Cyber Security News of the Week, April 29, 2011

Internet Badlands

‘Wardriving’ Hackers Cracked Wi-Fi Networks From Black Mercedes: Seattle police are investigating a criminal ring they believe used a specially outfitted Mercedes to hack into the Wi-Fi networks of area businesses, a practice called “wardriving.” SecurityNewsDaily April 25, 2011

Bizarre pornography raid underscores Wi-Fi privacy risks: BUFFALO, N.Y. — Lying on his family room floor with assault weapons trained on him, shouts of “pedophile!” and “pornographer!” stinging like his fresh cuts and bruises, the Buffalo homeowner didn’t need long to figure out the reason for the early morning wake-up call from a swarm of federal agents. That new wireless router. He’d gotten fed up trying to set a password. Someone must have used his Internet connection, he thought. MSNBC News April 25, 2011

Where Did That Scammer Get Your Email Address?: You’ve seen the emails: They claim to have been sent by a financial institution in a faraway land, or from a corrupt bureaucrat in an equally corrupt government. Whatever the ruse, the senders always claim to need your help in spiriting away millions of dollars. These schemes, known as “419,” “advance fee” and “Nigerian letter” scams seemingly have been around forever and are surprisingly effective at duping people. But where in the world do these scammers get their distribution lists, and how did you become a target? Krebs on Security April 25, 2011

Ex-Gucci admin accused of $200,000 IT rampage: A network engineer fired by fashion house Gucci has been charged with going on an IT rampage against his former employer in which he deleted data, shut down servers and left the company nursing an estimated $200,000 cleanup bill. Computerworld April 6, 2011

Cyber attack forces ORNL to shut down Internet access; experts probing Advanced Persistent Threat: A highly sophisticated cyber attack — known as Advanced Persistent Threat or APT — forced Oak Ridge National Laboratory to shut down all Internet access and email systems over the weekend. Knox News April 18, 2011

Securing the Future

Where is the “Public Awareness” in the Cyber Security Public Awareness Act?: Last week, Senators Sheldon Whitehouse (D-RI) and Jon Kyl (R-AZ) introduced the Cyber Security Awareness Act of 2011 (S.813). Forbes April 26, 2011

DHS Secretary Calls for Public-Private Alliance to Battle Cyber-Attacks: In a speech to California college students, Department of Homeland Security Secretary Janet Napolitano discussed how the public, government and private industry can work together to contain rapidly evolving cyber-threats. eWeek April 26, 2011

Consumers at Risk

Millions of Passwords, Credit Card Numbers at Risk in Breach of Sony Playstation Network: Sony warned today that intruders had broken into its PlayStation online game network, a breach that may have jeopardized the user names, addresses, passwords and credit card information of up to 70 million customers. Krebs on Security April 26, 2011

Sony unsure if PlayStation Network user data was stolen: Sony has yet to determine if customers’ personal information and credit card details have been stolen as part of an external intrusion into its system that has left PSN, the PlayStation network, inaccessible for five days. The Register April 25, 2011

Sony Faces Lawsuit, Regulators’ Scrutiny Over PlayStation Breach: Sony Corp. (6758)’s network entertainment unit faced a legal and regulatory backlash over delays in telling 77 million subscribers that their personal account data may have been stolen by a hacker. Bloomberg April 28, 2011

Rays of Sunshine

Microsoft, FBI Reprogram Botnet to Remove Coreflood Permanently: While the Federal Bureau of Investigation has seized control the Coreflood botnet, it is now working with Microsoft to try to permanently remove malware from thousands of infected zombie machines to prevent Coreflood from springing back to life. eWeek April 28, 2011

Alerts and Warnings

FBI warns U.S. businesses of new Chinese cybercrime scheme: Washington (CNN) — FBI agents combating international cybercrime are currently battling hackers on two new fronts — from a remote corner of China to the virtual battlefields of “Call of Duty” emanating from the family playroom. CNN April 28, 2011

Privacy Matters

Apple Speaks Out on iPhone Tracking, Promises to Encrypt Location Data: Apple released a Q&A about the location data that’s stored on the iPhone. In the statement, the company says broadly that it does not track the iPhone’s location, and that the data, which is currently stored in an unprotected file, will be encrypted in the next major update of iOS. In the statement, Apple admits that iPhones send location data to Apple to maintain a crowd-sourced database of Wi-Fi hotspots and cell phone towers, as many have suspected . However, the company says the locations recorded can be up to 100 miles away from the where the phone actually is, and that the data is sent anonymously. PC Magazine April 25, 2011

Windows Phone stores your location too: After all the coverage of iPhone and Android location tracking, Microsoft says its mobile platform does the same thing. The software giant has confirmed Windows Phone 7 automatically tracks user location data whether or not the user has GPS service enabled. TG Daily April 27, 2011

Jobs Says Apple Made Mistakes With iPhone Data: SAN FRANCISCO — Hoping to put to rest a growing controversy over privacy, Steven P. Jobs, Apple’s chief executive, took the unusual step of personally explaining that while Apple had made mistakes in how it handled location data on its mobile devices, it had not used the iPhone and iPad to keep tabs on the whereabouts of its customers. The New York Times April 27, 2011