Kudos to Kenneth Belva at bloginfosec.com for his post on Paula Abdul, she of American Idol and “Opposites Attract” fame, becoming the latest voicemail-leak victim.

Belva reported that he suffered some mockery at the hands of other bloggers for his earlier post on the infamous Alec Baldwin data breach. (I can only imagine then what bloggers thought of my impromptu review of Baldwin’s performance in Glengarry Glen Ross).

Well, make fun if you will, but Belva is on to something. It might be an entertainer 20 years past his or her prime today, but I’d bet it’ll be a CEO or business strategist tomorrow – all depending on the length of time that disgruntled employees can save voicemail.

Security researchers may have to go another round over whether a .bank domain would cut down on the number of successful phishing attempts targeting financial organizations and their customers.

Mikko Hypponen, F-Secure’s research chief, sparked the debate earlier this month when he posted on the F-Secure blog that a .bank domain would greatly benefit the financial industry, partially because, he contended, cybercrooks wouldn’t be able to afford the large fees to register a site on it.

A number of other security bloggers took the other side of the argument, naming myriad ways fraudsters would get around the new domain name.

Mikko shot back this week. And we’ll bring you more when the debate is joined…again.

On the argument that home users would not catch on to the new domain name:

The main point of such a new TLD would not be that users would suddenly get a clue and would learn to read the web addresses correctly (although for those who do read the URLs, this would obviously be an improvement). The main point is that it would allow the users’ software to work better. Security software and browser toolbars would essentially have a “white list” to work with.

That cybercriminals could afford the high prices for a domain name:

Only if they can prove that they are a real bank. And they would not be able to register misleading domain names. And in the worst case, a rogue domain would be shit down quickly. The possibility of losing their investment in registering such a domain wouldn’t be worth the risk for criminals.

You can read all of Hypponnen’s arguments at the F-Secure weblog.

Isn’t it always a bit surprising when the (new) latest significant data breach happens at a tech company?

That’s been the case twice in the past week, first when IBM suffered a data breach when a number of data tapes fell from the back of a third-party vendor’s truck.

Later last week, that mantle was passed to Alcitel-Lucent, which lost a disk containing the PII of an unknown number of employees and retirees that was also in the possession of a partner at the time of the incident. Some reports have put the Alcitel-Lucent victim total as high as 200,000.

Jaime Chanaga of The CSO Board LLC was one of the first security bloggers to comment on the incident today. Here’s what he had to say:

“In this case, Alcatel-Lucent made an error in judgment in failing to implement basic information security technologies, such as data encryption, to protect the personal information on employees stored on any computer media leaving their facilities. This incident illustrates the fact that even technology savvy organizations can fail to protect sensitive information by ignoring the proper use of information security controls such as data encryption.”

On Friday, the news team at SC Magazine followed up a report in The Wall Street Journal on how and where the TJX breach began.

The where is simple – Minnesota. The how isn’t quite as easy, but it’s still uncomplicated: TJX was reportedly using an outdated wireless security system to safeguard the private information of its customers. After a wardriving effort, attackers easily cracked the company’s network and pilfered the data for more than a year, eventually affecting 45 million shoppers.

Here’s commentary from around the web on the latest TJX breach news:

“So, assuming that there were security and technical people aware of these security methods, and they are the most basic ones I can think of in wireless security, the issue really lies somewhere else. TJX is a vast company, covering many countries, and the evidence is that this one area was hit. That sounds lucky. The issue seems to come down to one of communication, pure and simple. This is so often the case in security breaches and one rarely discussed.”
- IT Security, the View from Here

“I hope other businesses who are still using WEP or no encryption in their wireless networks read about this. It’s one thing to have the convenience of wireless, it’s another thing to share it with someone who wants to steal your credit card data. Another point the auditors made in the TJX review is that the wireless network was basically part of the wired network, with no firewalls or other layers of security between the two. This is basic network architecture, which should have been in place if the network was set up by a security professional.”
- Network Security Blog

“TJX made a lot of serious mistakes, but they deserve credit for doing the investigation and publishing the results. Bismarck said that the wise man doesn’t learn from his mistakes, but instead learns from other people’s mistakes. The only way we can have wise security is if other people publish their mistakes so we can learn from them. If you’ve shopped at TJ Maxx, Marshalls, HomeGoods or A.J. Wright, it’s not overkill to cancel your credit card. Stolen ones have already been used for fraudulent charges, often to buy gift cards. Don’t assume you’re safe just because nothing’s happened to you yet: smart crooks may delay using a credit card to throw off investigators.”
- The Security Mentor

There are some phrases we reporters type so much, we could easily write them up in our sleep.

Add to the list “personal information of college students breached.”

Last month, a laptop was stolen from the home of a professor at Louisiana State University, breaching the personal information of about 750 students there.

The laptop likely contained students’ Social Security numbers, full names and grades, according to this report in the Daily Reveille.

Meanwhile, the names and Social Security numbers of more than 5,600 students at the University of New Mexico were disclosed when they were unintentionally posted to the school’s website, according to this report in the Free New Mexican.

University officials said the odds are minimal that any of the info was misused because they information, which included names and Social Security numbers, were only on the site for a few hours. Phew!

Technology news is sort of like food; if you leave it out too long, it’s only a matter of time until it goes bad.

If breaking news isn’t covered within a few days, it’s going to be passed over for the next juicy steak of a story to come along. And with ever-changing technology, and bad guys who never seem to sleep, nowhere in the media is this as clear as than with tech news.

So with that in mind, here are a few blog items to much on over the weekend.

As if they don’t have enough to worry about…
When doing business overseas, a road warrior is likely to check his or her bank account information via the web instead of running up an expensive phone bill or strolling the streets of Tokyo or London looking for a Chase Bank ATM.

So imagine being stationed in a foreign country for months on end, with few urban centers nearby to check account balances.

That’s the rationale behind a new man-in-the-middle phishing scheme that traps members of the U.S. Armed Forces into visiting a website that logs their keystrokes. F-Secure’s research team has a good description on its blog.

Warning: The scam websites, which pretend to be official Bank of America pages and require check card numbers, expiration dates and PIN numbers, look quite real.

Keep it classified
Here’s an another scary item.
Privacy blog PogoWasRight.org, named after a cartoon character famous for saying, “We have met the enemy and he is us,” (must’ve been before my time) has picked up an Associated Press story on Los Alamos workers being warned about identity theft.

Moving towards disclosure
Finally, patch distribution is a tricky business. Most months, Microsoft can’t seem to make anyone happy, no matter what it fixes or how many patches it releases.

With Oracle’s latest patch release just in the rearview mirror, Eric Maurice, the company’s manager for security in the Business Technology Unit, blogged about the latest distribution.

It’s worth reading because public disclosure about patch distributions is an even trickier business than releasing the fixes. It’s a tightrope walk above malicious users and IT pros, and both groups want as much information as possible.

It’s also worth noting that Oracle has made strides in recent months to release patches on a more selective basis and rank vulnerabilities on a clearer scale.