Microsoft: Sleeping With The Enemy... Again

"Microsoft has signed a deal to open its Windows 7 source code up to the Russian intelligence services.

"Russian publication Vedomosti reported on Wednesday that Microsoft had also given the Russian Federal Security Service (FSB) access to Microsoft Windows Server 2008 R2, Microsoft Office 2010 and Microsoft SQL Server source code, with hopes of improving Microsoft sales to the Russian state.

"The agreement will allow state bodies to study the source code and develop cryptography for the Microsoft products through the Science-Technical Centre 'Atlas', a government body controlled by the Ministry of Communications and Press, according to Vedomosti."

More at ZDNet UK...

Tax Dollars To Fund Government Time-Waster

"Federal employees and managers will be able to meet, interact, train and learn together in a government-only online virtual world being created in the vGov project.

"The Agriculture and Homeland Security departments, Air Force and National Defense University iCollege have joined to create the vGov virtual world behind a secure firewall that can only be accessed by federal employees with authenticated identities.

"Paulette Robinson, assistant dean for teaching, learning and technology at the iCollege, said at the Gov 2.0 Expo today the project will use the three-dimensional immersive experience of virtual worlds to bring employees together from locations worldwide for real-time interactions. People will use avatars to appear in the virtual world, where they can chat with other avatars and interact with the environment."

More at Federal Computer Weekly...

Microsoft's African Investments Start To Pay Off

"Imagine a network of virus-driven computers so infectious that it could bring down the world's top 10 leading economies with just a few strokes. It would require about 100 million computers working together as one, a `botnet` -- the cybersecurity world's version of a WMD. But unlike its conventional weapons equivalent, this threat is the subject of no geopolitical row or diplomatic initiative. That's because no one sees it coming -- straight out of Africa.

"Cybercrime is growing at a faster rate in Africa than on any other continent in the world, according to statistics presented at a conference on the matter in Cote D'Ivoire in 2008. Cybersecurity experts estimate that 80 percent of PCs on the African continent are already infected with viruses and other malicious software. And while that may not have been too worrisome for the international economy a few years ago, the arrival of broadband service to Africa means that is about to change. The new undersea broadband Internet cables being installed today will make Africa no further away from New York than, say, Boston, in the virtual world.

"Broadband Internet access will allow Africa's virus and malware problems to go global. With more users able to access the Internet (and faster), larger amounts of data can be transferred both out and inward. More spam messages in your inbox from Africa's email fraudsters will be only the beginning..."

More at ForeignPolicy.com...

There's An App For That

"Militants in Iraq have used $26 off-the-shelf software to intercept live video feeds from U.S. Predator drones, potentially providing them with information they need to evade or monitor U.S. military operations.

"Senior defense and intelligence officials said Iranian-backed insurgents intercepted the video feeds by taking advantage of an unprotected communications link in some of the remotely flown planes' systems. Shiite fighters in Iraq used software programs such as SkyGrabber -- available for as little as $25.95 on the Internet -- to regularly capture drone video feeds, according to a person familiar with reports on the matter.

"U.S. officials say there is no evidence that militants were able to take control of the drones or otherwise interfere with their flights. Still, the intercepts could give America's enemies battlefield advantages by removing the element of surprise from certain missions and making it easier for insurgents to determine which roads and buildings are under U.S. surveillance."

More at THE WALL STREET JOURNAL...

Much Ado About Diddly Squat

"Denial-of-service attacks against government Web sites in this country and South Korea appear to have had little impact and are not particularly sophisticated, experts say.

"`It’s a very noisy attack,` said Rick Howard, intelligence director at VeriSign iDefense, which provides cybersecurity and intelligence services for private- and public-sector organizations. `Everyone in government says it didn’t affect them that much.`

"`It’s been more of a nuisance,` said Phil Neray, vice president of security Strategy at Guardium. `We have countermeasures for denial-of-service attacks.`

"Several security companies have obtained the malicious code used to carry out the attacks. Symantec Corp. identified it as W32.dozer and a variant of the MyDoom worm that has infected a large number of computers."

More at Federal Computer Week...

"Mystery Virus" Pwns Govt. Nets

"Law enforcement computers were struck by a Mystery computer virus Thursday, forcing the FBI and the U.S. Marshals to shut down part of their networks as a precaution.

"The U.S. Marshals confirmed it disconnected from the Justice Department's computers as a protective measure after being hit by the virus; an FBI official said only that that agency was experiencing similar issues and was working on the problem..."

More at Yahoo Tech...

Hackers Download "Terabytes" Of Pentagon Data

"Hackers broke into U.S. Department of Defense computers and downloaded terabytes of data containing design information about the Joint Strike Fighter, a US$300 billion stealth fighter currently under development, according to The Wall Street Journal.

"The stolen files all relate to the design of the Joint Strike Fighter and its electronic systems, the Wall Street Journal reported, saying they could be used to help defend against the jet...

"The reported attack raised more questions than it answered.

"For example, the report did not say how attackers managed to download terabytes of data before being discovered. A single terabyte can take up to several weeks to download over a relatively fast data connection, such as a DSL or cable modem..."

More at NetworkWorld...

All Your Grid Are Belong To Us

"The hackers who reportedly planted malware on key parts of the U.S. electrical grid, perhaps with the intent to cripple the country's power infrastructure, most likely gained access like any other cybercriminal -- by exploiting a bug in software such as Windows or Office, a security researcher said today.

"`Any computer connected to the Internet is potentially vulnerable,` said Roger Thompson, chief research officer at AVG Technologies USA Inc. `Getting to the actual infrastructure devices directly -- that's always possible, but a whole lot less likely. In any industry, critical or not, there are always plenty of PCs that have been compromised.`"

Source: ComputerWorld...

FBI Rounds Up Evil IT Workers In Nation's Capitol

"FBI agents have arrested a District of Columbia government worker and another man while they search the offices of the city's chief technology officer.

"The head of that city office, Vivek Kundra, recently left to take a White House technology post.

"A law enforcement official, speaking on condition of anonymity because charges had not yet been unsealed, said worker Yusuf Acar was arrested Thursday. Another man, Sushil Bansal, was also arrested. A court appearance is expected later in the day.

"Katherine Schweit, spokeswoman for the FBI's Washington field office, said the search was being conducted as part of an ongoing investigation.

"Schweit declined to give the subject of the investigation, or comment further on the case."

Source: Yahoo!...

Top Twenty "No Brainer" IT Security Controls Revealed

"A coalition of public and private organizations, including U.S. military and intelligence agencies, today will release a preliminary set of baseline IT security controls intended to become a foundation for a standardized approach to securing the nation’s critical information infrastructure.

"The Consensus Audit Guidelines (CAG) are being released initially for public comment, but plans call for them to be piloted in several agencies later this year. Eventually the federal Chief Information Officers Council will evaluate the recommendations to decide whether it makes sense to adopt them as a standard throughout government.

"The value of the guidelines is not so much in providing new security controls for systems administrators, but in standardizing the priority security efforts. The project is headed by former Air Force and Energy Department CIO John Gilligan, who called the approach a `no brainer.`"

Read the full article at Government Computer News...

US Government Systems "Under Constant Attack"

"Reports of cyberattacks on U.S. government computers jumped by 40 percent in 2008, records indicate.

"U.S. Computer Emergency Readiness Team figures show reports of attacks by people trying to plant malicious software intended to allow them to control or steal sensitive government data have been climbing steadily, USA Today reported Tuesday.

"`Government systems are under constant attack,` Joel Brenner, counterintelligence chief in the U.S. Office of the Director of National Intelligence, told the newspaper. `We're seeing a dramatic, consistent increase in cybercrime (and) intelligence activities.`"

Source: MarketWatch...

Government Security Contractor PWN3D

"Employees at federal security agencies are being notified that their personal information may have been compromised after hackers planted a virus on computer networks of government contractor SRA International Inc...

"The breach is embarrassing for SRA, a 6,600-employee technology consulting company that sells cybersecurity and privacy services to the federal government. The company wouldn't say which federal agencies were affected by the breach, but in U.S. Securities and Exchange Commission filings, it lists intelligence agencies and the U.S. Department of Defense, the U.S. Department of Homeland Security and the U.S. National Guard among its clients..."

More at ComputerWorld...

H(1B) Bomb Defused at Fannie Mae

"A logic bomb allegedly planted by a former engineer at mortgage finance company Fannie Mae last fall would have decimated all 4,000 servers at the company, causing millions of dollars in damage and shutting down Fannie Mae for a least a week, prosecutors say.

"Unix engineer Rajendrasinh Babubha Makwana, 35, was indicted Tuesday in federal court in Maryland on a single count of computer sabotage for allegedly writing and planting the malicious code on Oct. 24, the day he was fired from his job. The malware had been set to detonate at 9:00 a.m. on Jan. 31, but was instead discovered by another engineer five days after it was planted, according to court records.

"Makwana, an Indian national, was an employee of technology consulting firm OmniTech, but he worked full time on-site at Fannie Mae's massive data center in Urbana, Maryland, for three years."

More at Wired...

Bush Era Logic Bomb Takes Out White House Email Server

"It's more than five hours and counting now since the entire White House e-mail system went down.

"Press Secretary Robert Gibbs announced the technical snafu at his 1:30 p.m. briefing, apologizing to the media for the e-mail silence this afternoon.

"The result is maddening for the new White House team, which already has been frustrated with the archaic communications gear they discovered when they arrived at their offices.

"White House aides had just switched over from their transition e-mails this weekend, finally handing out their new, government e-mail addresses when the outage hit.

"Both outgoing and incoming mail are out, the result, an aide explained, of an outage with the Outlook server. The aide said the outage goes beyond the press shop. The first lady's office is also without e-mail, as are other offices."

From The Washington Post...

There Goes The Neighborhood

"Lockheed Martin Corp. and Boeing Co., the world’s biggest defense companies, are deploying forces and resources to a new battlefield: cyberspace.

"The military contractors, eager to capture a share of a market that may reach $11 billion in four years, have formed new business units to tap increased spending to protect U.S. government computers from attack.

"Chicago-based Boeing set up its Cyber Solutions division in August `because of a realization by the company that it’s a very serious threat,` Barbara Fast, vice president of the unit, said in an interview. `It’s not a question of if we’ll be attacked but when and so how will we be prepared.` Lockheed launched its cyber-defense operation in October."

More at Bloomberg...

ITSec Industry: 2009 Full of Opportunities

"The 'Homeland Security Threat Assessment' for the next five years ought to be a must read for all our leaders as a new year begins. We can’t be complacent even during a recession.

"I’ll never forget the answer a top Homeland Security official during a North Carolina Technology Association event when I asked what threat caused to have nightmares. A homegrown group of unknown terrorist wannabes mixing a toxic bacteriological brew in a bathtub, he said. Operating below law enforcement’s radar, such a group could cause devastation and panic with an attack using some sort of infectious agent...

"Preventing terrorism from hackers as well as from other threats such as bioterrorism also remains continued opportunities for entrepreneurs seeking to develop tools and technology to keep us safe."

From localnewswire...

Sad Tale of Government Pwnage

"On October 26, 2006, computer security personnel from across the legislative branch were informed that the Congressional Budget Office had been hit with a computer virus. The news might not have seemed extraordinary. Hackers had been trying for years to break into government computers in Congress and the executive branch, and some had succeeded, making off with loads of sensitive information ranging from codes for military aircraft schedules to design specifications for the space shuttle.

"Employees in the House of Representatives' Information Systems Security Office, which monitors the computers of all members, staffers, and committee offices, had learned to keep their guard up. Every year of late, they have fended off more than a million hacking attempts against the House and removed any computer viruses that made it through their safeguards. House computers relay sensitive information about members and constituents, and committee office machines are especially loaded with files pertaining to foreign policy, national security, and intelligence. The security office took the information from the CBO attack and scanned the House network to determine whether any machines had been compromised in a similar fashion.

"They found one. A computer in one member's office matched the profile of the CBO incident. The virus seemed to be contacting Internet addresses outside the House, probably other infected computers or servers, to download malicious files into the House system. According to a confidential briefing on the investigation prepared by the security office and obtained by National Journal, security employees contacted the member's office and directed staffers to disconnect the computer from the network."

Full story PLUS audio slideshow at the National Journal...

Analyst: Hackers are Overwhelming US Govt Computers

"Foreign hackers have accessed between half and all of the U.S. government and military computers they 'have an interest in,' according to one analyst. Many of the attacks are sanctioned by the Chinese government—something few top U.S. officials are willing to acknowledge, he said.

"John Tkacik, a senior research fellow at the Heritage Foundation, said his estimate was based on recent media and governmental reports along with personal interviews with U.S. officials. Chinese cyber attacks have grown so relentless and sophisticated they’ve become the 'single biggest military and intelligence threat the U.S. faces.' He was speaking at a Heritage discussion titled, 'Under Attack: Today’s Cyber Threat.'...

"There were 43,880 incidents of malicious activity from all sources against DoD and defense company computers in 2007, a 31 percent increase from the year before, according to a recent annual report from the U.S.-China Economic and Security Review Commission (USCC)."

From Security Management...

Even "The Good Guys" are Crooks, Part III

Ex-agent admits hacking into FBI

"A former FBI agent pleaded guilty Monday to charges that he hacked into his agency’s computer to help his girlfriend, actress Linda Fiorentino [shown at left -Ed.], obtain key information on the federal case against a Hollywood private investigator."


Full story at The Examiner...

DHS: EPIC FAIL/

Tech commission suggests new cybersecurity post

The Department of Homeland Security has failed to ensure the nation's cybersecurity, a new report to be released Monday concludes, because the threat of cyberattacks is too vast for any one agency to tackle and must be addressed by a new White House office, as well as revised laws and government practices.

From cnet news...