SPAM - More Than Ever

Ever since the expansion, and loosening of controls, of domain-names (especially in Europe) I've notice an vast proliferation of SPAM.

Example domains:

• @bborc.top
• @caorc.top
• @eeaorc.top
• @faorc.top
• @paorc.top

What I noticed (as shown in example above) is these sites only change the characters between "@" and 'dot-whatever' sometimes changing only one character.


REF:  The Spmhaus Project

ALSO:  Google's Fighting Spam

INTERNET - Criminals Steal 1.2 Billion Web Credentials

"After criminals steal 1.2 billion web credentials, how to protect personal info from data breaches" PBS NewsHour 8/6/2014

Excerpt

GWEN IFILL (NewsHour):  Computer hacking and the breaches of privacy that come with them are becoming a regular and unwelcome feature of our wired world.

Now The New York Times and a security firm based in the Midwest are reporting a massive one that includes the collection of more than a billion username and password combinations and more than 500 million e-mail addresses.  What’s more, the perpetrators appear to be a shadowy Russian crime ring.

Details, including the names of the victims, are hard to come by.  But the news has raised eyebrows around the world.  So, how serious is it?

For that, we turn to Dmitri Alperovitch, co-founder and chief technology officer of CrowdStrike, a Web security firm.

Mr. Alperovitch, tell us just in context of all these other breaches we have had in the past year, say, how — relative to those, how big is this?

DMITRI ALPEROVITCH, CrowdStrike:  Well, the number is certainly striking; 1.2 billion credentials is a lot.  In the past, we have seen some big breaches that numbered in the hundreds of millions.

But this is certainly the biggest one that I — that I can remember.

THE WEB - Who Should Oversee It

The title of this article is slightly misleading to non-techies.  NO single entity controls the WEB.  The issue is who assigns the Internet Protocol (IP) Addressing and assigning of Domain Names to IPs.

"As the U.S. government relinquishes control, who should oversee the Web?" PBS NewsHour 3/24/2014

Excerpt

SUMMARY:  The Commerce Department recently announced it would give up oversight of ICANN, the California nonprofit that manages the unique domains of the world's websites and email servers.  There's been international pressure to make the change, especially in light of revelations about NSA surveillance.  Vint Cerf of Google and Randolph May of the Free State Foundation join Judy Woodruff to offer debate.

JUDY WOODRUFF (NewsHour):  Who controls the World Wide Web, and how is it overseen and governed?  These are the questions that most of us don’t really know the answers to, but the Obama administration announced a change in the role played by the United States, one that’s stirring up concerns about the Internet’s future and freedom from censorship.

FADI CHEHADE, CEO, ICANN:  To become the world’s ICANN, we have to go to the world.

JUDY WOODRUFF:  Change was in the wind as the Internet Corporation for Assigned Names and Numbers, ICANN, kicked off a meeting in Singapore this weekend, its purpose, to start crafting a transition from U.S. control of administration of the Internet.

Since 1998, the California nonprofit has had a federal contract to manage the unique identifiers of the world’s Web sites and e-mail servers, regulating domain names such as dot-com and dot-gov.

WORLD WIDE WEB - 25th Birthday

"25 years on, still adapting to life tangled up in the Web" PBS NewsHour 3/12/2014

Excerpt

JUDY WOODRUFF (NewsHour):  The World Wide Web turns 25 years old today.  The date marks the publication of a paper that originally laid out the concept, which eventually led to the vast system of Internet sites we now use.

Jeffrey Brown looks at how it’s changed the world we live in.

JEFFREY BROWN (NewsHour):  One way to do that is to look at how individual Americans think about the Internet and its impact on their lives.

The Pew Research Internet Project did that in a survey just out.  Among much else, it finds that 87 percent of American adults now use the Internet, and the number goes up to 97 percent for young adults from 18 to 29.  Ninety percent of Internet users say the Internet has been a good thing for them personally, though the number drops to 76 percent when asked if the Internet has been a good thing for society generally, with 15 percent saying it’s been bad for society.

And 53 percent of Internet users say the Internet would be, at minimum, very hard to give up.

We’re joined by three people who’ve watched the growth of the Internet from different angles.  Xeni Jardin is a journalist and editor at the Web blog Boing Boing, which covers technology and culture.  Catherine Steiner-Adair is a clinical and consulting psychologist at Harvard Medical School, and author of “The Big Disconnect: Protecting Childhood and Family Relationships in the Digital Age.”  And Daniel Weitzner teaches computer science and Internet public policy in at MIT.  From 2011 to 2012, he was U.S. deputy chief technology officer in the White House.

And welcome to all of you.

And, Daniel Weitzner, I will start with you, because you worked with Tim Berners-Lee, who — one of the main people that started all this 25 years ago.  What has — what surprises you now, sitting here 25 years later, about where we’re at?

DANIEL WEITZNER, Massachusetts Institute of Technology:  Well, it does surprise me how tremendously the Internet and the Web has grown into every aspect of our lives.

I think that a lot of us who were involved in the early days of the Internet and the Web had hoped that it could really reach the whole world.  And there’s no question that Tim Berners-Lee, who — whose architecture for the World Wide Web really helped it to grow, had the ambition that it in fact cover the whole world — represent everything in the world.  But I think it’s amazing how far we have actually come in that direction.

INTERNET - FCC Net Neutrality Rules

"Will end of net neutrality rules impact future innovation?" PBS Newshour 1/15/2014

Excerpt

HARI SREENIVASAN (Newshour):  Net neutrality is the idea that broadband Internet service providers, Comcast, Time Warner Cable, Verizon and others, should treat everything that flows across the Internet equally.  That means preventing service providers from creating fast lanes for sites they have business ties with, such as streaming video services like Hulu or Netflix, and slowing access to others, like Amazon.

It also means not charging more for YouTube and other sites based on their heavier bandwidth use or in exchange for faster speeds, all of which could affect what consumers see online, how fast, and at what price.  The principles were set out by the Federal Communications Commission nearly a decade ago.

The agency enshrined them in its Open Internet Order adopted in 2010.  But Verizon sued to challenge the agency's authority, and, yesterday, the U.S. District Court of Appeals for the District of Columbia found the FCC acted improperly.  The 81-page ruling said the agency is wrong to classify Internet service providers as information services, but at the same time regulate them as common carriers, meaning as it does telephone and utility companies.

While the FCC decides whether to appeal, Amazon and others are watching to see if the broadband networks impose their own rules, favoring some content companies over others.

For its part, Verizon issued a statement yesterday that said, in part:  "Verizon has been and remains committed to the open Internet.  This will not change in light of the court's decision."

The ruling doesn't apply to wireless services accessed through mobile devices, which represent a growing share of the market.

CYBER SECURITY - Cyberattacks on U.S. Universities

"Universities Face a Rising Barrage of Cyberattacks" by RICHARD PÉREZ-PEÑA, New York Times 7/16/2013

Excerpt

America’s research universities, among the most open and robust centers of information exchange in the world, are increasingly coming under cyberattack, most of it thought to be from China, with millions of hacking attempts weekly.  Campuses are being forced to tighten security, constrict their culture of openness and try to determine what has been stolen.

University officials concede that some of the hacking attempts have succeeded.  But they have declined to reveal specifics, other than those involving the theft of personal data like Social Security numbers.  They acknowledge that they often do not learn of break-ins until much later, if ever, and that even after discovering the breaches they may not be able to tell what was taken.

Universities and their professors are awarded thousands of patents each year, some with vast potential value, in fields as disparate as prescription drugs, computer chips, fuel cells, aircraft and medical devices.

“The attacks are increasing exponentially, and so is the sophistication, and I think it’s outpaced our ability to respond,” said Rodney J. Petersen, who heads the cybersecurity program at Educause, a nonprofit alliance of schools and technology companies.  “So everyone’s investing a lot more resources in detecting this, so we learn of even more incidents we wouldn’t have known about before.”

Tracy B. Mitrano, the director of information technology policy at Cornell University, said that detection was “probably our greatest area of concern, that the hackers’ ability to detect vulnerabilities and penetrate them without being detected has increased sharply.”

Like many of her counterparts, she said that while the largest number of attacks appeared to have originated in China, hackers have become adept at bouncing their work around the world.  Officials do not know whether the hackers are private or governmental.  A request for comment from the Chinese Embassy in Washington was not immediately answered.

Analysts can track where communications come from — a region, a service provider, sometimes even a user’s specific Internet address.  But hackers often route their penetration attempts through multiple computers, even multiple countries, and the targeted organizations rarely go to the effort and expense — often fruitless — of trying to trace the origins.  American government officials, security experts and university and corporate officials nonetheless say that China is clearly the leading source of efforts to steal information, but attributing individual attacks to specific people, groups or places is rare.

The increased threat of hacking has forced many universities to rethink the basic structure of their computer networks and their open style, though officials say they are resisting the temptation to create a fortress with high digital walls.

“A university environment is very different from a corporation or a government agency, because of the kind of openness and free flow of information you’re trying to promote,” said David J. Shaw, the chief information security officer at Purdue University.  “The researchers want to collaborate with others, inside and outside the university, and to share their discoveries.”

Some universities no longer allow their professors to take laptops to certain countries, and that should be a standard practice, said James A. Lewis, a senior fellow at the Center for Strategic and International Studies, a policy group in Washington.  “There are some countries, including China, where the minute you connect to a network, everything will be copied, or something will be planted on your computer in hopes that you’ll take that computer back home and connect to your home network, and then they’re in there,” he said.  “Academics aren’t used to thinking that way.”

Bill Mellon of the University of Wisconsin said that when he set out to overhaul computer security recently, he was stunned by the sheer volume of hacking attempts.

“We get 90,000 to 100,000 attempts per day, from China alone, to penetrate our system,” said Mr. Mellon, the associate dean for research policy.  “There are also a lot from Russia, and recently a lot from Vietnam, but it’s primarily China.”

Other universities report a similar number of attacks and say the figure is doubling every few years.  What worries them most is the growing sophistication of the assault.

Being a computer expert and a retired IT Technician the comment "free flow of information you’re trying to promote" does NOT mean that universities should not have very high network security.  Network security does not mean restricting free flow of information between AUTHORIZED users.

CYBERWAR - New York Times Hacked by China

"New York Times Computer System Target of Lengthy Chinese Hacking Attack" PBS Newshour 1/31/2013

Excerpt

SUMMARY:  The New York Times fell victim to a four-month cyber attack by Chinese hackers who cracked passwords to more than 50 email accounts, including those of top reporters.  Ray Suarez talks with Times reporter Nicole Perlroth and Grady Summers, vice president of the cyber security company hired to investigate the attacks.

INTERNET - Google's New Privacy Policy

"Google's New Privacy Policy: Invasive, Innovative or Both?" PBS Newshour 3/1/2012

Excerpt

JEFFREY BROWN (Newshour): And we turn to a big change for one of the tech industry's giants in the debate over online privacy.

In recent weeks, Google has been alerting its more than one billion users around the world that, beginning today, the company is consolidating some 60 privacy policies of its different services into one and more closely coordinating those services into one large database.

Here's part of how the company explains it.

WOMAN: So, instead of over 60 policies for different Google products and features, we're introducing just one, with fewer words, simpler explanations and less legal goop to wade through. That means that when you use Google, from Gmail and search, to YouTube and calendar, you can count on one simplified policy that explains our privacy commitment to you.

JEFFREY BROWN: Google says the move will also allow it to better serve customers by pulling together personalized information across a variety of different sites.

COMMENT: As an IT Technician and internet user this is what I see.

First, the personal data IS collected by Google servers, so consolidating the data from all the servers makes no difference.

Second, I run Firefox browser with an Add-Blocker add-on, I can CHOOSE block any add, including Google adds. There are 3rd-party add-block utilities for your system and IE.

Then there are utilities like SUPERAntiSpyware that includes the option to remove Adware.Tracking Cookies.

You cannot protect people who leave the back door unlocked from getting robbed, the same applies to people who use the internet WITHOUT paying close attention to privacy issues involved.

INTERNET - Online Protests Win the Day!

I'm a bit late with this news....

"After an Online Firestorm, Congress Shelves Antipiracy Bills" by JONATHAN WEISMAN, New York Times 1/20/2012

Excerpt

Congressional leaders on Friday indefinitely shelved two antipiracy bills that had rallied the Internet and rocked Capitol Hill, dealing a major defeat to the traditional media industry while emboldening a new breed of online political activists.

Using a medium that helped organize protests against the legislation, Senator Harry Reid, the majority leader, announced via Twitter that the vote would be delayed. But he indicated that the issue, which had been scheduled for a vote Tuesday, had not died.

“There’s no reason that legitimate issues raised about PROTECT IP can’t be resolved,” he wrote, referring to the Senate bill by its shorthand name. “Counterfeiting & piracy cost 1000s of #jobs yearly. Americans rightfully expect to be fairly compensated 4 their work. I’m optimistic that we can reach compromise on PROTECT IP in coming week.”

In the House, Representative Lamar Smith, the Texas Republican who is chairman of the Judiciary Committee, called off plans to formally draft his version of the antipiracy bill next month.

After vowing two days ago to move forward, Mr. Smith said in a statement on Friday: “The committee remains committed to finding a solution to the problem of online piracy that protects American intellectual property and innovation.” But he added, “The House Judiciary Committee will postpone consideration of the legislation until there is wider agreement on a solution.”

Speaker John A. Boehner, talking with reporters Friday in Baltimore, where House Republicans held their annual retreat, called the bill “well meaning,” but said it needed “more consensus.”

Supporters of the shelved bills as well as opponents pushing an alternative backed by the Internet giants Google and Facebook said differences could be bridged. But privately, Congressional aides and lobbyists say the pressures of an election year make action this year unlikely. Lawmakers will not be eager to brave another firestorm incited by Google, Facebook, Twitter, Wikipedia and other popular Web sites.

Senator Ron Wyden, Democrat of Oregon and a key opponent of the bills, said lawmakers had collected more than 14 million names — more than 10 million of them voters — who contacted them to protest the once-obscure legislation.

ALSO

Debating SOPA. UP with Chris Hayes
MSNBC (18:44)

INTERNET - Online Piracy Fight, Push-Back

"Hackers Retaliate Against DOJ in Raging Online Piracy Fight" PBS Newshour 1/20/2012

Excerpt

MARGARET WARNER (Newshour): It's one of the largest criminal copyright cases ever brought. The target is a website based in Hong Kong that's been used to share large files, including movies, videos, television shows, e-books, games, and music.

It's called Megaupload, and the heavily visited site is said to have 150 million registered users and 50 million visits a day. Now it stands charged with storing and distributing pirated material, and thus robbing copyright holders of more than $500,000.

Yesterday, the Justice Department shut it down and released indictments against seven executives. Four were arrested at the New Zealand mansion of its founder, who goes by the name Kim Dotcom.

Within hours, the hacker collective called Anonymous retaliated, shutting down the websites of the Justice Department and major media groups, including Universal Music and the Motion Picture Association of America. The government's crackdown came one day after this week's online protests against anti-piracy bills in Congress.

Another excerpt

CECILIA KANG, The Washington Post: So there's a lot of -- there's a lot of suspicion around the timing of this. But these are two -- one should keep in mind that these are two discreet issues. There's the federal indictment of a criminal case, and then there are the two bills right now that are being proposed on the Hill that I should say actually have been on hold, today were put on hold because of all the controversy around them.

INTERNET - Domain Names Controversy

"Domain Names: Debating the Effects of a Dot-Anything World" PBS Newshour 1/12/2012

Excerpt

RAY SUAREZ (Newshour): Since the earliest days of the Internet, Americans have gone to Web addresses with familiar names to the right of the dot, as in dot-com or dot-org.

Starting today, the company that assigns what are called domain names is making a big change. It's rolling out a program meant to dramatically increase the number and kind of names. So, instead of a company like let's say Marriott being called Marriott.com, it might now choose to be called simply .Marriott.

But it is going to cost plenty, up to $185,000 just to apply for the new name. And the total economic stakes could add up to hundreds of millions of dollars. Some businesses and lawmakers are upset with what this could mean for commerce and the future of the Web.

We look at this now with Rod Beckstrom, the president and CEO of ICANN, the Internet Corporation for Assigned Names and Numbers. And Dan Jaffe is with the Association of National Advertisers, which is part of a coalition opposed to the rollout of the program.

SECURITY - Pentagon Seeks Hacker Help

"Pentagon asks hackers for help with cyber security" by Joseph Straw, Daily News 11/8/2011

The Pentagon agency that invented the Internet is asking the hacker community for help in eliminating Defense Department computer vulnerabilities.

The Defense Advanced Research Projects Agency, or DARPA, hosted a meeting this week for defense stakeholders and civilian computer experts, acknowledging that it has to start thinking differently about cyber security, Wired.com reported.

And the computer networks that run U.S. infrastructure are so vulnerable to cyber attack that the White House should think twice before even attacking emerging adversaries, a national security expert said.

Richard Clarke, who advised ex-Presidents Bill Clinton and George W. Bush, added that U.S. defense networks are "as porous as a colander."

Their Goliath scale leaves them especially vulnerable to tiny attacks, the Associated Press and Wired reported.

Clarke, who claims his early 2001 warnings to the Bush administration about the emerging threat of Al Qaeda went unheeded, issued the new warnings as tensions escalate between the U.S., Israel and their shared adversary Iran.

Last month Wired reported that a mundane virus called a key logger - one that surreptitiously records keyboard typing - was found on the computers used to remotely pilot Air Force drones targeting terrorists overseas.

In 2009 national security officials disclosed that Russian and Chinese agents had penetrated the U.S. electric grid and left behind software to help map the systems.

CYBERCRIME - JoD Protections, Pro and Con

"How Effective Is Justice Department Crackdown on Counterfeit Goods Dealers?" PBS Newshour 11/29/2011

Excerpt

GWEN IFILL (Newshour): We look now at the government crackdown on the online sale of counterfeit goods. The Justice Department used Cyber Monday, the biggest online shopping day of the year, to shut down 150 websites that were allegedly peddling fake shoes, sporting goods and handbags. But was this the right approach?

Joining us to discuss that are Steve Tepp, chief intellectual property counsel at the U.S. Chamber of Commerce, and Larry Downes, author of "The Laws of Disruption," a book about law and innovation in the digital age.

More significant excerpts

STEVE TEPP, U.S. Chamber of Commerce: It's a massive problem that's growing every day, because many of these sites are located outside the United States, where there is no remedy.

For the sites located in the U.S., or at least where their domain name is registered in the U.S., dot-com, dot-net, then our enforcement agencies, like the Immigration and Customs Enforcement and the Department of Justice, who are both doing fantastic work on this, protecting the American people, can go to court and seize those domains with a court order.

That's what happened yesterday, and that's 150 domain names that will not be used to steal American jobs, to harm American consumers today.
----
LARRY DOWNES, "The Laws of Disruption": Well, first, it should be noted that, you know, what we're seizing here is not the website itself, just the domain name. It's a largely symbolic act.

What happens is, the site is still there. It can be accessed directly from the I.P. address. Or what often happens is the site comes back a little bit later under another domain name. So whether that is effective or not, it doesn't matter.

SECURITY - Fraudulent SSL Certificate for Google.com

"Fraudulent certificate triggers blocking from software companies" H Security 8/30/2011

A fraudulent SSL certificate for "*.google.com" issued by Dutch certificate authority (CA) DigiNotar, possibly to the Iranian government or its agents, has triggered a wave of updates from software makers to stop applications trusting the CA. The certificate was issued on 10 July to unknown persons in Iran.

Several security experts, such as Moxie Marlinspoke, confirmed that the SSL certificate came from DigiNotar; one pastebin entry detailed the contents of the suspicious certificate, while another called for the "internet death sentence" because the company's "carelessness may have resulted in deaths in Iran". The Electronic Frontier Foundation said in a blog posting that it believes the attacks have been used to intercept searches and private email. It is unknown who the certificate was actually issued to and whether or not any other bogus certificates were issued.

The attack was initially noticed by Google Chrome users because Chrome 13 and later implements certificate pinning which ensures that the browser will only accept certificates for Google from a whitelist of certificate authorities; DigiNotar was not a CA on the whitelist and users of Chrome were alerted that something was amiss with the certificate they were being presented. The certificate was revoked yesterday, 29 August, at 16:59 GMT, but because many browsers do not check for revoked certificates by default, software vendors have had to take action to prevent the continued exploitation of the bogus certificate. It is also currently unknown if any other bogus certificates were issued by DigiNotar, therefore the vendors are opting to block all certificates signed by the CA.

Microsoft has released a security advisory and updates for all supported Windows operating systems – including Vista SP3, Server 2008 SP2 and Windows 7 SP1 – which revoke trust in the CA's root certificate. Windows XP SP3 and Server 2003 SP2 will receive separate updates as these systems do not use the centrally managed Microsoft Certificate Trust List.

Mozilla has announced that it is releasing updates for Firefox (3.6.21, 6.0.1, 7, 8 and 9) and Firefox Mobile (6.0.1, 7, 8 and 9), Thunderbird (3.1.13 and 6.0.1) and SeaMonkey (2.3.2), which will also revoke trust in DigiNotar's root certificate. Mozilla has also released instructions on how to delete the DigiNotar Root CA certificate from Firefox manually.

Google is also disabling DigiNotar's certificate in Chrome "while investigations continue" even though Chrome detected the fraudulent certificate. The Chrome browser was only able to do that for google.com subdomains and if there are other fraudulent certificates for other domains Chrome would be unable to detect the deceit.

This is the second fraudulent certificate incident this year: in March, SSL certificates for addons.mozilla.org, Yahoo, Skype, Microsoft Live and Google were created by an intruder into a Comodo reseller.

INTERNTE - IPv6 World Test

"World Tests IPv6: Why 4.2 Billion Internet Addresses Just Weren't Enough"
PBS Newshour 6/8/2011

What I've discovered:

1. First and foremost, most of us desktop/laptop users will not have to worry about this, WEB sites you use today can still be accessed WHEN IPv6 becomes the world standard
   


2. Most major OS are IPv6 ready (examples WinXP, Vista, Win7, Linux, Mac)


3. Your ISP will have to implement IPv6, I found out that my ISP, AT&T will be doing that in the future and will notify me when they roll it out


4. The hardware you use to connect to your ISP (DSL/Cable Modems, routers, etc) will also have to be IPv6 capable; some hardware MAY be able to upgrade firmware or you'll have to buy a new model


5. The U.S., and most of the developed world, are IPv6 ready when it comes to the WEB as a whole

IPv6 is an extension of the IPv4 we use today, which is why most of us will not have to worry.

The industry I see as implementing IPv6 the fastest is the hand-held-devices; your iPad, Blackberry, new-gen cell phones, etc. This is the industry that is expanding the fastest and needs more IP addresses.

As for PC industry, newer products in the future will include IPv6 capable hardware.

Here's a link to Test Your IPv6 (from Netgear forums).

INTERNET - Apple's iCloud and Mac OS X Lion

"Apple Unveils New iCloud Music Service, but Privacy Issues May Lurk"
PBS Newshour 6/6/2011


Excerpt from transcript, security

RAY SUAREZ (Newshour): If I put my stored and accumulated content on the cloud, is it private?

CECILIA KANG, The Washington Post: Well, that's a good question.

The -- the devices will be encrypted. And that's what Apple said in passing. But there's a lot of questions as to your privacy and the security of cloud-based applications, Internet-based services. We have seen a lot of attacks on information, hacking attacks into Sony, Nintendo, PBS. You have seen a lot of these -- this -- the vulnerability of information that resides on the Internet.

And when I say it resides on the Internet, I mean that it resides on servers. You don't know where they are, but there are large data farms all over the country around the world, where bits -- your bits and pieces, the bits, I should say, of the music that you have, the videos that you have, the bits, the actual digital packets, they reside in these places that you don't really as much control of.

So, when you make this decision to switch to cloud-based applications, it's much easier, more convenient and often much cheaper. But there often is the -- there is the consideration of a tradeoff, perhaps, in that there may be less security involved. It's much safer when you have your information on your own computer that only you can access than on the Internet.

And your privacy is also perhaps in -- in question, in that more people, more companies have access to what you're doing. And they can see what you're doing online.

ALSO

As mentioned in video Mac OS X Lion (Wikipedia) (Apple) (links open in new page)

SECURITY - Global Cybersecurity

"U.S. Calls for Global Cybersecurity Strategy" by HELENE COOPER, New York Times 5/16/2011

The Obama administration on Monday proposed creating international computer security standards with penalties for countries and organizations that fell short.

While administration officials did not single out any countries in announcing the strategy, several officials said privately that the hope was that the initiative would prod China and Russia into allowing more Internet freedom, cracking down on intellectual property theft and enacting stricter laws to protect computer users’ privacy.

“The effort to build trust in the cyberspace realm is one which should be pushed in capitals around the world,” said Commerce Secretary Gary Locke, who will soon be taking over as President Obama’s ambassador to China.

The strategy calls for officials from the State Department, the Pentagon, the Justice Department, the Commerce Department and the Department of Homeland Security to work with their counterparts around the world to come up with standards aimed at preventing theft of private information and ensuring Internet freedom. A fact sheet released by the White House also promised that the United States would respond to attempted hacking “as we would to any other threat to our country.”

Attorney General Eric H. Holder Jr. called it a “historic strategy,” adding that “the 21st-century threats that we now face to both our national and international security really have no borders.”

Last week the administration released the domestic component of its new computer security strategy, increasing and clarifying the penalties for computer crimes, and giving the domestic security agency a clear mandate for the protection of the government’s own networks. That effort was intended to reverse a growing perception that penalties for attacks on government, corporate and personal computers had been relatively small.

In addition to giving the Homeland Security Department new authority over federal computer systems, the legislation calls for the agency to work with energy companies, water suppliers and financial institutions to rank the most serious threats and find ways to counter them. The law would also require each business to have an independent commercial auditor assess its plans and, in the case of financial firms, report those plans to the Security and Exchange Commission.

About time. We have international law enforcement agreements, and military security agreements, why not this one? While nations like China or North Kora will ignore this, that should not prevent the majority of nations to come up with a plan. It would protect national interests as well as individual people.

SECURITY - Cybercrime With World-Wide Impact

"Sony PlayStation System Hacking Incident Highlights Web-Security Gaps" PBS Newshour Transcript 4/27/2011 (includes video)

Excerpt

RAY SUAREZ (Newshour): The latest episode involved millions of people around the world who use Sony's PlayStation video game system and who may have had their credit card information stolen in a hacking incident.

The intrusion caused the company to shut down PlayStation's Internet network a week ago. It provides access to online gaming, music, movies, sports and TV shows. Seventy-seven million user accounts were disconnected worldwide. But it wasn't until yesterday that Sony disclosed a hacker obtained information, including players' names, addresses, birth dates, email addresses, passwords and log-in names.

And on the company's blog, Sony spokesman Patrick Seybold said, "While there is no evidence at this time that credit card data was taken, we cannot rule out the possibility."

Near Sony headquarters in Tokyo, some said the breach may stop them from using PlayStation.

KAZUNORI SANO, resident of Tokyo (through translator): I will be afraid of playing with the game machine after hearing of this. I don't want my credit card information to be leaked out somewhere else in the world.

RAY SUAREZ: And in Australia, police urged PlayStation users to be vigilant.

DETECTIVE SUPERINTENDENT COL DYSON, New South Wales State Police Force: It would appear that the risk in relation to credit cards may be low. But if people have concerns, they should be talking to their banks and watching for unauthorized usage of the cards.

RAY SUAREZ: Some industry experts say the scale of the breach could cost the company billions of dollars.

THOMAS PUHA, "Pelaaja": This is going to have a very negative impact on a business that they have built up, because I think a lot of -- obviously, a lot of consumers will really be very wary of putting their credit card information back online or even buying anything.

RAY SUAREZ: Sony said it expects the PlayStation Network to be restored in a week. In the meantime, an outside security firm has been hired to investigate what Sony deems the malicious intrusion.

For a closer look at all this, we turn to Kevin Poulsen, senior editor at Wired.com. A former hacker himself, he's also author of a new book, "Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground."

And, Kevin, for those people who aren't gamers, why would you have to load personal information into a game console in the first place?

KEVIN POULSEN, Wired.com: Well, a lot of gaming takes place now online. You have multiplayer games where you could play with or against opponents live in real time.

And, of course, a game console isn't just a game console anymore. You want to be able to download movies and other content. And all -- you pay for all of that, which means you have to give up this information.

RAY SUAREZ: Sony says it has no direct evidence that credit card numbers were taken, but it says -- quote -- "We cannot rule out the possibility."

When you have had a breach, when someone has been rifling around in your files electronically, can you tell what they have seen and what they haven't?

KEVIN POULSEN: There are usually -- there's usually some kind of trail left, yes. But if the hacker is good and took steps to cover his or her tracks, then it could -- it could take a while to extract that.

I imagine that's why Sony took so long to announce this. They were probably hoping to find better news. They were probably hoping to find evidence that the -- that information wasn't accessed. Now that they have brought in an outside company, I expect they will know a lot more than they do now, eventually. Of course, they -- they may know more than they're telling us now.

RAY SUAREZ: The PlayStation system has been down for over week, disappointing a lot of people who are frequent users.

Does that long-term shutdown tell you something about the seriousness of the breach, that they're not patching it, but rebuilding the whole network?

KEVIN POULSEN: Absolutely.

It's a really radical measure to take. And it's surely going to cost them a lot of money and a lot of fan loyalty. There are people that aren't even going care about the breach itself who are just going to be extremely angry that they were denied access to the PlayStation Network for so long. So, it's bad news all around.

If this had just been a casual intruder, a recreational intruder, some kid working from his bedroom, I doubt they would have taken this measure. So, they probably have some indication that this was a serious, focused attack.

RAY SUAREZ: Well, as we reported earlier, they got user names, passwords, various other kinds of personal information. What's the risk to account holders at this point?

KEVIN POULSEN: You know, the biggest risk is probably with the personal information, especially the passwords, because a lot of people use the same passwords everywhere.

So, that, coupled with your email address and your real name and your date of birth, the hackers will, if this was done for profit, then, all of that could wind up being sold on the black market, probably for a nice sum of money.

And then, whoever buys it, other computer intruders could use the information to try and hack into other accounts held by these PlayStation Network users. It could be anything from Facebook to online banking. You could use it to stage scams targeting the users in other ways.

So, it could be -- it could wind up that this becomes the first stage in a lingering problem that haunts users for a long time, if, in fact, that that was the nature of the breach.

Stress this quote, "You know, the biggest risk is probably with the personal information, especially the passwords, because a lot of people use the same passwords everywhere."

HINT, do not use the same password for all your online accounts.

SECURITY - Vulnerability of Internet Certificates

"An Attack Sheds Light on Internet Security Holes" by RIVA RICHMOND, New York Times 4/6/2011

Excerpt

The Comodo Group, an Internet security company, has been attacked in the last month by a talkative and professed patriotic Iranian hacker who infiltrated several of the company’s partners and used them to threaten the security of myriad big-name Web sites.

But the case is a problem for not only Comodo, which initially believed the attack was the work of the Iranian government. It has also cast a spotlight on the global system that supposedly secures communications and commerce on the Web.

The encryption used by many Web sites to prevent eavesdropping on their interactions with visitors is not very secure. This technology is in use when Web addresses start with “https” (in which “s” stands for secure) and a closed lock icon appears on Web browsers. These sites rely on third-party organizations, like Comodo, to provide “certificates” that guarantee sites’ authenticity to Web browsers.

But many security experts say the problems start with the proliferation of organizations permitted to issue certificates. Browser makers like Microsoft, Mozilla, Google and Apple have authorized a large and growing number of entities around the world — both private companies and government bodies — to create them. Many private “certificate authorities” have, in turn, worked with resellers and deputized other unknown companies to issue certificates in a “chain of trust” that now involves many hundreds of players, any of which may in fact be a weak link.

The Electronic Frontier Foundation, an online civil liberties group, has explored the Internet in an attempt to map this nebulous system. As of December, 676 organizations were signing certificates, it found. Other security experts suspect that the scan missed many and that the number is much higher.

Making matters worse, entities that issue certificates, though required to seek authorization from site owners, can technically issue certificates for any Web site. This means that governments that control certificate authorities and hackers who break into their systems can issue certificates for any site at will.

Experts say that both the certificate system and the technology it employs have long been in need of an overhaul, but that the technology industry has not been able to muster the will to do it. “It hasn’t been perceived to be a big enough problem that needs to be fixed,” said Stephen Schultze, associate director of the Center for Information Technology Policy at Princeton. “This is a wake-up call. This is a small leak that is evidence of a much more fundamental structural problem.”

In the Comodo case, the hacker infiltrated an Italian computer reseller and used its access to Comodo’s systems to automatically create certificates for Web sites operated by Google, Yahoo, Microsoft, Skype and Mozilla. With the certificates, the hacker could set up servers that appear to work for those sites and try to view the unscrambled e-mail of millions of people, experts say.

INTERNET - Broadband Access in U.S.

(click for better view)
NOTE: In the full article, this is an interactive map

"Broadband Access: Exploring Internet Connectivity by U.S. Community Type" by Dante Chinni, PBS Newshour 3/28/2011

The federal government wants you to have access to a broadband connection. Badly. The Federal Communications Commission has held dozens of workshops and filed away more than 23,000 comments on its National Broadband Plan.

"High-speed wireless service is the next train station, the next off-ramp," President Obama said in February. "It's how we'll spark new innovation, new investments and new jobs."

That's an important set of goals for an economy that is still trying to climb out of the last recession, and most experts would argue an accurate one. It's one reason why more than $7 billion of the 2009 stimulus plan was dedicated to broadband expansion.

If broadband is indeed key to all those elements, how close is the United States to achieving a goal of universal access to broadband? Well, in some of Patchwork Nation's 12 county types, availability seems to be very close to reality. In others, however, much work remains to be done, according to data collected by Connected Nation and analyzed by Patchwork Nation.

In the counties holding the nation's most-urban areas, the Industrial Metropolis, more than 99 percent of the population has access to a broadband connection - figured here at three megabytes per second. But in more sparsely populated areas, the numbers are much lower. In the Mormon Outposts, largely located in the Mountain West, the broadband connection rates average about 80 percent.

But the story of broadband coverage is complicated.

Who's Plugged In?

Looking county-by-county on the map you can see the communities that are well positioned for the Web-based economic/cultural/political future. Places like the New York City metro area are saturated with broadband, while places like rural Arkansas have much spottier coverage.

When you dig further into the numbers, however, you see they are about more than just income or population density. Education plays a role, as you might imagine. The counties with the second-best connectivity rate are the collegiate Campus and Career locales. Nearly 97 percent have access to broadband there even though in terms of population density and income levels the Monied Burbs would seem likely to have better connectivity. They about $10,000 richer per household on average. The Burbs have a broadband access score of about 95 percent.

And while the exurban Boom Towns have a higher median household income than the aging Emptying Nests by about $5,000, the places are roughly look similar in their access to broadband - 93.57 percent versus 93.30 percent respectively. That may because some of those more removed Boom Town communities, newly sprouted towns, are harder to wire.

There are even differences among the most far-flung of our county types - the Service Worker Centers and Tractor Country counties. Tractor Country, which is less-wealthy and less-populated than the Service Worker Centers, is slightly better connected.

Why? As we have noted previously, Tractor Country communities in particular seem to show a stronger streak of civic pride than other communities. People in those places may tend to dislike the federal government, but they seem believe strongly in doing things for the community itself. That certainly is something we have witnessed in Sioux Center, Iowa, a Tractor Country community we visit.

So if you were to sit down with a mathematician and try to figure out a formula for connectivity - admittedly a very difficult challenge - it might look something like population density, plus education, plus income, plus civic engagement equals better access to broadband.

More to the Picture

Wiring far-flung places will not be cheap. Getting an exact cost is difficult, but the Web is littered with stories of ridiculous expenditures aimed at bringing small, rural locales fully into the digital age.

And access is only one part of the issue, the other is the ability to afford an actual connection. Some of the least-wealthy counties we look at are among those listed above that have the least access - Tractor Country, the Service Worker Centers, the Evangelical Epicenters. And while the cost of wiring those places certainly plays an issue, it may be they are less wired precisely because they are less wealthy. There may be less interest in broadband there.

The costs of broadband service vary by community and service provider, of course, but, on average the cost is about $41 a month, according to a survey from the Pew Internet & American Life Project done last August. That's about $11 a month higher than dial-up access the survey found - or over the course of the year an extra $150. That's not astronomical, of course, but it may feel like a lot in some communities that are struggling with the effect of the recession as well as long-term economic woes.

Patchwork Nation has not yet explored Internet usage by community type, but we have looked at issues like social media use in our book. And we looked at broadband access versus adoption in Ohio on our site, where we found sharp differences. The Emptying Nests were below 50 percent for adoption, even with their well-wired communities. And the Service Worker Centers and Evangelical Epicenters were at about 40 percent and 26 percent, respectively.

That means even if the broadband network is fully built out - not an inexpensive proposition - there will still be the challenge of helping those who cannot afford it and, along with that, there will be the challenge of convincing those who aren't as interested in life online that broadband is critical to their future - the key to that national transformation President Obama has outlined.

That may be the toughest sell in some communities where times are tight.