June 2012 BCM
Transcription
June 2012 BCM
ISSN 1061-5725 This Month’s Presentation ON LINE Volume 30, No. 6 June 2012 www.ucs.org This Month’s Meeting: Wednesday 13th at 7 pm Check Out June 13, 2012 “Gene Barlow” via Skype(TM) Sharing, Protecting and Organizing your Hard Drive Important Security Related Report #29 “Woe is Me #8” Starting on on page 4 Utah’s Award Winning Computer Magazine! ™ By Cliff Millward, Editor cliffm@xmission.com Information As I put this magazine together, I was on the phone with Don Nendell. Donna was rushed to the hospital and was diagnosed with congenitive heart failure. Don says she is doing OK, but he is worn out himself with all the unfortunate events occurring to him. Pray that everything will work out for the better. Don is rather difficult to read sometimes, but he believes in what he is writing. If fact, he is extremely serious in everything he writes and feels he is doing everyone a service by his reporting. If you have not read any of his articles, I suggest you do. They are factual and eye-opening. Also, don’t forget to say a prayer for Donna. call this sign (#) the “hash” mark. So C# in GB becomes C (hash!) Hash is a culinary dish which can include almost any ingredient and, many times, is nothing more than a conglomeration of left overs! The U.S. usage derives from an old commercial habit of using the # to stand for pounds on bills of lading. This, however, is not the only name associated with this character. It is also known as the gate, square, grid, crunch, crosshatch, mesh, flash, pig-pen, ticktacktoe, scratchmark, thud, thump, splat, hex, grate, reticule, and recently the octothorpe. Recent Observations Modulation from C# to F# Recently, Microsoft has come out with a new programming language entitled, F#. According to them F# is a strongly typed, functional-first programming language for writing simple code to solve complex problems. The F# language originated in Microsoft Research and has been available since 2007. In the past five years, F# has continued to grow in popularity, and Microsoft has detailed how the language has helped solved complex programming problems in industries as diverse as banking, insurance and energy. Because of the above fact, I have reprinted my original “C#” article from this magazine which appeared in the August 2002 edition. “I remember the first time I heard a telephone announcement say “hit the ‘pound’ sign.” I pondered for a moment and realized (because of my musical background) that they must be referring to the “sharp” key located at the lower right side of the dialing keypad. The “pound” sign to me always has been the character used to denote money in Great Britain. (₤) In fact, when I used the Character Map in Windows to look up how to place this sign (₤) in my article, Windows referred to it as the “pound” sign! The # is described as the number sign. Microsoft has come out on the side of musicians by calling one of their products C# (sharp.) This naming, I assume, is a cause of humor in Great Britain because they Page 2 The ‘octothorpe’ name has been rumored to have been invented by Bell Lab engineers when touch-tone phones were introduced in the mid-1960s. There are other stories about the origin of octothorpe, but who cares? I suppose musicians could call it the D flat key because D flat and C sharp are enharmonic intervals, but computer stores would have a hard time knowing what you wanted if you asked for Microsoft D flat! The sign also has a darker side to its personality. I have seen it used many times in cartoons to represent profanity (@#*%#). Which nasty word it stands for I do not know - take your pick. Just watch your tongue the next time you order Microsoft C#. Seriously, this character is a sign of many aliases, so I assume it is up to each individual person to call it whatever he/she wants. Personally, pound and hash are too “earthy” for me; and I don’t care for gate, crunch, flash, pig-pen, etc. I like octothorpe! It makes me feel so elitist and intelligent to say, “use the octothorpe key,” or “I program in COctothorpe.” I could also say, “Octothorpe, Octothorpe,” or “Oh, Octothorpe,” or “you Octothorpe,” and feel better because I have uttered a disguised profanity that few will recognize. Guess I had better stick to “sharp” or “pound” if I want to stay out of trouble!” Blue Chips Magazine — June 2012 Finè Blue Chips Magazine “Utah’s Award Winning Publication” Charter Member of the Association of PC User Groups Magazine Staff Editor in Chief — Cliff Millward Review Program Editor — James Alexander Business/Technology Editor — Donna Nendell Photography — LeRoy Johnson Proof Readers — Larry Lamph, Doug Jackson 619-9633 250-2269 (702) 776-8677 Advertising Rates Ad costs 1 month 3 months 6 months 12 months 2 Page Spread $150 $400 $700 $1200 Full Page $100$275$500$900 Half Page $50 $130 $250 $450 Quarter Page $25 $70 $130 $225 Business Card $15$30$60$120 Full page size is 7½ x 10 inches. All other page sizes are based on a 7 x 10 inch page in order to conform to editorial style. Half-page ads may be 7 x 5 inches or 3½ x 10 inches. Quarter-page ads are 3½ x 5 inches. Business card ads are 3½ x 2½ inches. Classified Advertising Utah Blue Chips members may place personal classified ads at no charge. Maximum ad size is 7 lines, 35 characters per line. Officers and Trustees Eve. Phone E-mail President, Stuart Gygi V. Pres., Larry Lamph Secretary, Lowell Kenedy Treasurer, John Witzel Doug Jackson 576-1891 571-2908 278-3035 296-1390 322-2337 sgygi@ucs.org larry.lamph@ucs.org lkenedy@ucs,org witzelj@ucs,orgtt djackson104@ucs.org Information Persons or companies may join or renew at the meeting, or by sending a check payable to the Utah Computer Society to: Utah Computer Society Membership Secretary 5435 Riley Lane Murray, Utah 84107 Submissions Members are encouraged to submit text articles for publication in ASCII text only. Photos in .TIF or .JPG format only. Line graphics, tables, in almost any vector or .TIF format. Do not imbed graphics or tables in text files. All articles must be received by the 15th of the month preceding the month of publication. All articles become the property of the Utah Computer Society and by submitting an article, the author gives permission for the Blue Chips Magazine Staff to edit the submission. The author also gives permission for republication in other users groups’ communications. Permission to Copy Permission is granted to other nonprofit PC user groups to reproduce any article published in this newsletter, provided credit is given Blue Chips Magazine and the author (s) of the reproduced materials. Reprinted articles are subject to the terms of their respective copyright holders. Individual memberships are $25/year. Business Memberships are $35.00 a year. Corporate sponsorships are available at two levels. Corporate Sponsors enjoy all benefits of membership including multiple individual membership and prepaid advertising coverage. Contact a Board Member for more information. Other important information: Meeting Information Group Business (James Alexander) Magazine (Cliff Millward) Web Site WebMaster Membership (evenings) (Bob) http://www.ucs.org 250-2269 955-9633 http://www.ucs.org 262-6045 262-6045 MONTHLY MEETING LOCATION 2nd Wednesday of every month Monthly Meeting: On The Internet University of Utah, Union Building, 7:00 p.m. Page 3 Blue Chips Magazine — June 2012 Security Related (S-R) Update Report #29 Part 8, Woe is Me! By Don Nendell Dear Reader, If you are reading this in a non-PDF format, you are missing a large part of the whole Report/Review 1 & 2 . You should, therefore, stop reading and immediately follow the steps outlined in the Footnotes 1 & 2 below. Which BTW are: 1. “If you are reading this Report/ Review 1 & 2 from directly off of an Internet search, you could very well be seeing it in HTML (or text) format. Yuk! There’s No Graphics there! To see all the beautiful Graphics in this Report/Review 1 & 2 - the ones that we’ve worked so very hard to entertain you with - you will need to follow the procedures outlined in 2 below. Enjoy! Again, our web page is: (www.ucs. org).” 2. “See the actual Reports/Reviews 1 & 2 in the Blue Chips Magazine (BCM) Archives (i.e., begin your search on left-hand side of web page) at: (www.ucs.org). Note. Always choose the top option, i.e., PDF format for its beauty.” 3. After a successful debut the past few months, I am going to present the News and Views to you once again in an entirely different format than I’ve used in the 14-15 years I’ve been doing these Reviews/Security-Related Reports for you. Once again, I am going to list all the URL’s and Titles of all of the articles/topics/videos I’ve researched Security Related Report for this S-R, and then some, that I intend to present to you herein this month. That list will appear in the Footnotes 5 and 6 and be designated #X), where X is the order in which it appears in the Footnotes 5 and 6 respectively. In this way you can (cherry) pick (i.e., highlight it, copy it and paste it in your Browser Search Window) plus you can also choose which one(s) appeal(s) to your sense of urgency and/or security, and thenceforth follow the same procedure(s) I would go through (i.e., if you so desire?) so as to bring them to life and thus sh[r]ed (pun intended) greater illumination on the subject for you as it appears here in the BCM. BTW And just like it always is, month after month, and although you may not have known, nor been aware, of it, or not, it’s a huge list, too! Enjoy! ;-} Prolog (Repeat from S-R #28) I’ve been associated with SecurityRelated (S-R) subjects/topics/episodes/relationships in one form or another for over 17 years now. I’ve actually been writing S-R Reports, et al., for going on 13 years, too (FYI This is my 129th S-R to date, if I haven’t lost count, that is). And I swear, I feel like I’m actually just a Sprog (i.e., a “Newbie”) after all of the “Things/Stuff/etc.” I have been Page 4 Blue Chips Magazine — June 2012 discovering/uncovering for myself just in these past 3-4 months of S-R research, plus writing the last three (3) S-R Reports (i.e., Numbers 26, 27 & 28. See my BCM’s March, April, 2012, and May 2012 respectively for those S-R’s 1 & 2). Folks, it is simply “God awful fearful and frightful” what is currently and/or has been going on with the American citizen’s right to privacy/civil liberties and/or security ever since before WWII, even, under the guises of National Security, War on Ter- ror, and false aims like Domestic Security, etc. (See Below). All the pieces have been properly setup on the board, and are already in play, as we speak. And, it is growing worse by the day, I feel, with no end in sight, apparently; and strangely enough, it seems, with the foci, “Right Here, And Right Now!” (See Below) Introduction Page 1. Before we get started with my usual monthly diatribe, I’d first like to ask you all, that’s “ya’ll” (all of “you all”) in Texas talk, a question: Have you been to Best Buy, more specifically the Geek Squad kiosk, for any repairs lately? Well I have, and it’s my usual trials and tribulations jumping up and biting me in the 3 posterior again It inveriably, said always, seems to happen just as I begin wrting my S-R Reports/Reviews. If you have been following my reporting for any length of time now, you already know what is coming, no, not the drones yet (See also my April 2012 BCM S-A Report #26, Woe is Me #6 1 & 2); but they’re coming, you can count on it That’s almost on a par with believing that Skype has always been “secure,” and now most surely even more so now that it is in Microsoft’s hands to the tune of $8B US (who itself is holding hands wth the NSA, and has been openly since Windows 7 was developed). Oh yes, we’ll “TRY” to get to that one a little later. My beef. I bought an expensive four (4) year protection plan (Note. important point here) for my new, funny, now that I think of it, ;-} Wndows 7 Gateway PC. I’ve now taken it back two (2) times: once for the “Trojan from Hell infection” (BTW They’re the repair technician’s words, not mine. Mine are worse and as such, definitely not printable. See my January 2012 BCM S-A Report 1 & 2 FYI my favorite “Vipre” TS finally eradicated it after a terrible siege); and then a couple of days ago, this time with a “Black Screen of Death” HDD failure indication. The first time I took it to the Geek Squad was their confirmation of a virus/Trojan infection, duh, and they politely informed me it would cost $139 to remove it. Wait just a minute, I’ve got “Warranteed” protection against these things, don’t I? Nope! Keep on reading, it only gets juicier. BTW it was right then and there that I swore that I wouldn’t patronize their stores “ever more!” But wait, there’s more. Then, there’s this latest Best Buy fiasco. I was told that it would take 2-4 days to check it out, and that if it turned out to be a virus-, softwareet al., related problem, then the protection plan wouldn’t cover it - AGAIN. Period. Q. So what exactly does “it,” i.e., that expensive “Warrantee” Protection Plan actually cover for all that money? Duh? or Huh? Take your choice? I turned on the charm, for all that was worth, and “sweet-talked” (and BTW, accidently (on purpose) left a fiver laying on the examining table; after all, it’s Vegas, baby, the tipping capitol of the world, you know) the lovely young lass into starting the sick PC’s test(s) a bit early blink, blink. I went back the second day and asked her how my sick friend was doing, and she said that it had “passed the hard drive” test and was still about half way through another test. Say what? If the stupid thing wouldn’t even boot at all, then how could they test the hard drive and it passed? So now what else were they testing the machine for that they could clobber me with? (It turns out to be another HD). Well, it’s been three (3) days now and I’ve not received even a Page 5 Blue Chips Magazine — June 2012 peep from them yet? Whoa! I’ve just got to get this down before I explode. As an aside, I had four (4) 4GB of very, very special memory upgrade modules I had gotten from my great friend at Kingston to install, and I asked her what it would cost to just “pop” them in while the case was off. She said with a straight face, “$40 per module!” Whoa; $40 x 4 = $160 US (it’s not Russia or China, I don’t think yet). I wanted so very badly to wish her well in her next job, because now I can clearly see why Best Buy is downsizing plus nationwide closing 50 Big Box stores (See also my April 2012 BCM S-A Report Woe is Me #6 1 & 2). I’m still wondering since my HD “Passed” the test, why doesn’t it run yet, and what is Best Buy going to “TRY” to stick me with this time? Stay tuned! I will say with certainty, “Caveat emptor, read the fine print on “any” of these guys!” UPDATE: After calling them (after 3 days now) I learned that the “wrong HDD was set to boot up the PC. Yes, I agree, that’s what it looked like, or possibly a HDD failure, or even a virus/Trojan again, but I hadn’t reset it in the BIOS? (See graphic) UPDATE 2: Its back again, ugh! Q. So, how then did it get that way during my absence from the house, because it was working when I left to go to BINGO with Donna, and it was not when I got back home? Gremlins, or what? We continue. Then, after the agent was able to finally boot to Windows 7 again, the NIC card wouldn’t work, even though it was enabled in the BIOS. The agent later told me he reinstalled the NIC driver and everything was all “Hinky Dory, Again, By Jove!” AND SO IT IS! BEGONE GREM3 LINS! Page 2 Nothing new here, Again, Same-o, Same-o, how-some-ever: 1. Techlicious: Millions of LinkedIn & eHarmony Passwords Stolen by Josh Kirschner, Techlicious, June 8, 2012. Professional networking site LinkedIn and dating site eHarmony confirmed yesterday that millions of user passwords have been stolen from their databases and posted on the Internet. If you are a user of either of these services, it’s critical that you change your password immediately on these sites, as well as any other sites for which you use the same password, especially for email, banking or other sensitive data. The breach was identified when the hacker(s) posted the list of 8 million encrypted passwords to a hacker forum for help with breaking the encryption code. Sophos security is reporting that more than 60% of the passwords have already been cracked. The breach was identified when the hacker(s) posted the list of 8 million encrypted passwords to a hacker forum for help with breaking the encryption code. Worse, while the 8 million passwords posted represent only a small portion of the total users of the sites, some security experts suspect that the hacker(s) may have access to the full password list and only posted those that they were having difficulty cracking. Rick Redman, a security consultant for Kore Logic Security told Ars Technica, “It’s pretty obvious that whoever the bad guy was cracked the easy ones and then posted these, saying, ‘These are the ones I can’t crack.’” 2. Email Communication to LinkedIn Users (06/09/2012) We recently became aware that some LinkedIn passwords were compromised and posted on a hacker website. We immediately launched an investigation and we have reason to believe that your password was included in the post. To the best of our knowledge, no email logins associated with the passwords have been published, nor have we received any verified reports of unauthorized access to any member’s account as a result of this event. While a small subset of the passwords was decoded and published, we do not believe yours was among them. The security of your account is very important to us at LinkedIn. As a precaution, we disabled your password, and advise you to take the following steps to reset it. If you reset your password in the last two days, there is no need for further action. 1. Type www.linkedin.com/settings Page 6 Blue Chips Magazine — June 2012 directly into your browser 2. Type in your email address and press Sign In, no password necessary 3. Follow the onscreen directions to reset your password Note: Do not reuse your old password when creating your new password. If you have been using your old LinkedIn password on other sites, we recommend that you change those passwords too. We appreciate your immediate attention to resetting your password and apologize for the inconvenience. Thank you, The LinkedIn Team (Source: Footnote 6, 37) Just as interesting, and just as crazy 1. This INSANE Graphic Shows How Ludicrously Complicated Social Media Marketing Is Now by Charlie Minato Business Insider, May 17, 2012, Digital marketing is confusing - really confusing - as this insane graphic shows (below). Trying to navigate through the various new social media categories, blogs, sharing sites, and social media firms is an absolute mess. The depiction of the digital marketing landscape was shown at a Buddy Media event marking the launch of the social marketing software agency’s new suite of measurement tools. FYI If you look very closely, Pinerest isn’t in the graphic for some strange reason? (Read more at: http://www. businessinsider.com/social-mediamarketing-landscape-complicated2012-5?utm_source=feedburner&utm_ medium=feed&utm_campaign=Feed %3A+businessinsider+%28Business+ Insider%29#ixzz1veYY7ZnF). (Source: Footnote 6 61.) 2. Google Chrome Just Passed Internet Explorer To Become The World’s Most Popular Web Browser by Seth Fiegerman Business Insider May 21, 2012, After months of chipping away at its lead, Google Chrome has finally overtaken Internet Explorer to become most popular web browser worldwide. Chrome’s share of the market rose to 32.8% in the week ending May 20, while Internet Explorer’s share of the market dropped to 31.9%, according to new data from StatCounter, via TheNextWeb. This marks the first full week that Chrome has beaten Explorer. Google’s browser had previously topped Explorer for a single day back in March. Mozilla’s Firefox is the third most popular browser with just more than a 25% of the market. Read more at: (http://www.businessinsider.com/google-overtakes-internetexplorer-as-most-popular-browser2012-5?utm_source=twitterfeed&utm_ medium=twitter&utm_campaign=Fee d%3A+businessinsider+%28Business +Insider%29#ixzz1vebV5ZTi) (Source: Footnote 6 21.) 3. In Four Years, Most Cars Will Work With Smart Phones by Matthew de Paula, Forbes, May 18, 2012. y 2016 most cars will have smart phone integration, according to a new report from Juniper Research, a wireless technology research firm based in Hampshire, U.K. Aftermarket systems offered by companies like OnStar will help grow the sector to $14.4 billion in four years and give 92 million vehicles Internet connectivity. This technology will not only allow satellite-based navigation and streaming music from the Web, for example, but it will also open up a whole new market to telematics services currently only offered through automaker-specific subscription plans like GM’s OnStar and BMW Assist. These sophisticated satellite-linked systems can automatically dispatch emergency services to the scene of an accident, help law enforcement agencies locate stolen vehicles, and even disable them in some cases. The Chevrolet Spark offers a stereo upgrade that acts like an extension of a user’s smart phone to stream music, naviga- tion and other apps. Please notice how few buttons there are, since the system relies on the smart phone’s technology to work. (Source: Footnote 6, 29.) Now on to the “Security Plight” of the Nation. Page 3 1. EYE SPY INTELLIGENCE MAGAZINE ISSUE 79 Check this out. MAJOR EYE SPY FEATURE (www.eyespymag. com/issueseventy9.html) Defense Clandestine Service US unveils powerful new military/ civilian spy agency Codebreaking Gems HACKING MENACES INVISIBLE OPPONENTS INTELLIGENCE AND COUNTER-TERRORISM Tapping the Internet? THE UTAH DATA CENTER 9/11 ULTIMATE END GAME TAPPING THE INTERNET As the NSA’s new Utah Data Center nears completion, a look at concern from some commentators who believe it is a “catch all” for every communication COUNTER-TERRORISM AND INTEL PART 3 In this pulsating feature our authors look at terrorist types, objectives and supposed motives CYBER SPIES AND ESPIONAGE Senior US Eye Spy editor Kevin Coleman presents a new overview of how cyber attacks are damaging economies Page 7 Blue Chips Magazine — June 2012 INTEL HACKERS “Those who give up their liberty for a little temporary security deserve neither and lose both” - Benjamin Franklin 2. Revealed: Hundreds of words to avoid using online if you don’t want the government spying on you (and they include ‘pork’, ‘cloud’ and ‘Mexico’) by Daniel Miller, Daily Mail, May 29, 2012 (See graphic on page 16). Department of Homeland Security forced to release list following freedom of information request. Agency insists it only looks for evidence of genuine threats to the U.S. and not for signs of general dissent (My emphasis here; yeah, sure they are, and I’ve got a bridge in Brooklyn to sell to you, too?) The Department of Homeland Security has been forced to release a list of keywords and phrases it uses to monitor social networking sites and online media for signs of terrorist or other threats against the U.S. The intriguing the list includes obvious choices such as ‘attack’, ‘Al Qaeda’, ‘terrorism’ and ‘dirty bomb’ alongside dozens of seemingly innocent words like ‘pork’, ‘cloud’, ‘team’ and ‘Mexico’. (Source: Footnote 6, 47.) FYI Extracted from the DHS Analyst’s Desktop Binder 2011 (Redacted and as shown is) 1. Media Monitoring Capability Mission & Reporting Parameters: 1.1 MMC Mission. The MMC has three primary missions: First - to continually update existing National Situation Summaries (NSS) and InternationalSituation Summaries (ISS) with the most recent, relevant, and actionable open source mediainformation Second - to constantly monitor all available open source information with the goal of expeditiously alerting the NOC Watch Team and other key Department personnel of emergentsituations Third - to receive, process, and distribute media captured by DHS Situational Awareness Teams(DSAT) or other streaming media available to the NOC such as Northern Command’s(NORTHCOM) Full Motion Video (FMV) and via open sources These three missions are accomplished by employing various tools, services, and procedures thatare described in detail in this document. (Source: Footnote 6, 4.) “Americans will always demonstrate what we mean by ‘DON’T TREAD ON ME’... even to heavy handed union management. Our government should exist to SERVE the people, not pray upon them. We will not continue to use trillions of dollars to bail out the few select unions so they can promote and elect their puppets Those days are over.” Dan Thompson, American College Bryn Mawr, June 6, 2012 (on the Wisconson vote to recall the Governor). (Note “MEH” is commonly used as either a comparative or superlative meaning: “Mediocre; lackluster...” - John Hobbs, Hamline University). The “Snoop” (Pun intended) From Group 1. “The Stuxnet virus not only became known as one of the most potent zero-day attacks on a critical infrastructure that included a SCADA system, but it is also regarded as an act of cyber-sabotage that forever changed the threat landscape. Enterprises and government agencies are increasingly menaced by new varieties of advanced persistent threats (APTs) associated with organized cybercriminals and state-sponsored hacker groups. Threats can evolve more quickly than the ability to protect against them, which creates a security gap for most organizations. Threats can evolve more quickly than the ability to protect against them, which creates a security gap for most organizations.” - Dark Reading (For more on this and others See the HP 2011 Top Cyber Security Risks Report Below). 2. Cyber-attack concerns raised over Boeing 787 chip’s ‘back door’ by Charles Arthur, The Guardian, May 29, 2012. Two Cambridge experts have discovered a “back door” in a computer chip used in military systems and aircraft such as the Boeing 787 that could allow the chip to be taken over via the internet (sic). The discovery will heighten concerns about the risks of cyber-attacks on sensitive installations, coming on the heels of the discovery this week of the ‘Flame’ virus which has been attacking computer systems in Iran, Syria and Saudi Arabia. researchers Sergei Skorobogatov of Cambridge University and Chris Woods of Quo Vadis Labs say that they have discovered a method that a hacker can use to connect to the internals of a chip made by Actel, a US manufacturer. “An attacker can disable all the security on the chip, reprogram cryptographic and access keys … or permanently damage the device,” they noted. (Source: Footnote 6, 11.) HP 2011 Top Cyber Security Risks Report. Enterprise organizations have been under security attacks for the past decade, but security events in 2011 have created a ripple effect that will be felt for years to come and will actually start to shift the way we view security. In the 2011 Cyber Security Risks Report, HP Enterprise Security provides a broad view of the vulnerability threat landscape, as well as in-depth research and analysis on security attacks and trends (Source: Footnote 6, 2.) 3. Botnets: The backdoor to the Paul Beaumont adds weight to the theory that sooner or later a hacking incident or similar against the security services will lead to loss of life. Page 8 Blue Chips Magazine — June 2012 enterprise network by Tomer Teller, security researcher and evangelist at Check Point Software Technologies, SC Magazine May 21, 2012. Botnets are one of the most significant network security threats facing organizations today. Compromising anywhere from a few thousand to well over a million systems, botnets are used by cyber criminals to take over computers and execute illegal and damaging activities – such as stealing data, gaining access to unauthorized network resources, initiating Denial of Service (DoS) attacks or distributing spam. Botnets are here to stay. There is no more static malware; botnets in nature are dynamic and can quickly change form based on the cyber criminal’s command. With bot toolkits being sold online for the mere price of $500 and their attacks costing businesses millions of dollars – it gives people insight into how big the problem has become. The Impact of Bot Infection. It has been estimated that up to one quarter of all personal computers connected to the internet (sic.) may be part of a botnet. In 2011, it was reported that the TDL Botnet infected more than 4.5 million computers and approximately 100,000 unique addresses per day. In addition, the industry saw nearly half of IT security professionals experience a dramatic increase in malware attacks. 4. A Historical Look at Botnets. In looking at the evolution of the bot threat, the first bot, “GMBot,” was not malicious. In fact, it was created in the late 1980s to emulate a live person in Internet Relay Chat (IRC) sessions. However, around 1999 bots emerged that were designed with harmful intentions. Thereafter, bots grew more sophisticated, and in some cases, were commercialized as products. The Zeus bot of 2006, for example, originally sold for several thousand dollars. In mid-2011, source code for the Zeus and SpyEye botnet kits was leaked, making these powerful botnet creators available to practically anyone that wants to es- tablish their own botnet (See Graphic). The Future Threat. In the coming years, botnets will continue to evolve using a combination of social engineering, zero-day exploits, as well as the proliferation of mobile computing and social networking. See more critically impotant Botnet background/historical datat at: (Source: Footnote 6, 5.) 5. Government security trends that need your attention now by Richard Moulds, GSN: Government Security News, May 21, 2012. If 2011 taught us anything, it is that we will definitely continue to see a multitude of attacks, and that the attackers are growing even more persistent and technologically savvy. One lesson learned over the past year or so is that the line between government and commercial-grade IT security is blurring. On one hand, governments will need to use commercial technology wherever possible in order to keep costs down, and will be subject to the same disclosure laws as any enterprise. Yet, on the other hand, certain enterprises are now subject to the same types of attacks as government and need help in defending themselves from [all] government agencies that have been perfecting these skills for years. (Source: Footnote 6,23.) It’s All About $$, or Is it? 1. What A DDoS Can Cost by Kelly Jackson Higgins, Dark Reading May 16, 2012. A distributed denial-ofservice (DDoS) attack can cost a victim organization as much as $10,000 to $50,000 per hour in lost revenue, according to a new survey. Neustar polled 1,000 IT professionals in North America from various industries about DDoS attacks, and among the 300 businesses that said they had suffered one, Around 65 percent said a DDoS would cost them $240,000 in revenue per day of the attack, or $10,000 per hour; 21 percent said it would mean a loss of $1.2 million per day, or $50,000 per hour. Much of the damage depends on the industry: More than 80 percent of financial-services companies said they would lose more than $10,000 per hour, and close to 70 percent of retailers said they would lose more than $2 million a day, or more than $100,000 per hour in revenue. Ted Swearingen, director of the security operation center at Neustar, says DDoS attacks are on the rise, and no one is immune (Source: Footnote 6 , 66.) 2. Threat Intelligence: What You Really Need to Know by Randy George, InformationWeek Reports in conjunction with Dark Reading. If there was ever a time when threat intelligence could be put on autopilot, that time is over. With the increase in advanced, multidimensional threats, organizations can no longer depend solely on existing gateway tools to weed out nefarious activity. See the Report at: http://twimgs.com/ darkreading/threatintelligence/ S4980512threatintel.pdf. 3. House-approved NDAA would restrict use of drone info by Mark Rockwell, GSN;Government Security News, May 21, 2012. An amendment added to the sprawling FY13 National Defense Authorization Act (NDAA) passed by the House of Representatives on May 18 has a provision that would prevent the use of information collected by government drones in court without a warrant. The amendment, introduced by Rep. Jeff Landry (R-LA), would specifically prohibit information collected by Department of Defense drones without a warrant from being used as evidence in court. The Federal Aviation Administration is currently developing rules governing the operation of drones in U.S. national airspace. Privacy and digital rights groups, like the Electronic Privacy Information Center and the American Civil Liberties Union have pressed for restrictions on the aircraft as they gain wider use over the U.S. The NDAA was approved by the House on May 18 and now moves to the Senate for review. (Source: Footnote 6 , 25.) Page 9 Blue Chips Magazine — June 2012 Page 4 “A global cyber arms race” is underway.” - Rear Adm. Samuel Cox, Director of Intelligence at U.S. Cyber Command, April 18,2012. U.S. President Obama has called cyber attacks “the most serious economic and national security challenges we face as a nation.” (Source: http://spy-ops.com/web/breakingnews.aspx). 1. Congress To Amend NDAA To Give DoD & NSA Greater ‘Cyberwar’ Powers by Mike Masnick, techdirt, May 8, 2012. Remember the NDAA? Yeah, for a variety of reasons that bill got a lot of attention last year - mostly focused on the question of detainment of terrorists. But there are some other nuggets in the bill, including one tidbit about “military activities in cyberspace.” The existing version of the NDAA does grant the Defense Department the ability to conduct such military activities, but only “upon direction by the President” and if the purpose is to “defend our Nation, Allies and interests,” subject to existing laws. Here’s the existing text: SEC. 954. MILITARY ACTIVITIES IN CYBERSPACE Congress affirms that the Department of Defense has the capability, and upon direction by the President may conduct offensive operations in cyberspace to defend our Nation, Allies and interests, subject to: (1) the policy principles and legal regimes that the Department follows for kinetic capabilities, including the law of armed conflict; and (2) the War Powers Resolution (50 U.S.C. 1541 et seq.). However, the House Armed Services Committee is getting ready to do a markup on the NDAA that includes a change to that section (section 954), which expands the powers of the Defense Department, and basically gives it broad powers to conduct any military actions online - with it specifically calling out clandestine operations online. Here’s the text they want to substitute: SEC. 954. MILITARY ACTIVITIES IN CYBERSPACE (a) AFFIRMATION. Congress affirms that the Secretary of Defense is authorized to conduct military activities in cyberspace. (b) AUTHORITY DESCRIBED. The authority referred to in subsection (a) includes the authority to carry out a clandestine operation in cyberspace. (1) in support of a military operation pursuant to the Authorization for Use of Military Force (50 U.S.C. 1541 note; Public Law 107-40) against a target located outside of the United States; or (2) to defend against a cyber attack against an asset of the Department of Defense. (c) RULE OF CONSTRUCTION. Nothing in this section shall be construed to limit the authority of the Secretary of Defense to conduct military activities in cyberspace. (Important) Note a bunch of slightly sneaky things going on here. First, it gives blanket powers to the DoD, rather than saying it can only take actions on the President’s direction. While we may not have much faith that the President wouldn’t let the DoD do such things, giving such blanket approval upfront, rather than requiring specific direction is a pretty big change. Second, and perhaps more important, the new language specifically grants the DOD (and the NSA, which is a part of DOD) the power to conduct “clandestine operations.” This is (on purpose) left basically undefined. Combine this with the fact that the “Authorization of Use of Military Force” is so broadly defined in the current government, this then grants the DOD/NSA extremely broad powers to conduct “clandestine” operations with little oversight. Related to this is that it removes the restriction that the DOD must take actions that are “subject to the policy principles and legal regimes that the Department follows for kinetic capabilities, including the law of armed conflicts.” Instead it lets them use such powers, without these restrictions, against anyone declared an enemy under the AUMF (lots and lots of people) or in any effort to stop a cyberattack against the DOD -- which again you can bet would be defined broadly. This is a pretty big expansion of online “war” powers for the Defense Department, with what appears to be less oversight. And all done while people are looking the other way... (Source: Footnote 6, 8.) And now, the rest of the story 2. FBI quietly forms secretive Net-surveillance unit by Dec;an McCullogh, CNet, May 22, 2012. CNET has learned that the FBI has formed a Domestic Communications Assistance Center (DCAC), which is tasked with developing new electronic surveillance technologies, including intercepting Internet, wireless, and VoIP communications. The FBI has recently formed a secretive surveillance unit with an ambitious goal: to invent technology that will let police more readily eavesdrop on Internet and wireless communications. The establishment of the Quantico, Va.-based unit, which is also staffed by agents from the U.S. Marshals Service and the Drug Enforcement Agency, is a response to technological developments that FBI officials believe outpace law enforcement’s ability to listen in on private communications. While the FBI has been tight-lipped about the creation of its Domestic Communications Assistance Center, or DCAC - it declined to respond to requests made two days ago about who’s running it, for instance - CNET has pieced together information about its operations through interviews and a review of internal government documents. DCAC’s mandate is broad, covering everything from trying to intercept and decode Skype conversations to building custom wiretap hardware or analyzing the gigabytes of data that a wireless provider or social network Page 10 Blue Chips Magazine — June 2012 might turn over in response to a court order. It’s also designed to serve as a kind of surveillance help desk for state, local, and other federal police (Source: FOOTNOTE 6, 17.) 3. FBI forming “Communications Assistance Center” to help spy on Americans by John Koestsier, Venture Beat, May 23, 2012. Only weeks after requesting backdoor access to popular sites such as Facebook, Twitter, and Google+, the FBI is in the news again. Now the organization appears to be staffing the elite unit that will create the technologies to tap into Americans’ communications on social networks. CNet broke the story today (See Above), revealing that the unit has now been created. According to the story, the new division will be called the Domestic Communications Assistance Center, and it has already been allocated $54 million in funding by a Senate committee. While the group won’t engage in spying itself, it will create technologies to help state and local police intercept, decrypt, and analyze communications data. The legal issues here are not entirely clear. While the police and security forces of most nations have had the ability to wiretap telecoms for decades, that capability is less and less valuable as the bulk of communications moves towards social networks and voice-over-IP solutions like Skype. National and local law enforcement agencies want the ability to tap into new networks as well as old, and an amendment to CALEA, the Communications Assistance for Law Enforcement Act, is being proposed that would force social networks to give access to law enforcement for surveillance purposes. What’s far more clear is that the FBI is making these moves as silently and secretly as possible. There is no national debate, very little governmental debate, and almost no public awareness of the capabilities being requested and created. The changes represent what could be very significant privacy intrusions, coming just days after we saw how internal government employees can misuse data that their privileged positions give them access to (Source: Footnote 6, 16.) 4. The FBI’s New Unit Can Spy on Skype and Wireless Communications by Fernando Alfonso III, The Daily Dot, May 23, 2012. Four years and $54 million later, the Federal Bureau of Investigation is finally ready to launch a surveillance unit capable of spying on Skype conversations and other Internet communications. The Domestic Communications Assistance Center (DCAC) is a collaborative effort between the FBI, U.S. Marshals Service, and the Drug Enforcement Agency. All three agencies will build customized hardware to enable wiretapping on wireless and Internet conversations per court order requests. “It’s also designed to serve as a kind of surveillance help desk for state, local, and other federal police,” CNET reported (See Above). “The center represents the technological component of the bureau’s ‘Going Dark‘ Internet wiretapping push, which was allocated $54 million by a Senate committee last month.” The DCAC has been tight-lipped about its purpose. The FBI said in a statement that the organization will “not be responsible for the actual execution of any electronic surveillance court orders and will not have any direct operational or investigative role in investigations.” Scouring the Internet for illegal activity has become a top priority for the FBI.7 (Source: Footnote 6, 58.) Games, Sneakers, Enemy of State, et al.) is science fact today, and we are still not handling those original “theoretical problems any better today than we were then.” Winn identified the problems we continue to face as being “four letter words,” specifically: “Users” (i.e., being uneducated and naive), “Root” level access to data by “the bad guys,” Then, putting his fingers directly on the pulse of the problem, Winn delivered what I consider to be the “coup de grace” of his timely speech, when he “starred hard” out into the audience, and spoke directly to the lawyers in attendance there when he told them to, “Get out of our way and let us do our job!” It is mainly because of the lawyers “mucking up” the security battle ground, and not the available technology, BTW, either, that we are not able to “fire and/ or fight” back at the perps/attackers/ hackers/crackers/et al., with the same weapons they use in their attacks on us, that has us still 20 years behind the times (with no solution in sight either (my comment here) because of them). That said. There is ever such a “slight possibility” that’s what is go- In Conclusion 8 Winn Schwartau delivered a compelling and bold speech to the DHS at the 7th Annual GFIRST conference in Nashville. (Note. Watch the 30 minute thought-provoking speech at: (www. winnschwartau.com/) and See graphics on pages XX - XX). Winn spoke directly to the audience and told them that we in the security field are still back in the dark ages (My words here). What was science fiction of 20-24 years ago (War Page 11 Blue Chips Magazine — June 2012 ing on simultaneously today in the three (3) branches of our government (i.e., Judicial/Legislative/Executive). They just may(?) be “firing back” at the lawyers in order to get at the attackers? I fervently hope and pray that “that’s” what is happening in the Security field concerning the laws that have been enacted recently, and those that are being enacted, as we speak (See Above). Folks, mark my words, something “Big’ is going down, simultaneously across the board, as we speak, in the Security/Freedoms/Individual Liberties arenas? I don’t know what it is, yet, but we shall see real soon, I feel? And just remember this, “There are no coinci9 dences,” according to Zedd! BTW I have also been saying all along that the “other shoe will be dropping real soon, too, concerning the 9-11 bombings!” And, “that one” is still coming, count on that one, too? Summary The apparent lack of graphics (plus my usual attempts at ill-humor) throughout this S-R herein should indicate to everyone just exactly how “dire, stark, dark, sinister, and very, very dangerous” I now deem how all of the above information, plus that of the past 7 BCM S-R’s, reflects directly upon, and is represented to all of us Americans. I am a dyed-inthe-wool, blue-blooded patriot, folks, and have even risked my life flying in actual combat (in 40 out of a possible 48 months in Vietnam) fighting for the “freedoms represented by our truly wonderful country.” But, I must say that I personally think that our country has now entered into an exceedingly “dark age” in the abridgement of American “Security/Privacy/Individual Rights;” an abridgement that must be brought back “into the scrutiny of broad daylight” and returned once again directly in line with our civil liberties and Constitutional rights. Ergo, the title of these past 8 S-R’s: “Woe is me!” our “fair-share” part in this “just cause fight.” My Solemn Pledge: I have dedicated the past 17 years, plus I will continue to do so for the remainder of my life to defending “We, The People,” and Defeating the “Bad Guys, wherever they are!” It’s just that simple! And, you can do no less, my friends! Ciao! Footnotes 1 If you are reading this Report/ Review from directly off of an Internet search, you are seeing it in HTML (or text) format. Yuk! There’s No Graphics there! To see all the beautiful Graphics in this Report/Review the ones that we’ve worked so very hard to entertain you with - you will need to follow the procedures outlined in Footnote 2 below. Enjoy! Again, our web page (www.ucs.org).” 2 “See the actual Reports/Reviews in the Blue Chips Magazine (BCM) Archives (i.e., begin search on left-hand side of web page) at (www.ucs.org). Note. Always choose the top option, i.e., PDF format for its beauty. 3 Feature(s) precisely identified as reason(s) for designating this Review/Report as “SecurityRelated.” In this case, everything. 4 It’s not to late, but we cannot afford to wait any longer. We must defeat the enemy from without, as well as, more likely, “from within.” We can no longer be naive in 8 that fight. Wynn Schwartau in his book Information Warfare (1994, 1996, 1997), wrote, “WWIII began [back] in 1980.” This is not merely a terrorist war, it is an allout Cyberwar. Our government appears to be pulling out all the stops, folks, and it is turning into a “No holds barred” fight - just as it should be - but, and I repeat, BUT, “we, the innocent people,” must not get caught in the deadly crossfire of this “critical” Battle for our very lives, and we should not have to give up our individual freedoms and liberty in doing My Hard Earned Byline: Happiness Is A Working Computer (HIAWC). 5 Videos Referenced to in S-R #28: Video 1_What Sc_ares the Living IT Out of Me - Winn Schwartau - GFIRST Closing Speech - YouTube.htm Video 2_10 Secret Organizations _ Bing Videos.mht 6 List of URL’s Used in S-R #28 Report: _1_‘Real News From The Blaze’ UN Looks to Regulate the Internet But Can It Feasibly or Ethically Do So Video TheBlaze_com.htm _2_2011 Top Cyber Security Risks Report - HP Enterprise Security.htm _3_Al Qaeda cyber attack video shows urgent need for protections, says Sen_ Lieberman Government Security Page 12 Blue Chips Magazine — June 2012 News.htm _4_Analyst Desktop Binder_REDACTED.htm _5_Botnets The backdoor to the enterprise network - SC Magazine.htm _6_’Civil liberties They’re safe_’ And if you believe that… Technology The Observer.htm _7_Confirmed US and Israel created Stuxnet, lost control of it Ars Technica.htm _8_Congress To Amend NDAA To Give DoD & NSA Greater ‘Cyberwar’ Powers Techdirt.htm _9_Cyber crime as a Market - SC Magazine.htm _10_Cyber Warfare The next Cold War - SC Magazine.htm _11_Cyber-attack concerns raised over Boeing 787 chip’s ‘back door’ Technology guardian_co_uk.htm _12_Declan McCullagh - Google+ I just finished my CNET article, below, about the FBI’s new….htm _13_DHS social media monitoring practices revealed under FOIA Government Security News.htm _14_DHS urges consumers to check computers for insidious DNS infection before deadline Government Security News.htm _15_Disinformation-The methods used to keep you in the dark 2012 May 24 « Retorque….htm _16_FBI forming “Communications Assistance Center” to help spy on Americans VentureBeat.htm _17_FBI quietly forms secretive Net-surveillance unit Security & Privacy - CNET News.htm _18_Feds warn of booby-trapped hotel Wi-Fi connections - SC Magazine. htm _19_Further insights on Flame malware from Budapest lab and BeyondTrust Government Security News.htm _20_GhostNet spy network phishes international victims - SC Magazine.htm _21_Google Chrome Just Passed Internet Explorer To Become The World’s Most Popular Web Browser LinkedIn.htm _22_Gov_ Drones over Va_ ‘great’; cites battlefield success - WTOP_com. htm _23_Government security trends that need your attention now Government Security News.htm _24_Guarding against emerging spear-phishing threats Government Security News.htm _25_House-approved NDAA would restrict use of drone info Government Security News.htm _27_I Spy An Occupy Obama’s DHS Surveils Legit Protesters - WhoWhatWhy WhoWhatWhy.htm _28_IC3 annual report shows 3_4 percent rise in fraud loss - SC Magazine. htm _29_In Four Years, Most Cars Will Work With Smart Phones LinkedIn.htm _30_informationliberation - The news you’re not supposed to know__. htm _31_Internet crime complaints top 300,000 for third year Government Security News.htm _32_Iran Confirms Attack by a Virus That Steals Data - NYTimes_com. html _33_Iran, other Mideast states hit by computer virus Detroit Free Press freep_com.htm _34_Mass surveillance in the UK-A Simple Question-05-09-2012 - YouTube.htm _35_Microsoft’s Windows 8 $15 upgrade plan to kick off June 2 VentureBeat.htm _36_Military chip’s backdoor flaw poses national security questions - SC Magazine.htm _37_Millions of LinkedIn & eHarmony Passwords Stolen.htm _38_New regulations usher in the era of data governance Government Security News.htm _39_New Windows 8 preview shows off browser privacy - SC Magazine.htm _40_Obama Ordered Wave of Cyberattacks Against Iran - NYTimes_ com.html _41_One Nevada Credit Union launches remote check deposit - Business - ReviewJournal_com.htm _42_Online identity Evolve or perish! Government Security News.htm _43_Passware rolls out instant decryption of MS Office 2010 documents Government Security News.htm _44_PC Pitstop FAQ.htm _45_Plot involving enhanced underwear bomb interrupted by CIA, says The AP Government Security News.htm _46_Powerful cyber weapon uncovered that might be Stuxnet kin Government Security News.htm _47_REVEALED Hundreds of words to avoid using online if you don’t want the government spying on you Mail Online.htm _48_Risks of boomerangs a reality in world of cyberwar - Yahoo! News.htm _49_RQ-170 drone’s ambush facts spilled by Iranian engineer.htm _50_S4980512threatintel.pdf _51_Safeguarding your critical network against cyber threats in 2012 and beyond Government Security News.htm _52_Security & Privacy - The latest security news - CNET News.htm _53_Shooting down domestic drones dangerous, counterproductive, says AUVSI Government Security News.htm _54_Simon Singh heresy is at the heart of science – video Science guardian_co_uk.htm _55_Spy malware infecting Iranian networks is engineering marvel to behold Ars Technica.htm _56_Spy virus Flame got help from doctored Microsoft certificates - SC Magazine.htm _57_Sulky TV networks claim skipping commercials is illegal.htm _58_The FBI’s New Unit Can Spy on Skype and Wireless Communications.htm _59_THE FUTURE OF MOBILE [SLIDE DECK] LinkedIn.htm _60_The gaping hole in your data security The Web browser Government Security News.htm _61_This INSANE Graphic Shows How Ludicrously Complicated Social Media Marketing Is Now LinkedIn.htm _62_Top 3 Reasons to Encrypt Your Laptop.htm Page 13 Blue Chips Magazine — June 2012 _63_UK Surveillance Program Could Expose Private Lives - ABC News. htm _64_UN agency plans major warning on Flame virus risk Reuters.htm _65_Using a VPN to protect your web use Ask Jack Technology guardian_co_uk.htm _66_What A DDoS Can Cost - Dark Reading.htm _68_Where In Hacking The Ends Justify The Means - Dark Reading.htm _69_White House unveils broad, multipronged effort to combat botnets Government Security News.htm _70_Why antivirus companies like mine failed to catch Flame and Stuxnet Ars Technica.htm _71_Ziklag Systems names James Swanson its chief intelligence officer Government Security News.htm 7 8 Call the FBI for more on this? Winn Schwartau attempts to make the importance of information security accessible to the average person. In 2002, he was honored as a ““Power Thinker”” and one of the 50 most powerful people in networking by Network World. In 2008, he was voted one of the 25 Most Influential People in the Security Industry by Security Magazine. 9 Zeddicus “Zedd” Zu’l Zorander is a main character in the fictional The Sword of Truth series by Terry Goodkind, and in the live-action Legend of the Seeker, a syndicated TV series. He is the grandfather of Richard Rahl, The Seeker of Truth, and is a wizard of the First Order. Page 14 Blue Chips Magazine — June 2012 Page 15 Blue Chips Magazine — June 2012 Page 16 Blue Chips Magazine — June 2012 Page 17 Blue Chips Magazine — June 2012 Page 18 Blue Chips Magazine — June 2012 Page 19 Blue Chips Magazine — June 2012 Page 20 Blue Chips Magazine — June 2012 Page 21 Blue Chips Magazine — June 2012 Page 22 Blue Chips Magazine — June 2012 Utah Blue Chips Calendar June 2012, July 2012 ON LINE with Gene Barlow Magazine Deadline U of U 7:00pm UCS Board of Trustees C&C Bldg. Room N3005 6:30 p.m. ON LINE Magazine Deadline Blue Chips — Utah’s Computer Guide in the 21st Century