mspohr writes with this excerpt from Democracy Now!: "National Security Agency whistleblower William Binney reveals he believes domestic surveillance has become more expansive under President Obama than President George W. Bush. He estimates the NSA has assembled 20 trillion 'transactions' — phone calls, emails and other forms of data — from Americans. This likely includes copies of almost all of the emails sent and received from most people living in the United States. Binney talks about Section 215 of the USA PATRIOT Act and challenges NSA Director Keith Alexander's assertion that the NSA is not intercepting information about U.S. citizens." The parts about National Security Letters in particular are chilling, even though the issue is not new.
Sparrowvsrevolution writes "Security firm Dr. Web released new statistics Friday showing that the process of eliminating Flashback from Macs is proceeding far slower than expected: On Friday the security firm, which first spotted the Mac botnet earlier this month, released new data showing that 610,000 active infected machines were counted Wednesday and 566,000 were counted Thursday. That's a slim decrease from the peak of 650,000 to 700,000 machines infected with the malware when Apple released its cleanup tool for the trojan late last week. Earlier in the week, Symantec reported that only 140,000 machines remained infected, but admitted Friday that an error in its measurement caused it to underestimate the remaining infections, and it now agrees with Dr. Web's much more pessimistic numbers."
Sparrowvsrevolution writes "Four years ago, security researcher Adam J. O'Donnell used game theory to predict in a paper for IEEE Security and Privacy when malware authors would start targeting Macs. Based on some rough assumptions and a little algebra, he found that it would only become profitable to target Apple's population of users when they reached 16% market share. So why are we now seeing mass attacks on Macs like the Flashback trojan when Apple only has 11% market share? O'Donnell says it turns out he may have underestimated the effectiveness of the antivirus used by most Windows users, which now makes overconfident Mac users a relatively vulnerable and much more appealing target. Based on current antivirus detection rates, O'Donnell's equations now show that victimizing Macs becomes a profitable alternative to PCs at just 6.5% market share."
Qedward writes "The European Parliament has approved the controversial data transfer agreement, the bilateral PNR (passenger name register), with the US which requires European airlines to pass on passenger information, including name, contact details, payment data, itinerary, email and phone numbers to the Department of Homeland Security. Under the new agreement, PNR data will be 'depersonalized' after six months and would be moved into a 'dormant database' after five years. However the information would still be held for a further 15 years before being fully 'anonymized.'"
Jeremiah Cornelius writes "Khosrow Zarefarid warned of a security flaw in Iran's banking system providing affected institutions the details, including 1,000 captured bank accounts. When the affected banks, including the largest state institutions didn't respond, Khosrow hacked 3 million accounts across at least 22 banks. He then dropped these details — including card numbers and PINs — on his blog. Three Iranian banks Saderat, Eghtesad Novin, and Saman have already warned customers to change their debit card PINs. 'Zarefarid is reportedly no longer in Iran, though it is unclear when he left.'"
peetm writes "Two 70-year-old papers by Alan Turing on the theory of code breaking have been released by the government's communications headquarters, GCHQ. It is believed Turing wrote the papers while at Bletchley Park working on breaking German Enigma codes. A GCHQ mathematician said the fact that the contents had been restricted 'shows what a tremendous importance it has in the foundations of our subject.'"
New submitter grzzld writes "I am a systems analyst for a County in New York. Last year I made a SharePoint site that manages grants and it was well received. So much so that it won a NACo award. Since then, there have been several requests from other municipalities from around the country who would like to get this SharePoint site. The county is trying to figure out how to protect ourselves from people making money from it and having people hold us liable if it they use it and something goes awry. I am afraid that ultimately nothing will be done and the site will not be shared since at the end of the day it is much easier to not do anything and just say no. I proposed that we license it under an Open Source agreement but I am not versed enough in the differences between all of them. It is also unclear to me if I could do this since the nature of the 'program' is a SharePoint site. It seemed like CodePlex would be a good place to put this since it is Microsoft centric and it an open source initiative. I just want to contribute my work to others who may find it useful. The county just wants to make sure they can't be held liable and have somebody turn my work around and make a buck. How can I release this to the world and make sure the county's concerns are addressed?"
hypnosec writes "Toshiba Information Systems has been given a slap on the wrist by the Information Commissioner's Office (ICO), following a data spillage. This happened during an on-line competition that Toshiba organized last year. Back in September 2011, a concerned member of the public contacted the ICO and informed the body that some data pertaining to those registered for the competition was accessible. In fact, the personal details of 20 entrants were compromised in a security flaw on the site. Those details included names, addresses and dates of birth, along with other contact information. The ICO investigated and found that Toshiba's security measures weren't thorough enough, and hence, didn't detect the vulnerability — from a mistake, made by a third-party web designer. A fine hasn't been levied, but Toshiba has signed an undertaking to ensure this doesn't happen again."
benrothke writes "While Julius Caesar likely never said 'Et tu, Brute?' the saying associated with his final minutes has come to symbolize the ultimate insider betrayal. In The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, authors Dawn Cappelli, Andrew Moore and Randall Trzeciak of the CERT Insider Threat Center provide incontrovertible data and an abundance of empirical evidence, which creates an important resource on the topic of insider threats. There are thousands of companies that have uttered modern day versions of Et tu, Brute due to insidious insider attacks and the book documents many of them." Read on for the rest of Ben's review.
An anonymous reader writes "Austrian police have arrested a 15-year-old student suspected of hacking into 259 companies across the span of three months. Authorities allege the suspect scanned the Internet for vulnerabilities and bugs in websites and databases that he could then exploit. As soon as he was questioned, the young boy confessed to the attacks, according to Austria's Federal Criminal Police Office (BMI)."
Qedward writes in with a link about the gap between the tech side of business and the bean counters. "CIOs are being dismissed by CEOs as too techie and not aligned with business activities. According to recent Gartner survey of 220 CEOs across the world, business leaders expect spending on IT to rise, but without a corresponding rise in the importance of the role of the CIO within the organization. CIOs appear to be failing in the eyes of CEOs in terms of alignment with the rest of the business. The research showed the stereotype of the head of IT being too preoccupied with technical issues to be effective business leaders persists. He said they were perceived as unable to bring a breadth of business perspective to the table."
scibri writes "Ron Fouchier, one of the researchers involved in the controversy over whether to publish research on mutant versions of H5N1 bird flu, has said he plans to submit his paper to Science without applying for an export control license as demanded by the Dutch government. Failing to get the license means he could face penalties including up to six years in prison. Whether the paper falls under export-control laws is unclear. The Netherlands implements European Union (EU) legislation on export controls, which require an export permit for 'dual-use' materials and information — those that could have both legitimate and malicious uses — including those relating to dangerous pathogens. But the EU law allows an exception for 'basic scientific research' that is 'not primarily directed towards a specific practical aim or objective,' which Fouchier says should cover his work."
snydeq writes "With rising popularity of Internet-enabled TVs, the usual array of attacks and exploits will soon be coming to a screen near you. 'Will Internet TVs will be hacked as successfully as previous generations of digital devices? Of course they will. Nothing in a computer built into a TV makes it less attackable than a PC. ... Can we make Internet TVs more secure than regular computers? Yes. Will we? Probably not. We never do the right things proactively. Instead, we as a global society appear inclined to accept half-baked security solutions that are more like Band-Aids than real protection.'"
ErichTheRed writes "Yet another move by IBM out of end-user hardware, Toshiba will be buying IBM's retail point-of-sale systems business for $850M. Is it really a good idea for a company defined by good (and in this case, high-margin) hardware to sell it off in favor of nebulous consulting stuff? 'Like IBM's spin-offs of its PC, high-end printer, and disk drive manufacturing businesses to Lenovo, Ricoh, and Hitachi respectively in the past decade, IBM is not just selling off the RSS division but creating a holding company where it will have a stake initially but which it will eventually sell.' Is there really no money in hardware anymore? "