Chris Mosby at myITforum.com

I got an e-mail last night from one of the victims of the Katrina disaster that just really got to me.  I have replied so I could find out where he is at and see what I find out for him.  In the meantime if anyone knows any information that might be of help, please contact me.

Here is the e-mail, with the name removed.

How about some info on temporary housing. Such as where do I go to apply. Please don't say FEMA as I registered a month ago and still haven't heard from them for an appointment. MSEMA gives me a number that no one answers. I keep getting the runaround from every agency I call, if I am lucky enough to get thru. No One seems to know anything about anything except to pass the buck. As long as they don't have to answer with any kind of intelligent information. You seem to have access to more info than the Feds or the State. So, some info on how and where to go about housing would sure be appreciated.

I am aware that all the agencies are very busy, but surely someone must know something.

 

 

Thanks

[name removed]

I can only guess how this obviously and justifiably frustated person ended up on my blog looking for information. Maybe Google searches zeroed in on all the news info I was posting when the destruction was first coming to light.  This is a very sad thing, and the government has seemed to really fail to help the people that really need it.

Hey, it wasn’t me, I don’t drive Fords.

Monitor Duty: Has Anyone Checked On The Joker's Whereabouts?

September 29, 2005
Has Anyone Checked On The Joker's Whereabouts?

Last week during a trip thru Ohio NASCAR Nextel Cup driver Mark Martin's #6 Batman Begins Ford show car was stolen. The show car (worth around $250,000), along with the truck and trailer it was being transported in, was stolen from a hotel parking lot. The police have no leads.

Now this is a sad state of affairs..

ZDNet: India benefits as half the Valley outsources

By Dawn Kawamoto

More than half of Silicon Valley companies are outsourcing, and roughly half of those outsourced jobs are going to India, according to a survey released Thursday by Santa Clara University.

More than 53 percent of Silicon Valley companies surveyed this month reported that they outsource a portion, or all, of their operations, according to the survey. And India is benefiting.

"India has an educated work force, and its people speak English, so it makes it an attractive place for outsourcing," said Mario Belotti, an economics professor at the university's Leavey School of Business.

IT leaders in India, however, remain watchful of other nations that may take their lead away. China, Russia and the Philippines are regions that also receive their fair share of outsourcing.

China, for example, captured 8 percent of the outsourced jobs, and other Asian nations nabbed 11 percent, according to the survey.

While outsourcing remains a large component of how businesses operate in Silicon Valley, a couple sectors have been scaling back on their use. Manufacturing has seen a notable decline, Belotti said.

In August, 39 percent of companies surveyed reported that they outsourced their manufacturing operations during the past three months. That was down from 48 percent two years earlier.

"Much of this drop was in the semiconductor and electronics area," Belotti said.

He noted that the pullback may stem from more Silicon Valley companies hiring locally for manufacturing jobs, especially in the computing and electronics areas. In August, the region posted a 7 percent year-over-year increase in computing and electronics manufacturing jobs.

Hacker hits University of Georgia employee records server - Computerworld

As many as 1,600 Social Security numbers may have been exposed

News Story by Todd R. Weiss

SEPTEMBER 29, 2005 (COMPUTERWORLD) - About 1,600 current and former employees of the University of Georgia are being notified that their Social Security numbers, stored on a campus server, may have been seen by a hacker operating from a foreign country.

In an announcement yesterday, the Athens-based school said the security breach was discovered Sept. 19 by university IT staffers and that the intrusion was stopped. No credit card information was accessed during the incident, the university said.

The affected records belong to current and former employees of the university's College of Agricultural and Environmental Sciences. Some 2,429 Social Security numbers may have been exposed during the breach, but because about 800 of those are duplicate records, the actual number of affected individuals is about 1,600.

All potential victims are being notified of the breach by e-mail or postal mail and are being advised of an ongoing investigation by the Georgia Bureau of Investigation and by the FBI, said Tom Jackson, a university spokesman.

So far, there have been no reports of identity theft or any other illegal use of the information, Jackson said.

"While there is no evidence that information was actually accessed, the potential exists for the intruder to match names and Social Security numbers," said Stan Gatewood, the university's chief information security officer. "So it is imperative that we notify the individuals involved, so that they may take appropriate steps to protect against identity theft."

The university also faced a hacker incident in January 2004, Jackson said, when some 32,000 credit card numbers were exposed after a hacker broke into student application files (see "University of Georgia computer systems hacked"). No perpetrator was ever identified and no reports have ever been received of anyone using the stolen credit card numbers, he said.

Two weeks ago, a laptop computer that had been stolen in March from the University of California, Berkeley, was recovered after investigators discovered it had been bought over the Internet by a man in South Carolina (see "Laptop with personal data of 98,000 people recovered").

Interesting idea to test security…

Microsoft gets hacker feedback on IE Version 7 Beta 2 - Computerworld

It sought advice at the Hack in the Box Security Conference

News Story by Dan Nystedt

SEPTEMBER 29, 2005 (IDG NEWS SERVICE) - Microsoft Corp. showed off the preliminary work it has done on the second beta version of its popular Internet Explorer Version 7 at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia, and came away with good feedback, company officials said today.

"It's the first time we've ever come out ahead of a product release to present and get feedback," said Tony Chor, group program manager for Microsoft's Internet Explorer team, referring to the company's presentation to a hacker-specific group.

Chor and colleague Andrew Cushman, director of Microsoft's security engineering and communications group, spoke highly of the feedback they heard at the presentation and preferred to use the term security research community instead of hackers when referring to attendees.

"Hacker has a negative connotation, like a criminal," said Cushman. People such as attendees of the Hack in the Box conference approach security from a very different, very valuable perspective, he said. "This community is a good source of information, and we haven't availed ourselves of that source," Cushman added.

Chor went a step further, saying Microsoft has maintained an "adversarial" relationship with the hacking community in the past, but "that wasn't working. It just made them mad, and we didn't benefit from their passion and expertise."

The company is working to engage the "security research community" in the future by making presentations at more hacker conventions and giving attendees a chance to critique some of Microsoft's work ahead of releases.

Chor and Cushman handed out business cards liberally, and they said they hope to get more e-mail responses from people as well as notes on their blog. "People had a lot of good suggestions and asked a lot of good questions," said Chor.

Some hackers at the show gave Microsoft high marks for showing off some new security features on the Web browser and seeking their views. They added that they would have liked to hear more technical details on new features in the browser. But their impression was that the presenters appeared almost apologetic, and they said that they don't plan to switch to any Microsoft products in the near term at the expense of, say, Mozilla Corp.'s Firefox browser.

Chor said he plans to increase the amount of technical details in future presentations.

The Beta 2 version of IE Version 7, currently under construction at Microsoft, will likely be ready by the end of the year, said Chor.

One new feature in the Web browser is that it runs in higher security "protected mode" by default, set at a lower user privilege. In protected mode, all downloads and other packages are automatically dropped in the "temporary Internet files" folder, so malware can't be deposited on the hard disk. In the temporary folder, IE and Windows treat the files as dangerous, and they're given no privileges to move about.

With add-ons like a Google Inc. toolbar or ActiveX, IE Version 7 Beta 2 will offer more permission prompts, since downloads such as ActiveX opt-ins can be an avenue for attack, Chor said. Microsoft also plans to license its "protected mode" innovation to other developers for free to help spread its use, said Chor.

For businesses, Microsoft added a "compatibility mode" that works when a person is using a company's intranet. It allows them to drop files wherever they want to on their PCs.

Interesting post…

Welcome to the Microsoft Security Response Center Blog! : A Day in the Life of a Security Bulletin

A Day in the Life of a Security Bulletin

Hi all- Alexandra Huft here again! I thought you might find it interesting to see “behind the scenes” of how a security vulnerability eventually becomes a security bulletin.

So, I’ll start way back at the beginning. We receive reports from many different finders on issues that may or may not be a vulnerability. The first thing that we do is work to determine that we are able to duplicate what the finder has reported. Sometimes this is very simple, other times we need to go back to the finder for additional information, but whenever possible we try and recreate what they've discovered with our own research. We work with the affected product teams and our own experts on the Secure Windows Initiative team (SWI) to reproduce these reports. We also try to keep the finder updated with as much information as we can provide, so that they are aware of where we are in the process. We then work on determining the severity, which is not always the easiest thing. Like you, we all have our opinions, which lead to many a heated discussion in the MSRC Situation Room where we meet several times a week. We all want the best decision for all of our customers.

Okay, so fast forward a bit….after we have determined that it is a vulnerability, we then work with the product groups to build the security update. Here is where it can get tricky. Let’s say you have two product groups that need to work together on a particular update because both products have the vulnerable component. Because each group may run different testing, the possibility for one group to be ready to ship before the other is increased. We also work with other groups on extensive testing of the update to test things like application compatibility. So, what do you do? Ship one update for one product groups’ component, but not the other? Wait? What if the issue is ‘critical’ in severity? What if we find an issue in the last stages of testing that could impact customer's applications negatively? You would think that this would be an easy decision and before I came to the MSRC I would have sworn that this would be a no brainer. Well I was wrong! As with all of our security vulnerability reports, each security update gets looked over in depth and we find that it may not be in our customer’s best interest to provide one update before the other. If we did provide one update before the other, then that may leave the component that we do not have an update for vulnerable, making our customer more at risk because the information is now public.

There is a lot of thought that goes into the security updates, and at times it may appear that we have forgotten or are just taking our time to get them out. However, like you, what we want is what is best for our customers, to be as secure as possible. As we continue to say we always appreciate feedback. If you think you may have a great idea, please share it with us. Having been in the field, like most, I know what it is like to have to deal with security issues in “real time”.

Have a fabulous rest of the week. Thanks for all you do. I appreciate it!



~Alexandra

Donna's SecurityFlash - ZoneAlarm Pro DDE-IPC Advanced Program Control ByPass Weakness

Posted on Thursday, September 29, 2005 6:51 PM

ZoneAlarm Pro is prone to a weakness that permits the bypassing of the Advanced Program Control feature settings. An attacker can exploit this weakness to bypass restrictive settings and transmit data to external sources through the use of permitted applications.

Solution: Reports indicate that this issue has been addressed in the latest release of Zone Labs Security Suite; this has not been confirmed by Symantec.

http://www.securityfocus.com/bid/14966/discuss
PoC in http://hackingspirits.com/vuln-rnd/vuln-rnd.htm

GAO says IT systems for air traffic vulnerable - Computerworld

Agency cites improvements but still finds gaps in security

News Story by Reuters

SEPTEMBER 27, 2005 (REUTERS) - WASHINGTON -- High-tech networks that link key parts of the U.S. air traffic control system lack important controls and may be vulnerable to hackers and others familiar with how those computer programs work, congressional investigators concluded yesterday.

The Government Accountability Office said in an update (download PDF) to a 2000 report that the Federal Aviation Administration has made progress in protecting its IT systems and noted the agency's contention that its interconnected networks are secure.

Greg Martin, an FAA spokesman, said separately that the investigation was too narrowly focused and that the agency has adequate controls in place nationwide.

"They are very secure systems," Martin said. "There is a lot that the [report] failed to take into account."

Martin said any vulnerabilities are countered by several redundancies and other controls built throughout the IT architecture.

But the GAO, the investigative arm of Congress, nevertheless disclosed a series of gaps that include outdated security plans, inadequate awareness training and questions about whether the FAA could detect intruders and keep the system up during a security breach.

"The agency has not adequately managed its networks, software updates, user accounts and passwords and user privileges," the GAO found.

Other information security controls -- including physical security and background investigations -- also have shortcomings that are not mitigated by special operating systems and custom software.

"The proprietary features of these systems cannot fully protect them from attacks by disgruntled current or former employees who are familiar with these features, nor will they keep out more sophisticated hackers," the GAO said.

These networks help provide flight tracking and other information to air traffic controllers and flight crews. They serve hundreds of airport towers, approach control centers and facilities for handling high-altitude traffic.

"Interruptions of service by these systems could have a significant impact on air traffic nationwide," the GAO concluded.

The nation's air traffic system handled more than 46 million flights in 2004. More than 640 million passengers flew on commercial planes. At any one time, as many as 7,000 aircraft could be in the air.

The GAO review was conducted at FAA headquarters and three other sites.

F-Secure integrates antispyware into new releases | InfoWorld | News | 2005-09-28 | By Jeremy Kirk, IDG News Service

F-Secure integrates antispyware into new releases
Software can also manage children's Internet use

By Jeremy Kirk, IDG News Service
September 28, 2005

F-Secure (Profile, Products, Articles) announced Tuesday the launch of F-Secure Internet Security 2006, consumer-oriented software that can also manage Internet use by children.

The company also released F-Secure Anti-virus 2006. Both products have real-time integrated antispyware, which the company said are the first antivirus products able to detect spyware before it is installed.

The products use F-Secure's BackLight technology that takes aim at rootkits, or malware that remains hidden in computers and is undetected by current security products, according to the company. Daily automatic updates are delivered over the Internet.

The Internet Security software uses an antispam feature that employes a database of verified spam IP addresses and spam gangs, a feature F-Secure said wards off common phishing techniques. An antidialer ensures against unexpected phone bills caused by hackers.

A child-lock feature allows parents to screen out questionable Web sites and set time limits on how long children can be on the Internet.

A one-year subscription to Internet Security 2006 is offered for $78 and Anti-Virus 2006 for $64 on F-Secure's Web site. Both prices exclude value added tax.

Washington Technology - Purdy: DHS will ramp up cybersecurity

Purdy: DHS will ramp up cybersecurity

By Alice Lipowicz
Staff Writer

The Homeland Security Department has drafted a set of key scenarios for possible cyberattacks against the Internet and critical IT systems, and is seeking comments from the private sector on how to best prepare and respond to such attacks, according to Andy Purdy, acting director of DHS’ National Cybersecurity Division.

DHS officials and the White House also are putting the finishing touches on a new national cybersecurity research and development plan, Purdy said earlier this week at a seminar on Capitol Hill. The event was sponsored by Nortel Networks Corp., a global telecommunications equipment manufacturer based in Brampton, Ontario.

“At DHS we recognize the importance of cybersecurity risks and we are energized by that risk,” Purdy said.

Homeland Security Secretary Michael Chertoff also is preparing to name an assistant secretary for cybersecurity and telecommunications, he said.

Purdy outlined several initiatives undertaken by his division to bolster cybersecurity and to prepare for a national cyberattack exercise known as Cyber Storm in November.

As part of their planning for disaster recovery for IT systems, DHS officials are looking at key dependency elements, such as maintaining adequate electrical power supplies, as critical parts of the recovery, Purdy said.

The department is working with advisers to prepare plans for maintaining Internet operation following a catastrophe, and also focusing on Internet-based control and process systems, which are IT systems that control the daily operations and interrelations of many plants and utilities.

“Control and process systems are one of our major priority efforts—it’s a huge challenge and a significant cybersecurity risk,” Purdy added.

DHS also is meeting with software industry groups to promote shared responsibility for cybersecurity. “It’s not just the responsibility of end users. The hardware and software makers need to do a better job to reduce vulnerabilities so we can all be safer,” he said. For example, the industry needs to develop tools to make sure that software does not include secret back doors and malicious code, he said.

Also at the event, Nortel CEO Bill Owens warned that a catastrophic cyberattack against the Internet could create a “virtual [Hurricane] Katrina” that would reverberate throughout the U.S. economy.

Owens said the growing threat over the next two or three years is coming from new viruses that may attack wireless devices and mobile phones, which can then infect broadband networks, government computers and mission-critical IT systems. He said China, India and South Korea take the risks more seriously than does the United States.

“I am frightened as hell about this issue of cybersecurity because we see it in spades around the world,” Owens said.

Donna's SecurityFlash - Vulnerability found in several antivirus & antispyware program

SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System - Current Infosec News and Analysis

Potential New AOL Chait Virus (NEW)
Published: 2005-09-28,
Last Updated: 2005-09-28 16:26:38 UTC by Chris Carboni (Version: 2(click to highlight changes))
We have a report that a new virus may be making the rounds being distributed via AOL chat.

Details are sketchy so far but we have the following thanks to Alan and Chris.

McAfee deletes the viruses but every time the user logs of and back onto the system it regenerates the batch file.

User gets a chat via AOL

"Checkout this JPEG" with a link

After clicking the link it sends to everyone on their buddy list and creates the file

C:\xz.bat

Contents of the file: it is set to disable MS security, firewall

Creates 3 registry entries one of which is a service

Hkey_local_machine\Software\Microsoft\Windows\Current Version\Run

Name :Strtax Data: lock.exe (Delete)

Hkey_local_machine\Software\Microsoft\Windows\Current Version\Run Services

Name :Strtax Data: lock.exe (Delete)

Hkey_User\Software\Microsoft\Windows\Current Version\Run Services

Name :Strtax Data: lock.exe (Delete)

After deleting those three keys and a reboot the xz.bat file stopped trying to reload itself.

If you have a copy of xz.bat or lock.exe please submit it by using the contact form at http://isc.sans.org/contact.php

More about the IE hole that I posted about yesterday, and is also similar to a vulnerability that is fixed in Firefox 1.07 

The Secunia advisory his here: http://secunia.com/advisories/16942/ 

MS Investigates New IE Security Hole

September 27, 2005
By Ryan Naraine

Users of Microsoft's flagship Internet Explorer browser are sitting ducks for security bypass attacks, according to a warning from a private researcher.

A spokesperson for the software giant acknowledged the MSRC (Microsoft Security Response Center) is investigating public reports of the flaw, which has been rated "moderately critical" by Secunia Inc.

"We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time," the spokesperson said in a statement released to Ziff Davis Internet News.

Even as Microsoft Corp. is describing the issue as a "possible vulnerability" that "may impact" Internet Explorer, the researcher who discovered the bug has posted a detailed explanation of the risks involved.

In an advisory posted to cgisecurity.net, researcher Amit Klein warned that the bug can be exploited by malicious people to manipulate certain data and conduct HTTP request smuggling attacks.

The flaw was identified in IE's implementation of XmlHttpRequest, the Javascript object that allows a client-side Javascript code to send almost raw HTTP requests to the origin host and to access the response's body in raw form.

Klein discovered that input passed to the method parameter in the "open()" function in the "Microsoft.XMLHTTP" ActiveX control isn't properly sanitized before being used in a HTTP request.

This error can be exploited to inject arbitrary HTTP requests via specially crafted input containing tab and newline characters.

Successful exploitation requires that the HTTP request be sent to a server or via a proxy allowing tab characters instead of spaces in certain parts of the HTTP request.

A successful attacker could launch security bypass, data manipulation and information disclosure attacks.

Security alerts aggregator Secunia rates the issue as "moderately critical" and confirmed the vulnerability exists on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2 (Service Pack 2).

Secunia recommended that IE users set the browser's security level to "High" as a temporary precaution.  Blogger’s Note: Our you could just drop that browser and … well you know

Now this is interesting…

Digital plague hits online game World of Warcraft
Robert Lemos, SecurityFocus 2005-09-27

A digital virus spread by terrorists left bodies on the streets and cities quarantined by the government.

“ Not only does it present an in-game dynamic that was not expected by players or Blizzard developers, it reminds us that even in seemingly controlled online atmospheres unexpected consequences can occur. While not as serious as a classic computer virus, it reminds us that computer code can impact us and we're not always safe, regardless of what precautions we take. ”

Brian Martin, independent security consultant and World of Warcraft player

Fortunately, the epidemic was not real, but the aftermath of an inadvertent digital plague caused by a simple change to the massively multiplayer online roleplaying game, World of Warcraft.

The change? Giving a monster the ability to curse in-game avatars with a self-propagating, albeit temporary, disease. While the developers only intended the disease to affect the group of characters fighting the monster, the infectious malady quickly became a tool in the hands of malicious players known as griefers, who found ways to bring the digital virus into heavily inhabited areas of the world.

For a week, the efforts of malicious players left behind massive casualties, made cities nearly uninhabitable, and became a reminder of the uncontrollability of self-propagating code.

"There are three things you can do: infect people, die, and watch other people do the first two," said one person posting to the World of Warcraft community forum under the handle 'Modahan.' "There's no way to rush for a cure; there's no way to stop the plagued idiots from coming in, there's no quest, no change, no nothing."

Read the rest of the article here: Digital plague hits online game World of Warcraft

CounterSpy goes 1.5
 Posted on Tuesday, September 27, 2005 10:31 AM

 Sunbelt CounterSpy Version 1.5 Now Available.