US studying Australian Internet security program‏

Associated Press

 

The government is reviewing an Australian program that will allow Internet service providers to alert customers if their computers are taken over by hackers and could limit online access if people don't fix the problem.

Obama administration officials have met with industry leaders and experts to find ways to increase online safety while trying to balance securing the Internet and guarding people's privacy and civil liberties.

Experts and U.S. officials are interested in portions of the plan, set to go into effect in Australia in December. But any move toward Internet regulation or monitoring by the U.S. government or industry could trigger fierce opposition from the public.

The discussions come as private, corporate and government computers across the U.S. are increasingly being taken over and exploited by hackers and other computer criminals.

White House cybercoordinator Howard Schmidt told The Associated Press that the U.S. is looking at a number of voluntary ways to help the public and small businesses better protect themselves online.

Possibilities include provisions in the Australia plan that enable customers to get warnings from their Internet providers if their computer gets taken over by hackers through a botnet.

A botnet is a network of infected computers that can number in the thousands and that network is usually controlled by hackers through a small number of scattered PCs. Computer owners are often unaware that their machine is linked to a botnet and is being used to shut down targeted websites, distribute malicious code or spread spam.

If a company is willing to give its customers better online security, the American public will go along with that, Schmidt said.

"Without security you have no privacy. And many of us that care deeply about our privacy look to make sure our systems are secure," Schmidt said in an interview. Internet service providers, he added, can help "make sure our systems are cleaned up if they're infected and keep them clean."

But officials are stopping short of advocating an option in the Australian plan that allows Internet providers to wall off or limit online usage by customers who fail to clean their infected computers, saying this would be technically difficult and likely run into opposition.

"In my view, the United States is probably going to be well behind other nations in stepping into a lot of these new areas," said Prescott Winter, former chief technology officer for the National Security Agency, who is now at the California-based cybersecurity firm, ArcSight.

In the U.S., he said, the Internet is viewed as a technological wild west that should remain unfenced and unfettered. But he said this open range isn't secure, so "we need to take steps to make it safe, reliable and resilient."

"I think that, quite frankly, there will be other governments who will finally say, at least for their parts of the Internet, as the Australians have apparently done, we think we can do better."

Cybersecurity expert James Lewis, a senior fellow at the Center for Strategic and International Studies, said that Internet providers are nervous about any increase in regulations, and they worry about consumer reaction to monitoring or other security controls.

Online customers, he said, may not want their service provider to cut off their Internet access if their computer is infected. And they may balk at being forced to keep their computers free of botnets or infections.

But they may be amenable to having their Internet provider warn them of cyberattacks and help them clear the malicious software off their computers by providing instructions, patches or anti-virus programs.

They may even be willing to pay a small price each month for the service - much like telephone customers used to pay a minimal monthly charge to cover repairs.

Lewis, who has been studying the issue for CSIS, said it is inevitable that one day carriers will play a role in defending online customers from computer attack.

Comcast Corp. is expanding a Denver pilot program that alerts customers whose computers are controlled through a botnet. The carrier provides free antivirus software and other assistance to clean the malware off the machine, said Cathy Avgiris, senior vice president at Comcast.

The program does not require customers to fix their computers or limit the online usage of people who refuse to do the repairs.

Avgiris said that the program will roll out across the country over the next three months. "We don't want to panic customers. We want to make sure they are comfortable. Beyond that, I hope that we pave the way for others to take these steps."

Voluntary programs will not be enough, said Dale Meyerrose, vice president and general manager of Cyber Integrated Solutions at Harris Corporation.

"There are people starting to make the point that we've gone about as far as we can with voluntary kinds of things, we need to have things that have more teeth in them, like standards," said Meyerrose.

For example, he said, coffee shops or airports might limit their wireless services to laptops equipped with certain protective technology. Internet providers might qualify for specific tax benefits if they put programs in place, he said.

Unfortunately, he said, it may take a serious attack before the government or industry impose such standards and programs.

In Australia, Internet providers will be able to take a range of actions to limit the damage from infected computers, from issuing warnings to restricting outbound e-mail. They could also temporarily quarantine compromised machines while providing customers with links to help fix the problem.

Malware Hits Computerized Industrial Equipment

NY Times

 

The technology industry is being rattled by a quiet and sophisticated malicious software program that has infiltrated factory computers.

The malware, known as Stuxnet, was discovered by VirusBlokAda, a Belarussian computer security company in July, at least several months after its creation.

Security experts say Stuxnet attacked the software in specialized industrial control equipment made by Siemens by exploiting a previously unknown hole in the Windows operating system.

The malware is the first such attack on critical industrial infrastructure that sits at the foundation of modern economies.

It also displays an array of novel tactics — like an ability to steal design documents or even sabotage equipment in a factory — that suggest its creators are much more sophisticated than hackers whose work has been seen before. The malware casts a spotlight on several security weaknesses.

Eric Chien, the technical director of Symantec Security Response, a security software maker that has studied Stuxnet, said it appeared that the malware was created to attack an Iranian industrial facility. Security experts say that it was most likely staged by a government or government-backed group, in light of the significant expertise and resources required to create it. The specific facility that was in Stuxnet’s crosshairs is not known, though speculation has centered on gas and nuclear installations.

Since it was unleashed, Stuxnet has spread to plants around the world., affecting operations and warehouse material handling. Siemens said it had received 15 reports from affected customers, 5 of which were located in Germany. All of these sites successfully removed the malicious program, which can be detected and removed by commercial antivirus programs.

“Up to now there have been no instances where production operations have been influenced,” the company said in an e-mailed statement.

Security researchers initially believed Stuxnet’s primary purpose was espionage because of its ability to steal design documents for industrial control systems. But more in-depth study of the program, which is extremely large and highly complex by malware standards, has revealed that it can also make changes to those systems.

Exactly what Stuxnet might command industrial equipment to do still is not known. But malware experts say it could have been designed to trigger such Hollywood-style bedlam as overloaded turbines, exploding pipelines and nuclear centrifuges spinning so fast that they break.

“The true end goal of Stuxnet is cyber sabotage. It’s a cyber weapon basically,” said Roel Schouwenberg, a senior antivirus researcher at Kaspersky, a security software maker. “But how it exactly manifests in real life, I can’t say.”

Stuxnet’s remarkable sophistication has surprised many security professionals. Its authors had detailed knowledge of Siemens’ software and its security weaknesses. They discovered and used four unknown security flaws in Microsoft’s Windows operating system. And they masked their attack with the aid of sensitive intellectual property stolen from two hardware companies, Realtek and JMicron, which are located in the same office park in Taiwan.

“It’s impossible this was created by some teenager in his basement,” Mr. Chien said. “The amount of resources and man hours to put this together,” he said, show “it has to be something that was state originated.”

UAE Warns of BlackBerry Social and Security Risks

CNBC

 

The BlackBerry, made by Canada's Research In Motion, is open to misuse that poses security risks to the United Arab Emirates, which said on Sunday it would seek to safeguard its consumers and laws.

Gulf state Bahrain in April warned against the use of BlackBerry Messenger software to distribute local news, drawing criticism from media freedom watchdog Reporters Without Borders which called it an act of censorship.

That sparked concerns that other Gulf countries might also consider curbing the use of certain applications on the BlackBerry, which holds around 20 percent of the global smartphone market behind Nokia but ahead of Apple.

BlackBerry was operating "beyond the jurisdiction of national legislation," the UAE's Telecommunications Regulatory Authority said in a statement issued on Sunday.

"As a result of how BlackBerry data is managed and stored, in their current form, certain BlackBerry applications allow people to misuse the service, causing serious social, judicial and national security repercussions."

The UAE was working to resolve "these critical issues with the objective of finding a solution that safeguards our consumers and operates within the boundaries of UAE law."

Earlier this month, RIM said it was preparing to launch an applications store and consumer Internet services in China as part of its push into the world's top mobile market.

A long-running censorship dispute between Beijing and Google Inc  was only recently resolved. Google had said it might be forced to abandon the Chinese market because of hacking attacks and censorship concerns.

McAfee to Acquire Trust Digital to Further Mobile Security

Bloomberg / Business Week

 

McAfee Tuesday said it's signed an agreement to acquire privately held Trust Digital as part of its strategy to expand into the mobile security arena, the enterprise sector in particular. The acquisition price for Trust Digital was not disclosed.

Tech M&A deals of 2010"The acquisition of Trust Digital's industry-leading enterprise mobility management solutions will extend the current McAfee security portfolio beyond the traditional endpoint, addressing the rapidly expanding mobile security market," said Dave DeWalt, president and CEO of McAfee. "Once completed, Trust Digital's industry leading enterprise mobility management solutions combined with leading McAfee antvirus, antispyware, host intrusion prevention, policy auditing and firewall technologies, will enable McAfee to address the mobile workforce by mitigating the risks associated with vulnerable or malicious mobile applications downloaded by employees."

DeWalt spoke about the planned acquisition during McAfee's Analyst Day in New York Tuesday.

Trust Digital focuses on a range of mobile operating systems, including iPhone OS, Android, Web OS, Windows Mobile and Symbian. "Together, we will enable IT to say 'yes' to the iPhone and Android," said Mark Shull, CEO of Trust Digital, on the combination of McAfee and Trust Digital. Trust Digital, said to have a few dozen customers, has just over 30 employees expected to join McAfee.

Brian Foster, senior vice president of product management at McAfee, said the strategy is to expand into enterprise management of mobile smartphones, for instance, integrating Trust Digital's encryption and management capabilities for Android with McAfee content protection and other security. Plans are also to bring Trust Digital's products under McAfee's common management console, ePolicy Orchestrator.

"It makes sense for McAfee -- or any of the large players -- so they can stay ahead of the demand," said Gartner analyst John Giraud. "The issue is protecting information on smartphones as they get more powerful, the iPhone and Android in particular. This is a fresh topic for a lot of people."

Girard said Trust Digital is small enough to be affordable for McAfee, which is making a good move in this acquisition.The acquisition is expected to be completed by June 30th.

WebCam Spying Suit Triggers War of Words

eWeek

A high school assistant principal in the Lower Merion School District in Pennsylvania lashes out about the Webcam spying allegations, while the student at the center of the case says her denials fall short.

The Webcam spying allegations that have rocked Pennsylvania's Lower Merion School District turned into a verbal sparring match Feb. 24 when a high school administrator offered an emotionally charged rebuttal that the family suing the district said does not constitute a denial of relevant facts.

The parents of Harriton High School student Blake Robbins filed a class action lawsuit (PDF) Feb. 11 alleging that the school remotely activated a Webcam and took a picture of their son, which they accuse Assistant Principal Lynn Matsko of citing as evidence that he was engaged in "improper behavior in his home."

In response to what she termed "many false accusations reported about me in the media," Matsko denied any involvement in spying on Robbins or any other student.

"If I believed anyone was spying on either of my children in our home, I too would be outraged … At no point in time did I have the ability to access any Webcam through security tracking software," Matsko said. "At no time have I ever monitored a student via a laptop Webcam, nor have I ever authorized the monitoring of a student via security tracking Webcam either at school or within the home. And I never would."

She continued, "In my 10-plus years as an assistant principal I have never disciplined a student for conduct he or she engaged in outside of school property that is not in connection with school, or a school-related event. That is not, has never been and never should be my role."

Calling the allegations "abhorrent and outrageous," Matsko said she has been subjected to numerous "offensive and threatening" e-mail messages since the controversy broke.

After her statement, Robbins read a statement to the media in which he stressed that the intent of the suit was not to disparage Matsko, but to take the school board to task for green-lighting the technology involved in the accusation.

The students' MacBook laptops were outfitted with task management software called LANrev that could be used to remotely activate the Webcams. The district has characterized the technology as a security tracking feature intended to recover lost laptops, and has reported that the software had been used for this purpose 42 times as of Feb. 19.

In his statement, Robbins noted that Matsko did not deny seeing a Webcam picture and screenshot of him in his home—she denied having authorized or activated the Webcam.

"We have no reason to doubt Ms. Matsko's statement that she did not personally activate the Webcam on my computer, but that has never been the issue," he said. "The issue is that we know someone accessed my Webcam and provided Ms. Matsko with a screenshot and a Webcam picture of me at home in my bedroom."

In an interview with the Philadelphia Inquirer, an attorney representing the Robbins family claimed Matsko told the student directly that he had been observed via the Webcam "trying to sell pills."

After being notified of the lawsuit, the district disabled the feature and pledged not to re-enable it without notifying students and their family members. Meanwhile, the FBI and local investigators have reportedly opened up an investigation into the case.

Pennsylvania School Official in Webcam Spy Case

AP

PHILADELPHIA (AP) - A suburban Philadelphia school district accused of secretly switching on laptop computer webcams inside students' homes says it never used webcam images to monitor or discipline students and believes one of its administrators has been "unfairly portrayed and unjustly attacked."

The Lower Merion School District, in response to a suit filed by a student, has acknowledged that webcams were remotely activated 42 times in the past 14 months, but only to find missing, lost or stolen laptops - which the district noted would include "a loaner computer that, against regulations, might be taken off campus."

"Despite some reports to the contrary, be assured that the security-tracking software has been completely disabled," Superintendent Christopher W. McGinley said in a statement on the district's Web site late Friday. Officials vowed a comprehensive review that McGinley said should result in stronger privacy policies.

Harriton High School student Blake Robbins and his parents, Michael and Holly Robbins, filed a federal civil rights lawsuit Tuesday against the district, its board of directors and McGinley. They accused the school of turning on the webcam in his computer while it was inside their Penn Valley home, which they allege violated wiretap laws and his right to privacy.

The suit, which seeks class-action status, alleges that Harriton vice principal Lindy Matsko on Nov. 11 cited a laptop photo in telling Blake that the school thought he was engaging in improper behavior. He and his family have told reporters that an official mistook a piece of candy for a pill and thought he was selling drugs.

Neither the family nor their attorney, Mark Haltzman, returned calls this week seeking comment. A listed number for Matsko could not be found.

"We believe that the administrator at Harriton has been unfairly portrayed and unjustly attacked in connection with her attempts to be supportive of a student and his family," the statement on the Lower Merion School District site said. "The district never did and never would use such tactics as a basis for disciplinary action."

A district spokesman declined further comment on the statement Saturday.

Lower Merion, an affluent district in Philadelphia's suburbs, issues Apple laptops to all 2,300 students at its two high schools. Only two employees in the technology department, not administrators, were authorized to activate the cameras, which captured still images but not sound, officials said.

"While certain rules for laptop use were spelled out ... there was no explicit notification that the laptop contained the security software," McGinley said. "This notice should have been given, and we regret that was not done."

The district's Web site said 42 activations of the system resulted in the recovery of 18 computers, not 28 as district spokesman Doug Young had said earlier. They reiterated that it was done only to locate lost, stolen or missing laptops.

"The district has not used the tracking feature or webcam for any other purpose or in any other manner whatsoever," the Web site said. The site also noted that there was nothing to prevent students from covering the webcam with tape.

McGinley said the district had hired former federal prosecutor Henry Hockeimer Jr. to review past practices and suggest improvements.

The FBI is looking into whether any federal wiretap or computer-intrusion laws were violated, according to an official who spoke to The Associated Press on condition of anonymity because the official was not authorized to discuss the investigation. Montgomery County District Attorney Risa Vetri Ferman has said she might also investigate.

Andy Derrow, father of a Harriton junior, said he does not believe the district was spying on students. He said he has two other sons who graduated from the school and had substantially benefited from the computer program.

"I don't think there was any ill intent here," he said "I think we all need to take a breath and wait and see what the facts are."

Microsoft, Partners Pitch in on Super Bowl Security

Information Week

A collaboration platform combines SharePoint, mapping software, and analysis capabilities to let law-enforcement agencies in Miami share information in real time.

Law-enforcement officials will have help keeping Super Bowl attendees in Miami safe using collaboration technology from Microsoft and its partners.

The system, called Project Dolphin, will let officials collect information from different law-enforcement agencies, including the Miami-Dade Police Department, during Sunday's event and share and analyze that information in real time.

Project Dolphin combines tools from Microsoft, ESRI, GuideSTAR Technologies, and Analyst International Corp (AIC). The system comprises Fusion Core Solution, developed by Microsoft and ESRI, which uses Microsoft's SharePoint Server with ESRI's ArcGIS 9.3.1 server and GuideSTAR's investigative and intelligence analysis tool, GS/1.

Different public-safety organizations will be keeping track of security at Super Bowl XLIV, and the data they collect is stored in their own systems. Fusion Core brings that information together into one system, enabling authorized personnel to exchange documents, information, and alerts securely.

Authorities can view information geospatially using ESRI's visualization and mapping technology, while other software enables analysis of the information gathered.

Miami-Dade Police, the eighth largest law-enforcement agency in the U.S., will be using the Project Dolphin software with its own IT system, which is already quite sophisticated, Microsoft said.