_________________________________________________________________ London, Wednesday, December 18, 2002 _________________________________________________________________
INFOCON News _________________________________________________________________ IWS - The Information Warfare Site http://www.iwar.org.uk _________________________________________________________________ --------------------------------------------------------------------- To subscribe - send an email to "[EMAIL PROTECTED]" with "subscribe infocon" in the body To unsubscribe - send an email to "[EMAIL PROTECTED]" with "unsubscribe infocon" in the body --------------------------------------------------------------------- _________________________________________________________________ ---------------------------------------------------- [News Index] ---------------------------------------------------- [1] Revised cybersecurity plan goes to Bush next week [2] Gilmore Commission critical of Bush cybersecurity plan [3] Ridge talks to future employees of Homeland Security Department [4] Privacy group sues Pentagon for "total information" project [5] Pentagon seeking limit on wireless Net access [6] Bush signs e-government bill into law [7] Elcomsoft not guilty - DoJ retreats from Moscow [8] Bush plans to deploy anti-missile defenses [9] (Finland) Internet plan under attack [10] DDoS: Are You Next? [11] Fake escrow site scam widens [12] (UK) Businesses to discuss cybercrime charter [13] New 'Iraq oil' network worm found [14] Christmas not so merry for alleged eBay swindler [15] Navy XML policy signed [16] Anti-spammer in car chase [17] AOL wins $7m in porn spam case [18] And deep in IE, a creature was stirring... [19] Multiple vulns in MySQL, upgrade now [20] (UK) Government email policy 'flawed' _________________________________________________________________ CURRENT THREAT LEVELS _________________________________________________________________ Electricity Sector Physical: Elevated (Yellow) Electricity Sector Cyber: Elevated (Yellow) Homeland Security Elevated (Yellow) DOE Security Condition: 3, modified NRC Security Level: III (Yellow) (3 of 5) _________________________________________________________________ News _________________________________________________________________ (The first draft showed how good the current administration is at 'riding the Washington gravy train', so it remains to be seen whether the improved version will be any better. WEN) [1] Revised cybersecurity plan goes to Bush next week By Bara Vaida , National Journal's Technology Daily White House officials expect to present a revamped national cybersecurity strategy to President Bush for his approval next week, and a formal public release is expected in early January, according to a spokeswoman for the White House Office of Cyberspace Security. The strategy has been significantly rewritten and includes greater responsibility for Internet service providers (ISPs) to ensure that computer networks are less vulnerable to attack, according to sources. Further, it puts more emphasis on the need for private firms to disclose computer vulnerabilities and for wireless technologies to be secure. Earlier this month, Richard Davidson, president of the National Infrastructure Advisory Council (NIAC) that is advising Bush on cybersecurity, told a Western Governors Association conference that his group recommended that ISPs be given more responsibility for securing cyberspace. http://www.govexec.com/dailyfed/1202/121702td2.htm ---------------------------------------------------- [2] Gilmore Commission critical of Bush cybersecurity plan By DAN VERTON DECEMBER 17, 2002 Content Type: Story Source: Computerworld WASHINGTON -- A congressionally appointed panel of experts yesterday delivered a report to the president calling the government's incessant focus on public/private partnerships to improve cybersecurity an inadequate solution for the job at hand. In its fourth annual report, the Advisory Panel to Assess Domestic Response Capabilities for Terrorism Involving Weapons of Mass Destruction, chaired by former Virginia Gov. James S. Gilmore III, called the recently released Draft National Strategy to Secure Cyberspace "a small step" in the right direction. http://www.computerworld.com/securitytopics/security/story/0,10801,76827 ,00.html ---------------------------------------------------- [3] Ridge talks to future employees of Homeland Security Department By Tanya N. Ballard Homeland Security Secretary-designate Tom Ridge addressed employees' fears about the new department's organization on Tuesday during a town hall-style meeting in Washington. "I know there's a lot of anxiety and uncertainty perhaps, but hopefully there's a lot of excitement," Ridge told the group of about 200 employees, a tiny handful of the roughly 170,000 employees pegged for the new department when it is officially launched on Jan. 24. "I know what you do and I know how well you do it, and I really believe in one department.we'll have the opportunity to do it better." The new Homeland Security Department, created under legislation approved by Congress and signed by President Bush last month, will have a budget of nearly $37 billion and will merge 170,000 employees from 22 different agencies. On Tuesday, Ridge fielded questions ranging from the role of agencies merged into the agency to the location of the new department's headquarters. http://www.govexec.com/dailyfed/1202/121702t1.htm See also: Homeland Security Appointments Watch As the Bush administration works to staff up the Homeland Security Department, GovExec.com will offer updated reports on who's headed where. http://www.govexec.com/dailyfed/homelandappointments.htm ---------------------------------------------------- [4] Privacy group sues Pentagon for "total information" project By Shane Harris A group that advocates keeping personal information out of government hands wants a federal judge to intercede in its fight against the Pentagon. The Electronic Privacy Information Center (EPIC) requested a temporary restraining order in U.S. district court Tuesday, asking the judge to overturn the Defense Department's decision not to release information about a controversial research project. The restraining order, which cannot be appealed, would force the Pentagon to give EPIC any documents related to the legal authority for the project, its impact on privacy and civil rights, and the activities of the project director, former National Security Adviser John Poindexter. The Pentagon launched the project, called the Total Information Awareness (TIA) system, almost a year ago as part of its ongoing research into counter-terrorism strategies. Researchers are testing ways to electronically search databases of personal transactions-such as credit card purchases or phone records-and to look for relationships among the data that might indicate a terrorist attack is being plotted. http://www.govexec.com/dailyfed/1202/121702h1.htm ---------------------------------------------------- [5] Pentagon seeking limit on wireless Net access John Markoff NYT Wednesday, December 18, 2002 Interference with military radar cited SAN FRANCISCO The U.S. Defense Department, arguing that an increasingly popular form of civilian wireless Internet access could interfere with U.S. military radar systems, is seeking limits on the technology, which has been seen as a bright spot for the gloomy communications industry. Industry executives, including representatives from Microsoft Corp. and Intel Corp., met with Defense Department officials last week to try to stave off that effort, which includes a government proposal now pending before the international organization that oversees global use of the radio-frequency spectrum. The military officials are seeking technical restrictions that they say are necessary for national security but that industry executives say would threaten expansion of technology such as the so-called Wi-Fi systems used for wireless Internet access in U.S. airports, coffee shops, homes and offices. http://www.iht.com/articles/80678.html ---------------------------------------------------- [6] Bush signs e-government bill into law >From National Journal's Technology Daily Industry groups and congressional leaders on Tuesday hailed President Bush for signing into law a measure to bolster online government services. The law makes permanent an e-government office within the White House Office of Management and Budget and authorizes $345 million over four years to fund interagency technology initiatives. It also enhances privacy protection by requiring agencies to assess the privacy impact of new government technology systems. Sen. Joseph Lieberman, D-Conn., said in a statement, "The president's signing of this bill today brings the federal government fully into the electronic age, giving taxpayers the same round-the-clock access to government that they have come to expect from the private sector." http://www.govexec.com/dailyfed/1202/121702td1.htm ---------------------------------------------------- [7] Elcomsoft not guilty - DoJ retreats from Moscow By Andrew Orlowski in San Francisco Posted: 17/12/2002 at 23:55 GMT The Russian software company which has found itself on trial in an American court was acquitted on all counts of circumventing the DMCA today. Elcomsoft's woes began in August last year, when programmer Dmitry Sklyarov was charged under the Digital Millennium Copyright Act's circumvention 1201 clauses (one small part of which is under review by the Librarian of Congress) while visiting Las Vegas for a technical conference. Skylarov was imprisoned for his part in creating an Adobe eBook reader that permitted fair-use of copyright material, and imprisoned pending trial. http://www.theregister.co.uk/content/55/28612.html http://online.securityfocus.com/news/1857 ---------------------------------------------------- [8] Bush plans to deploy anti-missile defenses AP AP Wednesday, December 18, 2002 'Modest' initial stage of a limited system is expected by 2004 WASHINGTON President George W. Bush said Tuesday that he would begin deploying by 2004 a limited system to defend the United States against ballistic missiles. Though the first parts of the system will be put into use while more advanced technology is still being developed, Defense Secretary Donald Rumsfeld said the initial system would probably stop "a relatively small number of incoming ballistic missiles, which is better than nothing." As a candidate, Bush promised to build an anti-missile shield, and earlier this year, to advance the plan, he pulled out of an anti-ballistic missile treaty. On Tuesday, he cited the Sept. 11 terrorist attacks as evidence that the United States faces "unprecedented threats" and needs the anti-missile shield. http://www.iht.com/articles/80644.html ---------------------------------------------------- [9] Internet plan under attack AP AP Wednesday, December 18, 2002 HELSINKI A bill that would hold the operators of Web sites and Internet providers in Finland liable for what their users say is being criticized as a way to muzzle freedom of speech. Critics contend the bill, if passed by Finland's Parliament, could lead to an end to online publishing. Under the new proposal, Internet providers and web page hosts could be liable for the content on their sites, even if they did not see or post it themselves. Web site operators would also be required to keep records of users who post content on newsgroups, message boards and chat sites. Also, owners of computers that store and relay e-mail and Web pages over the Internet would be liable under the proposal. The constitutional committee is expected to evaluate the plan in January. "Taken literally, most of the requirements in the bill are impossible to follow," said Kai Puolamaki, a researcher at the Helsinki University of Technology and a member of Electronic Frontier Finland, a watchdog group that focuses on freedom of speech online. http://www.iht.com/articles/80677.html ---------------------------------------------------- [10] DDoS: Are You Next? By Konstantinos Karagiannis On October 21, 2002, a concentrated distributed denial-of-service attack (DDoS) almost brought the Internet to its knees. The attack hit the Internet's backbone, taking down 9 of the 13 root servers for almost an hour. These servers are the Domain Name System (DNS) machines that translate between IP addresses and domain names. (For example, www.pcmag.com represents the Web server at the IP address 63.111.13.100.) Fortunately, the Internet's redundancy meant that the unaffected root servers were able to handle the traffic until the compromised computers came back online. Had the attack been just a little more successful, people all over the world would have been unable to navigate the Web as usual. It's nearly impossible to overestimate the havoc this would have wrought on business, government, and just about every facet of modern life. Denial-of-service attacks typically flood a server with traffic and prevent access to the services running on that server. DDoS attacks are among the most potentially crippling forms of DoS. They come from multiple machines and are far more overwhelming and difficult to prevent or trace. The October 2002 attack was one of the boldest known DDoS attacks, but these types of assaults happen all the time. http://www.pcmag.com/article2/0,4149,768385,00.asp ---------------------------------------------------- [11] Fake escrow site scam widens Auction winners sometimes lose $40,000 at a time By Bob Sullivan MSNBC Dec. 17 - In July, MSNBC.com warned Internet users that fake escrow Web sites were the latest scam. Six months later, the scam has widened considerably, and it now appears to be among the most successful Internet cons ever. By taking advantage of Net auction winners' inherent trust of escrow sites, the con artists are stealing as much as $40,000 at a time from big-ticket auction winners. Their total take may well reach into millions of dollars so far. And while federal authorities, including the Department of Commerce and FBI, are investigating, there seems to be no way to slow down the con artists. http://www.msnbc.com/news/846795.asp ---------------------------------------------------- [12] Businesses to discuss cybercrime charter By Andy McCue [18-12-2002] Members of blue chip user group to meet hi-tech crime unit in January UK corporate users are to get their first chance next month to examine in detail the cybercrime confidentiality charter drawn up by the National Hi-Tech Crime Unit (NHTCU). The charter, to encourage businesses to report hacker attacks by minimising the disruption of an investigation and keeping the information out of the media, was unveiled by the police earlier this month. Members of the blue chip user organisation The Infrastructure Forum (Tif), will meet with the NHTCU at the end of January to discuss the charter. http://www.pcw.co.uk/News/1137655 ---------------------------------------------------- [13] New 'Iraq oil' network worm found By Paul Roberts, IDG News Service DECEMBER 17, 2002 Content Type: Story Source: IDG News Service A new network worm that spreads through shared folders on machines running Microsoft Corp.'s Windows NT, 2000 and XP operating systems has been detected, according to advisories posted by a number of antivirus software makers today. The new worm, called W32/Lioten, also goes by the name Iraq_oil, Datrix, W32.Lioten, and I-Worm.Lioten, according to an advisory posted by Helsinki, Finland-based security company F-Secure Corp. Unlike other worms that spread through mass e-mailing, Lioten scans the Internet for vulnerable Windows machines that are sharing folders with other users on a home or business network. http://www.computerworld.com/securitytopics/security/virus/story/0,10801 ,76855,00.html ---------------------------------------------------- [14] Christmas not so merry for alleged eBay swindler By LINDA ROSENCRANCE DECEMBER 17, 2002 Content Type: Story Source: Computerworld It was a sting worthy of Paul Newman and Robert Redford. Earlier this month, Eric Smith, a 21-year-old student at the University of New Orleans, pulled a fast one on Melvin Christmas, a Chicago man who allegedly swindled him out of a brand new Apple Macintosh PowerBook G4 867. Here's what happened, according to police, information from Smith's personal Web site and an interview with the college student: Shortly after purchasing the brand new PowerBook for about $2,300 at the end of November, just after they were released by Apple, Smith decided the laptop was too expensive to keep and put it up for sale on eBay. He asked for a buy-it-now price of $2,950. In addition to the brand new computer, he included an Airport wireless base station "and a bunch of other knick-knacks" to justify the higher price. http://www.computerworld.com/securitytopics/security/cybercrime/story/0, 10801,76857,00.html ---------------------------------------------------- [15] Navy XML policy signed BY Matthew French Dec. 18, 2002 Navy chief information officer David Wennergren has signed the Navy's Extensible Markup Language policy, setting the standard for how XML will be used within the service. XML facilitates information exchange among applications and systems because it enables agencies to tag data and documents. "Interoperability is a cornerstone of [the Navy Department's] efforts to strengthen its independent operations and, subsequently, improve the warfighter's ability to find, retrieve, process and exchange information," Wennergren said in a Dec. 13 statement to Navy commanders. "The department, like many government and private-sector organizations, has increasingly looked to XML technology to meet its data-sharing needs." The policy's overall goals are to promote XML as a technology to help achieve interoperability throughout the Navy and serve as a guideline to support interoperability among the Navy and other DOD components. http://www.fcw.com/fcw/articles/2002/1216/web-xml-12-18-02.asp ---------------------------------------------------- [16] Anti-spammer in car chase By Tim Richardson Posted: 17/12/2002 at 15:59 GMT Rich Clark, an American spam hater, claims he was involved in a car chase and received threatening phone calls after taking photos of the house belonging to mega-wealthy bulk-emailer, Alan Ralsky. It seems Rich was taking the photos so he could post them on an anti-spam Web site. Next thing he knew, he was being cut-up by a guy in a black Jag who had just left the house. The day after, he received threatening messages on his answerphone. http://www.theregister.co.uk/content/6/28605.html ---------------------------------------------------- [17] AOL wins $7m in porn spam case By Tim Richardson Posted: 17/12/2002 at 12:18 GMT AOL has won $7m in damages after it claimed its punters had been bombarded with porn spam. The giant Internet company used the court ruling to warn spammers that it will use the full force of the law to hit at anyone who targets its punters with unsolicited email. AOL brought the case against CN Productions in the late 1990s, alleging it had sent unwanted emails advertising adult Web sites. In 1999, AOL won an injunction barring CN Productions from spamming its users. http://www.theregister.co.uk/content/6/28600.html ---------------------------------------------------- [18] And deep in IE, a creature was stirring... By John Leyden Posted: 17/12/2002 at 11:18 GMT eEye security researcher Derek Soeder was moved to verse after analysing a complicated - and not particularly devastating - heap corruption vulnerability involving the way Windows handles PNG image format files. An advisory by eEye begins thus: Twas the night before Christmas, and deep in IE A creature was stirring, a vulnerability MS02-066 was posted on the website with care In hopes that Team eEye would not see it there http://www.theregister.co.uk/content/55/28599.html ---------------------------------------------------- [19] Multiple vulns in MySQL, upgrade now By John Leyden Posted: 17/12/2002 at 16:24 GMT Security researchers urge admins to update MySQL database servers, following the discovery of a set of potentially troublesome security flaws. The vulnerabilities could allow attackers to crash unpatched versions of the popular open source database server, inject malicious code on servers or hack into accounts without a password, warns German firm e-matters. http://www.theregister.co.uk/content/55/28607.html ---------------------------------------------------- [20] Government email policy 'flawed' By Nick Farrell [17-12-2002] Parliamentary internet group calls for better encryption The government's policy on email encryption is still flawed, a group of MPs has warned. Liberal Democrat Richard Allan, chairman of the Parliamentary All-Party Internet Group, told Radio 4's Today programme that many MPs and civil servants were unaware of how easy it is for emails to be read by the wrong person. http://www.pcw.co.uk/News/1137649 ---------------------------------------------------- _____________________________________________________________________ The source material may be copyrighted and all rights are retained by the original author/publisher. Copyright 2002, IWS - The Information Warfare Site _____________________________________________________________________ ------------------------------------------------------------------------ 'Information is the currency of victory on the battlefield.' GEN Gordon Sullivan, CSA (1993) ------------------------------------------------------------------------ Wanja Eric Naef Principal Researcher IWS - The Information Warfare Site http://www.iwar.org.uk ------------------------------------------------------------------------ Join the IWS Infocon Mailing List @ http://www.iwar.org.uk/general/mailinglist.htm ------------------------------------------------------------------------ To subscribe - send an email to "[EMAIL PROTECTED]" with "subscribe infocon" in the body To unsubscribe - send an email to "[EMAIL PROTECTED]" with "unsubscribe infocon" in the body --------------------------------------------------------------------- IWS INFOCON Mailing List @ IWS - The Information Warfare Site http://www.iwar.org.uk