Google cyberattack

UPDATE 1-U.S. struggles to ward off evolving cyber threat

Wed May 12, 2010 6:45pm EDT

• UPDATE 1-Google cyberattack hit password system-NY Times
  Mon, Apr 19 2010

* "Crown jewel" password system infiltrated - NY Times

* Spies, criminals, terrorists eye U.S. networks

* Terabytes of data stolen, threat evolving quickly (Adds details on new U.S. cyber command)

By Phil Stewart and Jim Wolf

WASHINGTON, May 12 (Reuters) - The United States is losing enough data in cyber attacks to fill the Library of Congress many times over, and authorities have failed to stay ahead of the threat, a U.S. defense official said on Wednesday.

More than 100 foreign spy agencies were working to gain access to U.S. computer systems, as were criminal organizations, said James Miller, principal deputy under secretary of defense for policy.

Terrorist groups also had cyber attack capabilities.

"Our systems are probed thousands of times a day and scanned millions of times a day," Miller told a forum sponsored by Ogilvy Washington, a public relations company.

He said the evolving cyber threat had "outpaced our ability to defend against it."

"We are experiencing damaging penetrations -- damaging in the sense of loss of information. And we don't fully understand our vulnerabilities," Miller said.

His comments came as the Obama administration develops a national strategy to secure U.S. digital networks and the Pentagon stands up a new military command for cyber warfare capable of both offensive and defensive operations.

The Senate last week confirmed National Security Agency Director Keith Alexander to lead the new U.S. Cyber Command, which will be located at Ft. Meade, Maryland, the NSA's headquarters.

Miller suggested the new organization, which is expected to be fully operational in October, had its work cut out for it.

Among its challenges are determining what within the spectrum of cyber attacks could constitute an act of war.

Miller said the U.S. government also needed to bolster ties with private industry, given potential vulnerabilities to critical U.S. infrastructure, like power grids and financial markets.

STAGGERING LOSS

Hackers have already penetrated the U.S. electrical grid and have stolen intellectual property, corporate secrets and money, according to the FBI's cybercrime unit. In one incident, a bank lost $10 million in cash in a day.

"The scale of compromise, including the loss of sensitive and unclassified data, is staggering," Miller said. "We're talking about terabytes of data, equivalent to multiple libraries of Congress."

The Library of Congress is the world's largest library, archiving millions of books, photographs, maps and recordings.

U.S. officials have previously said many attempts to penetrate its networks appear to come from China.

Google (GOOG.O) announced in January that it, along with more than 20 other companies, had suffered hacking attacks that were traced to China. Google cited those attacks and censorship concerns in its decision to move its Chinese-language search service from mainland China to Hong Kong.

Miller took an example from the Cold War playbook to explain how the United States military would need to prepare for fallout from a cyber attack, which could leave cities in the dark or disrupt communications.

In the 1980s, the Pentagon concluded that the military needed to prepare to operate in an environment contaminated by the use of weapons of mass destruction.

"We have a similar situation in this case. We need to plan to operate in an environment in which our networks have been penetrated and there is some degradation," he said.

One of the challenges Miller singled out was the development of enough U.S. computer programmers in the future.

"In the next 20 to 30 years, other countries including China and India will produce many more computer scientists than we will," he said. "We need to figure out how to not only recognize these trends but take advantage of them."

* Gmail passwords appear safe - NY Times

* Google declines to elaborate upon Jan. 12 announcement (Adds Google comment in paragraph 8; edits paragraphs 1, 6, 9)

NEW YORK, April 19 (Reuters) - A December cyberattack on Google Inc (GOOG.O) computers hit the company's password system that millions of people worldwide use to access almost all of the company's Web services, The New York Times said, citing a person with direct knowledge of the investigation.

The closely-guarded program is considered a crown jewel at Google, enabling users and employees to sign in with their password only once to operate various services including e-mail and business applications, the newspaper said in its April 20 edition.

Code-named Gaia for the Greek goddess of the earth, and still in use under the name Single Sign-On, the program was described publicly only once at a technical conference four years ago, the newspaper said.

The intruders do not appear to have stolen passwords of Gmail users, and Google quickly started to bolster security, the newspaper said.

But the theft leaves open a possibility, perhaps faint, that the intruders may find weaknesses that Google might not know about, the newspaper said, citing independent computer experts.

Google disclosed the hacking on Jan. 12, when on its website it reported having detected "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google."

The Mountain View, California-based company said the attack appeared to target Chinese human rights activists, and that only two Gmail accounts appeared to have been accessed. [ID:nN12133127]

"We're not going to comment beyond our original blog post," Jay Nancarrow, a spokesman for Google, said on Monday night. "That remains our statement of record on the issue."

When it revealed the attack, Google said it would stop censoring search results on Google.cn.

In March, it closed its China-based Web search service and began redirecting users to an uncensored portal in Hong Kong. That decision came amid heightened tensions between China and Washington, D.C.

10 Security Reasons to Quit Facebook (And One Reason to Stay On)

You can't go a day without logging in to see what your Facebook friends are up to? Consider these factors and you may decide being connected brings on too much risk.

by Joan Goodchild, Senior Editor, CSO

March 22, 2010

Last year, Baby Boomers quit Facebook at a faster pace than they joined.

That's according to data published last year by the site Inside Facebook. After a huge growth in Facebook membership among the over-55 age group took place at the end of 2008 and the beginning of 2009, that same demographic began to defect in large numbers, just months after signing up.

Boomers were the the only shrinking age demographic on the site. What do Boomers know that others don't? Boomers have discretion, according to Scott Wright, a security consultant based in Canada who also researches and writes about social media and security awareness on his site streetwise-security-zone.com.

While the numbers certainly continue to indicate that more people are joining Facebook than quitting, certain web sites that help people "kill" your online self have gained popularity, too. Facebook recently issued cease and desist orders to several of these sites, including one called Web 2.0 Suicide Machine.

Also see The 7 Deadly Sins of Social Networking

Why would someone decide to sign off Facebook forever? Here are ten observations from security and privacy pros about the risks of social media.

Your privacy is history
Wright took part in a panel discussion recently on the topic of privacy and said he was intrigued by the opinion of one academic who pointed out that the notion of privacy differs widely among generations.

"The 20-something view of privacy is basically that their parents not see what they are doing. That's about it," said Wright.

Facebook founder Mark Zuckerberg apparently agrees. Zuckerberg made controversial remarks to a live audience earlier this year at an awards event and stated that openly sharing information with many people is today's social norm. He went on to say "We view it as our role in the system to constantly be innovating and be updating what our system is to reflect what the current social norms are." Many have translated this to mean Facebook doesn't think its users want much privacy, and the policies of the site reflect that view.

Whether Zuckerberg is right or wrong depends on who you ask. And that leaves us to consider: As younger generations define privacy in new ways, it really good for us? Bethan Tuttle, an Washington-based independent consultant and privacy advocate, says no. Tuttle said she is concerned about some of the newer changes to Facebook that force users to share certain information because, in her words, without privacy, we don't have civil liberties.

"If you can't maintain privacy online and off, then you can't speak freely," said Tuttle. "These security issues need to be addressed in such a way that our privacy can be protected."

Tuttle thinks the massive and quick growth Facebook has experienced in the last two years, coupled with a lack of privacy-centric leadership has left end user privacy as casualty. (Read more in Six Ways We Gave Up Our Privacy.)

They don't have your best interests in mind
As Tom Eston, creator of the web site socialmediasecurity.com points out, the very business model Facebook, and other social networking sites like Twitter, stands on is making user information as public as possible in order to generate new ways to make money.

"They are really startups if you think about it. They don't have a true business model," said Eston. "Their philosophy is the more you share, the more information they have to make money with."

With that in mind, can you really count on them to protect you? And do you know just how much information you are sharing that can be used not only by Facebook, but by the application developers that create those fun quizzes and games? Wright says most people don't.

Case in point: A quiz designed by the ACLU that shows Facebook users just how much information they hand over to application developers every time they agree to install a new app. Want to take that quiz to find out who you were in a past life? Each time you do, almost everything on your profile, even if you use privacy settings to limit access, is made available to the creators of that application.

Frequent redesigns affect privacy settings
"Just when people figure out the privacy settings on Facebook, they go and change them again," said Wright. "It always seems like it is being done in everyone's best interest, but if you really examine it, they have never done anything other than to try and get people to share more information."

The latest Facebook redesign in December now makes public, and searchable, certain user information that was previously private, such as which pages you are a fan of and your profile picture. And many of the features you can make private are left public unless you go in and adjust your privacy settings, which is no small task, according to Tuttle.

"I am really good online but it took me several tries to get my Facebook privacy settings where I needed them to be," she said. "I think Facebook actually implemented some great changes with this redesign, but they need to make those easier and more stable. Privacy settings need to not be changed so many times in such a short period. People need to know weeks ahead of time exactly what to do and a method of not waking up one day and finding out all of their information has gone public."

Social engineering attacks are getting more targeted If you are using Facebook, surely you have received messages by now on your wall asking "Have you seen this video?" or "Is this you in this photo?" If you click on the link, you run the risk of being infected by malware. These are known as social engineering attacks, and they are becoming more sophisticated said Wright. (Read more in 9 Dirty Tricks: Social Engineers' Favorite Pickup Lines.)

"They are becoming very targeted. Even seasoned security professionals are falling for them," he said.

The more information you share, coupled with a decrease in privacy, only means it is even easier for cyber criminals to get information about you that can be used to trick you into clicking on a bad link.

You can't trust the ads
Even if you, unlike many users, know better than to click on a suspicious message or link in your Facebook account, what about the advertisements? While you may think the advertisements are harmless, unfortunately some contain malicious links. One common scenario involves a pop-up from the ad that claims your computer is infected and prompts you to download software to fix it. Instead of helpful software, you end up downloading something nasty instead. This is now commonly known in the security community as "scareware," and it's still a very effective way to snare unsuspecting users.

Spam
Blackberry owners using the mobile Facebook application have been experiencing increased amounts of spam lately that claims to be from Facebook, said Eston.

"I think it's a security concern," said Eston. "Mostly because spammers can use that vulnerability to make you think the message is coming from Facebook when it is not.

Many users simply wonder "Why is Facebook sending me this?" and instinctively open the message and log in to what turns out to be a fake screen that steals credentials.

You don't really know your friends
A report from security firm Cloudmark that was released at the end of 2008 concluded that close to 40 percent of new Facebook profiles are actually fake. If you are one of those people with hundreds of "friends," what are the chances you might have a fake friend or two out there in your network? Pretty high, said Wright.

Having lots of friends is dangerous is because it opens you up to additional security risks. Wright said those who get targeted for hacking are the ones who have lots of friends. The more friends you have, the more reach a criminal will have when he breaks into your profile and sends out a bad link to everyone.

You can't help yourself from being dumb
The recent attention around the site pleaserobme.com has brought to light the safety concerns around social networking. Pleaserobme aggregates the Twitter feeds of people who play Foursquare, a location-sharing application that allows users to "check in" from their various geographic whereabouts. The problem is, in playing the game, many users are also publicly broadcasting that their home is likely unattended and a good "opportunity" (as the site terms it) for thieves.

As Tuttle puts it, you need to think about what you are doing and many people are not. Whether you're updating your Facebook status or playing a location-sharing game through Twitter, you're putting yourself out there in potentially dangerous ways, particularly if you don't know all of your "friends" that well (See "You don't really know your friends" above).

"If you are posting that you have arrived at a hotel at 11:00 at night and you are a female with a cute photo, you're giving someone incentive to put on their shoes and go look for you. Are you even thinking about that?" she said.

The great unknown
The layout and privacy settings keep changing. There is a lot of analysis and speculation about a potential Facebook IPO in the future and generally a lot of discussion of Facebook's future business strategy. What does this mean for users? Wright said some fear it means an increase loss of privacy as the social networking site inevitably looks for ways to make money by offering up valuable user information to advertisers and developers. Will you stick around to see how the site evolves? Or will others take a cue from the Boomers and opt out?

"One of the things I find most interesting is that there are still many people who are scared to death of social networking sites," said Wright. "These are usually the people who don't see value in them. In the end, they may be the wisest of us all."

Ex's, creeps and parents
George Straight once sang, "All my ex's live in Texas, that's why I hang my hat in Tennessee." There is little doubt that if Straight were break up with a girlfriend in today's information age, he'd have to do more than simply move across state lines to avoid being found again. Facebook is making it possible for people who break up to be cyber stalked, even if they aren't friends anymore, said Eston. Although the virtual connection is broken along with the actual relationship, having mutual friends makes it easier for your ex to keep tabs on you. The same goes for any creepy guy or girl you are trying to avoid.

Or you may get a friend request from a parent, which Wright claims many 20-something users he talks to considers the worst thing that could ever happen in the history of social networking.

"That is big driver for quitting," he said. "Once the parent friends some of these people they immediately think 'I've got to get out of this!'"

Of course, if you're the parent and you're concerned about kids revealing too much on social networks, this is the promised reason you might want to STAY on Facebook—it might make your kids quit.

Google Hackers Stole Global Password System

Report: Google Hackers Stole Source Code of Global Password System

By Kim Zetter

The hackers who breached Google’s network last year were able to nab the source code for the company’s global password system, according to The New York Times.

The single sign-on password system, which Google referred to internally as “Gaia,” allows users to log into a constellation of services the company offers — Gmail, search, business applications and others — using one password.

The hackers, who are still unknown, were able to steal the code after gaining access to the company’s software repository, which stores the crown jewels for its search engine and other programs.

Because the hackers grabbed the software, and do not appear to have grabbed customer passwords, users aren’t directly affected by the theft. But the hackers could study the software for security vulnerabilities to devise ways to breach the system that could later affect users.

Google announced in January that it and numerous other companies had been hacked in a sophisticated attack. The hackers had targeted source code repositories at many of the companies, including Google.

According to the Times, the theft began when an instant message was sent to a Google employee in China who was using Windows Messenger. The message included a link to a malicious website. Once the employee clicked on the link, the intruders were able to gain access to the employee’s computer and from there to computers used by software developers at Google’s headquarters in California.

The intruders seemed to know the names of the Gaia software developers, according to the Times. The intruders had access to an internal Google corporate directory known as Moma, which lists the work activities of every Google employee.

They initially tried to access the programmer’s work computers and “then used a set of sophisticated techniques to gain access to the repositories where the source code for the program was stored.”

The Times doesn’t elaborate on the set of sophisticated techniques the hackers used to access the source code, but in March, security firm McAfee released a white paper in relation to the Google hack that describes serious security vulnerabilities it found in software configuration management systems (SCMs) used by companies that were targeted in the hacks.

“[The SCMs] were wide open,” Dmitri Alperovitch, McAfee’s vice president for threat research told Threat Level at the time. “No one ever thought about securing them, yet these were the crown jewels of most of these companies in many ways — much more valuable than any financial or personally identifiable data that they may have and spend so much time and effort protecting.”

Many of the companies that were attacked used the same source-code management system made by Perforce, a California-based company, according to McAfee. The paper didn’t indicate, however, whether Google used Perforce or had another system in place with vulnerabilities.

According to McAfee’s earlier report, the malicious website the hackers used in the Google hack was hosted in Taiwan. Once the victim clicked on a link to the site, the site downloaded and executed a malicious JavaScript, with a zero-day exploit that attacked a vulnerability in the user’s Internet Explorer browser.

A binary disguised as a JPEG file then downloaded to the user’s system and opened a backdoor onto the computer and set up a connection to the attackers’ command-and-control servers, also hosted in Taiwan.

From that initial access point, the attackers obtained access to the source-code management system or burrowed deeper into the corporate network to gain a persistent hold.

According to the paper, the hackers were successful at accessing source code because many SCMs are not secured out of the box and do not maintain sufficient logs to help forensic investigators examining an attack.

“Additionally, due to the open nature of most SCM systems today, much of the source code it is built to protect can be copied and managed on the endpoint developer system,” the white paper states. “It is quite common to have developers copy source code files to their local systems, edit them locally, and then check them back into the source code tree…. As a result, attackers often don’t even need to target and hack the backend SCM systems; they can simply target the individual developer systems to harvest large amounts of source code rather quickly.”

Alperovitch told Threat Level his company had seen no evidence to indicate that source code at any of the hacked companies had been altered.

Google password system was target of Chinese hackers

Charles Arthur

Web giant quit Chinese mainland after attack on internal system allowing people to use single password to access its services

Google's internal system which lets people access its services via a single password was the target of the Chinese hacking attack last December that led the company to withdraw from the mainland, according to the New York Times.

The system, known internally as "Gaia" – after the overarching planetary consciousness posited by James Lovelock – is behind the interface which lets not just users but also Google developers to log in and gain access to the company's resources. Millions of people use that interface to access documents and email from anywhere in the world using Google's "cloud" services. However, users' passwords have not been compromised: Google is understood to follow standard security practice, by which passwords are only stored in encrypted form known as a "hash". When a user logs in, the password they supply is encrypted using the same method and compared to the hash. If the two match, access is allowed. Reversing the process is computationally unfeasible.

But if the hackers could gain uncontrolled access to Gaia, they might be able to change the emails to which password resets are sent (for instance when people forget their original one), and then trigger a password reset – effectively capturing the account. They might also be able to limit or expand what an account was allowed to access.

The hacking was a two-stage process. First the hackers gained access to an internal Google system called Moma, which holds information about the work activities of each Google employee: the hackers may have used that to find specific employees. Then a China-based member of Google's staff was sent a link via Microsoft's instant messenger system to a website which infected their computer and gave the hackers access to the company's internal network.

The New York Times said that a person with "direct knowledge of the investigation" had provided the details of the hack, which it said lasted less than 48 hours. Google had no comment today, referring enquiries to its original blogpost from 12 January in which it revealed that it had been attacked, when it called the hack "a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google."

It also said then that "we have evidence to suggest that a primary goal of the attackers was accessing the Gmail accounts of Chinese human rights activists".

Google began making "significant" changes to its internal systems as soon as it discovered the attack. But the hackers seem to have had access to the actual program code that is used to run Gaia – which security experts said could, in theory, lead them to weaknesses in it that they could exploit which Google would not be able to detect.

The attack on Google was not an isolated incident: the company said at the time that it had evidence that "at least 20" other US companies in internet, finance, technology, media and the chemical sectors had also been infiltrated and their intellectual property stolen. The attack was dubbed "Aurora" by the internet security company McAfee, which said that it had been done through a weakness in Microsoft's Internet Explorer browser.

Observers have suggested that the Chinese government was behind the attacks because of the profile of the companies and the information that was targeted. While Google has never publicly backed this view, its decision upon discovering the attack to cease censoring its search results in China – and withdraw its operations from the Chinese mainland to Hong Kong – suggest it thinks the attacks were done on the orders of government.

The latest details may make some businesses wary of using so-called "cloud" computing, where high-value data or important personal information is stored online rather than on individual computers under the owner's control. But the fact that it was not just Google that was affected, but internet-connected machines in other companies too, suggests that organisations will need to reconsider the threat from government-inspired hackers.

WikiLeaks

International man of mystery

BERNARD LAGAN

http://wikileaks.org/

April 10, 2010

Julian Assange, who is behind the website WikiLeaks.

The founder of WikiLeaks lives a secret life in the shadow of those who blow the whistle, writes Bernard Lagan.

On the Al Jazeera television network, an overbearing host was grilling Julian Assange, one of the founders of WikiLeaks, the online drop zone for whistleblowers.

Assange, an Australian who rarely makes public appearances and shuffles around the world with little more than a rucksack and a laptop, quickly dealt with his haughty inquisitor. Lean and tall with a handsome, distant face, long grey locks and dressed in a a dark suit, Assange, in his late 30s, is a commanding presence.

He has a deep broadcaster's voice and gave measured, drum-tight answers about the blow he had just dealt the US military with WikiLeak's release of footage of an American helicopter gunship killing Iraqi citizens and two Reuters journalists on a Baghdad street in July 2007.

The video, shot from the helicopter, includes the voices of soldiers urging a gravely wounded Reuters photographer to pick up his weapon (they apparently did not realise it was a camera) so he could be lawfully finished off with the aircraft's deadly 30mm cannon. When a beaten-up van slithers to a halt and its passer-by occupants tumble out to aid the wounded, they too are gunned down. Only two maimed children survive.

It becomes clear why the military has resisted the demands of Reuters and others for the release of the video; the military had long claimed it did not know how the Reuters journalists had died and it initially withheld the fact that children were present.

Assange resisted Al Jazeera's invitation to savage US authorities for their years of dissembling, remarking simply: ''There was certainly spinning the message and it does seem like there has been a cover-up.''

He didn't need to say more; by week's end the video had been viewed 4.8 million times. Its impact upon the reputation of US servicemen in Iraq is devastating. Another US military video - showing last year's bombing of Afghan villages as they siphoned fuel from a tanker hijacked by the Taliban - is also coming to WikiLeaks.

Clearly someone inside the military has begun leaking, elevating WikiLeaks and Assange overnight from mainstream journalism's fringes to a must-see news breaker. ''This is a whole new world of how stories get out,'' declared Sree Screenivasan, a professor of digital media at the Columbia University journalism school in New York.

Yet for all its ideals in support of openness and freedom of information, those behind WikiLeaks - especially its key founder, Assange - dwell in shadows and intrigue.

They have no headquarters, no offices and the barest of a formal structure. Assange is particularly elusive, part obviously through necessity and part mercurial make-up. Home - or the nearest he has to one - is said to have been eastern Africa for the past two years or so.

He has rarely spoken of his upbringing in Australia or life outside of his work, arguing that to do so may assist those who want him and WikiLeaks silenced.

But the trail of his life is across the internet, as coded and mysterious as the man he is today. It begins - publicly at least - in October 1991 when Assange, then a teenager, was charged with 30 computer hacking offences.

Prosecutors alleged he and others hacked the systems of the Australian National University, RMIT and Telecom. They had even managed to remotely monitor the Australian Federal Police investigation into their activities, Operation Weather.

Assange admitted 24 hacking charges and was placed on a good behaviour bond and ordered to pay $2100. The investigation in Australia began after an audacious attack on NASA's computers in 1989.

The word ''WANK'' appeared in big letters on NASA monitors, an acronym for Worms Against Nuclear Killers. Underneath was an Australian connection - lines from a Midnight Oil song. Whoever did it was never identified.

In 1997 an astonishing book was published in Melbourne. It sold a respectable 10,000 hard copies but, when it was made available free on the internet it was downloaded 400,000 times within two years.

Underground told the riveting inside story of the city's computer hackers and Assange was prominently billed in it as a researcher for the book's author, Dr Suelette Dreyfus, now an academic researcher. It opened with a detailed account of the NASA attack.

Dreyfus wrote glowingly of Assange's efforts: ''Julian had worked thousands of hours doing painstaking research; discovering and cultivating sources, digging with great resourcefulness into obscure data bases and legal papers - not to mention providing valuable editorial advice.''

The book did not name the Melbourne hackers but used their online identities and told their story. The records of Assange's court case and his biographical details on WikiLeaks match the story of Mendax - one of the hacker's online identities in Underground.

Mendax is described as a super intelligent child who never knew his father and was dragged from state to state by his mother who pursued a series of turbulent relationships.

In 1988, Mendax was 16 years old and living in Emerald in central Queensland - the age Assange was at that time. Dreyfus wrote: ''For a clever 16-year-old boy the place was dead boring. Mendax lived there with his mother; Emerald was merely a stopping point, one of dozens, as his mother shuttled her child around the continent trying to escape from a psychopathic former de facto.''

Dreyfus continued: ''Sometimes Mendax went to school. Often he didn't. The school system didn't hold much interest for him. It didn't feed his mind … The computer system was a far more interesting place to muck around in.''

She also wrote that Mendax had a deep voice for his age. Assange has a distinctively deep voice. Mendax fathered a son in his teens. Assange has said he has a son at university. Mendax suffered a breakdown after he was arrested by the police, and after a period in hospital he lived rough in the Dandenong Ranges outside Melbourne. When he finally appeared in court on the hacking charges, Assange was living in the Dandenongs.

Was this the story of Assange's life? Was he Mendax? Dreyfus will not say, citing the promise she made to the young hackers who had helped her with her book, that she would not disclose their identities. She is protective of and still obviously close to Assange.

She told the Herald this week: ''He is not politically motivated. He is more concerned with truth and the quest for it. He is certainly not party political. I think he sees that there are good people on both sides of politics and definitely bad people. He is a very brave person. He is absolutely convinced that it is worth taking high personal risks in exchange for getting truth out to the community.''

Among WikiLeaks' volunteers, those who are close to Assange are similarly protective and reluctant to speak on the record. They described on background this week a man whose traits would not be unexpected if they evolved from Mendax's turbulent and nomadic formative years. Assange, they say, is noticeably self reliant, self contained, resourceful and apt to keep a distance from others.

After his conviction, he stayed in Melbourne and built up his computer skills as programmer and as a developer of freeware.

He read widely on science and maths - he is largely self taught in most of his endeavours. He did enrol for a period at Melbourne University but did not complete his studies in mathematics.

Less convincingly answered by those who know him is whether Assange's quest to reveal secrets is the destiny of man moved by social conscience, or the natural progression of a highly intelligent child raised on the run, who found solace alone on a computer and anonymous camaraderie in cyber space.

For his epigraph in the online edition of Underground, Assange used an Oscar Wilde quote: ''Man is least himself when he talks in his own person. Give him a mask, and he will tell you the truth.''

Is Mendax the real Julian Assange?

Cyber War is comming, Richard Clarke

'Cyber War' author: U.S. needs radical changes to protect against attacks

By Ellen Messmer

In his new book, Cyber War, Richard Clarke says nations are building up their online armies and weapons largely far from public view, increasing the danger of a deliberate or accidental cyberwar, which in turn could trigger violent conflicts across the globe.

"Cyber war has already begun," Clarke writes. "In anticipation of hostilities, nations are already preparing the battlefield.' They are hacking into each other's networks and infrastructures, laying in trapdoors and logic bombs -- now, in peacetime. This ongoing nature of cyberwar, the blurring of peace and war, adds a dangerous new dimension of instability."

The United States, he says, has a weak cyber-defense posture and should make radical changes, such as regulating ISPs to be able to play a role, under government supervision, in defending the country should a serious cyberattack strike.

Is the U.S. the nation most vulnerable to cyberattack?

Clarke, turning 60 this year, served as special advisory to the president for cyber security in 2001 and now teaches at Harvard's Kennedy School for Government and works at Good Harbor Consulting. He tapped Robert Knake, international affairs fellow at the Council on Foreign Relations, with a specialty studying cyberwar, as co-author of the new book, expected out April 20. (See exclusive excerpt here.)

But Cyber War at heart is Clarke's passionate view on the dangers lurking just below the surface and what steps might be taken to prevent cyberwar. With a background decades ago in nuclear arms control and espionage in the Cold War, he compares that era with today's secretive world of military cyber commands operating over the Internet where attacks, such as disruptive denial-of-service attacks, break-ins and dangerous Trojans that could steal or alter data, are extremely difficult to trace back to their source.

"The force that prevented nuclear war -- deterrence -- does not work well in cyber war," Clarke says. "The entire phenomenon of cyber war is shrouded in such government secrecy that it makes the Cold War look like a time of openness and transparency."

With considerable detail, Clarke and Knake render vivid accounts of how significant waves of cyberattacks in the past few years have hit Estonia, Georgia, South Korea and the United States, among other places, and why some in particular bear the hallmarks of state-sponsored efforts to disrupt an adversary's Internet-based banking, media and government resources.

It's known that the United States, China, Russia, North Korea, Israel, France and others have established cyber military structures to serve as both offense and defense in any cyber conflict. But though the United States likely has the best cyberwar capabilities in the world, "that offensive prowess cannot make up for the weaknesses in our defensive position," Clarke contends.

Because the United States is the most Internet-dependent and automated in terms of supply chain, banking, transportation-control systems and other modern facilities, it's also the most vulnerable to cyberattack, Clarke argues. And the military's dependence on the Internet also means it would be vulnerable to disruptions of it.

"The U.S. military is no more capable of operating without the Internet than Amazon.com would be," Clarke says. "Logistics, command and control, fleet positioning -- everything down to targeting -- all rely on software and other Internet-related technologies."

On the other hand, he sees China with an advantage because its military aims to guard both enterprise and government resources, plus the Chinese government basically controls the Chinese Internet outright in many ways. "The Chinese government has both the power and the means to disconnect China's slice of the Internet from the rest of the world, which they may very well do in the event of a conflict with the United States," he writes

"Cyber gap" in protecting businesses

The United States has made the U.S. Cyber Command responsible for defending Department of Defense systems and the Department of Homeland Security responsible for defending civilian government agencies in any cyberattack. But Clarke sees a "cyber gap" in protecting business networks, including banking systems and the electric grid.

Electric power grids are a central source of concern for Clarke because he believes that countries are secretly placing logic bombs -- malicious software hidden away that could be activated to cause power failures -- in each other's power grids. These logic bombs (Clarke's book fails to provide us with concrete examples) might be activated as an act of cyberwar, but might just as easily go off in different scenarios, such as by mistake or by a hacker discovering them and triggering them.

Logic bombs bringing down power grids could inordinately harm civilians through massive loss of electrical supply, and this is a topic that needs to be publicly addressed, Clarke says. He also argues it's time the United States consider establishing international treaties aimed at banning cyberwar against civilian infrastructures.

Clarke writes: "The main reason for a ban on cyber war against civilian infrastructures is to defuse the current (silent but dangerous) situation in which nations are but a few keystrokes away from launching crippling attacks that could quickly escalate into a large-scale cyber war, or even a shooting war. The logic bombs in our grid, placed there in all likelihood by the Chinese military, and similar weapons the U.S. may have or may be about to place in other nations' networks, are as destabilizing as if secret agents had strapped explosives to transmission towers, transformers and generators.

"America's national security agencies are now getting worried about logic bombs, since they seem to have found them all over our electric grid. There is a certain irony here, in that the U.S. military invented this form of warfare."

Clarke suggests that in the United States, it should be up to the U.S. president to approve use of logic bombs against an adversary.

"When U.S. cyber warriors talk about the 'big one,' they usually have in mind a conflict in cyberspace with Russia or China, the two nations with the most sophisticated offensive capability other than the U.S.," Clarke says. "No one wants hostilities with these countries to happen."

Russia -- which has stated it would view a massive cyberattack as an act that would warrant retaliation with traditional weapons -- has been the main advocate of starting talks that could lead to international treaties related to cyber arms. While Clarke acknowledges he has previously rejected Russia's ideas on this score, he now says he's warming up to them because he thinks it's likely in the best interests of the United States and the rest of the world. He says the United States should consider a "no first use" pledge related to cyber weapons. But currently, he notes, the official U.S. position effectively blocks arms control in cyberspace.

Clarke would also like to see a new regulatory structure put in place in which larger ISPs, under government supervision and perhaps what would be a new agency called the Cyber Defense Administration, would play a formal monitoring and protection role for the nation. The United States would likely have to pay for these types of new services.

Indeed, there would be treaties that would require ISPs around the globe to proactively "be able to detect and 'black-hole' major worms, botnets, DDoS attacks and other obvious malicious activity." The goal would be to trace back attacks that might appear to violate treaties.

Amazing cyber espionage

Clarke does not appear to support the notion of banning cyber espionage, however, among nations. In fact, he seems to like it."The idea of limiting cyber espionage requires us to question what is wrong with doing it, to ask what problem is such a ban intended to solve?" Clarke asks in his book, with his answer being, "espionage is about getting knowledge."

And he marvels at modern cyber-espionage.

"Cyber espionage is in many ways easier, cheaper, more successful and has lower consequences than traditional espionage. That may mean that more countries will spy on each other, and do more of it than they otherwise would," he writes. But elsewhere, he also acknowledges "cyber espionage does have the potential to be damaging to diplomacy, to be provocative, and possibility even destabilizing."

Clarke doesn't hold back in the book from airing a few grievances.

Though a supporter of President Obama, Clarke is a fierce critic of some of the president's policies such as the electric-power "smart grid," which he thinks will be "a Less Secure Grid."

That's largely because a modernized U.S. power grid, for which billions of dollars has been allocated, will be more highly networked and automated with more points of attack, but as yet no clear defenses, such as encryption requirements, he points out.

Clarke also takes more than a few swipes at Microsoft, whose software is widely used by federal agencies, "even though Linux is free." Clarke is angry because Windows-based software over the years has had so many vulnerabilities that have been exploited in attacks against the government. And he perceives Microsoft as largely unwilling to change.

"Microsoft is a terribly successful empire built on the premise of market dominance and low-quality goods," he states. "For years, Microsoft's operating system and applications, like its ubiquitous Internet browser, have been pre-packaged on the computers we buy."

He says that although Microsoft "did not originally intend for its software to be running critical systems," the problem is that has happened "from military weapons platforms to core banking and finance networks. They were, after all, much cheaper than custom-built applications."

The Pentagon buying commercial-of-the-shelf software brought in "all the same bugs and vulnerabilities that exist on your own computer." Clarke adds, "Microsoft can buy a lot of spokesmen and lobbyists for a fraction of the cost of creating more secure systems."

He resents that Microsoft refused to "share a copy of its secret operating code to its largest U.S. commercial customers," but was so compliant with demands from the Chinese government.

"By threatening to ban Chinese government procurement from Microsoft, Beijing persuaded Bill Gates to provide China with a copy of its secret operating code," he says, and as part of the deal, "China modified the version sold in their country to introduce a secure component using their own encryption." He says China has also developed its own operating system, Kylin, modeled on open source Free BSD, which has been approved by the People's Liberation Army for use on their systems.

Clarke also finds it alarming that Chinese companies have been selling counterfeit Cisco routers at cut-rate discounts around the world. One firm, Syren Technology, that was indicted by the FBI and Justice Department as having a customer list that included the Marines Corps, Air Force and multiple defense contractors.

Clarke concludes that the United States, despite whatever advantages it thinks the military may have, has to act now to come up with a viable and comprehensive cyber strategy.

"While it may appear to give America some sort of advantage, in fact cyberwar places this country at greater jeopardy than it does other nations," Clarke says. "Nor is this new kind of war a figment of our imaginations. Far from being an alternative to conventional war, cyber war may actually increase the likelihood of the more traditional combat with explosives, bullets and missiles. If we could put the genie back in the bottle, we should -- but we can't."

Richard Alan Clarke[1] (born October 1951) was a U.S. government employee for 30 years, 1973–2003. He worked for the State Department during the presidency of Ronald Reagan.[2] In 1992, President George H.W. Bush appointed him to chair the Counter-terrorism Security Group and to a seat on the United States National Security Council. President Bill Clinton retained Clarke and in 1998 promoted him to be the National Coordinator for Security, Infrastructure Protection, and Counter-terrorism, the chief counter-terrorism adviser on the National Security Council. Under President George W. Bush, Clarke initially continued in the same position, but the position was no longer given cabinet-level access. He later became the Special Advisor to the President on cybersecurity, before leaving the Bush Administration in 2003.

Richard Clarke came to widespread public attention for his role as counter-terrorism czar in the Clinton and Bush Administrations in March 2004, when he appeared on the 60 Minutes television news magazine, released his memoir about his service in government, Against All Enemies, and testified before the 9/11 Commission. In all three instances, Clarke was sharply critical of the Bush Administration's attitude toward counter-terrorism before the 9/11 terrorist attacks, and of the decision to go to war with Iraq. Following his strong criticisms of the Bush Administration, Bush administration officials and other Republicans attempted to discredit Clarke or rebut his criticisms, making Clarke a controversial figure.


(1951)Richard Clarke is currently Chairman of Good Harbor Consulting, a strategic planning and corporate risk management firm, an on-air consultant for ABC News, and a contributor to GoodHarborReport.net, an online community discussing homeland security, defense, and politics. He is an adjunct lecturer at the Harvard Kennedy School and a faculty affiliate of its Belfer Center for Science and International Affairs.[3] He has also become an author of fiction, publishing his first novel, The Scorpion's Gate, in 2005, and a second, Breakpoint, in 2007.

CYBERSECURITY LEGISLATION

ROCKEFELLER UNVEILS BIPARTISAN CYBERSECURITY LEGISLATION

Mar 26, 2010 (Congressional Documents and Publications/ContentWorks via COMTEX) -- WASHINGTON, D.C. - Senator Jay Rockefeller, Chairman of the U.S. Senate Committee on Commerce, Science, and Transportation, released a draft of bipartisan cybersecurity legislation to address our nation's vulnerability to computer and Internet crime, espionage and attacks. This week, the Commerce Committee favorably reported out Senator Rockefeller's Cybersecurity Act.

"The purpose of this bill is to make absolutely sure that our country is ready in the event of a major cyber attack," said Rockefeller. "Cyber attacks are a 21st century security threat and they call for a rigorous 21st century response. We need a much more well-coordinated and collaborative effort between private sector companies, our citizens and government. We all must work together as a well-practiced team with a winning game plan in order to protect our nation, our networks and our way of life from the growing cyber threat." Senator Rockefeller's legislation would protect the security of the computer networks West Virginians and Americans rely on--not only the computer networks that connect people at home and at work, but also the computer networks that run the state's and nation's banks, schools, power grids, ports and dams, air traffic control system, and so many other critical aspects of American life and the American economy.

The legislation is the culmination of a year's work of consultation and input from cybersecurity experts in the private sector, government and civil liberties community. The bill was marked-up by the Senate Commerce Committee on March 24, 2010.

BACKGROUND The bill provides a framework for engagement and collaboration between the private sector and government on cybersecurity, while protectingcivil liberties, proprietary rights, and confidential and classified information. The bill will: * Create a National Cybersecurity Advisor, modeled on the U.S. Trade Representative, to coordinate the government's cybersecurity efforts and collaborate with the private sector.

* Initiate a new public awareness campaign to make basic cybersecurity principles and civil liberties protections familiar to citizens.

* Support major new cybersecurity R & D and the recruiting of students to study cybersecurity and apply their skills in public service.

* Create a dynamic cycle of market-driven innovation in professional training and cybersecurity products and services.

* Call on the private sector and government to share threat and vulnerability information, including access to classified threat information for cleared private sector executives - along with the responsibility for acting on it.

* Require the President and private sector jointly to develop and rehearse detailed cyber emergency response plans.

Senator Rockefeller's legislation does not give any new or broader authority to the President. It does makes sure we plan for and practice our response to an attack, so that if the President ever had to declare an emergency because of a cyber attack, both the government and private sector would be ready to immediately act to protect our country and our people.

China to blame for repeated cyberattacks

The computerized critical infrastructure of the US is "severely threatened" by cyberattacks now occurring on an "unprecedented scale with extraordinary sophistication."

• 

Director of National Intelligence Dennis Blair testifies on Capitol Hill in Washington, Wednesday, before the House Intelligence Committee hearing on the annual threats assessment of the US intelligence community.

Manuel Balce Ceneta / AP

That's the headline Dennis Blair, director of national intelligence, offered the Senate Select Committee on Intelligence Tuesday. But it was the largely unreported details he unpacked that could provide the wake-up call for government and private industry, whose computer networks he says are now under persistent and subtle assault.

In his remarks, Mr. Blair concluded that:

• Sensitive information is “stolen daily from both government and private sector networks.”

• Investigations are finding "persistent, unauthorized, and at times unattributable presences on exploited networks, the hallmark of an unknown adversary...."

• The US cannot be certain its cyberspace infrastructure will be available and reliable in a crisis.

• The US and the world face greater vulnerability to disruption as a result of the trend toward convergence of voice, facsimile, video, computers, and controls that operate critical infrastructure on a single network: the internet. These include banking, power, and water supplies

• Cyberthreats are increasingly subtle and sophisticated. Last year saw the deployment of “self-modifying malware, which evolves to render traditional virus detection technologies less effective.”

Such attacks are already happening, confirmed Daniel Geer, chief information security officer for In-Q-Tel, a nonprofit venture capital firm funded by the Central Intelligence Agency, at a security conference for the oil and gas industry in Houston in November. Other cybersecurity experts cite a growing threat from so-called "polymorphic" spyware that can change its digital signature to millions of different combination to evade identification by anti-virus software.

In this new scenario, a single piece of malware often has multiple characteristics. Its digital signatures can morph to evade detection. At the same time, it can spin off decoys intended to be caught to make it appear as if an attack has been thwarted.

The recent sophisticated attacks on Google should be a "wake-up call,” Blair said. His remarks echoed recent reports that show the problem is not only coming from clever hackers, advanced viruses, or organized cybercrime gangs – but from “nation states,” too.

"Many [of the most sophisticated attackers] have the capabilities to target elements of the US information infrastructure for intelligence collection, intellectual property theft, or disruption," Blair said.

Countries see repeated cyberattacks

More than half of the 600 IT managers operating critical infrastructure in 14 countries reported being recently hit by "high-level" adversaries such as organized crime, terrorists or nation states, according to a new global survey of information technology executives by the Center for Strategic and International Studies in Washington late last month.

A majority of the group hit, 59 percent, said they thought their computer networks and controls systems were under "repeated cyberattack, often from high-level adversaries like foreign nation-states."

Blair's comments might be news to the Senate, but cybersecurity experts face these threats daily. The "persistent" threat he referred to, for instance, is known widely as the "Advanced Persistent Threat" or APT within the security community. It's also shorthand for state-sponsored "foreign intelligence" operations and sometimes just "China."

"These are not ‘slash-and-grab jobs’,” says Rob Lee, a director at Mandiant, a leading cyber security firm. "The goal of the intruder is to occupy the network. These are professionals, not people doing this at night. This is someone's full-time job from the initial breach to lateral movement across the network, the actual occupation, then the ex-filtration of data - there are clear lines of responsibility between different actors going on."

Is China to blame?

According to Mr. Lee and other experts, the common thread in the APT is connected to China. Among 40-45 very sophisticated attacks in the past year, about two-thirds were “China related,” he said.

Shawn Carpenter, principal forensics analyst at NetWitness Corporation, concurs. He says that in a number of cases he has traced malware code back to Chinese hacker sites and to Chinese character sets in software compilers used to create the code. "You can put together some pretty compelling links that trace their way back to China," he says.

Representatives of the Chinese Embassy regularly rebut such criticisms, as they did with a Monitor report last month on cyber attacks targeting the US oil and gas industries.

Washington: Internet domain company GoDaddy.com said it planned to stop registering domain names in China, joining Google Inc in protesting cyber attacks and censorship in that country.

"We believe that many of the current abuses of the Internet originating in China are due to a lack of enforcement against criminal activities by the Chinese government," said Go Daddy Group Inc general counsel, Christine Jones.

She said GoDaddy had repelled dozens of extremely serious attacks that appear to have originated in China in the first three months of 2010.

Jones said GoDaddy, based in Scottsdale, Arizona, would continue to manage .cn domain names of existing customers.

"Our experience has been that China is focused on using the Internet to monitor and control the legitimate activities of its citizens, rather than penalizing those who commit Internet-related crimes," Jones said.

Google said in January that it had sustained a hacking attack that it said originated in China. This week Google shut its Chinese portal over censorship and said it planned to phase out deals to provide filtered search services to other online or mobile firms in China.

Google said visitors to its China search engine, google.cn, were being redirected to Hong Kong-based google.com.hk.

"I compliment Google and I compliment GoDaddy," said Democratic Senator Byron Dorgan, chairman of the Congressional-Executive Commission on China, which focuses on human rights in China.

Republican Representative Chris Smith said GoDaddy's action was "a powerful sign that American IT companies want to do the right thing in repressive countries."

Google told the commission it was seeing intermittent censorship of some Internet queries from mainland China that had been rerouted to Hong Kong.

"We are well aware that the Chinese government can, at any time, block access to our services," said Google's director of public policy, Alan Davidson.

"Indeed we have already seen intermittent censorship of certain search queries on both google.com.hk and google.com."

Internet censorship has drawn increased attention from U.S. lawmakers since Google's spat with China began and a policy initiative by US Secretary of State Hillary Clinton to promote global Internet freedom.

"This is a foreign policy priority of the United States," said Democratic Senator Ted Kaufman, co-chair of the Senate's newly formed Global Internet Freedom Caucus.

Card Hackers Albert Gonzalez

A federal judge sentenced the hacker behind the largest compromise of credit and debit card data in U.S. history to a 20-year sentence this week. While the exploits used to swipe data from over 130 million accounts went beyond cracking passwords, there are some basic precautions businesses should take to protect data from similar breaches and minimize the impact if a breach does occur.

Alberto Gonzales, the attacker behind the notorious data breaches at TJ Maxx, and Heartland Systems--among others--caused nearly $200 million in damages for the companies, banks, and insurers impacted by his attacks. That figure doesn't include the money, time, and mental anguish of the individual customers affected by the data breach.

Kevin Haley, Director Symantec Security Response, expressed via e-mail "Organizations and consumer alike can take precautions to lower their security risk. A first step can be effective passwords."

"People choose passwords based on different factors: how easy they are to remember, how strong or complex they are, the sentimental value they have, etc. Symantec developed a survey to see how users are doing today creating and updating their passwords," added Haley.

The Symantec survey yields some interesting results. Here are some of the key findings:

• 44 percent have more than 20 accounts that require passwords

• 45 percent have just a few passwords that are alternated for all accounts

• 10 percent used their pets name when creating a password (a big no-no)

• 63 percent do not change their passwords very often

Sadly, these results are not all that shocking. It is just the most recent in a long line of surveys illustrating why the password is the weakest link in the security chain in most cases. Businesses that implement cutting edge security tools and lock data down tightly, and then "protect" it all with an administrator account with the password "12345" have essentially not protected anything.

Last year Imperva conducted an exhaustive analysis of the 30 million passwords exposed in the Rockyou breach, and found the following:

• About 30 percent of users chose passwords whose length is equal or below six characters.

• Moreover, almost 60 percent of users chose their passwords from a limited set of alpha-numeric characters.

• Nearly 50 percent of users used names, slang words, dictionary words or trivial passwords (consecutive digits, adjacent keyboard keys, and so on).

The bottom line is that passwords are the primary security control standing between your sensitive and confidential data and a breach or compromise of that data. Complex passwords are difficult to remember, and constantly changing passwords makes committing them to memory even harder--but not using complex passwords, and not changing them periodically greatly increases the risk of a breach.

Passwords are only part of the equation, though. Businesses must also follow other security best practices to prevent unauthorized access and protect data from breaches--especially confidential and sensitive data like account numbers, Social Security numbers, credit card numbers, and other information. For most businesses, protecting these types of data is governed by one or more compliance mandates requiring at least a minimum level of security measures be in place.

Businesses should also have logging and monitoring tools in place. Hopefully the security controls in place will be sufficient to prevent any breach or compromise, but in the event that such an attack occurs, the logging and monitoring tools will hopefully alert IT staff that something suspicious is going on. Logging also provides forensic evidence to help identify when and how an attack occurred, and which servers or data may have been impacted.

Albert Gonzalez, the mastermind behind one of the largest cyber thefts in US history.

Businesses won't have to worry about Alberto Gonzalez for another twenty years, but Gonzalez is a dime a dozen and there is no shortage of hackers seeking out businesses with weak security measures and sensitive data to breach.

Make sure your business isn't the next one making headlines for a data breach by taking basic security precautions and ensuring that the password--the key to the front door--is not easily guessed or cracked.

Tony Bradley is co-author of Unified Communications for Dummies . He tweets as @Tony_BradleyPCW . You can follow him on his Facebook page , or contact him by email at tony_bradley@pcworld.com

Card hacker Albert Gonzalez gets 20 years, but cyber crime rising

Albert Gonzalez cost companies and insurers almost $200 million, federal prosecutors say, earning him the longest sentence ever leveled for cyber crime.

Mr. Gonzalez was sentenced in Boston on Thursday for breaking into the computer systems of major retailers in Massachusetts. A separate sentencing Friday will address similar hacking cases in New Jersey and New York involving companies such as 7-Eleven Inc., New England grocery store chain Hannaford, and payment card processor Heartland Payment Systems.

Gonzalez pleaded guilty to all charges. His escapades cost companies, banks, and insurers almost $200 million, federal prosecutors say. His sentence is the harshest ever leveled for computer crime in an American court, said Mark Rasch, former head of the computer crimes unit at the US Department of Justice.

Authorities say Gonzalez's activities suggest a growing sophistication among homegrown hackers who use software to harvest credit-card data and other personal information through vulnerable Internet signals and hacked ATMs. Data are often sold to overseas operators or used to benefit the hackers themselves.

According to a report published this month by the Internet Crime Complaint Center, a joint operation between the FBI and the National White Collar Crime Center, online crime complaints reached 336,655 in 2009, up 22.3 percent from the previous year. Total loss linked to online fraud was $559.7 million, a 111 percent rise.

The report listed nondelivery or nonpayment of goods as the top cyber crime reported to law enforcement in 2009, at 19.9 percent. Rounding out the top five were identity theft (14.1 percent), credit-card fraud (10.4 percent), auction fraud (10.3 percent) and computer fraud (7.9 percent).

Gonzalez fits the profile of most cyber criminals: He is male and lived in Florida, the state with the second-highest number of known perpetrators. California is first.

Hackers typically do not operate alone. In the Gonzalez case, two foreign codefendants helped him retrieve and transfer the data overseas.

However, a Chicago case involving cleaning service workers shows how cyber crime is not just limited to computer geeks – or even men. On Thursday, Cook County Sheriff Tom Dart announced the arrest of seven people – all women – who stole data to purchase more than $300,000 in jewelry, electronics, and other goods.

The data were stolen from as many as 250 patient files from the offices of the Northwestern Medical Faculty Foundation by workers of a nighttime cleaning service. Mr. Dart said the data were used to open new credit accounts at major retailers or to add names to existing accounts. Warrants were issued for two suspects who remain at large.

Riskiest cities for cyber crime

This week computer software maker Symantec ranked the top ten “riskiest online cities” for cyber crimes this month, based on a combination of online spending and availability, the number of infected computers and Internet vulnerability rates. They are:

1. Seattle
2. Boston
3. Washington, DC
4. San Francisco
5. Raleigh
6. Atlanta
7. Minneapolis
8. Denver
9. Austin
10. Portland