Researcher says hacked data stored properly
388991
A Connecticut researcher on leave at UC Berkeley said Friday she tried to follow all the rules when she stored a confidential database on a campus computer system that was broken into by a hacker.
574935
One of Harvard University&#39;s Web sites appeared on Monday to have been hacked, with its contents appearing on the BitTorrent file-sharing network.A compressed 125MB file claiming to be the database for the Web site of Harvard&#39;s Graduate School of Arts and Sciences is available via the BitTorrent peer to peer network. The file is listed on The Pirate Bay, a Web site that indexes torrents, or small information files that coordinate the download of content from other users on BitTorrent.The Web site for the Graduate School of Arts and Sciences was offline on Monday.A note attached to the torrent claimed the file contained a backup of the site -- including some contacts files and other files associated with Joomla, an open-source content management system -- along with other various bits. It appears to be legitimate.The note&#39;s writer claims the stunt is intended to demonstrate the insecurity of Harvard&#39;s server. The writer also exposed what purport to be usernames and passwords belonging to two of the site&#39;s system administrators.&quot;Stupid people, you don&#39;t use a secure password,&quot; read a note preceding the sensitive information.As of Monday afternoon, the compromised file was being distributed by 11 users -- known in file-sharing terminology as &quot;seeders&quot; -- and was being downloaded by nine &quot;leechers,&quot; or those downloading the files.Harvard&#39;s media office was closed on Monday due to a national U.S. holiday.
79168
Independent security researcher stumbles upon usernames and passwords to nearly 1,000 government officials worldwide.
161831
Unprecedented amounts of data will need to be secured in new, untested ways. What's the best course to pursue in such uncharted territory?
105905
Blog: Original researcher makes public his own exploit code.
510816
Today, many people rely on computers to do homework, work, create, etc., so it's important to take special care with your data storage. This week you'll learn about how to protect your data and prevent intrusions.  By Vincent Deguzman. 0919
322190
Researchers report that 37 percent of old hard drives still contain personal data from former owners.
599663
One of Harvard University's Web sites appeared on Monday to have been hacked, with its contents appearing on th...
283682
A computer hacker apparently broke into a database, leaving 32,000 people uncertain whether their finances or identities might be compromised.
547003
If you&#39;re a convicted identity thief, you&#39;ve got about a 50 percent chance of avoiding jail time.That&#39;s one of the findings of a new study of closed U.S. Secret Service case files, released Monday by Utica College&#39;s Center for Identity Management and Information Protection. This is the first time researchers have been allowed to sift through the Secret Service&#39;s data. The study&#39;s authors based their findings on an&#160;analysis of 500 closed Secret Service cases.&quot;Prosecutors had a slightly better chance of sending a convicted identity thief to prison than not (51 percent) and could expect to see the imprisoned offender sentenced to three years or less of incarceration,&quot; the report said.The college has been working with a number of partners, including the Secret Service, IBM, and the Federal Bureau of Investigation, since the Center&#39;s creation in mid-2006 to study the methods used by ID thieves and to help corporations and law enforcement prevent this type of crime.Technology like printers, mobile phones, and computers were used in about half of the cases, but the Internet was the exclusive tool of ID thieves only about 10 percent of the time.Identity theft is concentrated in the northeastern and southern United States, the study found. And the majority of the offenders in the Secret Service cases were African-American; more than two-thirds of all offenders were male.The study also found that ID thieves tended to hit people that they did not know, rather than preying on friends and relatives. A family member or friend was the victim in 16 percent of cases. In about a third of the cases, the theft was an inside job, with the data being stolen from an employer.Identity theft is a well-studied phenomenon, but it&#39;s unusual for a survey to be based on this kind of closed-case data. &quot;This study is significant because it did not depend on self-reported or survey data,&quot; the authors wrote.The median loss from identity theft was just over $31,000, but in one case, investigated by the Secret Service&#39;s Dallas field office, the defendant spent millions on luxury vehicles and then managed to set up shell companies and defraud investors. Total losses: $13 million. &quot;In general,&quot; however, &quot;the more offenders involved in the case, the higher the victim loss,&quot; the study stated.According to Javelin Strategy &amp; Research, identity theft cost U.S.businesses and consumers an estimated $49.3 billion in 2006.&#160;
114781
A computer security researcher figures out exactly how a high-tech scammer
619128
(InfoWorld) - The anonymous researcher who claims to have crafted a Mac OS X worm said Tuesday that he or she will report his findings to Apple Inc., but added that the Cupertino, Calif. company "has a very long way to go" on security. Identified only as the researcher behind the Information Security Sell Out blog, he or she on Sunday announced that a still-unpatched bug in mDNSResponder, a component of Apple's Bonjour automatic network configuring service, could be exploited by a worm. Apple's May security update, dubbed 2007-005, included a fix for the mDNS bug. "[My worm] is in the same code base, obviously, but that is where the similarity to the recently patched issues ends," said the Info Sec researcher in an e-mail interview. "When Apple fixed the previous issues, they did not take care of the entire code base and there are a lot of bugs there...some are exploitable, like the one I am using, while others are not. But the fact remains that Apple did a horrible job in fixing this package." According to Info Sec, the worm is fully automated and ready to use. "It would be considered a fully weaponized exploit and fully automated," said the researcher. "This is really no different than other worms we have seen [on the Windows platform]. Other than that, I am not able to give any more details." Another researcher, however, questioned whether Info Sec crafted the worm in only a few hours, as claimed. "Writing the exploit in one day...unlikely for anything other than a stack overflow," said Dave Aitel, the chief technology officer at Immunity Inc., the Miami Beach, Fla.-based security company best known for its CANVAS penetration testing ("pentest") software. "So most likely he found a stack overflow in mDNS, which is perfectly possible. It is open source, after all." Info Sec didn't detail the vulnerability, but did emphasize that writing the exploit was a breeze. "The hard part is finding the bug," he or she said. "Once you have found it, it is very easy to exploit. The Bonjour (mDNS) service is UDP [User Datagram Protocol, one of the core Internet protocols] Universal as well, making it even more fun for things like worms." But like other researchers who have grown tired of claims that Mac OS X is more secure than rival operating systems, Info Sec saved a last shot for Apple. Although he/she will report the new-found vulnerability to Apple at some point, there is no timetable for the moment. "I do believe in being responsible and working with vendors," said Info Sec, "but I also feel that some vendors need to be treated like children and learn lessons the hard way. Apple has a very long way to go when dealing with security issues in their products." Aitel leaned a bit the same way. In a posting to his DailyDave mailing list Monday in which he pointed out the Info Sec exploit, Aitel said: "I note that 'Infosecurity Sellout' is claiming there is another bug in mDNS which is wormable. This is obviously untrue, since there are no more remote bugs in OS X." That last line was firmly tongue in cheek, Aitel clarified today in an e-mail. "No, I'm just being funny. OS X is horribly insecure," he said. In an e-mailed statement, Apple spokesman Anuj Nayar rebutted. "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users," he said.
287792
Administaff, a provider of human resources services, is notifying 159,000 former and current workers that personal data about them was on a laptop reported missing on Oct. 3. The data was unencrypted.
624933
A researcher says the techniques to stay anonymous online can be thwarted through flaws in the systems.
381545
Authorities are still working to determine who broke into the campus system Jan. 3 and how. University campuses present a particularly inviting security target, experts say, because their systems house large amounts of personal data. -The Washington Post
426070
Researcher who demonstrated the "sidejack" attack at Black Hat USA now says even encrypted Gmail can be compromised.
385883
Photocopying wallet information pays off.