Category Archives: Security

Security

UCLA warns of security breach

Leave a comment

The identity alert site at UCLA has some late breaking news:

A sophisticated computer hacker has illegally and fraudulently accessed a restricted UCLA database containing names and certain personal information. This database includes UCLA’s current and some former students, faculty and staff, some student applicants and some parents of students or applicants who applied for financial aid. The database also includes current or former staff and faculty of the University of California, Merced, and current or former employees of the University of California Office of the President, for which UCLA does administrative processing.

UCLA is notifying all of those individuals in the database, even though a continuing investigation indicates that the computer trespasser sought and obtained only some of the information. There is no evidence to suggest that personal information has been misused.

That’s a lot of data. Wonder if these big schools are considering breaking apart and isolating repositories in order to reduce the value of assets exposed by a single breach.

Did they really have to say “sophisticated” hacker? That seems to differ in tone from the detail in a breach notification message, distributed today:

Only designated users whose jobs require working with the restricted data are given passwords to access this database. However, an unauthorized person exploited a previously undetected software flaw and fraudulently accessed the database between October 2005 and November 2006. When UCLA discovered this activity on Nov. 21, 2006, computer security staff immediately blocked all access to Social Security numbers and began an emergency investigation. While UCLA currently utilizes sophisticated information security measures to protect this database, several measures that were already under way have been accelerated.

So which was more sophisticated, the hacker or the information security measures?

Unaccelerated measures. I know how that goes. Upper management often says “I know it’s required for compliance, and it sounds great, but can we do it later?” Costs more to do things late, but even more to do things late and fast. It’s hard to know where you need to accelerate the most if your budget isn’t able to cover all the lost time.

At the end of their email message is the following warning and advice:

This is an automated message regarding the recent identity alert at UCLA. We’re sorry, but we are unable to respond to emails. Please do not reply to this email. If you have questions or concerns and would like to speak with someone, please call (877) 533-8082. For additional information and steps to take, please go to the dedicated website at http://www.identityalert.ucla.edu.

Hard to tell if they do not want to respond to email because of the liability, vulnerability/compromise issues, or because phone line bandwidth tends to be far inferior to the unlimited capacity of email queues so they hope to throttle-down the amount of complaints coming into their inbox.

The letter also wisely points out that they will not be requesting any information from the victims:

Please be aware that dishonest people falsely identifying themselves as UCLA representatives might contact you and offer assistance. I want to assure you that UCLA will not contact you by phone, e-mail or any other method to ask you for personal information. I strongly urge you not to release any personal information in response to inquiries of this nature.

I’m sure more details will emerge over the next few days.

Security

Microsoft Word Exploit in the Wild

1 Comment

Just another day in the Office.

Here is an update to the Microsoft Word Remote Code Execution vulnerability announcement from just a few days ago. Another zero-day vulnerability has been found along with exploits in the wild:

…this attack used a new zero-day vulnerability in Microsoft Word. It is reported that the emails originated from a Yahoo! email account, which the hacker accessed through a mobile device CDMA link to conceal their identity. Security professionals claim the emails contain information about the political situation in Iran and attempts to entice recipients…

[…]

Experts claim the attack was designed to steal sensitive data through the recipient’s computer.

Moreover, Microsoft continues to investigate another proof-of-concept zero day flaw for Word discovered last week. However, neither of the vulnerabilities are expected to be tackled in tomorrow’s security update, Patch Tuesday.

It’s not clear what separates the two vulnerabilities, or if they are just variations of the same flaw.

I suppose the Microsoft advice is still to never open word attachments unless you can verify the sender’s identity and confirm their good intentions. Easy to do in an Office environment, right?

The December 12th security updates do not seem to mention either vulnerability, although they do show a re-release of MS06-059, which fixes a fix for an Excel remote code execution vulnerability.

Some Microsoft Excel 2002 users who have Microsoft Windows Installer 2.0 installed received indication that the original version of security update 923089 for Excel 2002 was installed successfully. However, the actual binary file, Excel.exe, was not updated to the secure version. The re-release version of security update 923089 for Excel 2002 corrects this issue.

Verifying the success of a patch should never be underestimated.

Food, Security

Sudan IV dye pollution causes rise in food prices

Leave a comment

It sounds like the process to detect a carcinogenic red dye called Sudan IV is non-trivial. Something to do with HPLC?

I mention this because in 2005 there was a Sudan dye scare in the UK, which apparently led directly to higher food prices:

Two recent incidents of turmeric contamination and 97 cases of sudan-contaminated palm oil for sale on the European food market prompted the Commission to call for tighter controls for both these foodstuffs.

Once details of the measures are cleared, the tighter rules mean that imports of both these foodstuffs must be accompanied by certificates to prove they are free of the carcinogenic sudan red food dye. Such certificates are currently required for all imports of chilli and chilli powder products into Europe.

[…]

Over 600 well known processed foods were pulled from the supermarket shelves after the UK’s Food Standards Agency (FSA) detected the illegal dye in a batch of worcester sauce made by St.Albans-based Premier Foods.

I suppose the recent incident in China should have the same effect, although it is not clear yet whether the Chinese are going to require red eggs to be more tightly controlled or just find someone to severely punish.

And while food prices might rise, I certainly would rather pay for food I can trust rather than some colorful piece of chemically altered substance that is approved for consumption by an agency that does not want to address the root of the problem (pun intended). In other words, my heartfelt congratulations to the Mayor of New York for the successful and complete ban of transfats even though the FDA seemed unable or unwilling to do so.

I understand the concern with a rise in food prices but sometimes I think people forget that the ban/control is for a known toxic substance that is almost undetectable to humans (i.e. tastes good). I’m happy to pay experts to ensure a better quality of life and prevent poison from entering my food, thank you.

Food, Security

The Brown Jug Law — Confiscating Fake IDs for Cash

Leave a comment

Several years ago a para-legal, who also happened to be vice-president of the Brown Jug liquor store in Anchorage, initiated a new Fake ID law for Alaska. He promoted the notion that the market for fake IDs could be better regulated, based on the following logic:

When a minor uses a false identification or misuses a valid ID to attempt to circumvent the law, a crime has been committed, and that’s the case in almost every jurisdiction.

But too often the business that has been hoodwinked gets charged with the crime when it is in reality the business that is the victim.

In Alaska, they take a different tack: a business that is the victim or attempted victim of such fraud can confiscate the ID, then sue the perpetrator for $1,000 in civil damages.

After the law passed the Brown Jug started to alert parents of teens caught with fake IDs that they had the option of fighting a civil action or paying a $300 fine and sending the accused to alcohol awareness classes. Seems to me that someone using a fake ID to get alcohol is already plenty aware of the stuff, but I digress.

Has this approach been successful?

According to [Brown Jug’s] O’Neill, bouncers at the club spot a lot of false IDs and earn enough in resulting bonuses that these jobs have become very sought after and are considered to be high paying.

At Chilkoot Charlies, O’Neill said, one-third of the $1,000 penalty goes to the bouncer, one-third is kept by the company for administration (they pay a lawyer to process the letters and claims) and one-third is donated to a charity called People First.

As of the end of November, Brown Jug stores had confiscated almost 200 misused IDs. Last year the company nabbed 284, so word might be out that you do not attempt to use a phoney ID at Brown Jug—just the result the company was hoping for. “Kids spread the word,” O’Neill said.

“We confiscate more false IDs than all the other licensees in the state combined,” O’Neill said, not by way of bragging, but to illustrate how much more effective the law could be with more diligence from fellow licensees.

That last note caught my attention, especially as earlier in the article O’Neill admits

“Not enough licensees do it,” he said, “and no one at the police department has the time or desire to do it.”

Why not increase the fees until the police think it is worth their time or they have “desire”? Setting a bounty for accusations has its risks (aside from opportunity cost — police investigating other more serious offenses). For example, I wonder if they have run into a situation yet where unscrupulous bouncers or checkout clerks are generating the fake IDs themselves and then framing kids in order to blackmail parents? Taking that thought a little further, I wonder if Alaska will soon promote legislation that allows the people to sue companies responsible for security breaches involving IDs? That might help prevent fake IDs from reaching the market and thus be a powerful counterpart to the Brown Jug Law (incentive to detect fake IDs). Or, in a more specific sense, it would help decrease the incentive to steal an ID from one customer to blackmail another.

I found the Brown Jug Law article on the Montana Gaming Group website.