Monday, December 03, 2012

Cyber Security News for the Week Of December 3, 2012

From our friends at Citadel Information Group

Cyber Crime
Study May Offer Insight Into Coca-Cola Breach: Spend enough time with cybersecurity experts and chances are you will hear some variation of this line: There are two types of companies in the United States, those that have been hacked and those that don't yet know they've been hacked. The New York Times, November 30, 2012

Greek Man Accused Of Stealing Data On 9 Million Citizens: A Greek man has been arrested in possession of some 9 million personal records - most of the country's population. DarkReading, November 21, 2012

Identity Theft
Sensitive documents found in Macy's Thanksgiving Day Parade confetti: Authorities in Long Island are investigating how shredded confidential police documents ended up as confetti in the annual Macy's Thanksgiving Day parade in New York City, according to Nassau County Police. CNN, November 26, 2012

Cyber Warning
Shylock Malware Detects VMs to Evade Analysis: The sophisticated banking Trojan gains a new trick: The ability to detect virtual machines controlled using remote sessions, a common configuration for researchers. eWeek, November 30, 2012

Java Zero-Day Exploit on Sale for 'Five Digits': Miscreants in the cyber underground are selling an exploit for a previously undocumented security hole in Oracle's Java software that attackers can use to remotely seize control over systems running the program, KrebsOnSecurity has learned. KrebsOnSecurity, November 27, 2012

Security Flaw In Common Keycard Locks Exploited In String Of Hotel Room Break-Ins: Whoever robbed Janet Wolf's hotel room did his work discreetly. Forbes, November 26, 2012

Cyber Underworld
Online Service Offers Bank Robbers for Hire:An online service boldly advertised in the cyber underground lets miscreants hire accomplices in several major U.S. cities to help empty bank accounts, steal tax refunds and intercept fraudulent purchases of high-dollar merchandise. KrebsOnSecurity, November 29, 2012

Java Zero-Day Exploit on Sale for 'Five Digits': Miscreants in the cyber underground are selling an exploit for a previously undocumented security hole in Oracle's Java software that attackers can use to remotely seize control over systems running the program, KrebsOnSecurity has learned. KrebsOnSecurity, November 27, 2012

Yahoo Email-Stealing Exploit Fetches $700: A zero-day vulnerability in that lets attackers hijack Yahoo! email accounts and redirect users to malicious Web sites offers a fascinating glimpse into the underground market for large-scale exploits. KrebsOnSecurity, November 23, 2012

Cyber Mercenaries
Malware Corrupts Iranian Financial Databases: Symantec is warning that financial malware, dubbed Narilam, is actively targeting financial applications primarily used in Iran. Information Week, November 26, 2012

Cyber Espionage
Japan's Space Agency Says Rocket Information Was Stolen by Computer Virus: The Japan Aerospace Exploration Agency said that the virus in a computer at its Tsukuba Space Center northeast of Tokyo was found to be secretly collecting data and sending it outside the agency. The agency said that after the virus was detected by antivirus software on Nov. 21, it conducted an emergency sweep for viruses that showed no other computers at the center had been infected. The New York Times, November 30, 2012

Anonymous Hackers Swat At Syrian Government Websites In Reprisal For Internet Blackout: "When your government shuts down the Internet, shut down your government," goes the slogan popularized by the hacker group Anonymous. As Syria blacked out its digital connections Thursday, the group seems to have settled for the tactic that it knows best: shutting down and vandalizing the few government websites that remain online. Forbes, November 30, 2012

Hackers Attack the International Atomic Energy Agency: The International Atomic Energy Agency (IAEA) has acknowledged that hackers successfully breached its cyber-defenses and obtained a list of agency email addresses. A group calling itself Parastoo (a Farsi word for a bird and a common girl's name in Iran) has claimed responsibility. Datamation, November 28, 2012

Online Bank Fraud
PATCO Fraud Dispute Settled: The ongoing dispute between PATCO Construction Inc. and People's United, formerly Ocean Bank, over a $500,000 account takeover incident dating back to 2009 has finally come to a close. BankInfoSecurity, November 27, 2012

Cyber Security Management
How South Carolina Failed To Spot Hack Attack: Just one look: That's all it took for an attacker to compromise South Carolina state systems. InformationWeek, November 26, 2012

Building a Fortress in the Cloud for Your Critical Data: Businesses are in the crosshairs as military and spy organizations around the world step up their cyber-snooping techniques, and the shift to cloud is only exacerbating the risks. How can you be sure your cloud partner is capable of protecting your data from cyberattacks? CIO, November 26, 2012

IT and Employees See BYOD Security (Much) Differently: Bring-your-own-device (BYOD) is top of mind for most CIOs and IT leaders these days, but only a fraction of the IT organizations that have opened the BYOD door have gone beyond allowing access to company email and instant messaging, according to a recent study by Blue Coat, Web security and WAN optimization company. Blue Coat also found that IT staff and other company employees have dramatically different perspectives on security when it comes to mobile devices. CIO, November 20, 2012

National Cyber Security
Draft cyber executive order excludes commercial products: A new draft of the White House's cybersecurity executive order maintains the administration's effort to improve the digital defenses of critical infrastructure - but it includes a number of changes, following several administration meetings with stakeholders. Politico, November 30, 2012

CyberCity allows government hackers to train for attacks: CyberCity has all the makings of a regular town. There's a bank, a hospital and a power plant. A train station operates near a water tower. The coffee shop offers free WiFi. But only certain people can get in: government hackers preparing for battles in cyberspace. The Washington Post, November 26, 2012

Cyber Corps program trains spies for the digital age: TULSA, Okla. - Jim Thavisay is secretly stalking one of his classmates. And one of them is spying on him. LA Times, November 22, 2012

Cyber Sunshine
All Banks Should Display A Warning Like This: One of my Twitter account followers whose tweets I also follow - @spacerog - shared with me the following image, which he recently snapped with his phone while waiting in line at the Philadelphia Federal Credit Union. It's an excellent public awareness campaign, and one that I'd like to see replicated at bank branches throughout the country. KrebsOnSecurity, November 27, 2012

How People Change: Nick Crews was, by his own admission, a middling father. He enjoyed cuddling with his three kids, but he was frequently away on naval deployments and didn't stay in touch with them once they went off to boarding school. The New York Times, November 26, 2012

Securing the Village-Events Calendar
Cyber Security Awareness-Continuing CPA Education; Dec 3, 2012: Dr. Stan Stahl, Citadel and ISSA-LA President, will speak on cybersecurity at the lunch meeting of the West San Gabriel Valley (Pasadena) Discussion Group. In this non-technical presentation, Dr. Stahl will discuss cyber security risks and what CPAs need to do to protect themselves and their clients.

Content Protection Summit 2012, Dec 6, 2012, Universal Hilton, Universal City: This year's summit will again offer cutting-edge strategies on protecting content against rapidly evolving piracy and cyber-attack threats. Produced by Variety and CDSA, ISSA-LA is proud to be an Association Partner. Keynote Speaker: Former Senator Chris Dodd. For more information and to register, click here.

Imperial Capital's 2012 Security Investor Conference; Dec 12-13, 2012: Waldorf Astoria, New York. Featured keynote speaker, Richard A. Clark. For more information and to register, click here.

ISSA-LA December Lunch Meeting; Dec 19: Join ISSA-LA at Les Freres Taix French Restaurant for our monthly meeting. For more information and to register, click here.

Santa Monica Rotary Club; May 3, 2013: Dr. Stan Stahl, Citadel and ISSA-LA President, will speak on cybersecurity at the weekly meeting of the Santa Monica Rotary Club. In this non-technical talk - It Takes the Village to Secure the Village SM - Dr. Stahl discusses the financial implications of cyber crime, illustrates how cyber criminals take control of a user's computer, describes the limitations of technology, summarizes emerging cyber security laws, regulations and practices, and provides practical tips to lower the risk of becoming a victim.

ISSA-LA Fifth Annual Information Security Summit; May 21, 2013: SAVE THE DATE. Join over 500 of your colleagues and peers at the Universal City Hilton. Special Keynote Speaker: Howard Schmidt, former White House CyberSecurity Coordinator.'s Security Recruiter Blog