STE WILLIAMS

WordPress.com Crushed Under DDoS

WordPress came under massive attack on Thursday, causing disruptions for many of the sites that rely on the webhosting platform to publish their content.

“WordPress.com is currently being targeted by a extremely large Distributed Denial of Service attack which is affecting connectivity in some cases,” Sara Rosso, a representative of WordPress owner Automatic, said in a statement released to customers. “The size of the attack is multiple Gigabits per second and tens of millions of packets per second.”

The attack later subsided, but the vast amount of junk data being thrown at the company’s servers while the DDoS, or distributed denial-of-service, attack was ongoing made it hard to defend against using standard countermeasures.

Rosso said WordPress was working with its upstream providers to mitigate any further attacks. She also said WordPress “will be making our VIP sites a priority in this endeavor.”

While significantly smaller than Google-owned Blogger and other hosts, WordPress is nonetheless a crucial platform for a large amount of the Web’s population. In July Drupal estimated WordPress powered 8.5 percent of websites.

“You have no idea how hard it was to get this post up, as WordPress.com, our blog host, is currently under a denial of service attack,” TechCrunch reported. “It’s been almost impossible to access the TechCrunch backend for the past 10 minutes and users are receiving a ‘Writes to the service have been disabled, we will be bringing everything back online ASAP’ error message.”

Antivirus provider Sophos also reported difficulties in posting stories to its Naked Security blog, but said traffic to its main website was unaffected because it used a different provider?

Source…

Self-erasing flash drives destroy court evidence

The inner workings of solid state storage devices are so fundamentally different from traditional hard drives that forensic investigators can no longer rely on current preservation techniques when admitting evidence stored on them in court cases, Australian scientists said in a research paper.

Data stored on Flash drives is often subject to a process the scientists called “self-corrosion,” in which evidence is permanently erased or contaminated in ways that bits stored on magnetic-based hard drives are not. The alterations happen in the absence of any instructions from the user. The findings introduce a “grey area” into the integrity of files that are forensically extracted from the devices and threaten to end a “golden age” of digital evidence gathering offered by older storage types. (more…)

Cross Agency Sharing Approved for Australian Wiretaps

Australia’s Senate has passed amendments to that country’s wiretap laws, allowing security agency ASIO to pass information across a wide range of government agencies, and apparently to conduct wiretaps on behalf of those agencies.

According to Greens Senator Scott Ludlam, the Australian Security Intellgence Organisation (ASIO) is already more scrutiny-free than similar agencies in the US or the UK. The new Act makes it possible for ASIO to conduct wiretaps on behalf of other agencies, by request. According to Ludlam, this represents an expansion of ASIO’s remit far beyond its stated purpose.

The senator also noted that the bill vastly expands the range of people with which ASIO could share information. For example, if ASIO turned up information relating to tax fraud, this can be passed to the Australian Tax Office. (more…)

Calls For A Single UK Privacy Comissioner

The UK needs a single privacy commissioner, and not the tangle of officials it is creating to police the area, an alliance of pressure groups claimed yesterday.

Terri Dowty, Director of Action on Rights for Children (ARCH), warned of the uncoordinated and ineffective proliferation of commissioners now operating in this area. Dowty made the call on behalf of a number of other campaign groups, including Privacy International, Genewatch UK and NO2ID.

The call came in a statement broadly welcoming of government proposals to cut back on its predecessor’s over-bearing regulation of everyday life, Dowty expressed concern that the Protection of Freedoms Bill, which received its second reading in Parliament this week, proposes the establishment of two new commissioners for biometrics and CCTV. This would expand the number of commissioners responsible for privacy and surveillance from three to five.

However, Dowty said: “[this] will not necessarily lead to greater protection for the public and may even fracture the protection that already exists.

She went on: “The only way of providing meaningful oversight of freedom and privacy is to bring all of these commissioners into a single privacy commission”.

Over the last few years, the UK has invested heavily in “Commissioners”, with individuals bearing that title employed to look after areas as diverse as Children, Traffic and Immigration Services. We already have:

  • An Information Commissioner, responsible for promoting and enforcing compliance with the Data Protection Act 1998
  • An Interception of Communications Commissioner created by s57 Regulation of Investigatory Powers Act 2000, whose duties include the oversight (but not the investigation) of those who issue warrants and the procedures of those acting under warrants
  • A Chief Surveillance Commissioner with similarly limited powers, charged with keeping under review the operation of the powers and duties of directed and covert surveillance under RIPA.

The Repeal Bill proposes adding two more Commissioners whose remit would broadly cover issues of privacy. Clause 34 of the Bill would establish a Surveillance Camera Commissioner, responsible for advising the Home Secretary on the drawing up of a code of practice (on the use of surveillance cameras) “encouraging” compliance with the code and reviewing its operation.

Clause 20 would establish a Biometrics Commissioner, whose role would be limited to reviewing any national security determinations made under existing terrorism legislation or under Clause 9 of the Bill, and with the power to order the destruction of biometric material if it cannot lawfully be retained.

A spokesman for the Home Office told us that such rationalisation was not being proposed, because the areas covered by each Commissioner and the powers granted to each were wholly different. This response also implied a certain lack of joined-up thinking on the part of government, as they suggested that since some of these roles fell under the Ministry of Justice, some under the Home Office, a single view on the subject of Commissioner rationalisation was not possible.

However, according to those in favour of rationalisation, this is simply rhetoric disguising some very real flaws in current proposals.

First, as ARCH points out, there is already overlap of powers (on CCTV, for instance), leading to confusion as to which Commissioner is responsible for particular fields and also the creation of gaps that no single Commissioner feels empowered to cover.

Second, the proliferation of Commissioners has costs attached – and while these may not be massive (of the order of £2m for an “ordinary” Commissioner, and £17m for the Information Commissioner) there are clearly savings to be made.

Finally, by limiting the powers of individual Commissioners to such narrow areas, the government is failing to future-proof its Freedoms Bill and instead is creating an inevitable requirement for future Commissioners to be created in response to new threats to privacy, such as RFID, or additional obligations set by EU directives.

Is government really opposed to the idea of a Privacy Commissioner? Or is it possible, as Dowty suggests, that the idea just hasn’t occurred to them??

Source…

HBGary Chief Quits After Anonymous Hack

HBGary Federal chief exec Aaron Barr has resigned in a bid to allow the firm to draw a line under the continuing revelations from the Anonymous hack attack.

Barr was the prime mover in plans to out senior members of Anonymous at the B-Sides security conference last month. But hunter became hunted after the more skilled members of Anonymous hacked into HBGary Federal’s computer network before publishing its email database.

The emails included the revelation that Morgan Stanley, a HBGary client, was hit by the Operation Aurora attacks of late 2009, as well as messages that purported to show HBGary was planning a dirty tricks campaign against WikiLeaks. (more…)

UK Businesses Suffer Regular Ecrime Losses

The average UK business is losing £10,000 a year thanks to cyber espionage, extortion and other forms of online fraud.

In total the UK economy is losing £27bn a year and British businesses soak up £21bn of this loss. Given there are 2.1 million UK firms registered for VAT this gives a loss per firm of £10,000.

The numbers, available from the Office of Cyber Security (pdf) and Detica, claim an estimated loss of £9.2bn from IP theft – not illegal file-sharing but theft of trade secrets from UK firms.

A further £7.6bn is lost due to industrial espionage – defined as the theft of non-IP related data and £2.2bn is handed to criminal gangs by UK firms as the result of extortion. The OCS admits it has no evidence for such extortion, because it believes this crime is mostly not reported.

£1bn a year is lost due to loss or theft of customer data and £1.3bn goes thanks to direct online theft.

A spokesman for the Cabinet Office said it was impossible to say how much cyber crooks benefited from the billions they’re extracting from Blighty.

The figures are based on a “most-likely scenario” but will form the basis of future policy.

The OCS warned: “Our assessments are, necessarily, based on assumptions and informed judgements rather than specific examples of cyber crime, or from data of a classified or commercially-sensitive origin.”

It suggests approaching selected companies to ask if they are victims of cyber crime in order to both build awareness of the issues and to get some solid data on the problem.

The OCS also recommends the creation of a website to publicise the issue and to act as a central, anonymous, reporting hub for UK firms to report fraud.

The OCS estimates that the UK government loses £2.2bn due to cyber crime.

Even this number is an estimate. It is based on total tax and benefit fraud in the UK combined with an estimate of how many of these are due to “criminal attacks”. The OCS treated all these attacks as cyber crimes “due in the main to the volume of transactions now conducted online”.

The OCS release is available for download here.?

 

Exxon, Shell and BP in 4yr Hack

Bloomberg News has identified six of the energy companies targeted in recent series of “coordinated covert and targeted cyberattacks” and says the victims could face legal liability for choosing not to disclose them to shareholders.

The roster includes Exxon Mobil, Royal Dutch Shell, BP, Marathon Oil, ConocoPhillips, and Baker Hughes, according to an article the news service published on Thursday. The report cited one of the victim companies and investigators who declined to be identified.

The attacks were ongoing for at least two years and possibly as long as four years. The unknown hackers worked through servers located in China. (more…)

Germany Starts To Tighten IP Address Laws

Passing along IP addresses of web visitors to a third party without their permission could become illegal in Germany.

According to the Frankfurter Allgemeine Zeitung, data protection authorities in Lower Saxony have already targeted sites who depend on IP addresses for online advertising.

The Lower Saxony authorities recently ordered German web marketer Matthias Reincke to remove Google’s AdSense and an Amazon widget that features books from the US online retailer.

Lower Saxony data protection commissioner Joachim Wahlbrink says users should give their permission before IP addresses of visitors can be passed on to advertisers such as Amazon. Informing web visitors that the information will be transmitted is not adequate. Data protection officials in other German states now seem to agree. (more…)

Assange Set To Lose Extradition Case

An expert in UK extradition law says it’s “very likely” that WikiLeaks founder Julian Assange will lose his battle against extradition to Sweden, where he’s wanted for questioning in an investigation into rape and sexual assault allegations.

Julian Knowles, a barrister for law firm Matrix Chambers and the author of books on extradition, told BBC Radio that the legal and factual bases underpinning Assange’s defense during three days of extradition hearings in London earlier this month weren’t persuasive. As a result, Chief Magistrate Judge Howard Riddle, who is scheduled to deliver his judgment on later today, is likely to rule in favor of Swedish prosecutors seeking Assange’s extradition, he said.

“From what I read and heard about the Assange extradition hearing, I think it’s very likely that the Swedish prosecutor will prevail and extradition will be ordered by the senior district judge,” Knowles said during an interview on BBC Radio’s Law in Action program. “In a nutshell, the two preliminary arguments that the defense are running are (one) the prosecutor has no power to issue the warrants and (two) that Mr Assange is only really wanted for questioning and isn’t really wanted for trial and you have to be wanted for trial in order to be properly extradited.” (more…)

UK Council Loses USB Stick Containing Patient Records

Cambridgeshire County Council has had its wrist slapped for losing an unencrypted memory stick containing the details of vulnerable adults.

The unencrypted memory stick contained the personal details of at least six individuals. The stick including case notes and minutes of meetings where staff discussed the care of the at-risk individuals.

The Council had previously gone to some lengths to get workers to only use encrypted storage for such sensitive information, including asking staff to hand in unencrypted discs and running internal campaigns to promote its newly established encryption policy. (more…)