$30M ERP Clusterf*ck

"California's Marin County has sued Deloitte Consulting LLP for $30 million over an allegedly botched SAP Enterprise Resource Planning (ERP) project.

"The lawsuit, filed in Marin County Superior Court last Friday, accuses Deloitte of misrepresenting its skills and capabilities when originally pitching for the project in 2004.

"The 38-page complaint alleges that Deloitte was lying when the company promised to assemble a team of its "best resources" for the project and when it claimed to have `deep SAP and public sector knowledge` when marketing itself to the county.

"Deloitte's misrepresentation of facts resulted in a defectively designed and deficiently implemented project that resulted in the county having to pay millions of dollars to remedy, the lawsuit alleged.

"Meanwhile, Deloitte is claiming that it fulfilled all of its obligations under the contract..."

More at ComputerWorld...

The First Rule Of Govt. Info Security...

"Last week, Pennsylvania’s chief information security officer Robert Maley was at an information security conference in San Francisco talking about a hacking incident involving PennDOT’s computers. This week, Maley is gone.

"Gary Tuma, Gov. Ed Rendell’s press secretary, confirmed that Maley is no longer employed by the state, but he declined to comment further, saying it is a personnel matter.

"Attempts to contact Maley yesterday were unsuccessful.

"Danielle Klinger, a spokeswoman for the state Department of Transportation, said the agency is not aware of any hacking or breach that occurred involving scheduling system for its driving test. However, she said that a few weeks ago, `we did discover an anomaly and we have actually turned that over to [the state police] for further investigation. We’re not sure what that anomaly is, but it is being investigated. Unfortunately, I can’t provide any more details on it.`"

More at PennLive.com...

Energizer Bunny Arrested, Charged With Battery

"A USB charger from Energizer uses software that contains a Trojan, according to US-CERT. The software was apparently developed outside the U.S. and may have been giving hackers access to PCs since 2007. An analyst said trust in the Energizer bunny may have led many consumers to install the DUO USB charger malware even with a warning.

"US-CERT researchers said Friday that the software that installs with the Energizer charger contains a Trojan horse that gives malicious hackers a back door into Windows machines.

"`An attacker is able to remotely control a system Relevant Products/Services, including the ability to list directories, send and receive files, and execute programs. The backdoor operates with the privileges of the logged-on user,` US-CERT said. `Removing the Energizer USB charger software will also remove the registry value that causes the backdoor to execute automatically when Windows starts.`"

More at NewsFactor.com...

AV Spending Seen As Pointless

"Following the highly publicized and successful malware attacks on Google, Symantec, Adobe, Dow Chemical, and others, business and government executives are questioning the value of their AntiVirus subscriptions. Their unprecedented skepticism will grow even more intense as more executives learn that all of these successful attacks were easily preventable.

"`In almost every meeting I’ve had since the mainstream media started reporting on these highly visible failures, executives and IT personnel have criticized their AntiVirus computer protection. This Aurora/Hydra outbreak could spark a big change in 2010 enterprise IT security spending, a multi-billion dollar change`, predicts Mike Fumai, CEO of Blue Ridge Networks.

"There’s nothing particularly novel about the exploitable vulnerabilities in Internet Explorer this month, or those in Adobe Acrobat Reader last month. These are merely new entries in a formulaic story re-written almost monthly. Last week’s out-of-cycle security patch from Microsoft is just a less frequently seen plot twist. Until now, these recurring stories only served to increase spending on AntiVirus software from well-known security vendors. However, these targeted organizations with deep pockets and large IT security staffs were successfully attacked because their name-brand AntiVirus software did not have signatures to detect the malware attack code."

More at PRWeb...

Firefox, Opera Benefit From IE Schadenfreude

"Mozilla yesterday reported a `huge increase` in downloads of Firefox in Germany after that country's computer security agency urged users of Microsoft's Internet Explorer (IE) to dump the browser and run a rival instead.

"German downloads of Firefox during a four-day stretch starting last Friday jumped by about 300,000 over normal, said Ken Kovash, Mozilla's director of analytics, on the company's `Blog of Metrics.` `Over the past few days there has been a huge increase in the number of Firefox downloads from IE users in Germany,` Kovash claimed.

"Norwegian browser maker Opera Software said that downloads in Germany of its desktop application were double the usual rate last weekend, and downloads in Australia were up 40% over normal.

"Mozilla and Opera cited recommendations by German, French and Australian authorities to stop using IE as the cause for the jump. Last Friday, Germany's Federal Office for Information Security, known by its German initials of BSI, and France's CERTA each called for users to stop running IE until Microsoft patches a critical vulnerability. `Pending a patch from the publisher, CERT recommends using an alternative browser,` a translation of the French advisory stated."

More at ComputerWorld...

Facebook Follies

"Vanessa Palm and Alexander Rust, two 20-something Americans vacationing in the Bahamas last February, decided to catch and eat an iguana - a species protected under Bahamian law. Unfortunately for them, they also decided to post pictures on Facebook of their illicit meal.

"Bahamian authorities were alerted to the photos, and promptly proceeded to track down and arrest the two tourists for killing and eating a protected iguana.

"Perhaps they used the jail time to debate whether or not it tasted like chicken.

"Similarly, a 20-year-old employee of a Petland pet store in Ohio not only drowned rabbits from the store, she creepily bragged about it on her Facebook "wall." Someone from People for the Ethical Treatment of Animals (PETA) learned of this, and she was soon charged with two counts of animal cruelty.

"Meanwhile, it wasn't enough for 38-year-old Jacob Rehm of Morrisville, Vt., to steal a tour bus from his former employer, Lamoille Valley Transportation, and take it on a joyride. No, he had to go and make a four minute video of his little adventure (complete with a tour of the $500,000 bus itself) and post it on YouTube.

"After the bus was recovered in another town and Rehm was charged with the theft, the prosecutors found that video very helpful when they went to court."

More at The Southeast Texas Record...

Adobe Hoisted On Its Own Petard

"Adobe today confirmed that the cyberattack that hit its corporate network earlier this month was connected to the large-scale attacks Google cited yesterday as one reason it might abandon China.

"Meanwhile, some researchers have hinted, and others have claimed, that the attacks against both Google and Adobe were based on malicious PDFs that exploited a just-patched vulnerability in Adobe's popular Reader software...

"Security researchers hinted earlier today that the attacks against Google, Adobe and dozens of other major firms were conducted using malicious PDFs that exploited one or more vulnerabilities in Adobe Reader. Analysts at Verisign's iDefense security group told Robert McMillan of IDGNews today that hackers had launched targeted attacks using a malicious document attached to e-mail messages."

More at ComputerWorld...

Microsoft Getting Into Kiddie Porn Business

"Microsoft, through a combination of efforts from the National Center for Missing and Exploited Children (NCMEC), their own dedicated Microsoft Research section and Dartmouth College, Hanover, a new next-generation technology is being launched with the aim of tacking online child abuse imagery.

"Using PhotoDNA, the system picks out images which are identical, even if they have been edited, resized, cropped and edited in other ways, and logs them. The system matches them through a technique which monochromes the image, breaks the image into smaller chunks and the intensity gradients are converted into a signature.

"The signatures, even through editing, will remain the same and allow the system to find copies of the original image. Some similarities could compare QR codes to this, allowing similar cells to match other images, allowing the system to recognise similar gradients and therefore image copies across massive sets of data."

More at ZDNet Blogs...

You Are So ROCKED

"It’s no secret that most people use the same password over and over again for most of the services they sign up for. While it’s obviously convenient, this becomes a major problem if one of those services is compromised. And that looks to be the case with RockYou, the social network app maker.

"Over the weekend, the security firm Imperva issued a warning to RockYou that there was a serious SQL Injection flaw in their database. Such a flaw could grant hackers access to the the service’s entire list of user names and passwords in the database, they warned. Imperva said that after it notified RockYou about the flaw, it was apparently fixed over the weekend. But that’s not before at least one hacker gained access to what they claim is all of the 32 million accounts. 32,603,388 to be exact. The best part? The database included a full list of unprotected plain text passwords. And email addresses. Wow..."

More at TechCrunch...

Facebook Users PWN3D By Rubber Ducky, Cats

"In research commissioned by The Daily Telegraph, which has shocked even top fraud squad police, almost half of users in their 20s agreed to a request from a rubber duck to be Facebook `friends`.

"A similar result occurred with a group of internet users in their 50s, with many agreeing to be Facebook friends with a photo of two cats.

"Many of the Facebook users in both age groups volunteered some of their most intimate details to both the rubber duck and the cats, including their full date of birth, workplace, email address and location. Some even volunteered full addresses and phone numbers without prompting.

"The study was conducted by leading internet security firm Sophos.

"It has raised serious questions about the wisdom of average internet users, given the friend requests were sent without any introduction."

More at The Daily Telegraph...

Believe It? You Will.

Some Things Never Change

"AT&T got some bad news from Consumer Reports this week, as the magazine's latest survey shows that the carrier now has the lowest level of customer satisfaction in the U.S.

"AT&T got its lowest marks in the survey for its voice services, as it was the only wireless carrier in the United States to receive below-average marks for its voice quality. Verizon received above average marks for its voice service while T-Mobile and Sprint both received average marks. AT&T also received subpar remarks across the board for its customer service while receiving average marks for its text-messaging and data services."

From ComputerWorld...

Push "da button", Frank

"Some Facebook users have been infected with a worm after clicking on an image of a scantily clad woman, which then redirects the victims to a pornography site, according to security researchers.

"The worm posts an image on a victim's Facebook Wall with a photo of a woman in a bikini and the message `click 'da button, baby.` Wall posts are viewable by a Facebook user's friends.

"If a friend clicks on the image and is logged into Facebook, the image is then is posted to their own Wall. Their Web browser will then open a Web page with a larger version of the same image. A further click on "da button" redirects the friend to a pornography site, according to Roger Thompson chief research officer for antivirus vendor AVG Technologies. Thompson posted a video of the attack on his blog."

From ComputerWorld...

Old Passwords Never Die

"Federal authorities on Wednesday filed intrusion charges against two men accused of accessing the computer systems of their former employer.

"Scott R. Burgess, 45, of Jasper, Indiana, and Walter D. Puckett, 39, of Williamstown, Kentucky, both worked as managers for Indiana-based Stens Corporation until taking jobs with a competing company in Ohio, according to an indictment filed in federal court. On at least 12 occasions, they used old passwords to access their former employer's computer and access proprietary information, prosecutors allege.

"Although the men left their jobs in 2004 and early 2005, they were able to use the outdated passwords successfully as late as September of 2006. On at least two occasions, administrators at Stens grew suspicious and terminated old passwords. The men simply tried different login credentials - and succeeded several times."

From The Register...

Surge In Security Newbs Predicted

"IT professionals are placing their bets on security as they plot their next career moves, according to a new study published earlier today.

"The survey of more than 1,500 IT workers, which was conducted by the IT trade association CompTIA, found that 37 percent intend to pursue a security certification over the next five years. Another 18 percent of IT workers said they will seek ethical hacking certifications during the same time period, while 13 percent identified forensics as their next certification target.

"`Given the growing reach of security, with threats becoming more pervasive and dangerous and with no business or industry immune to those threats, it makes sense that many IT professionals view this as a must-have for career advancement,` said Terry Erdle, senior vice president, skills certifications for CompTIA."

More at DarkReading...

The REAL Threat: Unemployed Advertising Agents

"Remember when the global economic crisis was supposed to drive legions of desperate, unemployed computer programmers into cybercrime? It turns out the real threat comes from unemployed advertising agents.

"Scammers posing as the well known ad agency Spark-SMG tricked Gawker Media into running a fake Suzuki ad last week that served malicious code, according to a report in Silicon Alley Insider. A similar scam hit the New York Times in September, but unlike the newspaper, Gawker has released the e-mails it exchanged with the scammers, and the messages show just how confidently the perps navigated the ad-buy process..."

More at Wired...

Gartner: Newbz To Write 25% Of Business Apps

"By 2014, citizen developers will build at least 25 percent of new business applications, according to Gartner, Inc. Gartner said that this advance should both enable end users and free up IT resources. However, analysts warned that IT organizations that fail to capitalize on the opportunities that citizen development presents will find themselves unable to respond to rapidly changing market forces and customer preferences.

"Gartner defines a citizen developer as a user operating outside of the scope of enterprise IT and its governance who creates new business applications for consumption by others either from scratch or by composition.

"`Future citizen-developed applications will leverage IT investments below the surface, allowing IT to focus on deeper architectural concerns, while end users focus on wiring together services into business processes and workflows,` said Eric Knipp, senior research analyst at Gartner. `Furthermore, citizen development introduces the opportunity for end users to address projects that IT has never had time to get to — a vast expanse of departmental and situational projects that have lain beneath the surface.`"

From Businesswire...

Gartner Smoking Crack Again

"Avatars are creeping into business environments and will have far reaching implications for enterprises, from policy to dress code, behavior and computing platform requirements, according to Gartner, Inc. Gartner predicts that by year-end 2013, 70 percent of enterprises will have behavior guidelines and dress codes established for all employees who have avatars associated with the enterprise inside a virtual environment.
view counter

"Avatars are two- or-three dimensional objects that most often resemble a human and are often animated and controlled remotely by a person in a virtual or 3-D Internet environment. In a business setting they are used as visual representations of people.

"`As the use of virtual environments for business purposes grows, enterprises need to understand how employees are using avatars in ways that might affect the enterprise or the enterprise’s reputation,` said James Lundy, managing vice president at Gartner. `We advise establishing codes of behavior that apply in any circumstance when an employee is acting as a company representative, whether in a real or virtual environment. Addendums, specific to virtual environments can be added as required.`"

From Internet Ad Sales...

Twit PWNAG3 "Rampant"

"Social networks are rapidly becoming a primary channel to market for malware distributors and other cyber-criminals as the use of popular sites such as Twitter continues to take off, and the communications vehicles subsequently create new opportunities for attackers to hide their threats using features such as so-called link shorteners.

"Attackers have been working to infiltrate and abuse social networks for years, but the issue is becoming truly pervasive nowadays as they shift even more of their efforts away from more traditional electronic messaging systems and distribute a greater share of their nefarious content over so-called Web 2.0 sites, in particular Twitter, according to Symantec security researcher Ben Nahorney.

"The distribution of malware infection links over Twitter has become particularly problematic of late, Nahorney noted in a recent blog post. Since the 140 character limit for posts to made over micro-blogging platform has lead to widespread use of URL-shorteners obscure address details, and even savvy users of Twitter are likely taking bigger risks, the implication appears to be..."

More at eWeek...

IT Employee Of The Week

"In a twist of Alanis Morrissettian irony, a man serving a six-year prison sentence for stealing millions of dollars through online credit card fraud recently succeeded in (surprise!) hacking into his prison's computer network, effectively paralyzing the entire system. The really incomprehensible part, though, is that officials at Ranby Prison, close to Retford, Nottinghamshire, England, gave him access to the computer.

"Apparently in dire need of an internal TV station at the facility, officers decided against hiring a third party (e.g., not a convicted hacker) to set up the system. They instead opted to keep the operation in (the Big) house, delegating the duty to one Douglas Havard. So, as convicted hackers are wont to do, Havard, left unguarded, worked his way into the prison's hard drive, and set up a labyrinth of passwords to lock everyone else out of the system....."

More at switched.com...

FED FAP FLAP

"Employee misconduct investigations, often involving workers accessing pornography from their government computers, grew sixfold last year inside the taxpayer-funded foundation that doles out billions of dollars of scientific research grants, according to budget documents and other records obtained by The Washington Times.

"The problems at the National Science Foundation (NSF) were so pervasive they swamped the agency's inspector general and forced the internal watchdog to cut back on its primary mission of investigating grant fraud and recovering misspent tax dollars.

"`To manage this dramatic increase without an increase in staff required us to significantly reduce our efforts to investigate grant fraud,` the inspector general recently told Congress in a budget request. `We anticipate a significant decline in investigative recoveries and prosecutions in coming years as a direct result.`"

More at The Washington Times...