Sykipot Trojan hijacks DoD smart cards – Computerworld

IDG News Service – A variant of the Sykipot Trojan Horse hijacks U.S. Department of Defense (DoD) smart cards in order to access restricted resources.

“We recently discovered a variant of Sykipot with some new, interesting features that allow it to effectively hijack DoD and Windows smart cards,” said Jaime Blasco, a security researcher at AlienVault, in a blog post. “This variant, which appears to have been compiled in March 2011, has been seen in dozens of attack samples from the past year.”

Smart cards interface with computers through a special reader. They use digital certificates and PIN codes for authentication purposes.

Sykipot is commonly used in advanced persistent threat (APT) attacks. According to Blasco, the Sykipot variant recently analyzed by AlienVault contains several commands to capture smart card information and use it to access secure resources.

via Sykipot Trojan hijacks DoD smart cards – Computerworld.

Facebook to Change European Service After Data-Privacy Probe – Businessweek

Facebook Inc., the world’s biggest social networking site, will overhaul its service in Europe over the next six months as a result of an investigation into how the social network handles personal data.

Facebook “has agreed to a wide range of best practice improvements” to its service that will get a formal review in July, the Irish data-protection agency said today, after concluding a three-month audit. Facebook’s Ireland operation is responsible for all the Palo Alto, California-based company’s users outside the U.S. and Canada, the agency said.

“This was a challenging engagement both for my office and for Facebook Ireland,” Billy Hawkes, Ireland’s data-protection commissioner, said in an e-mail. The report said there has to be “increased transparency and controls for the use of personal data for advertising purposes” and “the deletion of data held from user interactions with the site much sooner.”

via Facebook to Change European Service After Data-Privacy Probe – Businessweek.

Amazon bests Microsoft, all other contenders in cloud storage test | ars technica

Amazon’s S3 Simple Storage Service has outperformed Microsoft’s Windows Azure Storage and all other major providers in an extensive study testing the feasibility of businesses using cloud services for primary storage, data protection, and disaster recovery.

Nasuni, which sells data protection services that work across any type of cloud storage, says it has been testing the 16 largest cloud storage providers (CSPs) since April 2009 to determine the best services for its customers. Ultimately, only six of the 16 providers passed Nasuni’s testing—in addition to Amazon and Microsoft, the other winners were Nirvanix, Rackspace, AT&T Synaptic, and Peer1 Hosting. Both AT&T and Peer1 use EMC’s Atmos platform on the back end, although EMC itself discontinued its own public cloud based on Atmos.

While these six are, apparently, ready for real-world use, Nasuni politely declined to say which ten services failed its test, so we can’t warn you away from those vendors. But Nasuni does say the difference between the ones who passed the tests and those that didn’t is in some cases quite large. When Nasuni tested the providers for scalability by continuously writing small files of 1KB for weeks on end to determine error rates and performance, two of the eight providers that made it through this stage of testing failed, and others couldn’t complete the test.

“Without proper testing, it is impossible to differentiate between an industrial-strength CSP and a lesser operation,” Nasuni said. “In fact, some providers have asked Nasuni to cease testing at this stage because they said it was negatively impacting their customers, which is a truly frightening statement. True cloud storage should be able to accommodate billions of files without any visible strain. Those CSPs that faced performance issues under Nasuni’s test are simply not equipped to deliver an appropriate level of service to customers.”

via Amazon bests Microsoft, all other contenders in cloud storage test.

Shaq Says Computer Tech Hacked Him | Courthouse News Service

Shaquille O’Neal claims a computer tech he hired, who hid his criminal past, stole his private emails and sold them for profit, then “threatened to use the electronic communications to harm O’Neal unless O’Neal paid [him] twelve million dollars.”

When he refused to submit to these “baseless demands,” O’Neal says, the man filed a “baseless” lawsuit against him.

The NBA great sued Shawn Darling in Miami-Dade County Court.

The complaint claims that Darling “admitted under oath that he twice sold O’Neal’s personal emails to a well known and highly trafficked Internet website.”

O’Neal says he hired Shawn Darling in 2007 as an information technology specialist “who operates at [a] company called Your IT Team LLC.”

He says Darling set up computer and sound systems in his house, and that he “gave Darling the names of his email accounts and passwords so that Darling could perform these services. Darling submitted invoices for these services to O’Neal and received payment.”

O’Neal says he paid Darling from $75 to $150 an hour, and that over the course of the 2 years Darling worked for him, he came to trust him.

“Unbeknownst to O’Neal, at [the] time the business relationship existed, Darling was a convicted felon, having been sentenced in Wisconsin for bank fraud. Darling concealed his criminal past from O’Neal,” the complaint states.

O’Neal says Darling recommended that he set up an Internet server to host an Internet domain to store all of O’Neal’s electronic correspondence. He agreed, and Darling created Big32.com for O’Neal.

But rather than getting O’Neal his own server, Darling hosted Big32.com on his own servers, to get access to everything on Big32.com, O’Neal says.

“Darling also used the passwords O’Neal gave Darling as part of his employment by O’Neal outside the scope of Darling’s employment relationship to access O’Neal’s email accounts without O’Neal’s permission,” the complaint states.

via Courthouse News Service.

U.S. Attorney Durkan: Protecting Yourself and Your Business against Cybercrime « USDOJ: Justice Blog

Critical to cracking this sophisticated scheme, which is alleged to have victimized more than 50 area businesses, was the fact that companies came forward to report the crimes.  Because of that reporting, members of the U.S. Secret Service Electronic Crimes Task Force were able to connect the dots on what looked like unrelated incidents.  As part of the public education around protecting business and personal networks , the U.S. Attorney and law enforcement provided tips to protect against being a victim:

  • Businesses should review their wireless encryption and confirm that they are using the appropriate level of encryption (WPA2 Personal or WPA Enterprise).
  • Businesses should keep a record of all laptop computers and ensure that any computers with remote access are encrypted.  Any missing laptop computers should have passwords and credentials replaced immediately.
  • Businesses should be aware of hacking that can occur from physical access to the server room as well as from external hacking.
  • Employees should never click past security certificate warning screens and should notify their IT staff immediately.
  • Managers should be aware of “watercooler” talk among employees that may indicate a breach has occurred.  This includes numerous employees complaining of fraud on personal accounts.
  • Businesses should ensure that they have a security response plan prepared in the event that some kind of incident does occur.
  • If you notice suspicious activity, contact your local law enforcement.  You can make a referral to the U.S. Secret Service Electronic Crimes Task Force or other law enforcement agencies through the Justice Department’s portal: www.cybercrime.gov/reporting.htm.

via U.S. Attorney Durkan: Protecting Yourself and Your Business against Cybercrime « USDOJ: Justice Blog.

Hotmail Reborn? Microsoft Overhauls World’s Most Popular Email Service | Fox News

Hotmail is getting hip again.

Microsoft on Monday pushed the reboot button on the world’s biggest email service, unveiling a series of new features intended to help the service’s approximately 350 million users better sort through the clutter in their in-boxes.

Five new features were unveiled at Windows Live event in San Francisco, including a new tool to deal with “graymail” — meaning newsletters and social networking updates that aren’t quite spam but aren’t quite legitimate emails either — a way to automatically clean up an in-box, improved flags to move key emails to the top of the mailbox, and more.

“75 percent of email identified as spam by our customers actually turns out to be unwanted graymail that they receive as a result of having signed up on a legitimate website,” explained Dick Craddock, program manager for the Hotmail service, in a Microsoft blog unveiling the new features.

To sort through those items, the company unveiled a new newsletter category that lets users flag such emails and read them at their leisure — or simply delete the darn things. A one-click unsubscribe feature makes it easy to stop getting an unwanted newsletter as well, something that should come as a relief to those suffering from inbox bloat.

The company also unveiled a scheduled cleanup feature to keep only the latest event email from a site, only the latest deals from Groupon, or only the newest newsletter — yet another way of keeping out the clutter.

via Hotmail Reborn? Microsoft Overhauls World’s Most Popular Email Service | Fox News.

OnStar Tracks Your Car Even When You Cancel Service | Threat Level | Wired.com

Navigation-and-emergency-services company OnStar is notifying its six million account holders that it will keep a complete accounting of the speed and location of OnStar-equipped vehicles, even for drivers who discontinue monthly service.

OnStar began e-mailing customers Monday about its update to the privacy policy, which grants OnStar the right to sell that GPS-derived data in an anonymized format.

Adam Denison, a spokesman for the General Motors subsidiary, said OnStar does not currently sell customer data, but it reserves that right. He said both the new and old privacy policies allow OnStar to chronicle a vehicle’s every movement and its speed, though it’s not clear where that’s stated in the old policy.

“What’s changed [is that if] you want to cancel your OnStar service, we are going to maintain a two-way connection to your vehicle unless the customer says otherwise,” Denison said in a telephone interview.

The connection will continue, he said, to make it “easier to re-enroll” in the program, which charges plans from $19 to $29 monthly for help with navigation and emergencies.

via OnStar Tracks Your Car Even When You Cancel Service | Threat Level | Wired.com.

Court Clerk Becomes First to Be Charged Under New U.K. Bribery Act | Law.com

An administrative court clerk is set to become the first person to be prosecuted under the Bribery Act 2010 over allegations that he accepted a bribe to influence criminal proceedings.

The Crown Prosecution Service (CPS) has decided to prosecute Munir Yakub Patel under Section 2 of the act for requesting and receiving a bribe intending to improperly perform his functions, marking the first case since new U.K. bribery laws came into effect this summer.

The alleged misconduct is said to have been carried out during Patel’s employment at London’s Redbridge Magistrates’ Court.

via Court Clerk Becomes First to Be Charged Under New U.K. Bribery Act.

Skype to Buy GroupMe Group Messaging Service

The group messaging battle just heated up with the announcement Sunday that Skype has entered into a definitive agreement to acquire GroupMe, a group messaging service that will enhance Skype’s ability to facilitate text and photo messaging.

With this acquisition, Skype said in a press release that GroupMe will provide “best-in-class text-based communications and innovative features that enable users to connect, share locations and photos and make plans with their closest ties.”

via Skype to Buy GroupMe Group Messaging Service.

Customers, Service Providers May Have E-Discovery Gap | Law.com

E-discovery customers and service providers need to better understand each other to improve the state of early case assessment tools, analysts at Enterprise Strategy Group found in their latest legal technology report.

Law firms and legal departments too often underappreciate service providers’ expertise, while service providers focus too broadly on custom projects and too narrowly on research and development, analysts Brian Babineau and Katey Wood concluded in Initial Case Assessments with e-Discovery: Integrating e-Discovery Tools in Corporate Investigations.

The disconnect is a major reason why software companies rule the e-discovery market despite common complaints about legal technology being overly influenced by engineers. “In ESG’s conversations with general counsel over the last five years, many in-house attorneys found that the software market’s concept of ECA didn’t sufficiently support their approach,” the report from Milford, Mass.-based ESG states.

via Customers, Service Providers May Have E-Discovery Gap.