Happy Birthday, Melissa!

March 26th marked the 14th anniversary of the launch of the Melissa virus.  This virus replicated itself through email and spread like wildfire,  quickly clogging email servers (and bandwidth) in business and government institutions alike.  For this, Melissa has the distinction of being the first self-replicating email worm.

You can read more about the worm and its author here.

PCI Goes to Court

Genesco has petition the courts to reimburse it for over $13 million in fines and penalties collected on behalf of Visa by payment processors following a 2010 data breach at the Tennessee-based sports retailer.  The heart of the case seems to center around contractual languageregarding what constitues noncompliance for the sake of levying fines and penalties.

While it is doubtful that the outcome of the court case will set the PCI standard back on its heels, it does have the potential to cause a minor tremor throughout the PCI community for a couple of reasons:

• The fine schema by the card processors for breaches appears (note word!) to be inconsistent.  As the article points out, Mastercard hit Genesco up for $2 million in fines for the same data breach that Visa asked for $13 million.  This may or may not be an indicator of the ratio of card numbers/accounts that were exposed.

• If Genesco can credibly demonstrate that it was, indeed, in compliance with the PCI-DSS at the time of the breach then it may (again, note word :) ) cause folks to awake to the notion that PCI compliance does not mean that an organization is secure.  If this happens, then retailers and merchants may question the validity of the standard only insofar as pertains to the fines and penalties levied by the card brands.  If this occurs, it could open the floodgates regarding more sharing of the pain around data breaches between merchants, payment processors, and the brands themselves.

Regardless of the final outcome, I look forward to seeing the volume of the debate begin to increase...assuming, of course, Visa doesn't read the tea leaves and decide to settle with Genesco in order to squelch the noise :) 

You can read the full article here.  Enjoy!

California State Senator Pushing for Warrants for Email Searches

Earlier this week, California state senator Mark Leno introduced a bill which would require all law enforcement agencies operating under the state’s jurisdiction to receive a warrant before reading the email of private citizens.  

Under the provisions of the Electronic Communications Privacy Act of 1986, law enforcement agencies can request access to emails that have already been opened by the intended recipient or have been stored on servers for more than 180 days.  While these provisions seemed reasonable at the time of passage, they fail to take into account the massive amounts of online storage available via email providers today.  Worse, depending upon the backup regimens of the email provide an email deleted by the individual user might still be available via an online backup share for quite some time.  Again, the ECPA is not quite as clear on this point as it might be.

Lest you think this movement is limited to California, there were additional reports this week that there appears to be consensus building re: modifying the ECPA at a national level.  In a hearing held on 19 March by the Judiciary subcommittee on Crime, Terrorism, Homeland Security and Investigation, Rep. Jim Sensenbrenner (R-Wis.) said that only requiring a subpoena instead of a warrant to access emails is "outdated and probably unconstitutional."  Of course, believe that a law needs to be amended and making pronouncements to that effect is markedly different than deciding how to amend the law or agreeing on a timetable for action.

You can read the report on the California action here, and the article re: action on the Hill here.

Hacker Sentenced to 41 Months for AT&T/iPad hack

A federal judge has sentenced Andrew Auernheimer to 41 months in prison. Auernheimer exploited a security flaw in AT&T's iPad registration scheme in order to download contact information for thousands of iPad users. In addition to prison time, Auernheimer  will be subject to three years of supervised release has been ordered (along with a co-defendent) to pay AT&T $73,000.

I admit that I have been surprised by the amount of mainstream press this sentencing has gotten. One one side, Auernheimer is portrayed (accurately) as a unrepentant hacker who is milking his 15 minutes of fame. On the other, folks are questioning both the interpretation of the relevant law (The Computer Fraud and Abuse Act of 1986) as well as the appropriateness of the sentence handed down -- especially in light of the recent sentencing of two Ohio teens in a highly-publicized rape case.

You can read a quick summary of the Auernheimer case here.

Cyber Election Fraud in Florida

Earlier this week, NBC reported that an attack against a Florida website resulted in the first known case of online election fraud in the US.  According to a grand jury report on irregularities in the August 2012 election, someone created a computer program that "automatically, systematically, and rapidly" submitted over  2,500 "phantom requests" for absentee ballots to a Miami-Dade County elections website in an attempt to skew election results. While this was not the only fraudulent act that occurred during the election, it is still a milestone that is worth noting :) 

You can find a full copy of the report here.  Enjoy!

Facebook "Likes" Can Reveal Personal Information

A recent article on CSOOnline.com reviews a research project conducted at Cambridge University.  In this project, researchers were able to predict several personal characteristics (race, ethnicity, sexual orientation, religious affiliation, etc.) based upon a detailed analysis of Facebook "likes."  The overall point being made by researchers is to demonstrate how seemingly innocuous yet publicly available digital data can reveal more about you that you might think.  A pretty powerful teaching point for use in your SETA programs :)

A copy of the study may be found here, and is also linked off of the CSO magazine article.  It's a very short read...enjoy!  Oh, and take a moment to dig into Table S1 of the research article;  it lists some of the most common "likes' which were most revealing of personal traits/characteristics.  While some were fairly obvious, a few raised my eyebrows.

Vulnerabilties in Security Appliances

Recent articles published in CSO Online and Computerworld are referencing a report by NCC Group which casts light on the vulnerabilities and security flaws which exist in many computer appliances.  NCC's research, which it released at Black Hat Europe 2013, revealed significant vulnerabilities in almost all security appliance prodcuts that were tested.  These included vulnerabilities to:

• Cross-Site_Scripting attacks
• Automated password attacks for SSH
• Unauthenticated detailed version disclosure

...and many more.  A gentle reminder to professionals everywhere to ensure that our infrastructure is as up to date and hardened as possible...and a call to arms for the security profession to push the security industry to set the example for hardened, well-coded, and secure appliances.

I have posted a copy of the full NCC report here for those who are interested.