_________________________________________________________________
London, Wednesday, December 18, 2002
_________________________________________________________________
INFOCON News
_________________________________________________________________
IWS - The Information Warfare Site
http://www.iwar.org.uk
_________________________________________________________________
---------------------------------------------------------------------
To subscribe - send an email to "[EMAIL PROTECTED]" with "subscribe
infocon" in the body
To unsubscribe - send an email to "[EMAIL PROTECTED]" with
"unsubscribe infocon" in the body
---------------------------------------------------------------------
_________________________________________________________________
----------------------------------------------------
[News Index]
----------------------------------------------------
[1] Revised cybersecurity plan goes to Bush next week
[2] Gilmore Commission critical of Bush cybersecurity plan
[3] Ridge talks to future employees of Homeland Security Department
[4] Privacy group sues Pentagon for "total information" project
[5] Pentagon seeking limit on wireless Net access
[6] Bush signs e-government bill into law
[7] Elcomsoft not guilty - DoJ retreats from Moscow
[8] Bush plans to deploy anti-missile defenses
[9] (Finland) Internet plan under attack
[10] DDoS: Are You Next?
[11] Fake escrow site scam widens
[12] (UK) Businesses to discuss cybercrime charter
[13] New 'Iraq oil' network worm found
[14] Christmas not so merry for alleged eBay swindler
[15] Navy XML policy signed
[16] Anti-spammer in car chase
[17] AOL wins $7m in porn spam case
[18] And deep in IE, a creature was stirring...
[19] Multiple vulns in MySQL, upgrade now
[20] (UK) Government email policy 'flawed'
_________________________________________________________________
CURRENT THREAT LEVELS
_________________________________________________________________
Electricity Sector Physical: Elevated (Yellow)
Electricity Sector Cyber: Elevated (Yellow)
Homeland Security Elevated (Yellow)
DOE Security Condition: 3, modified
NRC Security Level: III (Yellow) (3 of 5)
_________________________________________________________________
News
_________________________________________________________________
(The first draft showed how good the current administration is at
'riding the Washington gravy train', so it remains to be seen whether
the improved version will be any better. WEN)
[1] Revised cybersecurity plan goes to Bush next week
By Bara Vaida , National Journal's Technology Daily
White House officials expect to present a revamped national
cybersecurity strategy to President Bush for his approval next week, and
a formal public release is expected in early January, according to a
spokeswoman for the White House Office of Cyberspace Security.
The strategy has been significantly rewritten and includes greater
responsibility for Internet service providers (ISPs) to ensure that
computer networks are less vulnerable to attack, according to sources.
Further, it puts more emphasis on the need for private firms to disclose
computer vulnerabilities and for wireless technologies to be secure.
Earlier this month, Richard Davidson, president of the National
Infrastructure Advisory Council (NIAC) that is advising Bush on
cybersecurity, told a Western Governors Association conference that his
group recommended that ISPs be given more responsibility for securing
cyberspace.
http://www.govexec.com/dailyfed/1202/121702td2.htm
----------------------------------------------------
[2] Gilmore Commission critical of Bush cybersecurity plan
By DAN VERTON
DECEMBER 17, 2002
Content Type: Story
Source: Computerworld
WASHINGTON -- A congressionally appointed panel of experts yesterday
delivered a report to the president calling the government's incessant
focus on public/private partnerships to improve cybersecurity an
inadequate solution for the job at hand.
In its fourth annual report, the Advisory Panel to Assess Domestic
Response Capabilities for Terrorism Involving Weapons of Mass
Destruction, chaired by former Virginia Gov. James S. Gilmore III,
called the recently released Draft National Strategy to Secure
Cyberspace "a small step" in the right direction.
http://www.computerworld.com/securitytopics/security/story/0,10801,76827
,00.html
----------------------------------------------------
[3] Ridge talks to future employees of Homeland Security Department
By Tanya N. Ballard
Homeland Security Secretary-designate Tom Ridge addressed employees'
fears about the new department's organization on Tuesday during a town
hall-style meeting in Washington.
"I know there's a lot of anxiety and uncertainty perhaps, but hopefully
there's a lot of excitement," Ridge told the group of about 200
employees, a tiny handful of the roughly 170,000 employees pegged for
the new department when it is officially launched on Jan. 24. "I know
what you do and I know how well you do it, and I really believe in one
department.we'll have the opportunity to do it better."
The new Homeland Security Department, created under legislation approved
by Congress and signed by President Bush last month, will have a budget
of nearly $37 billion and will merge 170,000 employees from 22 different
agencies. On Tuesday, Ridge fielded questions ranging from the role of
agencies merged into the agency to the location of the new department's
headquarters.
http://www.govexec.com/dailyfed/1202/121702t1.htm
See also:
Homeland Security Appointments Watch
As the Bush administration works to staff up the Homeland Security
Department, GovExec.com will offer updated reports on who's headed
where.
http://www.govexec.com/dailyfed/homelandappointments.htm
----------------------------------------------------
[4] Privacy group sues Pentagon for "total information" project
By Shane Harris
A group that advocates keeping personal information out of government
hands wants a federal judge to intercede in its fight against the
Pentagon.
The Electronic Privacy Information Center (EPIC) requested a temporary
restraining order in U.S. district court Tuesday, asking the judge to
overturn the Defense Department's decision not to release information
about a controversial research project. The restraining order, which
cannot be appealed, would force the Pentagon to give EPIC any documents
related to the legal authority for the project, its impact on privacy
and civil rights, and the activities of the project director, former
National Security Adviser John Poindexter.
The Pentagon launched the project, called the Total Information
Awareness (TIA) system, almost a year ago as part of its ongoing
research into counter-terrorism strategies. Researchers are testing ways
to electronically search databases of personal transactions-such as
credit card purchases or phone records-and to look for relationships
among the data that might indicate a terrorist attack is being plotted.
http://www.govexec.com/dailyfed/1202/121702h1.htm
----------------------------------------------------
[5] Pentagon seeking limit on wireless Net access
John Markoff NYT
Wednesday, December 18, 2002
Interference with military radar cited
SAN FRANCISCO The U.S. Defense Department, arguing that an increasingly
popular form of civilian wireless Internet access could interfere with
U.S. military radar systems, is seeking limits on the technology, which
has been seen as a bright spot for the gloomy communications industry.
Industry executives, including representatives from Microsoft Corp. and
Intel Corp., met with Defense Department officials last week to try to
stave off that effort, which includes a government proposal now pending
before the international organization that oversees global use of the
radio-frequency spectrum.
The military officials are seeking technical restrictions that they say
are necessary for national security but that industry executives say
would threaten expansion of technology such as the so-called Wi-Fi
systems used for wireless Internet access in U.S. airports, coffee
shops, homes and offices.
http://www.iht.com/articles/80678.html
----------------------------------------------------
[6] Bush signs e-government bill into law
>From National Journal's Technology Daily
Industry groups and congressional leaders on Tuesday hailed President
Bush for signing into law a measure to bolster online government
services.
The law makes permanent an e-government office within the White House
Office of Management and Budget and authorizes $345 million over four
years to fund interagency technology initiatives. It also enhances
privacy protection by requiring agencies to assess the privacy impact of
new government technology systems.
Sen. Joseph Lieberman, D-Conn., said in a statement, "The president's
signing of this bill today brings the federal government fully into the
electronic age, giving taxpayers the same round-the-clock access to
government that they have come to expect from the private sector."
http://www.govexec.com/dailyfed/1202/121702td1.htm
----------------------------------------------------
[7] Elcomsoft not guilty - DoJ retreats from Moscow
By Andrew Orlowski in San Francisco
Posted: 17/12/2002 at 23:55 GMT
The Russian software company which has found itself on trial in an
American court was acquitted on all counts of circumventing the DMCA
today.
Elcomsoft's woes began in August last year, when programmer Dmitry
Sklyarov was charged under the Digital Millennium Copyright Act's
circumvention 1201 clauses (one small part of which is under review by
the Librarian of Congress) while visiting Las Vegas for a technical
conference. Skylarov was imprisoned for his part in creating an Adobe
eBook reader that permitted fair-use of copyright material, and
imprisoned pending trial.
http://www.theregister.co.uk/content/55/28612.html
http://online.securityfocus.com/news/1857
----------------------------------------------------
[8] Bush plans to deploy anti-missile defenses
AP AP
Wednesday, December 18, 2002
'Modest' initial stage of a limited system is expected by 2004
WASHINGTON President George W. Bush said Tuesday that he would begin
deploying by 2004 a limited system to defend the United States against
ballistic missiles.
Though the first parts of the system will be put into use while more
advanced technology is still being developed, Defense Secretary Donald
Rumsfeld said the initial system would probably stop "a relatively small
number of incoming ballistic missiles, which is better than nothing."
As a candidate, Bush promised to build an anti-missile shield, and
earlier this year, to advance the plan, he pulled out of an
anti-ballistic missile treaty. On Tuesday, he cited the Sept. 11
terrorist attacks as evidence that the United States faces
"unprecedented threats" and needs the anti-missile shield.
http://www.iht.com/articles/80644.html
----------------------------------------------------
[9] Internet plan under attack
AP AP
Wednesday, December 18, 2002
HELSINKI A bill that would hold the operators of Web sites and Internet
providers in Finland liable for what their users say is being criticized
as a way to muzzle freedom of speech. Critics contend the bill, if
passed by Finland's Parliament, could lead to an end to online
publishing.
Under the new proposal, Internet providers and web page hosts could be
liable for the content on their sites, even if they did not see or post
it themselves. Web site operators would also be required to keep records
of users who post content on newsgroups, message boards and chat sites.
Also, owners of computers that store and relay e-mail and Web pages over
the Internet would be liable under the proposal.
The constitutional committee is expected to evaluate the plan in
January.
"Taken literally, most of the requirements in the bill are impossible to
follow," said Kai Puolamaki, a researcher at the Helsinki University of
Technology and a member of Electronic Frontier Finland, a watchdog group
that focuses on freedom of speech online.
http://www.iht.com/articles/80677.html
----------------------------------------------------
[10] DDoS: Are You Next?
By Konstantinos Karagiannis
On October 21, 2002, a concentrated distributed denial-of-service attack
(DDoS) almost brought the Internet to its knees. The attack hit the
Internet's backbone, taking down 9 of the 13 root servers for almost an
hour. These servers are the Domain Name System (DNS) machines that
translate between IP addresses and domain names. (For example,
www.pcmag.com represents the Web server at the IP address
63.111.13.100.) Fortunately, the Internet's redundancy meant that the
unaffected root servers were able to handle the traffic until the
compromised computers came back online. Had the attack been just a
little more successful, people all over the world would have been unable
to navigate the Web as usual. It's nearly impossible to overestimate the
havoc this would have wrought on business, government, and just about
every facet of modern life.
Denial-of-service attacks typically flood a server with traffic and
prevent access to the services running on that server. DDoS attacks are
among the most potentially crippling forms of DoS. They come from
multiple machines and are far more overwhelming and difficult to prevent
or trace. The October 2002 attack was one of the boldest known DDoS
attacks, but these types of assaults happen all the time.
http://www.pcmag.com/article2/0,4149,768385,00.asp
----------------------------------------------------
[11] Fake escrow site scam widens
Auction winners sometimes lose $40,000 at a time
By Bob Sullivan
MSNBC
Dec. 17 - In July, MSNBC.com warned Internet users that fake escrow Web
sites were the latest scam. Six months later, the scam has widened
considerably, and it now appears to be among the most successful
Internet cons ever. By taking advantage of Net auction winners' inherent
trust of escrow sites, the con artists are stealing as much as $40,000
at a time from big-ticket auction winners. Their total take may well
reach into millions of dollars so far. And while federal authorities,
including the Department of Commerce and FBI, are investigating, there
seems to be no way to slow down the con artists.
http://www.msnbc.com/news/846795.asp
----------------------------------------------------
[12] Businesses to discuss cybercrime charter
By Andy McCue [18-12-2002]
Members of blue chip user group to meet hi-tech crime unit in January
UK corporate users are to get their first chance next month to examine
in detail the cybercrime confidentiality charter drawn up by the
National Hi-Tech Crime Unit (NHTCU).
The charter, to encourage businesses to report hacker attacks by
minimising the disruption of an investigation and keeping the
information out of the media, was unveiled by the police earlier this
month.
Members of the blue chip user organisation The Infrastructure Forum
(Tif), will meet with the NHTCU at the end of January to discuss the
charter.
http://www.pcw.co.uk/News/1137655
----------------------------------------------------
[13] New 'Iraq oil' network worm found
By Paul Roberts, IDG News Service
DECEMBER 17, 2002
Content Type: Story
Source: IDG News Service
A new network worm that spreads through shared folders on machines
running Microsoft Corp.'s Windows NT, 2000 and XP operating systems has
been detected, according to advisories posted by a number of antivirus
software makers today.
The new worm, called W32/Lioten, also goes by the name Iraq_oil, Datrix,
W32.Lioten, and I-Worm.Lioten, according to an advisory posted by
Helsinki, Finland-based security company F-Secure Corp.
Unlike other worms that spread through mass e-mailing, Lioten scans the
Internet for vulnerable Windows machines that are sharing folders with
other users on a home or business network.
http://www.computerworld.com/securitytopics/security/virus/story/0,10801
,76855,00.html
----------------------------------------------------
[14] Christmas not so merry for alleged eBay swindler
By LINDA ROSENCRANCE
DECEMBER 17, 2002
Content Type: Story
Source: Computerworld
It was a sting worthy of Paul Newman and Robert Redford.
Earlier this month, Eric Smith, a 21-year-old student at the University
of New Orleans, pulled a fast one on Melvin Christmas, a Chicago man who
allegedly swindled him out of a brand new Apple Macintosh PowerBook G4
867.
Here's what happened, according to police, information from Smith's
personal Web site and an interview with the college student:
Shortly after purchasing the brand new PowerBook for about $2,300 at the
end of November, just after they were released by Apple, Smith decided
the laptop was too expensive to keep and put it up for sale on eBay. He
asked for a buy-it-now price of $2,950. In addition to the brand new
computer, he included an Airport wireless base station "and a bunch of
other knick-knacks" to justify the higher price.
http://www.computerworld.com/securitytopics/security/cybercrime/story/0,
10801,76857,00.html
----------------------------------------------------
[15] Navy XML policy signed
BY Matthew French
Dec. 18, 2002
Navy chief information officer David Wennergren has signed the Navy's
Extensible Markup Language policy, setting the standard for how XML will
be used within the service. XML facilitates information exchange among
applications and systems because it enables agencies to tag data and
documents.
"Interoperability is a cornerstone of [the Navy Department's] efforts to
strengthen its independent operations and, subsequently, improve the
warfighter's ability to find, retrieve, process and exchange
information," Wennergren said in a Dec. 13 statement to Navy commanders.
"The department, like many government and private-sector organizations,
has increasingly looked to XML technology to meet its data-sharing
needs." The policy's overall goals are to promote XML as a technology to
help achieve interoperability throughout the Navy and serve as a
guideline to support interoperability among the Navy and other DOD
components.
http://www.fcw.com/fcw/articles/2002/1216/web-xml-12-18-02.asp
----------------------------------------------------
[16] Anti-spammer in car chase
By Tim Richardson
Posted: 17/12/2002 at 15:59 GMT
Rich Clark, an American spam hater, claims he was involved in a car
chase and received threatening phone calls after taking photos of the
house belonging to mega-wealthy bulk-emailer, Alan Ralsky.
It seems Rich was taking the photos so he could post them on an
anti-spam Web site. Next thing he knew, he was being cut-up by a guy in
a black Jag who had just left the house. The day after, he received
threatening messages on his answerphone.
http://www.theregister.co.uk/content/6/28605.html
----------------------------------------------------
[17] AOL wins $7m in porn spam case
By Tim Richardson
Posted: 17/12/2002 at 12:18 GMT
AOL has won $7m in damages after it claimed its punters had been
bombarded with porn spam.
The giant Internet company used the court ruling to warn spammers that
it will use the full force of the law to hit at anyone who targets its
punters with unsolicited email.
AOL brought the case against CN Productions in the late 1990s, alleging
it had sent unwanted emails advertising adult Web sites. In 1999, AOL
won an injunction barring CN Productions from spamming its users.
http://www.theregister.co.uk/content/6/28600.html
----------------------------------------------------
[18] And deep in IE, a creature was stirring...
By John Leyden
Posted: 17/12/2002 at 11:18 GMT
eEye security researcher Derek Soeder was moved to verse after analysing
a complicated - and not particularly devastating - heap corruption
vulnerability involving the way Windows handles PNG image format files.
An advisory by eEye begins thus:
Twas the night before Christmas, and deep in IE
A creature was stirring, a vulnerability
MS02-066 was posted on the website with care
In hopes that Team eEye would not see it there
http://www.theregister.co.uk/content/55/28599.html
----------------------------------------------------
[19] Multiple vulns in MySQL, upgrade now
By John Leyden
Posted: 17/12/2002 at 16:24 GMT
Security researchers urge admins to update MySQL database servers,
following the discovery of a set of potentially troublesome security
flaws.
The vulnerabilities could allow attackers to crash unpatched versions of
the popular open source database server, inject malicious code on
servers or hack into accounts without a password, warns German firm
e-matters.
http://www.theregister.co.uk/content/55/28607.html
----------------------------------------------------
[20] Government email policy 'flawed'
By Nick Farrell [17-12-2002]
Parliamentary internet group calls for better encryption
The government's policy on email encryption is still flawed, a group of
MPs has warned.
Liberal Democrat Richard Allan, chairman of the Parliamentary All-Party
Internet Group, told Radio 4's Today programme that many MPs and civil
servants were unaware of how easy it is for emails to be read by the
wrong person.
http://www.pcw.co.uk/News/1137649
----------------------------------------------------
_____________________________________________________________________
The source material may be copyrighted and all rights are
retained by the original author/publisher.
Copyright 2002, IWS - The Information Warfare Site
_____________________________________________________________________
------------------------------------------------------------------------
'Information is the currency of victory on the battlefield.'
GEN Gordon Sullivan, CSA (1993)
------------------------------------------------------------------------
Wanja Eric Naef
Principal Researcher
IWS - The Information Warfare Site
http://www.iwar.org.uk
------------------------------------------------------------------------
Join the IWS Infocon Mailing List @
http://www.iwar.org.uk/general/mailinglist.htm
------------------------------------------------------------------------
To subscribe - send an email to "[EMAIL PROTECTED]" with "subscribe
infocon" in the body
To unsubscribe - send an email to "[EMAIL PROTECTED]" with
"unsubscribe
infocon" in the body
---------------------------------------------------------------------
IWS INFOCON Mailing List
@ IWS - The Information Warfare Site
http://www.iwar.org.uk
