Bad Apples in the Barrel are the Biggest Danger to Security

In light of the story circulating about a mid-level manager at Homeland Security getting caught falsifying immigration documents, Michael Chertoff said:

"I wish we could be perfect. Human existence is not perfect, but I can tell you it is a very small proportion, and there is nothing more important than finding those few bad apples and throwing them out of the barrel."

I had considered writing a post about this mid-level manager, then it occurred to me that Mr. Chertoff was correct (from a global perspective) and that - from a security standpoint - there is nothing more important than throwing those "bad apples" out of the barrel.

"Bad apples" don't only exist in "Homeland Security," and although someone getting caught there makes good "press," we have bigger problems out there that need to be dealt with.

One of the biggest threats, we face today is rogue nations obtaining nuclear capabilities. AQ Khan, who developed nuclear weapons for Pakistan, admitted selling secrets to North Korea, Libya and Iran. Many believe that he obtained a lot of his knowledge from the Chinese, who were caught stealing nuclear secrets from us during the Clinton Administration, Online NewsHour: Spies Among Us -- June 9, 1999."

And there is evidence that the Chinese actively seek to plant insiders to steal information. Here is a previous post, I wrote about that.

If any of this is true, we are still being damaged as a result of "insider" problems from the 90's. Two of the biggest threats to world peace today are Iran and North Korea and their "nuclear ambitions."

Insider problems exist at all levels - and are a favorite means for rogue governments, foreign businesses, criminals and terrorist organizations to defeat any and all security measures.

Ira Winkler of the National Computer Security Association wrote:

The Federal Bureau of Investigation estimates that U.S. Corporations lose $100 Billion annually due to industrial espionage. While many people believe that the espionage is committed by well financed organizations that can only be stopped by national agencies, that is very incorrect. Industrial espionage usually exploits simple and very preventable vulnerabilities to produce tremendous results.

The theft of sensitive information from U.S. corporations is the goal for many foreign nations and companies. Adversaries do not care about what form the information takes. Whether information is in electronic format or is thrown away in the trash, it is irrelevant as long as the information is compromised.

Industrial spies know how to bypass any strong part of a security program to attack an organization at it's weakest point.

For Mr. Winkler's full analysis, link here.

Mr. Winkler's analysis brings up some very valid points and scary insights. The people who engage in insider theft will use any and all means to accomplish their goals. Look at all the major breaches that have been caused by a laptop being left unsecured?

Perhaps, I got off topic, but my vote is that we move on and forget this mid-level manager. Homeland Security has bigger fish to fry and the fact that he was caught indicates that they are willing to clean up their own backyard. After all, there are a lot of other backyards out there that probably need to be cleaned up and this is where our focus should lie.

And Just When We Thought the IRS Phishing Scams Were Gone for the Year

All during tax season, we saw warnings about phishing attempts using the name of the IRS. April 15th has come and gone, but the "phishermen" are still using the IRS name to lure victims.

For those unfamiliar with phishing, it normally starts with a lure - such as a refund from the IRS - in the form of an e-mail directing you to "click" on a site. The site (which is also fake) then directs you to give up all sorts of personal information, which the "phishermen" use to commit "identity theft." In more sophisticated schemes - even going on the site - can lead to all sorts of cybernasties (crimeware) being injected into your system. The crimeware allows them to track your information on a more "permanent" basis.

Phishing is on the rise and according to the APWG (Anti Phishing Working Group), May set a all-time record for phishing attempts.

Here is an interesting story from KUTV in Salt Lake City:

Tax season is over but some people are still getting notifications that they have a refund coming from the IRS. There are all types of so-called phishing schemes out there. And we found a new one today. Here is what the email looks like: Click Here.

It claims to be from the internal revenue service. It says you have a refund coming, just go to a website and fill out the refund request. And look at this: Click Here.

For the full story from KUTV: Click Here.

If you spot one of these attempts, you can forward it to the good folks at PIRT (Phishing Incident Reporting and Termination Squad) - who will take action to shut the bad guys down.

And last, but not least; you can call the IRS directly at 800-829-1040 to verify any communications, or e-mail the "suspected" phish to phishing@irs.gov. The IRS also has some pretty good information on their website on how to avoid falling for scam involving your taxes.

You can also report the activity to the APWG, which is mentioned above.

Israeli Sites Under Attack by Islamic Hackers

There has been a lot of speculation that Islamic groups use the Internet to further their political objectives. With the recent tension in the Gaza Strip, here is evidence of their capabilities as reported by Gal Mor, Ehud Kinan of YNet news:

Hundreds of websites were damaged by hackers in recent hours, following IDF activity in the Gaza Strip. The hackers are members of the Moroccan “Team Evil” group, responsible for most of the website damage in Israel in the past year. This is the largest, most concentrated attack on Israeli websites in recent years.

A Ynet investigation revealed that more than 750 Israeli websites, on a number of different domains, were hacked into and damaged in recent days. Prominent among them were the Soldier’s Treasury Bank, Bank Hapoalim (not the main page), Rambam Hospital, the Society for Culture and Housing, BMW Israel, Subaru Israel, Jump Fashion, non-profit organization “Yedid,” Kadima’s youth website, and the Globus Group ticket center. Many of these sites have not yet returned to normal.

Hackers left the message: You’re killing Palestinians, we’re killing servers.

For the full story on YNet, link here.

There is a lot of speculation of how terrorist groups might use the Internet to disrupt systems. Here are some previous posts, I've written on that matter:

Do Financial Crimes and Internet Fraud Fund Terrorism

Are Terrorists Probing Our Computer Systems?

Secret Shopper Scam Targets Walmart, Again

Back in November, I did a post on a Secret Shopper (advance fee) scam -- where people were solicited to act as Secret (Mystery) Shoppers -- and cash a large check at Walmart as part of their "paid" shopping assignment. They are then provided with a large dollar counterfeit cashiers check and instructed to cash it at Walmart. The second part of their assignment (if they get past the Walmart employee) is to wire the money to Canada via MoneyGram.

Of course, for their hard work they are instructed to keep a "generous" commission for themselves. And after the check returns, they are left with the responsibility of dealing with the consequences.

This scam seemed to die out for a few months, but is again raising it's "ugly head." I've received several reports -- by my readers and other sources -- that they are again being solicited to perform these so-called shopping assignments. The current scams seemed to be based out of Canada, which is where the original ones were based, also.

Walmart is known to take a tough stance on check fraud and makes use of local District Attorney programs as part of their "collection" efforts. This normally means -- if you fall for one of these scams and Walmart cashes the check -- failure to pay them back could mean criminal prosecution. Since the person cashing the check is responsible for the full amount cashed, the "generous commission" isn't a very good deal.

Of course, they might also call the authorities while someone is in their establishment passing a counterfeit check.

So far as the "Walmart connection," these scams all mutate and instructions to "shop" other establishments (although not seen yet) could be a future development. Only the result will remain the same, which is the person cashing the check will ultimately be held responsible. The best protection any of us have is to recognize the scam and ALWAYS remember that anything too good to be true, often IS NOT.

Here is the previous post, I wrote in November:

Secret Shoppers Scammed

If you want to report one of these scams, a good place to do so is:

Internet Crime Complaint Center (FBI)

And Canada (where most of this seems to come from) has a site of their own to report activity:

Phonebusters