that outlines each organization’s responsibility for applying cyber security requirements to nuclear power plants. The MOU was developed to ensure consistent regulation since the NRC and NERC have overlapping authority over cyber security at these commercial facilities. The MOU acknowledges the NRC’s regulatory responsibility for inspecting digital systems that can affect safety, security and emergency preparedness of a nuclear power plant as well as NERC’s responsibility for regulating digital systems related to continuity of electric power generation. As part of the MOU, the NRC and NERC agree to share information discovered during respective inspections that they believe may be relevant to any digital system governed by the other organization. Since under this provision NERC may need access to sensitive information or Safeguards Information, NERC has agreed to comply with NRC requirements related to protecting this information. The NRC and NERC will hold a series of workshops to help U.S. nuclear power plants define which of their cyber systems and assets must comply with each organization’s requirements. A Federal Register notice outlining the details of the MOU was published today and is available at: http://edocket.access.gpo.gov/2010/2010-229.htm.

Source: http://www.nrc.gov/reading-rm/doc-collections/news/2010/10-005.html

January 11, Agence France-Presse – (International) Toronto man denies plot to bomb bourse and cash in. A Toronto man on January 11 pleaded not guilty to plotting to bomb Canada’s main stock exchange in 2006, as prosecutors said he aimed to profit from wreaking economic havoc to fund other terror attacks. The 34 year old defendant is accused of conspiring to bomb the Toronto Stock Exchange, Canada’s spy agency offices and a military base in order to try to provoke Canada’s withdrawal from Afghanistan. He was arrested with 17 alleged Islamic extremists in a 2006 police sting operation after the group sought to purchase three tons of bomb-making ingredient ammonium nitrate from undercover police officers. According to reports, he saw an opportunity to profit from blowing up the Toronto Stock Exchange by short-selling stocks before the bombings and reap a windfall that could be used to fund more terror attacks abroad. While his co-conspirators were impressionable young men with modest means, bent on destruction and mayhem for “religiously-inspired political purposes,” prosecutors say the defendant was motivated primarily by financial gain. The plan was “to affect the economy, to make it lose half a trillion dollars,” said court documents cited by the daily Globe and Mail.

Source: http://www.google.com/hostednews/afp/article/ALeqM5jwfzJk4QP28W2baG...

January 11, Wired – (National) Airport scanners can store, transmit images. Contrary to public statements made by the Transportation Security Administration (TSA), full-body airport scanners do have the ability to store and transmit images, according to documents obtained by the Electronic Privacy Information Center. The documents, which include technical specifications and vendor contracts, indicate that the TSA requires vendors to provide equipment that can store and send images of screened passengers when in testing mode, according to CNN. The TSA has stated publicly on its website, in videos and in statements to the press that images cannot be stored on the machines and that images are deleted from the scanners once an airport operator has examined them. The administration has also insisted that the machines are incapable of sending images. But a TSA official acknowledged to CNN that the machines do have these capabilities when set to “test mode.” The official said these functions are disabled before the machines are delivered to airports and that there is no way for screeners in airports to put the machines into test mode to enable the functions. The official, however, would not elaborate on what specific protections, if any, are in place to prevent airport personnel from putting the machines in test mode. The TSA also asserts that the machines are not networked, so they cannot be accessed by hackers.

Source: http://www.wired.com/threatlevel/2010/01/airport-scanners?utm_sourc...(Wired:+Index+3+(Top+Stories+2))&utm_content=Google+Reader

January 11, WPIX 11 New York – (New Jersey) 4 students arrested, charged for making ‘terroristic’ threats. Four high school students were arrested and charged Monday, after making terroristic threats against their school on Facebook, police said. According to investigators, the teens — all students at Belleville High School — talked about blowing up or setting fire to the school on the social media website. The alleged threats were found by a fellow student who immediately alerted school officials. The school was evacuated around 11:30 a.m. and students were sent home by the superintendent after police were notified, authorities said. A search of the school conducted by the Essex County Sherriff’s Office Bomb Squad turned up nothing unusual. Of the students arrested were two 16-year-old females, one 17-year-old female and a 17-year-old male. The suspects were not identified because of their ages, police said. All four students are being charged with causing a false public alarm, making terroristic threats and conspiracy.

Source: http://www.wpix.com/news/local/wpix-teens-charged-for-threats,0,448...

January 11, Web Host Industry Review – (National) Hacker finds SQL injection vulnerability in Army Web site. A Romanian hacker has disclosed an SQL injection vulnerability on a U.S. Army Web site that could lead to a full database compromise. According to a report from Softpedia, a Web site used to provide information about military housing facilities to soldiers, called Army Housing OneStop, was found to be storing passwords in plain text — a major security oversight. A compromised AHOS Web site could provide an intruder access to some 76 databases on the server, some containing confidential information on worldwide Army installations. The AHOS has since been taken offline. A security enthusiast going by the name of TinKode blogged about a proof-of-concept attack on onestop.army.mil, which seems to have been developed by a third-party government contractor, DynaTouch Corporation. The published screenshots reveal that the Web server runs on Microsoft Windows 2003 with Service Pack 2 and the database engine used to power the ASP Web site is Microsoft SQL Server 2000.

Source: http://www.thewhir.com/web-hosting-news/011110_Hacker_Finds_SQL_Inj...

January 12, IDG News Service – (International) Google blames ‘human error’ for leak of users’ business data. Google is apologizing after it mistakenly e-mailed potentially sensitive business data last week to other users of its business listings service. The company’s Local Business Center allows businesses to create a listing for Google’s search engine and Maps application, as well as add videos, coupons or photos. Google then provides data on how customers found the listing, showing search terms people used before clicking the listing and other data such as the geographic location of someone who looked up driving directions to the business. Google will send reports to those who are signed up. Early last week, Google sent the reports to third parties by mistake. The mistake affected several thousands businesses registered with Local Business Center, of which there are more than a million. People who received the data then began to publicize the incident, realizing the privacy implications. A Chicago-based Internet consultant wrote on his blog that he received information regarding the listing for Boscos, a restaurant in Tennessee that brews its own beer. The data included the number of times Boscos’ listing appeared in Google’s local search results, the number of times it had been clicked on and the number of follow-through clicks on the actual business’ Web site.

Source: http://www.infoworld.com/d/security-central/google-blames-human-err...

January 12, The Register – (International) Apple sits on critical Mac bug for 7 months (and counting). Researchers have disclosed a critical vulnerability in the latest version of Mac OS X that they say Apple has sat on for almost seven months without fixing. The buffer overflow flaw could be exploited by attackers to remotely execute malicious code, and virtually all Apple devices - including Mac computers and servers, iPhones, and even Apple TV - are susceptible, one of the researchers told The Register. SecurityReason.com, the Poland-based security firm he works for, alerted Apple to the vulnerability in the middle of June and again last month, but the computer maker has yet to patch the bug. By contrast, developers for OpenBSD, NetBSD, FreeBSD, and a variety of Mozilla applications have fixed identical vulnerabilities, in some cases within hours of notification. The bug affects all applications and operating systems that implement gdtoa floating point numbers. The OS X bug resides in the libc/strtod(3) and libc/gdtoa function. The researcher said the vulnerability could be remotely exploited using booby-trapped PHP code on a website, among other methods.

Source: http://www.theregister.co.uk/2010/01/12/critical_osx_security_bug/

January 12, The Register – (International) Frustrated bug hunters to expose a flaw a day for a month. A Russian security firm has pledged to release details of previously undisclosed flaws in enterprise applications it has discovered every day for the remainder of January. Intevydis intends to publish advisories on zero-day vulnerabilities in products such as Zeus Web Server, MySQL, Lotus Domino and Informix and Novell eDirectory between January 11 and February 1, a security blogger reports. As an opener, Intevydis published a crash bug in Sun Directory Server 7.0, along with exploit code. The final line-up of zero-days is still being finalised, but the MySQL buffer overflows and IBM DB2 root vulnerability flaws on the provisional menu sound much tastier than Intevydis’s somewhat bland opener. Advisories are due to be published on the Intevydis blog here. Intevydis said it launched its campaign after becoming more and more disillusioned with foot-dragging by vendors when confronted by security flaws in their products. Only one software vendor, Zeus, reportedly worked with Intevydis in developing a patch to be released at the same time as an upcoming advisory from the Russian security firm. Intevydis’s stance is likely to reboot the long running debate about the responsible disclosure of security vulnerabilities. An entry on the Intevydis blog accuses software vendors of exploiting researchers as unpaid lackeys.

Source: http://www.theregister.co.uk/2010/01/12/enterprise_sec_disclosure_c...

January 11, DarkReading – (International) More researchers going on the offensive to kill botnets. Yet another botnet has been shut down as of January 11 as researchers joined forces with ISPs to cut communications to the prolific Lethic spamming botnet — a development that illustrates how botnet hunters increasingly are going on the offensive to stop cybercriminals, mainly by disrupting their valuable bot infrastructures. For the most part researchers monitor and study botnets with honeypots and other more passive methods. Then security vendors come up with malware signatures to help their customers scan for these threats. But some researchers are turning up the heat on the bad guys’ botnet infrastructures by taking the lead in killing some botnets: Aside from the recent takedown by Neustar of Lethic, which is responsible for about 10 percent of all spam, FireEye in November 2009 helped shut down the MegaD botnet. And researchers at the University of California at Santa Barbara in May revealed they had taken the offensive strategy one step further by infiltrating the Torpig botnet, a bold and controversial move that stirred debate about just how far researchers should go to disrupt a botnet.

Source: http://www.darkreading.com/insiderthreat/security/vulnerabilities/s...

January 11, The Register – (International) False Facebook charge group used to spread malware. A false rumor suggesting that Facebook is to start charging is being used to bait malware traps. Thousands of disgruntled punters, angry at the $4.99 a month charge for using the social networking site that will supposedly kick in from June (or July, according to other false reports) have been induced to visit “protest group” sites in response to spam emails. However, in reality, there is no such plan and the protest pages often contain malware, as urban myth debunking site Snopes warns: The protest page was a trap for the unwary; clicking on certain elements of it initiated a script that hijacked users’ computers. Some of those who did venture a click had their computers taken over by a series of highly objectionable images while malware simultaneously attempted to install itself onto their computers.

Source: http://www.theregister.co.uk/2010/01/11/facebook_charging_rumour_ma...

January 11, IDG News Service – (International) Group behind Twitter hack takes down Baidu.com. The group that took down Twitter.com in December 2009 has apparently claimed another victim: China’s largest search engine Baidu.com. Baidu.com was offline on January 11, but at one point it displayed an image saying “This site has been hacked by Iranian Cyber Army,” according to a report in the official newspaper of the Chinese Communist Party and other Web sites. With more than half of China’s Internet search market, Baidu is by far China’s most-used search engine. The company could not immediately be reached for comment. Not much is known about the Iranian Cyber Army, which first gained notoriety with its December 18 Twitter attack. Hacking groups such as this are constantly defacing Web sites, but it is extremely rare for them to take down a site as widely used as Twitter or Baidu.com. According to security experts, Baidu’s domain name records appear to have been tampered with. On Monday, the company was using domain name servers belonging to HostGator, a Florida ISP, instead of the Baidu.com nameservers the company normally uses. “It looks like their domain account credentials may have been snagged,” said a researcher with the antivirus vendor Trend Micro. That is the same technique that was used to hijack Twitter, when Iranian Cyber Army hackers were apparently able to log in to the account used to manage Twitter’s DNS records and redirect visitors to another Web server that posted a message similar to the one spotted on Baidu.com. That attack knocked Twitter offline for more than an hour.

Source: http://www.computerworld.com/s/article/9143919/Group_behind_Twitter...

January 11, The Register – (Florida) Judge awards Dish Network $51m from satellite pirate. A federal judge has slapped a $51m judgment on a Florida man for distributing software that allowed people to receive television programming from Dish Network without paying for it. The ruling, issued on January 11 by a US District judge of Tampa, found that the defendant violated both the Digital Millennium Copyright Act and the Communications Act. Using the online monikers “Thedssguy” and “Veracity,” the defendant provided 255,741 piracy software files, making him liable for damages of $51.148m, or $200 per download. Under the DMCA, the defendant could have been forced to pay $2,500 for each download, an amount that would have brought damages to more than $639m. The defendant was also ordered to pay Dish Network’s attorney fees and to permanently stop making or distributing software that circumvents the satellite provider’s security. The software at issue allowed users to bypass access security technology provided by Dish co-venture NagraStar, so they could receive premium programming and regular channels on so-called free-to-air receivers. The receivers are designed to play only unencrypted satellite transmissions, such as ethnic, religious, and advertising content. After flashing the devices with the software, users could watch paid programming on the receivers.

Source: http://www.theregister.co.uk/2010/01/11/satellite_piracy_judgement/

The abstracts above are selected from today's DHS Daily Open Source Infrastructure Report (Daily Report). The Daily Report is collected each week day as a summary of open-source published information concerning significant critical infrastructure issues. Each Daily Report is divided by the critical infrastructure sectors and key assets defined in the National Infrastructure Protection Plan. Items selected by Cybercrime.TV are drawn from Banking and Finance, Information Technology, and Communications, as well as other sectors when an item is computer-related.