"Secret Service paid TJX Hacker $75,000 a Year"

According to Wired, a convicted hacker and credit card thief was paid to work undercover for the U.S. Secret Service. A convicted accomplice told Wired that Albert Gonzalez was paid $75,000 a year in cash as a confidential informant to the U.S. Government.

Though the Secret Service would not comment, a former federal prosecutor told Wired that the payment was not unusual. He compared it to "million-dollar payouts" to informants involved in organized crime investigations. According to Department of Justice guidelines, agents are required to advise confidential informants that payments "may be taxable income that must be reported to appropriate tax authorities".

Albert Gonzalez was arrested in 2008 and accused of running one of the largest identity theft crimes in U.S. history. After his arrest Gonzalez lead instigators to more than $1 million buried behind his parent's home.

Gonzalez will be sentenced on Thursday. The government is seeking a 25 year sentence.

Disgruntled Hacker [Debt Collector] Disables More Than 100 Cars Remotely

Pay Technology's Webtech Plus

Cleveland-based Pay Technologies is a company that sells hidden wireless black boxes that allow car dealers to remotely disable a car’s ignition, or trigger the horn to begin honking, as a not-so-gentle reminder that a payment is due. The Webtech Plus responds to commands issued through a central website, and relayed over a wireless pager network.

A car dealer in Austin Texas began receiving complaints from hundreds of stranded customers late last month. According to the dealership's manager, the complaints stopped several days later, when he reset all the Webtech Plus employee passwords. Then police obtained access logs from Pay Technologies, and traced an IP address to a former employee. Police say he hacked into the dealership's computer system to deactivate the starters on the cars and set off their horns.

To call the suspect a "hacker" is really an insult to hackers. On the other hand, anyone who's ever spoken with a debt collector probably isn't very surprised by allegations of unethical behavior.

According to the dealership, the employee's account had been closed when he was terminated last month, but they allege he got in through another employee’s account. They claim he was working his way alphabetically through a database of all 1,100 customers whose cars were equipped with the device.

Attn. MPAA: There are much worse ways to copy movies than with a computer.

In 2007 prosecutors in Anchorage Alaska accused 34 year old stripper Mechele Linehan of plotting a murder based on the 1994 movie "The Last Seduction". Life so closely imitated art, said prosecutors, that they even tried to have the movie played for the jury.

Rockstar Games Grand Theft Auto

In 2008 a teenager confessed that he was trying to imitate scenes from the video game "Grand Theft Auto" when he robbed a murdered a taxicab driver in Bangkok Thailand. Movies like "The Deer Hunter" (1978) are even believed to have inspired several "copycat" suicides in the late 1970's and early 80's.

All of this may seem like fodder for censorship advocates, but that debate has largely come and gone in favor preserving the First Amendment's right to free speech. Wise as the framers of the U.S. Constitution may have been, few would accuse them of being clairvoyant. After all, who could have predicted the impact the Internet would some day have on both the precept of free speech and the concept of privacy?

Though many speak of the "right to privacy", it is not, at least as far as the U.S. Constitution is concerned, a right at all. It is, nonetheless, an ethos that has long been coveted by Americans, and is implicit in the Fourth Amendment's:

...right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures...

Of course, mention the term "search" to most people today, and it's far more likely to conjure thoughts of friends lists", home pages and e-books, than actual people, houses and papers. And while, in just the past few years, popular culture has come to embrace the sharing of intimate, private and personal details with virtual strangers, the desire to remain "secure" seems to be very much alive in the 21st Century. In fact, more than any other, the Fourth Amendment has played a central, albeit contested, role in the litigation of hi-tech criminal evidence.

I know what you watched last summer...

So, what does all this have to do with your Netflix queue? Though Americans, and many other people around the world, may be willing to voluntarily divulge personal information, either in trade for modern conveniences and services, or increasingly, for a sense of online significance, we're not quite as enthusiastic when it's taken from us and shared without any tangible return. It's no longer a secret that the monetary value of data has been pre-calculated into the return on investment (ROI) of so many of today's business models, but consumers still tend to expect a certain level of security. In recent years the bar has been set pretty low. Still, it may surprise many to learn that "anonymous" usage data can be deciphered into personally-identifiable intelligence, as proven by a pair of researchers at the University of Texas using what was thought to be anonymous user data provided to contestants in the three-year $1 million "Netflix Prize" to improve the site's recommendation results.

The UT's results brought both unwanted attention from the Federal Trade Commission and a lawsuit from a private firm, resulting in Netflix's decision last week to cancel a planned sequel to the prize awarded last year.

It's not hard to imagine how this sort of data could be exploited to peddle shoes to people who have rented all six seasons of "Sex in the City", or BestBuy ads targeted at fans of NBC's "Chuck".

Dreamworks Minority Report (2002)

It's no longer extraordinary to see similar data exploited in the process of investigating crimes either. Certainly the viewing interests and habits of the individuals mentioned above have been considered relevant discovery by law enforcement. In these cases, there's little, if anything, to decipher.  Anything that Netflix knows about you, your account, and your viewing habits, is subject to a warrant, and, with or without much imagination, could be incriminating. How many of us haven't seen a good fictional car case, a well-written murder plot, a scripted street-fight, or a perfectly executed crime? The consumption of such fiction could be hazardous to your defense, if it proceeds similar accusations.

Now, imagine the same evidence available to anyone, without a warrant, subpoena, or probable cause. Perhaps someone at the FTC had the movie "Minority Report" in their queue.

You probably won't find much sympathy for Elane Cioni. A mistress scorned, she's been convicted of hacking into the email account of her former-boss, the man with whom she was having an affair, and then his wife, his other girlfriends, and even his kids. (I suppose, that doesn't engender much sympathy for her main-target either.) But, you might be surprised to find out Cioni's not a very good hacker.

You might also be surprised to learn that there's a market for professional hacking and, similar to many legitimate professions, the jobs are going offshore. When it comes to password hacking, those who can, do. Those who can't, outsource. When Cioni wanted back into her boyfriend's life she turned to one of an increasing number of web sites with offers like this:

"Need to monitor your Child? Your Spouse? Your Boyfriend/Girlfriend? We Hack Passwords for $100 USD. We Crack all major web based emails. This include Hotmail, Yahoo! AOL and Gmail. We Provide Proofs Before payment."

Passwords for $100

One particular web site even states: "This unique service is 100% legal".

The Washington Post conducted an interview with the FBI to find out why these services remain online. "The FBI is aware of these illegal services," spokesman Paul Bresson said, "and we have been successful in the past in identifying criminal activity and working with prosecutors to bring indictments. Users of these services should know that just because a product is marketed on the Internet doesn't mean it's legal."

While Cioni had an agenda, the same password could have granted her access to her victims' bank accounts, insurance policies--access to practically any service that allows individuals to "log in". Once access has been gained, she could have reassigned passwords, and even rerouted email communications, effectively allowing her to assume the individual's identities. Fortunately, that wasn't her agenda. But, it's unknown how many of the nation's tens-of-millions of identity theft victims had their passwords purchased.

Making a case against Cioni wasn't very difficult. Of course, it helped that she mentioned things to her boyfriend that only someone who would have read his email would have known.  And, she used her own PayPal account to pay for the password hacking service. In case that wasn't enough, IP address records were subpoenaed from her Internet Service Provider (ISP), and her computer was searched to find fragments of her targets' email cached to her hard drive.

Then again, Elane Cioni is not a very good hacker.

You can listen to below an NPR interview on this topic, and hear more about this story:

Washington Post (http://www.washingtonpost.com/wp-dyn/content/article/2009/09/06/AR2009090602238.html)

Source: Wikipedia

In a match between Bird-brain vs. broadband, you might be surprised to see who wins.

An old friend of mine pointed out what sounded like an interesting story out of South Africa. Tired of slow download speeds, a South African call center pitted a racing pigeon against Telkom South Africa Ltd.’s ADSL data service to see which could move a 4GB file faster. In total it took just under three hours for the bird to fly approximately 50 miles--about 30 times faster than the ADSL service, which had only downloaded 4% of the file in the same time.

I'm afraid we're not really comparing apapane to apapane, or even apapane to ostriches. I doubt, for instance, that the pigeon would fair quite as well over, say, a 500 or 5000 mile "data run".

The experiment, however, raises what is perhaps a more relevant conclusion: You probably couldn't find a more secure method for moving data than via carrier pigeon. While all Internet traffic is subject to both warranted, and illicit intercept and monitoring at multiple gateways, routers, interconnection points, and hosts, one would be hard pressed to serve a warrant on--or even physically intercept--a carrier pigeon. Not to mention, even if they occasionally drop a "packet", it's hard to argue with their wireless range.

It's certainly something to think about.

Thanks Ron!

More at:

Bloomberg (http://www.bloomberg.com/apps/news?pid=20601116&sid=aB5JSWQt0XYY)

News.com.au (http://www.news.com.au/technology/story/0,28348,26053119-5014239,00.html)

You're not one of those people who leave their wi-fi network open to anyone who passes by, are you? You realize, of course, that--beside the obvious security risks to your computers, your network, your passwords, email, accounting files, your bank account, private identity, maybe even sensitive medical information--that anything someone else does on your network will be traced back to you--the resident and ISP subscriber? Say, for example, the kid next door decides to use your "lightning fast DSL" to download, or worse--share--his music collection via Bit Torrent. The RIAA subpoena will be addressed to you. Or, suppose someone driving by decides to stop and explore his sexual curiosities where they can't be traced back to his network. The search warrant will be addressed to you.

But, that's not your problem, right? Because your wi-fi network is encrypted, right? I remember, back in the day, I used to brag that it would be easier to poach my cable connection from the street than hack my wi-fi, because I was using WEP encryption (cracked in 2001), a MAC filter (easily spoofed), AND I cloaked my SSID (worthless). Since then, came WPA, and more recently WPA2.

Linksys settings for WPA2 wireless secruity.

If I lost you at "lighting fast DSL", then the following probably is your problem: Computer scientists in Japan have developed a way to break the WPA encryption system used in wireless routers in just one minute. For those keeping up, presumably you upgraded your router firmware some time back, or purchased and configured a new router to utilize WPA2--which is, so far, considered to be secure.

While the availability of the hack certainly makes for a very reasonable and plausible deniability and is bound to be tested in the courts by way of a defense--especially for the purposes of challenging a search warrant--my recommendation would be to lock your wireless router, and make certain that you're using the latest Wi-Fi security protocols. If that means hiring a professional--trust me, they're cheaper than legal fees. Remember, no wireless router comes secure out-of-the-box.

Source: Reuters

Lori Drew will likely forever be known as the mom found guilty of "cyberbullying" and taunting teenager Megan Meier to commit suicide. Nothing, however, could be further from fact. Drew was, in fact, found guilty of violating MySpace's terms of service (ToS), by posing as a fictitious teenage boy, AKA "Josh Evans". A victory, perhaps, far greater for the software industry than for the Meier family.

Similar to convicting Al Capone for income tax evasion, ToS violations are more commonly associated with hacker prosecutions. US District Judge George Wu has now overturned the ruling, saying that the conviction could have set a dangerous precedent for other legal cases.

"Treating a violation of a website's terms of services ... to constitute 'intentionally accessing a computer without authorisation' ... would result in transforming (the law) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent internet users into misdemeanant criminals," according to Judge Wu.

Historically, companies have used their Terms of Service to govern what a user can and can't do with a product or service. Were similar constraints to be applied to other products, a car owner might, for instance, be required to purchase "Genuine GM Unleaded Fuel". While this may seem like a loss for the Meier family--and common sense--it's really a score for anyone who ever wanted the right to unlock or add functionality to their iPhone.

Israeli scientists are declaring war on DNA evidence. According to a paper published today in the journal, Forensic Science International: Genetics, scientists in Tel Aviv have have demonstrated that it is in fact possible to fabricate DNA evidence, opening up an entirely new avenue of reasonable doubt.

As quoted to the New York Times by lead author, Dr. Dan Frumkin, “You can just engineer a crime scene. Any biology undergraduate could perform this.”

Not surprisingly, Dr. Frumkin also claims to have developed a test to distinguish real DNA from manufactured evidence, which he hopes to sell to forensic labs.

If confirmed independently, this could spell the end to what has long been regarded as a flagship of forensic evidence--at least in prime time television--and usher in an age where DNA hacking becomes the newest form of identity theft.

Right about the same time as I was standing cross-legged on the wrong side of an electronic door lock that stood right between a liter of consumed soda and the nearest porcelain bowl at the FBI's Sacramento CART facility, the wizzes at DefCon were snatching the "keys to the throne" right out of the wallets of passing Feds.

Thus far, all of the Federal facilities I have visited relied heavily on some mixture electronic combination lock, wireless keycard, and biometric security devices. In my own experience, I have observed agents from other facilities use their keycards to move into and about the buildings. (Fortunately, one of them came along just in time.) As a not-insignificant annual contributor to the Federal budget, I am--to be sure--glad to see that the latest security measures are in place. However, as evidenced by a security-awareness demonstration at this year's DefCon convention in Las Vegas, "latest" does not always equal "greatest".

Representatives from Aperture Labs in Great Britain mated an RFID reader to a web camera and placed them in plain view of show-goers. As attendees passed the table, they were scanned for RFID data. Any data captured was stored on an SD card along with a picture of its owner. In attendance were members of various law enforcement agencies, both identified and incognito. Once Aperture Labs revealed details of the experiment at a panel presentation, Federal agents (at least the ones willing to admit the affiliation) were understandably unamused.

Though the SD card was subsequently destroyed, “It takes a few milliseconds to read [a chip] and, depending on what equipment I’ve got, doing the cloning can take a minute,” said Adam Laurie, co-director of Aperature Labs. “I could literally do it on the fly.”

National security and public safety concerns aside, similar chips are now mandatory in all new U.S. Passports, and have already been widely circulated in the form of major credit cards.

Read more @ Wired (http://www.wired.com/threatlevel/2009/08/fed-rfid/)

Remember when Forrest Gump said, "Life is like a box of choc'o'lates. You never know what you're gonna' ge'ut"? Well, same goes for the ever-popular Twitter. At least, when it comes to shortened links.

URL-shortening is popular with Twitter users because--well--it's hard enough to make your point in 140 characters, or less. Let alone, add in some outrageously long URL. But, up until now, when you clicked on one of those shortened links, you never knew what you were going to get. What you might have gotten was a browser-full of malware (malicious-software)--that icky code that takes over your computer and makes it do things you didn't want it to do.

So, if you love to click on all those up-to-the-minute Twitter links, today is a good day! Because Twitter is FINALLY scanning for malicious links.

Hallelujah! It's about time! Your turn Facebook.

Via Techie Buzz (http://techie-buzz.com/social-networking/ma)