Tuesday, December 12, 2006

UCLA Identity Alert | home page A sophisticated computer hacker has illegally and fraudulently accessed a restricted UCLA database containing names and certain personal information. This database includes UCLA's current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. The database also includes current or former staff and faculty of the University of California, Merced, and current or former employees of the University of California Office of the President, for which UCLA does administrative processing. UCLA is notifying all of those individuals in the database, even though a continuing investigation indicates that the computer trespasser sought and obtained only some of the information. There is no evidence to suggest that personal information has been misused. UCLA greatly regrets the concern and inconvenience caused by this illegal activity. This Web site has been established to provide information to those who received a notification and those who believe they may be affected by this incident. Those who don't know whether they are in the compromised database are encouraged to contact the Identity Alert Hotline established by UCLA. The phone number is (877) 533-8082. 10:24:59 PM  PermaLink   / trackback []

UCLA Probes Computer Security Breach - New York Times LOS ANGELES (AP) -- The University of California, Los Angeles alerted about 800,000 current and former students, faculty and staff on Tuesday that their names and certain personal information were exposed after a hacker broke into a campus computer system. Only a small percentage -- ''far less than 5 percent'' -- of the records in the database were actually accessed, UCLA spokesman Jim Davis told The Associated Press. Still, it was one of the largest such breaches involving a U.S. higher education institution. The attacks in October 2005 and ended Nov. 21 of this year, when computer security technicians noticed suspicious database queries, according to a statement posted on a school Web site set up to answer questions about the theft. Davis said the hacker used a program designed to exploit an undetected software flaw to bypass security and get into the restricted database, which has information on current and former students, faculty and staff, and some student applicants and parents of students or applicants who applied for financial aid. Many of the records in the database do not link names and Social Security numbers, however, the two pieces of information the hacker was after, Davis said. The university's investigation so far shows only that the hacker sought and obtained some of the Social Security numbers. Out of caution, the school said, it was contacting everyone listed in the database. About 3,200 of those being notified are current or former staff and faculty of UC Merced and current or former employees of the University of California Office of the President, for which UCLA does administrative processing. 10:22:33 PM  PermaLink   / trackback []

UCLA Warns of Unauthorized Access to Restricted Database... 12/12/2006 UCLA is alerting approximately 800,000 people that their names and certain personal information are contained in a restricted database that was illegally and fraudulently accessed by a sophisticated computer hacker. This database contains certain personal information about UCLA's current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. Approximately 3,200 of those being notified are current or former staff and faculty of the University of California, Merced, and current or former employees of the University of California Office of the President, for which UCLA does administrative processing. In a letter being sent to affected individuals, Acting Chancellor Norman Abrams said that personal information about at least some of the individuals was obtained by the hacker but that there is no evidence that any data has been misused. The database includes names, Social Security numbers, dates of birth, home addresses and contact information. It does not include driver's license numbers or credit card or banking information. "We take our responsibility to safeguard personal information very seriously," Abrams said. "My primary concern is to make sure this does not happen again and to provide to the people whose data is stored in the database important information on how to minimize the risk of potential identity theft and fraud." UCLA blocked access to the Social Security numbers and the database when suspicious activity was detected on Nov. 21 and immediately activated its information technology security incident team. UCLA also notified the FBI, which is conducting an investigation. Even though UCLA's ongoing investigation at this time indicates only that the hacker sought and obtained some of the Social Security numbers, out of an abundance of caution, the university decided to notify all 800,000 people whose names are listed in the restricted database. 10:20:08 PM  PermaLink   / trackback []

Hackers Set New Data Breach Record at U.C.L.A. - The Lede - New York Times Blog The University of California, Los Angeles, has announced this morning that the personal information of some 800,000 current and former students had been contained in a restricted database "that was illegally and fraudulently accessed by a sophisticated computer hacker." According to the Associated Press, the attacks began in October of last year, and continued through Nov. 21, when a spike in queries to the database tipped off security staff that something was amiss. The database contained the usual sorts of information that thieves can use to open new lines of credit using a victim's identity: names, Social Security numbers, dates of birth, home addresses and contact information. Letters are being sent out to all 800,000 individuals affected. For those who like to keep track, this becomes the largest data breach at an educational institution to date -- at least as measured by the Privacy Rights Clearinghouse, which maintains a fairly comprehensive list of data breaches dating back to the Choicepoint incident, announced in February 2005, which essentially brought the issue of data security to the national consciousness. 10:17:49 PM  PermaLink   / trackback []

Senator: Illegal images must be reported | CNET News.com Millions of commercial Web sites and personal blogs would be required to report illegal images or videos posted by their users or pay fines of up to $300,000, if a new proposal in the U.S. Senate came into law. The legislation, drafted by Sen. John McCain and obtained by CNET News.com, would also require Web sites that offer user profiles to delete pages posted by sex offenders. In a speech on the Senate floor Wednesday, the Arizona Republican and former presidential candidate warned that "technology has contributed to the greater distribution and availability, and, some believe, desire for child pornography." McCain scored 31 of 100 points on a News.com 2006 election guide scoring technology-related votes. After child pornography or some forms of "obscenity" are found and reported, the Web site must retain any "information relating to the facts or circumstances" of the incident for at least six months. Webmasters would be immune from civil and criminal liability if they followed the specified procedures exactly. McCain's proposal, called the "Stop the Online Exploitation of Our Children Act" (click for PDF), requires that reports be submitted to the National Center for Missing and Exploited Children, which in turn will forward them to the relevant police agency. (The organization received $32.6 million in tax dollars in 2005, according to its financial disclosure documents.) 2:34:55 PM  PermaLink   / trackback []

Bill Would Extend Online Obscenity Laws to Blogs, Mailing Lists. Bill Would Extend Online Obscenity Laws to Blogs, Mailing Lists. Erris writes "Senator John McCain has proposed a bill to extend federal obscenity reporting guidelines to all forms of internet communications. Those who fail to report according to guidelines could face fines of up to $300,000 for unreported posts to a blog or mailing list. The EFF was quick to slam the proposal, saying that this was the very definition of 'slippery slope', and citing the idea of 'personal common carrier'." From the article: "These types of individuals or businesses would be required to file reports: any Web site with a message board; any chat room; any social-networking site; any e-mail service; any instant-messaging service; any Internet content hosting service; any domain name registration service; any Internet search service; any electronic communication service; and any image or video-sharing service." [Slashdot: Your Rights Online] 2:31:20 PM  PermaLink   / trackback []

Phishing Scams Soared in October. Phishing Scams Soared in October. The number of phishing Web sites set up to impersonate banks and steal people's financial and personal data skyrocketed in October to 37,444, the highest on record, according to stats released this week. The Anti-Phishing Working Group reports that 52 percent more phishing sites were recorded on the Internet than a month earlier and nine times as many as were spotted in October 2005. The steep increase coincides with a massive spike in the volume of spam circulating on the Internet. According to e-mail security firm Postini, 90 percent of all e-mail these days is spam. Experts say much of the spike in phishing sites is due to the increasing popularity of a fraud method known as "Rockphish," which can deflect the most common security responses to phishing scams. Security experts and anti-phishing groups often put pressure on domain name registrars to cancel fraudulent domains or lobby Internet service providers to take down the phishing Web sites altogether. But in Rockphish attacks, multiple phishing scams targeting different banks are placed on the same Web server. Each individual scam page is assigned to an Internet subdomain that for a short time is tied to an Internet address of a compromised computer that the phishers control. When a would-be victim clicks on a link in a Rockphish scam, they are routed through the drone PC to the correct scam page, depending on a special code specified in the e-mailed link. The result is that even if law enforcement or security experts manage to take down the infected PC responsible for relaying traffic to one of the scam sites, the effect of that take-down is usually only temporary as the attackers can simply substitute another bot-infected machine. In other words, "Rockphishing" makes it more difficult for security experts to find the true location of phishing servers. To get a sense of how aggressive these Rockphish attacks can be, consider this: One avid phish-fighter I interviewed last week who asked to remain anonymouse told me of his recent battle with a single Rockphish attack that generated some 2,000 unique phishing Web addresses in just two days. Rockphish attacks appear to be a response to the proliferation of browser-based anti-phishing toolbars and technologies. By repeatedly and quickly changing the Internet addresses of phishing sites, the phishers are clearly trying to put a serious strain on the blacklisting approach used by most anti-phishing tools. [Security Fix] 2:19:34 PM  PermaLink   / trackback []

Microsoft's Monthly Patch Release Plugs 11 Security Holes. Microsoft's Monthly Patch Release Plugs 11 Security Holes. Microsoft Corp. today released software updates to fix at least 11 security holes in various versions of its Windows operating system and other products. Windows users can download the free updates manually from Microsoft Update or via Automatic Updates. This month's patch batch includes an unscheduled update to remedy two vulnerabilities in Windows Media Player that criminals could use to install software on Windows PCs just by convincing users to open a specially crafted Windows Media Player file. Microsoft added this update at the last minute, not long after "proof-of-concept" code demonstrating how to exploit the flaw was posted online. Another update fixes four separate security holes in Internet Explorer that an attacker could use to break into or steal data from affected PCs just by coaxing the user into visiting a Web site or opening an e-mail designed to take advantage of the flaw. The IE patch doesn't apply to IE 7, however. While there were several reports of vulnerabilities in IE 7 in the past month, Microsoft says it is still investigating these and that it might yet tackle them in future patches. Today's patch bundle includes a fix to a dangerous hole in Microsoft Visual Studio 2005 that online scam artists already are using to compromise vulnerable machines. Visual Studio 2005 is not installed by default on any flavor of Windows, but if you do have this program installed on your computer, Microsoft Update should detect it and supply the needed patch. None of the updates released today address problems in Microsoft Word that bad guys also are exploiting. On Dec. 5, Microsoft said it was aware of a serious security hole in just about every version of Word the company produced. Then over this past weekend, the company warned of yet another unpatched Word flaw that is currently being exploited. With all of the critical flaws patched in Office this year (so far 33 -- or more than a third of all critical updates Microsoft released in 2006), this is (oddly enough) the second month in row in which Microsoft has not issued an Office patch. I could spend a lot of time here offering advice about more secure software packages, or not opening e-mail attachments from unknown senders etc. But the people who really need to heed that advice rarely seem to listen anyway. For most users, the best advice I can give (and will continue to give) is to set up your PC to run under a limited user account. I should note here, however, that if you are already browsing the Web under a limited user account, you will need to temporarily switch over to an administrator account to install patches manually or through Automatic Updates. [Security Fix] 2:17:13 PM  PermaLink   / trackback []

Erosion of the Secret Ballot Erosion of the Secret Ballot. Voting technology has changed greatly in recent years, leading to problems with accuracy and auditability. These are important, but another trend has gotten less attention: the gradual erosion of the secret ballot. It[base ']s useful to distinguish two separate conceptions of the secret ballot. Let[base ']s define weak secrecy to mean that the voter has the option of keeping his ballot secret, and strong secrecy to mean that the voter is forced to keep his ballot secret. To put it another way, weak secrecy means the ballot is secret if the voter cooperates in maintaining its secrecy; strong secrecy means the ballot is secret even if the voter wants to reveal it. The difference is important. No system can stop a voter from telling somebody how he voted. But strong secrecy prevents the voter from proving how he voted, whereas weak secrecy does not rule out such a proof. Strong secrecy therefore deters vote buying and coercion, by stopping a vote buyer from confirming that he is getting what he wants [~] a voter can take the payment, or pretend to knuckle under to the coercion, while still voting however he likes. With weak secrecy, the buyer or coercer can demand proof. In theory, our electoral system is supposed to provide strong secrecy, as a corrective to an unfortunate history of vote buying and coercion. But in practice, our system provides only weak secrecy. The main culprit is voting by mail. A mail-in absentee ballot is only weakly secret, the voter can mark and mail the ballot in front of a third party, or the voter can just give the blank ballot to the third party to be filled out. Any voter who wants to reveal his vote can request an absentee ballot. (Some states allow absentee voting only for specific reasons, but in practice people who are willing to sell their votes will also be willing to lie about their justification for absentee voting.) Strong secrecy seems to require the voter to cast his ballot in a private booth, which can only be guaranteed at an officially run polling place. The trend toward voting by mail is just one of the forces eroding the secret ballot. Some e-voting technologies fail to provide even weak secrecy, for example by recording ballots in the order they were cast, thereby allowing officials or pollwatchers who record the order of voters[base '] appearance (as happens in many places) to connect each recorded vote to a voter. Worse yet, even if a complex voting technology does protect secrecy, this may do little good if voters aren[base ']t confident that the system really protects them. If everybody [base "]knows[per thou] that the party boss can tell who votes the wrong way, the value of secrecy will be lost no matter what the technology does. For this reason, the trend toward complex black-box technologies may neutralize the benefits of secrecy. If secrecy is being eroded, we can respond by trying to restore it, or we can decide instead to give up on secrecy or fall back to weak secrecy. Merely pretending to enforce strong secrecy looks like a recipe for bad policy. (Thanks to Alex Halderman and Harlan Yu for helpful conversations on this topic.) [Freedom to Tinker] 2:15:33 PM  PermaLink   / trackback []

Congress Approves Internet Enforcement Bill. Congress Approves Internet Enforcement Bill. During its final week in Washington, the 109th Congress passed the US SAFE WEB Act, a law that will help the Federal Trade Commission be more effective in protecting consumers from spam, spyware, and Internet fraud on a global scale. The bill allows the FTC and its foreign counterparts to share confidential information and obtain investigative assistance from one another. CDT has long been supportive of this measure given the increasingly international nature of Internet crime. [Center for Democracy and Technology] 2:13:08 PM  PermaLink   / trackback []

Hackers Attack Using Second Microsoft Word Flaw. Hackers Attack Using Second Microsoft Word Flaw. On eve of Patch Tuesday, hackers jump Word segment of Microsoft Office in second attack. [PC World: Latest Technology News] 2:09:53 PM  PermaLink   / trackback []