Some interesting stuff today on Sunbelt Security’s blog about the fed shutdown of the California “ca.gov” websites this week.

For one, Sunbelt’s CEO and President Alex Eckelberry said today that the Marin County site is still not completely clean, and Madera County has experienced some hacks of its own.

Scroll down a bit, and you’ll see that Eckelberry highlighted a few emails sent to Marin County officials before the shutdown, warning them of the hackings.

On the fed shutdown itself:

“So, was shutting down the entire system overkill? Of course. It was complete overkill. But, on the other hand, it’s a wake up call: Keep your site clean. And for Pete’s sake, please heed the warnings of security researchers when they send you email.”

I don’t live in Ohio, and that’s a good thing for two reasons.

For one, I’m a big Steelers fan (hooray for Troy Polamalu’s four-year extension). And the other reason is that more than seven percent of the state’s population is now at risk of identity theft after a massive breach last month that compromised the personal data of 770,000 residents and 64,000 state employees.

It’s worth taking a look at David Cassel’s piece at Tech.Blorge.com, which details how the 22-year-old intern whose car was broken into, now feels that he’s been made the scapegoat for the entire state.

Click here to have a look.

Looking back, what a strange bunch of news we had last week – and by strange, I mean that SC Magazine covered a little bit of everything.

First, a lot of IT pros are likely scratching their heads wondering if the iPhone’s release is going to be a career-changing event, and not in a good way.

Researchers and analysts last week were cautious of the iPhone. Here’s another take from a Symantec researcher:

“Projections made by various analysts suggest that iPhone adoption will be quite high. This allows attackers to target a larger audience with malicious code designed to run on the devices. The Safari browser and HTML email capabilities of the device could present an ideal attack vector. As recently demonstrated, Safari can be affected by vulnerabilities just as easily as other browsers on the market. While Apple may patch these holes on both the desktop and mobile platforms, the question is will users who have to pay for data transfers be willing to download large security updates on a regular basis?”
- Marc Fossi, Symantec Security Response Weblog, “Dialing for trojans”

The conventional wisdom used to be that malware authors would try to reach as many end-users as possible to spread viruses, worms, trojans or the malware of the day.

But now, attackers may be taking a page from marketers and forgoing attempts at global mass-attacks in favor of targeted, language- and custom-specific attacks to spread malware through a specific region.

Last week we saw the “Italian Job” trojan attack, spread mostly through use of the Russian-gang-controlled MPACK toolkit.

Here’s what Exploit Prevention Labs had to say about the trojan that ran amok through the boot-shaped country this month.

“The most important thing to keep in mind about this attack using compromised hosts and the MPACK exploit toolkit is that there is nothing unique save for the number of hosts involved. A year ago, the popular exploit toolkit was WebAttacker from Inet-Lux. The same many-to-one approach of using multiple compromised hosts to redirect to a singular malicious site was popular. Also, both WebAttacker and MPACK can serve up several exploits based on the visitor’s configuration…Prior to this ‘Italian Job’ we’ve been seeing MPACK use in the wild exploding this year. However, there are other toolkits out there, and there is no shortage of malicious talent to construct new ones. Whoever advertises the highest anticipated rate of infection will have a chance to become the weapon of choice. Moving forward, I’m sure we’ll see further larger-scale attacks play out either with MPACK or another toolkit.”
- Robert Freeman, Frequency X, “Reflecting on an ‘Italian Job’”

And what would a recap of last week’s news be without Harry Potter. The boy wizard was at the center of an information security controversy of his own, as a hacker claimed to have penetrated the networks at Bloomsbury Publishing and found out the end of the hugely popular series.

Most experts think the reported hacking was a fake; here’s the good word from Security-Protocols:

“If what (hacker) ‘Gabriel’ says is true, then that means tons of new spoilers for the book are now available online and we are going to have a lot of very upset Harry Potter fans. The spoilers the hacker gives away basically tell who dies in the last book…We also have to remember that potential troll posts like this one have occurred on two previous Harry Potter books, both of which were not true.”
- Security-Protocols, “Harry Potter and the Deathly Hallows hacked?”

Kudos to Kenneth Belva at bloginfosec.com for his post on Paula Abdul, she of American Idol and “Opposites Attract” fame, becoming the latest voicemail-leak victim.

Belva reported that he suffered some mockery at the hands of other bloggers for his earlier post on the infamous Alec Baldwin data breach. (I can only imagine then what bloggers thought of my impromptu review of Baldwin’s performance in Glengarry Glen Ross).

Well, make fun if you will, but Belva is on to something. It might be an entertainer 20 years past his or her prime today, but I’d bet it’ll be a CEO or business strategist tomorrow – all depending on the length of time that disgruntled employees can save voicemail.

Security researchers may have to go another round over whether a .bank domain would cut down on the number of successful phishing attempts targeting financial organizations and their customers.

Mikko Hypponen, F-Secure’s research chief, sparked the debate earlier this month when he posted on the F-Secure blog that a .bank domain would greatly benefit the financial industry, partially because, he contended, cybercrooks wouldn’t be able to afford the large fees to register a site on it.

A number of other security bloggers took the other side of the argument, naming myriad ways fraudsters would get around the new domain name.

Mikko shot back this week. And we’ll bring you more when the debate is joined…again.

On the argument that home users would not catch on to the new domain name:

The main point of such a new TLD would not be that users would suddenly get a clue and would learn to read the web addresses correctly (although for those who do read the URLs, this would obviously be an improvement). The main point is that it would allow the users’ software to work better. Security software and browser toolbars would essentially have a “white list” to work with.

That cybercriminals could afford the high prices for a domain name:

Only if they can prove that they are a real bank. And they would not be able to register misleading domain names. And in the worst case, a rogue domain would be shit down quickly. The possibility of losing their investment in registering such a domain wouldn’t be worth the risk for criminals.

You can read all of Hypponnen’s arguments at the F-Secure weblog.

Isn’t it always a bit surprising when the (new) latest significant data breach happens at a tech company?

That’s been the case twice in the past week, first when IBM suffered a data breach when a number of data tapes fell from the back of a third-party vendor’s truck.

Later last week, that mantle was passed to Alcitel-Lucent, which lost a disk containing the PII of an unknown number of employees and retirees that was also in the possession of a partner at the time of the incident. Some reports have put the Alcitel-Lucent victim total as high as 200,000.

Jaime Chanaga of The CSO Board LLC was one of the first security bloggers to comment on the incident today. Here’s what he had to say:

“In this case, Alcatel-Lucent made an error in judgment in failing to implement basic information security technologies, such as data encryption, to protect the personal information on employees stored on any computer media leaving their facilities. This incident illustrates the fact that even technology savvy organizations can fail to protect sensitive information by ignoring the proper use of information security controls such as data encryption.”

Data breaches come in all shapes and sizes. And some don’t have a size.

Just today in fact, SC Magazine’s Dan Kaplan wrote this story about IBM – itself a pioneer in data storage and encryption – losing tapes that were in the possession of a third-party vendor.

Last week Texas’ House of Representatives passed a bill that would make PCI compliance the law of the Lone Star State, allowing financial institutions to take action against a company that is not compliant with the standard.

Tim Erlin at nCircle’s 360 Security blog has a brief analysis.

On Friday, the news team at SC Magazine followed up a report in The Wall Street Journal on how and where the TJX breach began.

The where is simple – Minnesota. The how isn’t quite as easy, but it’s still uncomplicated: TJX was reportedly using an outdated wireless security system to safeguard the private information of its customers. After a wardriving effort, attackers easily cracked the company’s network and pilfered the data for more than a year, eventually affecting 45 million shoppers.

Here’s commentary from around the web on the latest TJX breach news:

“So, assuming that there were security and technical people aware of these security methods, and they are the most basic ones I can think of in wireless security, the issue really lies somewhere else. TJX is a vast company, covering many countries, and the evidence is that this one area was hit. That sounds lucky. The issue seems to come down to one of communication, pure and simple. This is so often the case in security breaches and one rarely discussed.”
- IT Security, the View from Here

“I hope other businesses who are still using WEP or no encryption in their wireless networks read about this. It’s one thing to have the convenience of wireless, it’s another thing to share it with someone who wants to steal your credit card data. Another point the auditors made in the TJX review is that the wireless network was basically part of the wired network, with no firewalls or other layers of security between the two. This is basic network architecture, which should have been in place if the network was set up by a security professional.”
- Network Security Blog

“TJX made a lot of serious mistakes, but they deserve credit for doing the investigation and publishing the results. Bismarck said that the wise man doesn’t learn from his mistakes, but instead learns from other people’s mistakes. The only way we can have wise security is if other people publish their mistakes so we can learn from them. If you’ve shopped at TJ Maxx, Marshalls, HomeGoods or A.J. Wright, it’s not overkill to cancel your credit card. Stolen ones have already been used for fraudulent charges, often to buy gift cards. Don’t assume you’re safe just because nothing’s happened to you yet: smart crooks may delay using a credit card to throw off investigators.”
- The Security Mentor

There are some phrases we reporters type so much, we could easily write them up in our sleep.

Add to the list “personal information of college students breached.”

Last month, a laptop was stolen from the home of a professor at Louisiana State University, breaching the personal information of about 750 students there.

The laptop likely contained students’ Social Security numbers, full names and grades, according to this report in the Daily Reveille.

Meanwhile, the names and Social Security numbers of more than 5,600 students at the University of New Mexico were disclosed when they were unintentionally posted to the school’s website, according to this report in the Free New Mexican.

University officials said the odds are minimal that any of the info was misused because they information, which included names and Social Security numbers, were only on the site for a few hours. Phew!

There’s a truck driver in Texas with a full tank of gas and a clear conscience.

According to a report in the Hartford Courant, which came to the attention of SCMagazineBlogs.com via this write up by mordaxus on the Emergent Chaos blog, a Lockheed Martin employee dropped a USB flash drive at a gas station. That pack-of-gum-sized drive contained details on the Joint Strike Fighter aircraft, the nation’s most expensive weapons program.

According to a Bloomberg news story, Glen Frausto took the device home for a 20 minute investigation and turned it over to authorities.

The U.S. Air Force completed its investigation last month, according to authorities.

mordaxus has a simple solution for Lockheed: full-disk encryption. He’s right, if for no other reason than not everyone is Glen Frausto.