There Goes The Neighborhood

Well, there goes the neighborhood.  Websense recently conducted an analysis of Canada’s online security risk profile, and all trends point to Canada as the new online crime breeding ground.  Criminals may be making the move to Canada, as IP addresses in China and Eastern Europe are now being closely scrutinized.  According to WebSense, attackers are on a quest to move their networks to countries that have better reputations.

Canada saw a huge increase in the number of servers hosting phishing sites, jumping 319% in the last year.  This tremendous increase is second only to Egypt in terms of the growth of sites hosting crime ware.   Canada is also the only country that showed an increase in bot networks over the last eight months, up 53%.  In 2010 Canada was ranked 13th in the world for hosting online crime, and in 2011 Canada jumped to 6th place, behind United States, France, Russia, Germany and China.

WebSense wants to know if this is surprising to anyone? Why or why not?

Microsoft Skype?

Microsoft is reportedly buying Web video conferencing service Skype Technologies in an $8.5 billion deal.  The Wall Street Journal’s All Things Digital website reported that the deal has already been completed, and would be announced on Tuesday.

Skype announced plans for an initial public offering last year but more recently delayed them while considering other options.  Skype is controlled by an investor group including Silver Lake, the Canada Pension Plan Investment Board and Andreessen Horowitz.  Skype is not a money winner, and would have no immediate impact on Microsoft’s finances.  It would however, clarify Microsoft’s intentions to compete with rivals such as Apple and Google in the smartphone space.  Microsoft’s stock has been pretty flat, as investors worry about its ability to counter new rivals or adapt to new technology.  Might be just what they need to get back in the game.

-=[Busted]=- 6 ID Theft Scammers

Six people have been taken into federal custody for their roles in an identity theft scheme that defrauded banks out of more than $3 million after an investigation by the FBI, United States Postal Inspection Service, and the Internal Revenue Service; Criminal Investigative Division.

On May 4, a federal grand jury in Los Angeles returned a 29-count indictment charging them in connection with involvement in the scheme to defraud financial institutions by using stolen identities of people with good credit scores to establish lines of credit, and then using the money for personal expenses. Each of the six is charged with bank fraud. One is also charged with making false statements to banks, and two are charged with aiding and abetting the false statements.

They carried out the fraud by obtaining stolen personal identifying information, including dates of birth, Social Security numbers, credit profiles, FICO scores, and driver’s license numbers, to
complete fraudulent applications for business lines of credit at Bank of America and Wells Fargo Bank.  The stolen identities were also used to provide bogus corporate officers of shell corporations that did not actually exist.  They then concocted profits for the bogus businesses and transmitted false tax documents to make it appear as though the businesses were fully operational.  The defendants rented virtual office space and installed rental equipment on premise.  They also went as far as to recruit folks to pose as employees in order to convince bank employees that the corporations were legitimate during on-site inspections.

Once the applications were approved by the banks, funds were deposited into corporate bank accounts linked to the credit lines, usually in the amount of $100,000 each.  Within a few days, the defendants liquidated the credit lines by issuing checks payable to the themselves.  The money was shared among the defendants, draining more than 70 credit lines through this scheme.

If convicted on all counts, the defendants face maximum statutory sentences ranging from 750 years to 870 years.

Sony’s “3rd Breach”

SC Magazine reports that Sony has experienced a third breach in as many weeks.  This one is NOT as serious as either of the previous breaches, but if you are a Sony customer, it is still worth knowing about.

It appears that Sony found an old server from 2001 that was setup to gather sweepstakes entries, still connected to the Internet.  The data on that server involved the personal information of 2,500 sweepstakes contestants according to Reuters, which first reported the news. The data did not include credit card, Social Security numbers or passwords.  Enough intelligence is present to launch a significant spam and fraud campaign using email, snail-mail and phonecalls, though.

Sony has announced that as a result of these recent breaches, it plans to deploy software monitoring and configuration management tools, increase encryption, improve intrusion detection capabilities, and add new firewalls.  In addition, the company plans to hire its first-ever chief information security officer.

I hope that position resides in the GTA of Ontario, Canada.  I happen to know a guy…

Chrome & Win-7 Security By-Passed

French security company Vupen says that it’s hacked Google Chrome, sidestepping the browser’s built-in “sandbox” AND also evading Windows 7’s integrated anti-exploit technologies.  The claims have not yet been confirmed by the vendors.

The exploit is one of the most sophisticated pieces of code that Vupen has created so far, according to their blog.  The exploit can be served from a malicious Web site, and if a Chrome user surfed to that site, the exploit executes various payloads to download an executable from a remote location, launching it outside the sandbox at “Medium integrity level”.  It is silent (no crash after executing the payload), it relies on undisclosed (‘zero-day’) vulnerabilities and it works on all Windows systems.

Vupen posted a video demonstration of its exploit on YouTube.  That is what I call “fugly”.  I hope that Vupen keeps this code wrapped up tightly until both Microsoft and Google have had a crack at patching against it.