A New Security Risk: Your Old Cell Phone

In Dufus Or Joe Job Victim?, we looked at an idiot who sold a laptop computer, and came to regret it. Amir probably deserved what came to him, but it doesn't mean that we shouldn't learn from his mistake.

So how about your cell phone? You may be surprised to learn that it's a small computer. It may have an amazing storage capacity, and what's stored there can cause you embarassment, if you give away, lose, or sell the phone. Apparently, what's stored on your cell phone can be resurrected, even if erased - just as the contents of your computers hard drive can be recovered.

CNN Technology: Cell phones won't keep your secrets discusses experiences where

Curious software experts resurrected information on 10 used phones (purchased on eBay), including the racy exchanges between guarded lovers, and

• One company's plans to win a multimillion-dollar federal transportation contract.
• E-mails about another firm's $50,000 payment for a software license.
• Bank accounts and passwords.
• Details of prescriptions and receipts for one worker's utility payments.

The recovered information was equal to 27,000 pages -- a stack of printouts 8 feet high.

"Most people toss their phones after they're done; a lot of them give their old phones to family members or friends," said Miro Kazakoff, a researcher at Compete Inc. of Boston who follows mobile phone sales and trends.

Think next time, before you give your old phone away.

One Small Bit Of Good News

21 year old Christopher Maxwell was sentenced to 37 months in federal prison on Friday for hacking, that in the estimate of the Seattle FBI's cybersquad, netted Maxwell and two unnamed teenage accomplices "more than $100,000".

Maxwell, holding back tears, pleaded for probation in lieu of prison time.

I am a 21-year-old boy with a good heart and I made a mistake. I never realized how dangerous a computer could be. I thank God no one was hurt.

The judge was not taken by the tears, or the plea. While Pechman took Maxwell's age and lack of criminal record into account, she said the prison term was necessary to provide a deterrent to other hackers.

Victims of the hack included

• Colton Unified School District in California.
• Northwest Hospital in Seattle.
• The US Defense Department.

and doubtless thousands of unknown private computers that will never be identified.

He got off lightly, but it's a start. Hopefully the FBI is getting better at this now.

Pizza Order Credit Card Scam

OK, tonite you want a pizza for dinner. So you call your local pizza restaurant, and have one delivered.

But there's a problem. They don't accept cash payments anymore - it's pay by credit card only.

Right now is when you should smell a rat. But you're hungry, and you want to smell pizza. So you give them the number, they take your order, and you hang up.

Your pizza never comes, and your credit card is now being used in a major shopping spree by the guy who just took your order. And he's not a pizza call center employee.

The bad guys convinced AT&T to route calls, intended for the pizza shop, to their phone number.

Hello, Big Cheese Pizza. How can I rip you off today?

The police know about this in Southern California, but it's possible that it's going on elsewhere. You don't really know.

What's the story here? >>> AT&T Service Reps must be really gullible.

August 2006 Patch Tuesday Report

Last week, Microsoft issued 12 security patches, 9 which they rated as Critical (Patch ASAP), and 3 Important (Patch As Soon As Convenient). ISC / SANS rated those patches, for computers used as network clients, as 2 Extra Critical (PATCH NOW), 8 Critical, and 2 Important.

One of those patches, MS06-040 (KB921883), fixes a vulnerability in the Server service (remember that almost all Windows computers will run the Server service, even though they may not be dedicated servers).

Today, ISC SANS issued MS06-040: BOLO -- Be On the LookOut (NEW), stating that

Over the weekend there was a botnet doing fairly wide scale scanning for hosts affected by the vulnerabilities in the MS06-040 advisory. While technically a botnet, it was spreading in a worm like fashion.

MS06-040 is one of the two patches that were rated as PATCH NOW by ISC SANS. Among the advice given:

• If you have not done so yet:
  • Roll out the MS06-040 patches ASAP.
  • Do not forget to reboot those machines after patching!

MS06-040 has passed from vulnerability, to Proof Of Concept exploit, and to active exploit in progress. This is a serious situation, as documented by US CERT. Patch Now, please.

For convenient immediate downloads, I offer direct links here. Or you can use Windows Update, or Automatic Update.

• Take a system checkpoint first.
• Verify your Operating System name and service pack level:
  • My Computer
  • Properties
• Download the most urgent patches, properly chosen for your operating system and service pack level, to an organised folder on your disk.
  • MS06-040 (KB921883)
  • MS06-042 (KB918899)
• Run each update, from the folder, using Windows Explorer.

Ongoing Stories.

• SANS Microsoft August 2006 Patches: STATUS
  
• MS06-040 exploit in the wild
  
• Windows 2000 [!] - WGA-Dienst hat sich heimlich installiert
  

Bots And You

For those of you who are maybe living in a cave (and if so, what ISP services you?), of the millions of computers in the world, a good portion of them are not controlled completely by the person who is paying for their Internet service. These computers, hijacked by a successful hacking campaign, and controlled by another person, we call bots. One bot is useless; bots are maintained in collections, called botnets. A botnet could range in size from 10,000 to 1.5 million hijacked computers.

I've been observing, and writing about, botnets for some time.

• In November 2004, some bad guys very deviously hijacked a German advertising server, and 4 other servers, and delivered the Bofra / IFrame exploit to 5,000 - 10,000 computers. These computers became part of a botnet.
• In May 2005, we saw a practical application of a botnet, as the Sober worm was used to distribute spam relevant to a German political battle.
• This year, we have botnets being used to hijack Blogger blogs, and create networks of blogs serving spam.

Most people don't realise that botnets are both the attack vehicle, and the payload of a successful attack.

Bump Keys - A Growing Security Problem

Securing your computers, and your network, begins with physical security. This is one reason why WiFi Security is so important, and so problematic.

But, if you're depending upon a cylinder lock on your front door, to restrict physical access to your network, you need to be aware of the newest threat - Bump Keys.

This looks real scary. But is it real? One would hope not.

Well, in typical You Tube fashion, when you watch that video, you will have a choice of several others like it in the You Tube library. Watch the others too. One video - maybe somebody's imagination. Two videos - maybe a game by some college studants. Five videos, a DSLR Forums thread, and an MSNBC article - a very real problem.