Ex-U.S. Cyber Security Chief Sees Curb on Phishing
610153
A former White House Web security  chief predicted on Wednesday that technology companies and law  enforcers could soon stamp out most Internet "phishing" scams  that aim to trick people into giving away personal and  financial information.
389327
Computer-security experts, including former government officials, urged the Bush administration on Tuesday to devote more effort to strengthening defenses against viruses, hackers and other online threats. -Reuters
169088
(InfoWorld) - An attack this week that targeted online customers of at least 50 financial institutions in the U.S., Europe, and Asia-Pacific has been shut down, a security expert said Thursday. The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike Web site for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense Inc. To be infected, a user had to be lured to a Web site that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said. The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a Web site rigged with the malicious code. Once lured to the Web site, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The Web sites displayed only an error message and recommended that the user shut off their firewall and antivirus software. If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's Web site that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible. The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike Web sites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser. "It takes a lot of work but is quite clever," Gonzalez said. "The job is well done." The Web sites hosting the malicious code, which were located in Germany, Estonia, and the U.K., had been shut down by ISPs as of Thursday morning, along with the look-alike Web sites, Gonzalez said. It was unclear how many people may have fallen victim to the attack, which went on for about three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said. The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller. The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the U.S. and Australia. Â
20521
The government's cybersecurity chief has abruptly resigned after one year with the Department of Homeland Security, confiding to industry colleagues his frustration over what he considers a lack of attention paid to computer security issues within the agency.
315257
The government's cybersecurity chief has abruptly resigned after one year with the Department of Homeland Security, confiding to industry colleagues his frustration over what he considers a lack of attention paid to computer security issues within the agency.    Amit Yoran, a former software executive from Symantec Corp...
239208
Security experts are saying that a well-intentioned effort by the New Jersey Office of the Attorney General to combat phishing may backfire.Earlier this week, State Attorney General Anne Milgram called on four banks -- Bank of America, Citibank, Washington Mutual, and New Jersey-based Sun National Bank -- to provide her with details on how they respond to phishing incidents.This is a good move that will probably raise awareness about phishing, observers say. However, Milgram also asked the banks to send e-mail to their online customers, warning them that the bank has been a recent target for phishing scams and offering advice on how to tell fake e-mails form the real thing.That raised a red flag with anti-phishing experts.&quot;The New Jersey Attorney General asking the banks to send out another e-mail to clients is opening up ... those banks to be phished yet again,&quot; said Paul Laudanski, leader of the Phishing Incident Reporting and Termination squad project. &quot;I can see the phishers writing in a new e-mail scam campaign &#39;The New Jersey AG has asked us to inform you that you have been phished, please click this link to secure your account.&#39; Trouble, trouble, trouble! This is a setup for failure,&quot; he wrote in an e-mail message.Dave Jevans, chairman of the Anti-Phishing Working Group said that while he applauded Milgram&#39;s effort to educate consumers by inquiring directly with bank CEOs, he &quot;would have preferred that the Attorney General waited to hear back from these banks before issuing a request to send e-mails out to all their customers. That type of e-mail can set the stage for waves of copy-cat phishing,&quot; he said via e-mail. &quot;If the phishers send out fake e-mails of this type before the banks get to it, there&#39;s a potential problem.&quot;Even Katherine Tassi, Washington State&#39;s assistant attorney general, said she thought there could be problems. &quot;Consumers are already confused enough about whether e-mail from a bank is authentic or not,&quot; she said via e-mail. &quot;A lot of banks do, in fact, communicate by e-mail to their consumers, which is something that makes the problem worse.&quot; That&#39;s because consumers become more trusting of the e-mails, even messages that may be from a malicious source.Milgram&#39;s spokesman, Lee Moore, said that banks should use every means possible to educate their customers about phishing -- including e-mail. &quot;Banks need to compete with the phishers in the customer&#39;s e-mail box with the right message,&quot; he said.The New Jersey AG has been receiving more and more phishing complaints of late and is coming to view the phenomenon as a growing concern, Moore added.As of late Thursday, his office had not heard back from any of the banks.
309870
WASHINGTON - The government's cybersecurity chief has abruptly resigned from the Homeland Security Department amid a concerted campaign by the technology industry and some lawmakers to persuade the Bush administration to give him more authority and money for protection programs.    Amit Yoran, a former software executive from Symantec Corp., made his resignation effective Thursday as director of the National Cyber Security Division, giving a single's day notice of his intention to leave...
724562
Until just a few months ago, Gary Warner did not have the kind of day job you&#39;d expect from an antiphishing crusader. He didn&#39;t work for a security vendor or a bank, or any kind of company you&#39;d expect to care about phishing.Warner&#39;s career as a cyber-sleuth began on Halloween 2000. That&#39;s when his company&#39;s Web site was defaced by a hacker named Pimpshiz as part of a pro-Napster Internet graffiti campaign.&quot;My boss came to me and said, &#39;Find out who did this and put them in jail,&#39;&quot; said Warner, who was at the time an IT staffer with Energen, a Birmingham, Alabama oil and gas company.It was an eye-opening experience. &quot;I called the police and they were like, &#39;What do you want us to do?&#39;&quot; he said.Months later, when Pimpshiz struck servers at NASA, Warner reached out, calling staff there and saying &quot;Hey, we know who this guy is. Here&#39;s his name and address.&quot;Since then, Warner has quietly become one of the most-respected authorities on phishing in the U.S. -- the kind of guy that federal agents and banking IT staff call when they want to know how to catch the bad guys and shut down their credit-card-stealing Web sites.With Warner&#39;s help, authorities eventually arrested Pimpshiz, whose real name is Robert Lyttle,&#160;in connection with the hacks.Fishing for PhishersWarner said that the Pimpshiz case was formative, underlining how hard it is for law enforcement to catch the bad guys on the Internet.&quot;The experience showed me that it&#39;s not that they don&#39;t care,&quot; Warner said.&#160;&quot;Their hands are tied by the legal process.&quot;Soon, Warner found himself spending dozens of hours each week compiling data on spammers and phishing attacks. &quot;I would sit for a couple of hours every morning and find all the new phishing sites that I could,&quot; he said.He&#39;d take screenshots of the sites, e-mail the Webmasters who were hosting them and ask them for Web logs, and eventually he started making connections -- he&#39;d connect one phishing group with several different attacks -- and learn who he needed to call to get Web sites removed, no matter where in the world they were hosted.He&#39;d get calls from IT staff at small credit unions asking for help taking down fraudulent sites, every day, all day long. It was cutting in on his work. Late last year, he decided to make a change. &quot;I went to my boss and told him that I&#39;m going to look for a way to do this full time.&quot;Helping the Feds Crack Down on Online FraudIn July, with recommendations from FBI and Secret Service agents,&#160;Warner took a job as Director of Research in Computer Forensics with the University of Alabama at Birmingham (UAB).He also began working with law enforcement, not only educating FBI and Secret Service agents on how crimes were committed, but also helping to track down the criminals and helping with take-downs.&quot;He&#39;s an outstanding resource for the FBI,&quot; said Dale Miskell,&#160;supervisory special agent with the FBI&#39;s Birmingham Cyber Crime unit, who has worked with Warner since 2005.Miskell said Warner has helped the FBI with investigations and taught staff about his antiphishing techniques.&quot;He could be a multimillionare by his skillsets... he&#39;s a very gifted speaker, he can talk to the techies, and then he can turn around and talk to the non-techies and everyone will understand.&quot;Warner is now focusing on fighting cyber-crime full-time and on training a new generation of network forensics investigators. &quot;You wouldn&#39;t believe the looks on their eyes the first time they got an e-mail back from a Webmaster saying, &#39;Thanks for letting me know. I just shut that down.&#39;&quot;When he spoke with IDG News, it was five days after final exams at the University of Alabama at Birmingham and though it would have no effect on their marks, four students were still coming into the labs to help shut down phishers.&quot;That idea that as a private citizen, you can help, that&#39;s the kind of thing we&#39;re trying to inspire,&quot; he said.The Future of Phish-bustingAt the University, Warner is building up a 256-node supercomputer which could eventually become the largest collection of spam email on the planet, processing as many as 100 million email messages per day and providing researchers and law enforcement with valuable analysis data.For Warner, the work isn&#39;t so much a job, as it is his moral responsibility as a computer scientist. &quot;One of the things that really bothered me from the very beginning was people who were using my field to attack other people,&quot; he said. &quot;The way I see it, this is our Internet. I&#39;m going to stand at the end of my driveway and protect what&#39;s mine.&quot;He says that his anti-phishing work hardly feels like work at all. &quot;This is what I like to do,&quot; he said. &quot;It&#39;s cheaper than golf, and you can do it when the weather&#39;s bad.&quot;What You Can Do to Protect Yourself&quot;The best people that help law enforcement have no motive other than to catch the bad guy,&quot; said one law enforcement official who declined to be identified because he hadn&#39;t been authorized to speak with the press.But even if you&#39;re not a cyber sleuth, if you get hit by a computer criminal there are some things you can do to help police catch the criminal. What you should do depends a little bit on the crime. If you&#39;re the victim of identity theft, it&#39;s worth filing a report with state and local police so that you have a record of the crime.That comes in handy later, in case you need to prove that it was the thief, and not you, that incurred any subsequent charges. Another good place to stop is the Federal Trade Commission (FTC) site, which has a variety of tools to help identity theft victims get organized and set their credit back on track. And if things get really bad, the Social Security Administration can help you, too. This site has instructions on how to report social security fraud and get a new social security number.You can file a report with the FTC, but if you want your data to be used to catch the bad guys, the Internet Crime Complaint Center (IC3) is a better bet. Run in part by the FBI, the IC3 data is used regularly by law enforcement to link together large schemes. The more factual data you can report about your crime, the more useful it will be to police. Sometimes a single fax number or eBay ID can help crack open an entire case.The FBI is most interested in crimes that involve malicious software, phishing, and child pornography. Spam and auction fraud get a lower priority and, worse, if you&#39;re the victim of an auction fraud, the odds of you ever getting your money back are very low.Still, if you&#39;re rigorous about documenting the crime, and you fill out that IC3 complaint, you just may be helping to bring down your criminal -- some day.
193813
The top cybersecurity official in the United States has resigned, a little over a year after joining the Department of Homeland Security, the agency said Friday.
369317
Software vendors need automated tools that look for bugs in their code, but it may be a decade before many of those tools are mature and widely used, said the former director of cybersecurity for the U.S. Department of Homeland Security (DHS).
102596
Yoran was a software executive with Symantec Corporation when he was tapped a year ago to become director of the National Cyber Security Division in the Department of Homeland Security.
656052
Howard Schmidt, chief security officer at eBay and a former White House cybersecurity adviser, has been named chairman of the U.S. Computer Emergency Readiness Team at Carnegie Mellon University in Pittsburgh.
662835
House Homeland Security Committee chairman, Rep. Bennie Thompson (D-Mississippi), says hacks, virus outbreaks and other computer security problems undermine the government's efforts to encourage companies and private organizations to improve cyber security.
366031
Quick and determined action RSA The US's latest chief of cyber security has pledged quick and determined action to protect the nation's critical infrastructure from attack.â¦
6545
Computer-security experts, including former government officials, urged the Bush administration on Tuesday to devote more effort to strengthening defenses against viruses, hackers and other online threats.
40481
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystems' Chief Security Officer, he works out of a corner office in the Sun Labs. He's just down the hall from where scientists are working on Java-based sensors and Sun's next-generation Proximity Communication processors, which seek to do away with wire connections. Though he describes his job as a "marketing" position, Diffie doesn't sound anything like a corporate pitch man. He met with IDG News Service at his Menlo Park, California, office recently to share his thoughts on Microsoft, security, and privacy. Following is an edited transcript of that conversation. IDGNS: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen ... Diffie: Wait a minute. I think there are two issues. I think you'll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that it's judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why it's been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IDGNS: Nowadays we don't hear about widespread security outbreaks, but there's a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. Diffie: I think that's a well-placed mis-confidence. IDGNS: So, are things getting better? Diffie: Phishing is the security problem, at that level, that I hear the most about right now. But I certainly don't worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. I'm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer -- a standard used in secure Web connections] is not about the quality of the cryptography -- about which there's often some doubt - but about the fact that the certificate costs enough money that the thieves aren't putting up a front. It's hard for me to believe that [the Internet] is getting relatively more secure. The growth of communications has steadily outrun the protection of communications over the whole history of human communication. Now I conjecture that the expansion of networked communications and of society's dependence on network communications is outrunning the security of that network and will continue to do so for quite some time. So the consequence of believing that is [believing] we're becoming more vulnerable, although to what events, it is hard to say. IDGNS: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. Diffie: Look at the biggest claim of theft against Microsoft that's been made in the last 10 years. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of 1 billion people is fantastic. Security is always political. That is to say, it always advantages somebody and disadvantages somebody else. IDGNS: What are your current thoughts on privacy? Diffie: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? That's not very clear. It's a very squishy concept. In small communities you have very little privacy, but you have accountability, because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict people's ability to go investigate things. Here's my scenario: For all its current faults, it won't be 10 years before facial recognition gets incredibly good. And it will be a PC thing, not a big money thing. So everybody's camera will be saying 'Hi" to the people who go by. Putting a camera right where you sign your signature with your credit card enables any store to build up a database of its customers. So if they see you coming down the street they can change the display in the window. But then that's going to produce all these databases of information about people. Very small operations will be able to collect information. Would I like to see that outlawed? I doubt it. I think what outlawing it would be saying [is] that certain classes of big boys -- the Fortune 1,000, the secret police -- would be allowed to have access to such information, but you little irresponsible children won't be. So I have a cowboy viewpoint on this.
726299
Globalization and increased reliance on the Internet continue to raise the risk of cyberattacks, a U.S. security official warns.