HP Pretexters Not So Chatty
25182
Three former Hewlett-Packard employees and six private investigators take the Fifth in hearings on their phone records access. The head of the congressional committee says he's never seen anything like it. In 27B Stroke 6.
737026
(InfoWorld) - Hewlett-Packard Co. Chairman Patricia Dunn will answer questions on the spying scandal that has embroiled her company during a House committee hearing on Capitol Hill next week. HP's general counsel, Ann Baskins, will also appear at the hearing of the Subcommittee on Oversight and Investigations of the House Committee on Energy and Commerce, being held next Thursday, said HP spokesman Ryan Donovan. HP's lead outside counsel, Larry Sonsini of the Palo Alto law firm Wilson, Sonsini, Goodrich & Rosati, will also testify, according to Terry Lane, a committee spokesman. Sonsini advised HP on the legality of its investigation into media leaks of details from the company's board meetings between 2005 and 2006. Earlier this month, HP revealed it had hired outside investigators to find the leaker and that they had impersonated the subjects of their investigation in order to gain access to private telephone records. In the course of the search, HP board members and reporters were impersonated. The committee is looking into HP's methods and is considering new federal legislation that would make this practice, called 'pretexting,' illegal. HP is also being investigated by the Attorneys General of California and Massachusetts, the U.S. Federal Bureau of Investigation and the U.S. Attorney's office. Ronald DeLia of investigation firm Security Outsourcing Solutions is also set to appear, but Lane said it is possible he will invoke his Fifth Amendment right to not testify to protect against self-incrimination. Prosecutors reportedly are looking into DeLia's company and a Melbourne, Florida, investigation company, Action Research Group, in connection with the scandal. In a June 11 Congressional hearing on pretexting, several investigators invoked their Fifth Amendment rights and refused to answer questions on the practice, which is considered to be in a legal gray area. The committee has also asked HP Global Security Manager Anthony Gentilucci and Action Research Group owner Joe Depante to testify, but has not heard back from them, Lane said. HP has already provided the committee with "thousands of pages of documents" in connection with its investigation, Lane said. The pretexting scandal has been front page news for several weeks now and has forced Dunn to step down from her chairman's role, effective January. But it has not had much of an effect on the company's financial performance. HP's (HPQ) stock has hovered in the $36 range since news of the affair first broke three weeks ago. HP Executive Vice President Vyomesh Joshi, who runs the company's printing business, downplayed the effect that the scandal was having on HP's management. "I think our focus is business," he said in response to a question on the matter at the Bank of America's Annual Investment Conference in San Francisco Tuesday. "We have a very solid team who is focusing on the business, focusing on the execution. At the end of the day, that is what we want to do." Â
310204
Beware the Babbio The executives willing to testify about their roles in the HP spy scandal have claimed a blissful ignorance around the legal ins and outs of obtaining phone records. Their defense has hinged on the idea that they were assured by hired investigators that any phone snooping was legal and that they did not become really concerned about how phone records were obtained until learning of the euphemism "pretexting." Even after learning about pretexting, it took executives weeks to comprehend in full the fraud behind the practice.â¦
764406
A hacker claims to have posted key plot details to the final Harry Potter book, but the publisher warned the details could be fake.
64308
Internal documents say HP has pretexted before and that its investigators trailed a reporter while on vacation.
128155
By MICHAEL LIEDTKE   Associated Press writer  SAN FRANCISCO -- Extending beyond the skullduggery that pried loose people's private phone records, Hewlett-Packard Co.
154237
Or an investigative technique - oh, wait HP has entered the denial phase in its legal battle with former executive Karl Kamb. The company this week denied claims made by Kamb that it used pre-texting techniques during an internal investigation into the executive's side business selling flat panel TVs. Moreover, HP whacked back at Kamb, saying pre-texting was not a way of life at the company.â¦
459891
Company that used pretexting to obtain and sell phone records and credit card information gives up ill-gotten gains.
663322
(InfoWorld) - In an advance copy of his Congressional testimony released by a House Subcommittee on Wednesday, Hewlett-Packard chief executive officer (CEO) Mark Hurd blamed the scandal that has besieged his company on "a rogue investigation" that got out of hand. "How did such an abuse of privacy occur in a company renowned for its privacy? The end came to justify the means," Hurd wrote. "The investigation team became so focused on finding the source of the leaks that they lost sight of the privacy of reporters and others. They lost sight of the values HP has always represented." Former HP Chairman Patricia Dunn , forced to resign Sept. 21 because ofÂ the scandal,Â defended in her testimony her decision to investigate the leaks of confidential board discussions to the news media. Both are among several witnesses expected at a hearing before the Oversight and Investigations Subcommittee of the House Energy and Commerce Committee on Thursday in Washington. The committee is looking into the practice of "pretexting," or using false pretenses to gain access to confidential records. Investigators hired by HP to find the source of leaks engaged in pretexting to get hold of the phone records of directors, HP employees and reporters who cover the Palo Alto, California, technology company. Although much of the criticism of the scandal surrounds the tactics used by the investigators, Dunn wrote in her testimony that equal consideration should be given to the leaks from within the company that damaged HP. HP's board was notorious for its leaks to news media and that such disclosures made it difficult for the board to deal with important issues candidly, she wrote. "I wish fervently that none of this had ever happened," Dunn wrote in her testimony. "But boards have an unquestionable obligation to take steps to prevent [leaks]. That certain steps taken during the investigation went well beyond what was appropriate does not undermine the importance of the board's mission in this matter."ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
583540
(InfoWorld) - A planned talk on RFID security by a security researcher has been pulled from this week's Black Hat Federal security conference after secure card maker HID claimed the talk violated the company's patent rights and threatened to take legal action against Chris Paget, the researcher, and IOActive, Paget's employer, if the talk went forward. The company decided to cancel the talk after all-night negotiations with HID collapsed, said Josh Pennell, CEO of IOActive. In response, Black Hat organizers were forced to tear materials out of printed show proceedings and will instead present a discussion by a representative of the ACLU on the criticality of RFID security, said Jeff Moss, founder and director of Black Hat. A spokeswoman for HID did not immediately respond to a request for comment. The incident recalled a 2005 dispute over a presentation at Black Hat in Las Vegas involving Cisco Systems and Michael Lynn, a security researcher who worked for Internet Security Systems at the time. IOActive's decision to abort their presentation follows days of tense negotiations between the two companies, after HID became alarmed about Paget's discussion, "RFID for beginners," which was to address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies. Paget's RFID cloning device was on display at the recent RSA Security Conference in San Francisco, where he demonstrated for InfoWorld how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader. Paget's presentation at Black Hat Federal would have includedÂ  schematics and source code that attendees could use to create their own cloning device, and a discussion of vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month. HID claimed that Paget's talk would infringe upon two patents the company owns, one dating to 1991 and another dating to 1992. Both cover methods of detecting RFID signals between a transponder embedded in a device and an "interrogator," according to a source familiar with HID's claims. Pennell and others doubted that such broad patent claims could be used to stifle free speech, but said that the legal pressure mounted by HID, a subsidiary of Swedish firm ASSA ABLOY, was too much for his small, Seattle-based consulting firm to withstand. "If we say anything, HID will sue. These large companies have lots of resources, so they can find [legal] matter with pretty much anything," Pennell said, admitting disappointment at the failure to reach an agreement with HID. "It's always been IOActive's intent to help people with security," he said. Chris Paget said that, unlike Lynn's sophisticated hack of Cisco's IOS operating system, the RFID cloning devices he built were simple devices concocted from around $20 in off-the-shelf parts purchased on eBay. "This thing is simpler than a Furbie," he said, referring to the plush electronic play toy of years past. Moreover, the HID patents in question are public documents, containing all the information needed to build the RFID cloner, he said. "This is not something new that we're doing. HID has known about this for about two years, if not longer," Paget said. Indeed, HID marketing materials for its Smart Card technology notes that "by using diversified unique keys and industry standard encryption techniques, the risk of compromised data or duplicated (smart) cards is reduced," and that "these security measures are not implemented in proximity cards, giving contactless smart cards a significant security advantage." While it's possible to make secure RFID devices that can store sensitive information, the HID proximity cards that use it are not secure, and customers who use the cards need to know that, Paget said. "Our intent was to disseminate information so people could make informed decisions about RFID technology they're deploying. For example, whether to deploy a proximity card with a secondary factor like a biometric or PIN [personal ID number]. But we've been prevented by HID from discussing that, and we believe it's detrimental to the security community," he said.Â  Nicole Ozer, technology & civil liberties policy director at the ACLU of Northern California, said that the work IOActive was doing was vital and that, while the group supports the enforcement of patent law, "free speech must be protected and not "trampled by the overzealous use of patent law." Government agencies, including the Government Accountability Office and the Department of Homeland Security, have all raised concerns about RFID security, even as they issue guidelines for using RFID in passports and other documents, she said. "It's particularly important that the government and the public have all the information on RFID technology. The use of RFID without the proper protections could jeopardize privacy, security, and public safety," she said. For Moss and Black Hat, which is now part of CMP, the decision by IOActive to cancel Paget's talk was a discouraging reprise of the controversy two years ago over Michael Lynn's talk in Las Vegas. Show organizers, once again ripping pages out of conference proceedings at the request of IOActive, and recalling CDs containing copies of Paget's presentation. "We're supporting IOActive," Moss said, noting that CMP had its legal team working on behalf of IOActive to see if a solution could be reached. "I'm not sure if it was part of HID's strategy to drop a bomb at the last minute, but it really screwed up our conference strategy," he said.
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
121146
Meddling muggles boast of last book transcript attack A hacker posting on a full disclosure email list run by InSecure.org claims to have obtained a copy of a transcript of the forthcoming book Harry Potter and the Deathly Hallows.â¦
225653
(InfoWorld) - On the heels of a similarÂ suit filed Thursday by Verizon Wireless Inc., Cingular Wireless LLC on Friday suedÂ private investigators used by Hewlett-Packard Co. to obtain phone records of a CNET News.com journalist. Cingular filed suit in a U.S. District Court in Atlanta against Charles Kelly and CAS Agency Inc. alleging they used pretexting -- or pretending to be someone else to obtain phone records -- to get information from Cingular about customer Dawn Kamamoto, a CNET journalist that HP was investigating. Cingular also named "John Does 1-100" and "XYZ Corps. 1-100" in the suit to accommodate other private investigators that may not have been named who also were involved in obtaining information from Cingular, said company spokesman Mark Siegel. "Sometimes it's hard to identify who is in these companies and who runs them," he said "We [used those terms] to accommodate for the vagueness of the industry." During Congressional hearings Thursday about HP's investigation of journalists -- including Kamamoto and writers from the Wall Street Journal and BusinessWeek -- Kelly and CAS Agency were identified as investigators that HP used to obtain phone records information through pretexting, Siegel said. The defendants called customer service agents posing as Kamamoto to obtain her personal information, and also gained unauthorized access to her online account information, Cingular alleged in its filing. They then sold that information to HP. HP executives, including Chairman and Chief Executive Officer Mark Hurd, testified before the House Energy and Commerce Congressional Committee on Thursday about an investigation of journalists that took place in 2005 and earlier this year in an attempt to find out who at HP was leaking sensitive information to the press. The scandal has already forced Patricia Dunn to resign as HP's chairman and sparked investigations by the California attorney general and the U.S. House of Representatives. On Thursday, Verizon Wireless filed suit in New Jersey against investigators who used pretexting to obtain information about an HP director and that director's spouse, and then sold that information to HP. In its suit, Cingular is asking that a judge require the defendants to pay punitive damages to the company and be permanently restricted from: contacting Cingular for any reason, obtaining information about Cingular customers and advertising that they can obtain phone records from wireless companies about their subscribers. Cingular is also asking for the return of any information obtained about Cingular customers to the company. Cingular's Siegel said this is not the first time his company has filed suit against companies that have used pretexting to obtain customer information. "They call themselves data brokers -- we call them data burglars," he said. The company currently has several cases pending against other investigators who have used pretexting, which is not technically illegal, although Cingular believes it should be, Siegel added.
285558
By Michelle Kessler  SAN FRANCISCO -- Hewlett-Packard's snooping scandal has besmirched the company's reputation -- but many other things are going great for the computer giant, tech analysts say.
404185
(InfoWorld) - Although Hewlett-Packard's spying scandal has led to the resignation of four high-ranking officials and evoked comparisons in Congress to Watergate and fraud at Enron, it isn't likely to impede the company's long-term ability to compete, analysts and investors said. So far, these groups said, there has been scant evidence linking Mark Hurd to the legally questionable practice of pretexting, in which investigators probing news leaks impersonated board members and journalists in order to obtain their phone records. So long as Hurd is not shown to have approved or participated in those activities, HP is likely to emerge with its viability intact. "The problem has obviously been recognized and is being rectified, and with time the business will build back to normal," said Alex Vallecillo, a portfolio manager who follows technology stocks at Allegiant Asset Management. "We're all big boys and girls, and we understand what goes on in the corporate boardroom has no effect on the ability of [HP's] products and services to deliver value." Indeed, HP's shares gained 1.6 percent on Thursday, the same day Patricia Dunn, who was forced to resign as the company's chairman last week, was grilled before a hearing convened by the House Energy and Commerce Committee. Ten people involved with the investigation asserted their Fifth Amendment rights in declining to answer representatives' questions. Since Sept. 5, the day before the news of the scandal broke, HP shares have fallen 1.1 percent, compared with a 2.9 percent gain for the Nasdaq composite index and a 2.1 percent gain for the Dow Jones Industrial Average. Although the negative attention has been a distraction for HP, "that's a very short-term situation, which I expect to pass soon," said Sunil Reddy, senior portfolio manager at Fifth Third Asset Management. "All the cards are on the table right now; I'd be very surprised if anything new comes out." Analyst Rob Enderle of the Enderle Group, attending an event in New York where HP was showing off new PCs ahead of the Christmas shopping season, agreed. The corporate buyers he's talked to aren't likely to choose HP competitors as a result of the scandal, and he said he expected non-business customers to feel the same way. "It relates to behavior of folks the average consumer doesn't relate with and probably doesn't understand." That said, HP's investigative techniques have become the butt of plenty of jokes, Enderle said, in which business customers tell HP sales staff: "We're probably going to send this out to bid, but you probably already know that because you've been looking at my phone records."
350921
More ActiveX insecurity A security researcher has uncovered a serious security bug in a Hewlett-Packard website used to host virtual meetings that could allow an attacker to remotely run malicious code on the machines of people who use the service.â¦
534161
Hurd silent on growing scandal HP's spy fiasco went from bad to catastrophic yesterday, as the company admitted to having tapped the phone logs of nine reporters.â¦