STE WILLIAMS

Dutch Courts Rule WiFi Network Hacking Is Not a Crime

A Dutch court has ruled that hacking into Wi-Fi connections is not a crime providing any connected computers remain untouched. However Wi-Fi freeloaders would still lay themselves open to civil proceedings.

The unusual ruling came in the case of a student who threatened a shooting rampage against staff at students at Maerlant College in The Hague. The threat was posted on 4chan, the notoriously anarchic internet image board, after the student broke into a secure Wi-Fi connection. The unnamed student was caught and convicted of posting the message but acquitted on the hacking charge.

The miscreant was sentenced to 120 hours of community service.

Reports are vague on how the student hacker was tracked down, but it may well be that the denizens of 4chan got the ball rolling by reporting the threats to police, something that happened in a similar school massacre threat case in Michigan back in February.

The Netherlands has a computer hacking law that dates from the early 1990s and defines a computer as a machine involved in the “storage, processing and transmission of data”. Since a router is not used to store data, a judge reasoned, it fails to qualify as a computer – and thus the computer hacking law isn’t applicable. The ruling, which surprised legal observers in The Netherlands, means that piggy-backing (or leeching) open wireless networks is not a crime: though civil proceedings against leechers would still be possible, so a free-for-all is unlikely.

Most countries have laws the apply to hacking into computer networks as well as computers but not, it would seem, The Netherlands. The Dutch attorney general has decided to appeal the verdict in the case, a process that may take several months

HBGary Chief Quits After Anonymous Hack

HBGary Federal chief exec Aaron Barr has resigned in a bid to allow the firm to draw a line under the continuing revelations from the Anonymous hack attack.

Barr was the prime mover in plans to out senior members of Anonymous at the B-Sides security conference last month. But hunter became hunted after the more skilled members of Anonymous hacked into HBGary Federal’s computer network before publishing its email database.

The emails included the revelation that Morgan Stanley, a HBGary client, was hit by the Operation Aurora attacks of late 2009, as well as messages that purported to show HBGary was planning a dirty tricks campaign against WikiLeaks. (more…)

UK Businesses Suffer Regular Ecrime Losses

The average UK business is losing £10,000 a year thanks to cyber espionage, extortion and other forms of online fraud.

In total the UK economy is losing £27bn a year and British businesses soak up £21bn of this loss. Given there are 2.1 million UK firms registered for VAT this gives a loss per firm of £10,000.

The numbers, available from the Office of Cyber Security (pdf) and Detica, claim an estimated loss of £9.2bn from IP theft – not illegal file-sharing but theft of trade secrets from UK firms.

A further £7.6bn is lost due to industrial espionage – defined as the theft of non-IP related data and £2.2bn is handed to criminal gangs by UK firms as the result of extortion. The OCS admits it has no evidence for such extortion, because it believes this crime is mostly not reported.

£1bn a year is lost due to loss or theft of customer data and £1.3bn goes thanks to direct online theft.

A spokesman for the Cabinet Office said it was impossible to say how much cyber crooks benefited from the billions they’re extracting from Blighty.

The figures are based on a “most-likely scenario” but will form the basis of future policy.

The OCS warned: “Our assessments are, necessarily, based on assumptions and informed judgements rather than specific examples of cyber crime, or from data of a classified or commercially-sensitive origin.”

It suggests approaching selected companies to ask if they are victims of cyber crime in order to both build awareness of the issues and to get some solid data on the problem.

The OCS also recommends the creation of a website to publicise the issue and to act as a central, anonymous, reporting hub for UK firms to report fraud.

The OCS estimates that the UK government loses £2.2bn due to cyber crime.

Even this number is an estimate. It is based on total tax and benefit fraud in the UK combined with an estimate of how many of these are due to “criminal attacks”. The OCS treated all these attacks as cyber crimes “due in the main to the volume of transactions now conducted online”.

The OCS release is available for download here.?

 

Exxon, Shell and BP in 4yr Hack

Bloomberg News has identified six of the energy companies targeted in recent series of “coordinated covert and targeted cyberattacks” and says the victims could face legal liability for choosing not to disclose them to shareholders.

The roster includes Exxon Mobil, Royal Dutch Shell, BP, Marathon Oil, ConocoPhillips, and Baker Hughes, according to an article the news service published on Thursday. The report cited one of the victim companies and investigators who declined to be identified.

The attacks were ongoing for at least two years and possibly as long as four years. The unknown hackers worked through servers located in China. (more…)

Lush online store hacked

Australian cosmetics retailer Lush has pulled the kill-switch on its web store following a security breach.

In a statement that replaced its home page on Tuesday, Lush Australia says it has been alerted that the security breach may have exposed customers’ credit card information. The statement directs customers to contact their bank to discuss whether cancellation is warranted.

In spite of the similarity to a similar breach of Lush’s security in the UK, the company claims the two incidents are not related.

“Our Website is not linked to the Lush UK Website, which was recently compromised,” the company’s statement said.

Update: card theft confirmed

According to a report by the ABC, Lush has since confirmed that card details were stolen, along with the company’s entire customer database.

Lush Australasia director Mark Lincoln says customers would not have been aware that their card details were kept. The ABC report says the vulnerability occurred because of a “failure to keep the Website updated”.

The company told the ABC it does not know how long breaches may have been occurring. ?

Source

Hardware keyloggers discovered in public libraries in Greater Manchester

Two USB devices, attached to keyboard sockets on the back of computers in Wilmslow and Handforth libraries, would have enabled baddies to record every keystroke made on compromised PCs. It’s unclear who placed the snooping devices on the machines but the likely purpose was to capture banking login credentials on the devices prior to their retrieval and use in banking fraud.

A third detected device was discovered but disappeared before it was turned over to local police, the Manchester Evening News reports.

(more…)