Cyber Law Update August 2008 - Issue no. 4

India

Tech-savvy cyber crooks could steal your Net identity
Technology exists to prove a malicious e-mail did not originate from your PC

When several television channels received e-mails last week claiming credit for the bomb blasts in Ahmedabad on behalf of an outfit that called itself the Indian Mujahideen, the police traced the mail through an IP, or Internet Protocol, address to the e-mail account of a Navi Mumbai resident. Many of the same channels wasted no time to flash headlines that suggested that an American national was somehow involved in the “terror mail.” Reported in Hindu

Use of e-mails for cyber-crimes and terrorism

The technical aspects of cyber-law are a headache for the law enforcement agencies and judicial system in India. Very few law enforcement officers, public prosecutors and judges are aware about the technical aspects of ICT and its uses and abuses. Reported in MeriNews

Terror mail: BMC to take precaution for its WiFi project

The Ahmedabad terror e-mail, which was sent by hacking into the Internet Protocol address of a US national living in Navi Mumbai, has prompted the Brihanmumbai Municipal Corporation to take precautionary measures before it launches its ambitious WiFi project next year. The police cyber crime cell has also asked the civic body to take help from its experts and adequate measures before launching the project. Reported in Express India

Cyber cafe owner taken in police custody

A local court today remanded a cyber cafe owner in 14 days police custody for creating city-wide panic by sending an e-mail threatening bomb explosions.Kaushik Basu, the cyber cafe owner and a resident of Salt Lake, was arrested last night and charged with waging war against the country, threat to cause death or grievous hurt and criminal intimidation by anonymous communication which, according to the police, is serious offence. Reported in SaharaSamay

Police plans to check cyber cafes turning terror hubs

HYDERABAD: As terrorists are going hi-tech and giving advance information about their strike plan using the Internet, the Hyderabad police are seriously planning to formulate rules and regulations for cyber cafes. Reported in Times of India

Delhi Police gets first batch of cyber experts

Cyber crime increasing at the rate of 100% annuallyNew Delhi: With a whopping 100 per cent increase in cyber crimes annually, the Cyber Cell of Delhi Police will require more trained personnel to fight white collar crimes. In a first-of-its-kind effort, the first batch of 100 investigating officers of Delhi Police and two officers of Central Bureau of Investigation (CBI) were handed certificates in ‘Cyber Crime Investigation and Computer Forensics’ on Tuesday. Reported in MSN

International

Beijing Braces for Olympic Cyber-War

With the world’s eyes firmly focused on Beijing, officials and IT staff are bracing themselves for a flood of cyber-attacks … Reported in Byteandswitch

Max24.pl becomes the latest victim of cyber crime

A large Polish Internet store lost over zł.1 million in three days due to a hacker attack, and according to estimates, the European economy is losing euro 65 billion annually due to cyber-crime. Reported in WBJ
Source: Gazeta Wyborcza

International phishing gang busted

US authorities have charged 38 members of an international criminal gang that allegedly used spam e-mails to steal bank account details and passwords from thousands of customers. Reported in FINEXTRA

IBM X-Force Report: Cyber Threats Accelerate, Browser Vulnerabilities Proliferate in First Half of 2008

Mid-Year Report From IBM Internet Security Systems X-Force(R) Finds 94 Percent of Browser-Related Exploits Occurred Within 24 Hours of Vulnerability Disclosure. Published in CNN

US Senate polishes new teeth for cyber cops

The US Senate has passed a bill to strengthen the hands of federal prosecutors who fight computer crime by removing some of the more common hurdles in prosecuting online miscreants. Reported in the Register

New Guidelines Aim to Reduce Fraud

US: New guidelines for fighting fraud have been released jointly by three leading professional organizations. “Managing the Business Risk of Fraud: A Practical Guide” is sponsored by the Association of Certified Fraud Examiners (ACFE), the American Institute of Certified Public Accountants (AICPA), and The Institute of Internal Auditors (IIA). Principles for establishing effective fraud risk management, regardless of the type or size of an organization, are outlined in the guide.

“Managing the Business Risk of Fraud: A Practical Guide” can be downloaded for free from the sponsoring organizations’ Web sites at http://www.acfe.com/, http//www.aicpa.org/, and http://www.theiia.org/.

U.S. government cyber-security worse than previously thought

The latest report from ZATZ Publishing highlights a surprising lack of government record-keeping oversight, along with critical cyber-security gaps that without proper records management, America won't have critical records of the operation of their government. Reported in EchannlLine

Cyber-bully advice

In her new book 101 Facts about Bullying: What Everyone Should Know, author Meline Kevorkian offers suggestions for overcoming cyber-bullying. For tips for parents and kid read an article Published in Miami Herald

Cyber Law Update July 2008 - Issue no. 3

San Francisco cyber attack a wake up call for Canadian IT managers
US: A disgruntled network administrator who locked up the multi-million dollar computer system for the city of San Francisco is now behind bars. But Canadian tech experts warn a cyber terrorist could do the same thing this side of the border if we don't take precautions.

A cyber attack that virtually hijacked the controls of more than 60 per cent of San Francisco's municipal network should serve as a wake up call for IT managers in Canadian government jurisdictions, say technology experts.

He was arrested for allegedly changing passwords to San Francisco's computer system and effectively "locking up" the city's multi-million dollar fibre WAN (wide area network) system that handles sensitive data, critical IT operations, and much of the municipality's network traffic. Reported in ITBusiness.ca

Once Henry Ford remarks “Failure is the opportunity to begin again more intelligently.” Why to wait for failure. Act now proactively for better tomorrow as suggested by Chanakya, Indian Politician, strategist and writer, 350-275 BC, “As soon as the fear (say fear of failure) approaches near, attack and destroy it.”

Lithuanian tax office website hit by cyber attack
US: Lithuania said it suffered another foreign cyber attack over the weekend when the state tax office's website was swamped with requests, but no damage was sustained. Reported in Guardian

Even website of Indian Income Tax needs to plug few vulnerablities as mentioned in my comments on “Are your online tax returns safe?” by Ashwin Mohan of CNBC-TV 18.

SMBs in denial about cyber crime: McAfee
McAfee discovered that a third (32 percent) of North America's small- and medium-sized businesses (SMBs) have been attacked more than four times by cybercriminals in the last three years. The impact was that a quarter of those attacked (26 percent) took an entire week to recover. Canadian businesses were most affected with a third (36 percent) taking a week to recover.

"SMBs are truly exposed to the same cyber threats as their enterprise counterparts," said Darrell Rodenbaugh, senior vice-president of the mid-market segment at McAfee. "In fact there are some experts that would say they are greater targets because it is popularly known [SMBs] don't have the same protection in place that their enterprise counterparts do."

He added the reality is IT managers in SMBs face a paradox. They understand that are at risk but they are faced with limited resources and a lack of time. Reported in eChannelLine

Cyber thieves can easily take advantage
US: More than 75% of bank websites were flawed and could expose customers to cyber thieves eyeing their money or their identity, according to a survey by the University of Michigan. Reported in EconomicTimes. Similar article on FRAUD ALERT: Cyber-bank robbers hit online accounts published in CourierPostOnline

Cyber crime looms large over Middle East netizens

Dubai: Internet users in the Middle East are under increasing threat from cyber crimes, prompting large spending on web security, WAM reported Thursday quoting experts.

Web threats peaked in March to 50 million incidents of hacking from approximately 15 million in December 2007, a study by Internet security firm Trend Micro said.

Source: Indo-Asian News Service Reported in Computing

Man gets 41 years in prison for cyber fraud
Pak: A court has sentenced a man to 41-year prison term for credit card fraud, the first time a person convicted for cyber crimes has been punished so severely in Pakistan. Reported in Time of India

Cyber relationships aren't 'harmless fun'
US: Cyber relationship are "harmless fun" but harmless and commonly leads to serious relationship problems.

It is actually dealing with a problem of an emotional cyber-affair. In these cases the spouse has found someone on the Internet with whom he or she has formed an emotional connection. Such a connection outside the marriage is always wrong and detrimental to that primary relationship. These "cyber-affairs" have become a source of marital problems and often lead to divorce. Reported in MyWestTexas

Teen Claims She Was Bullied In School & Online
US: A South Florida teenager has filed a lawsuit against her private, all-girls school in Miami after she became the victim of an alleged vicious bullying campaign that spread from the classroom to online social networks. Reported in CBS4

Parents must act now to control cyber culture among children

Kenya:The pendulum of opinion on the impact of computers and the Internet on children will always swing. Is the technology good or bad for our kids?

Should the State control access or should it be left to parental guidance and “filter” software? Reported in NationalMedia

Strict action to be taken against fake mobile SMS and petrol smuggling
Pak: FIA Cyber crime cell will take strict action against the elements involved in spreading the fake information through Mobile SMS regarding the down fall trend in Stalk Exchange. Such activity would be consider as cyber crime. Reported in OnlineNews.com

Cyber Defamation
Korea: Justice Minister Kim Kyung-han's plan to introduce a ``Cyber Defamation Law'' has sparked controversy over how to guarantee freedom of expression on the Internet. The plan is part of a series of government measures to crack down on distributors of fraudulent and slanderous information in cyberspace. Reported in KoreaTimes

Cyber cafes asked to maintain record of customers
India: In a bid to track cyber crimes, the District Magistrate ordered cyber cafes and mobile phone shops to maintain records of their customers. Reported in SaharaSamay

Comments on “Are your online tax returns safe?” by Ashwin Mohan of CNBC-TV 18

This has reference to the report “Are your online tax returns safe?” by Ashwin Mohan of CNBC-TV 18. Article published and aired on CNBC 18

Correction…

“Three pieces of basic information ‑ name, date of birth, and pan number ‑ is all that an aspiring hacker requires.”

No, only two information, name and date of birth (date of incorporate in case of company). Go to know your PAN page https://incometaxindiaefiling.gov.in/knowpan/knowpan.jsp
…you will get PAN details.

Possible solution to minimize this problem:

“Uncertainty is the only certainty there is and knowing how to live with insecurity is the only security”

- John Allen Paulos in his book A mathematician Plays the Sock Market

Steps to be taken by PAN-holders:

1. Registered yourself before a hacker register on your behalf.
2. Check your registered email id regularly to ensure that your password has been not reset by unathorised person and report the same at ask@incometaxindia.gov.in

Suggestions to Income-tax department:
1. Do not authorized PAN-holders (hackers) to select new password. Alternatively, email it to their registered email id. In the event, PAN-holders do not recollect or changed their registered email id then courier it to their registered address.
2. Incorporate additional security measures such as secret question, strong password etc.
3. Rather than sending an email confirming registration/change of password send an email with the link for conformation.

Warning to budding hackers:

1. Tracking down your IP address and locating you will be not a tuff job for our IT savvy police.
2. You will be jailed for 3 years and/or liable for a fine upto 2 lakhs under section 66 of the Information Technology Act, 2000.

Suggestions to CNBC 18:
1. Kindly share such information to the relevant authority before airing it. Interest of public is paramount. Please respect it.
2. You should have given possible solutions rather then just highlighting problem. Nobody is prefect.

Cyber Law Update July 2008 - Issue no. 2

UK: The Swiss Institute of Technology, Google and IBM conducted the study and found 600 million users had not updated their browsers. "Failure to apply patches promptly or missing them entirely is a recipe for disaster," the report said. Cyber criminals are frequently using websites to attack users, it added. Reported in BBC

A German court has ruled that banks are liable for phishing attacks on customers. Reported in ComputerWeekly.com

Brazil: Google signed an agreement with Brazilian public prosecutors to help combat child pornography on its social networking site Orkut. Reported in MSNBC

Iran: The death penalty for those who promote corruption, prostitution and apostasy on the internet is being considered by Iran’s parliament. Reported in AsianNews

US: Missouri Governor signed legislation that aims to fight cyber-bullying by updating the state's current harassment and stalking laws to include communication over the Internet and through other electronic means. More

Haryana: Sirsa District Magistrate has ordered all the cafes owners in the district to install close circuit TV cameras in their premises with immediate effect. Reported in Economic Times

Security group fights back against cyber threats

Cisco, Intel, IBM, Microsoft and Juniper Networks will collaborate as part of the new Industry Consortium for Advancement of Security on the Internet (Icasi), which hopes to improve response times to online attacks that target multiple products.
The group asserted that industry cooperation is needed as hackers and other cyber criminals are employing ever more sophisticated techniques to breach security defences.Recent research conducted by Fortify shows that four in five (81 per cent) IT professionals believe that their applications are vulnerable to breaches, with nearly a third of of people working in the sector describing themselves as 'very worried' about the security situation. Reported in BCS

Police caution 13-year-old girl over sex pictures on MySpace

New Zealand: A 13-year-old girl has been cautioned by New Zealand police after sexually explicit pictures of another 13-year-old girl were posted on social networking site MySpace without her knowledge. Reported in Stuff

Is cyber sex really cheating?

US: That's one question raised by Christie Brinkley's sensational courtroom allegations that estranged husband Peter Cook indulged in a secret $3,000-a-month Internet porn habit she claims contributed to the collapse of their seven-year marriage. Reported in NYDailyNews

Who is Christie Brinkley?
Christie Brinkley is more than one of America’s most successful and recognizable models appearing on over 500 magazine covers worldwide. She also excels as an artist, writer, photographer, designer, actress, philanthropist environmentalist, and political activist. Combining her modeling experience with her artistic talents and diverse interests, Christie’s career over the years has been interesting and dynamic.

Vulnerabilities in ATM Network

Hackers broke into Citibank's network of ATMs inside 7-Eleven stores and stole customers' PIN codes, according to recent court filings that revealed a disturbing security hole in the most sensitive part of a banking record . More

It is just the tip of the iceberg.

List of vulnerabilities:

1. The bank associates with other banks to enable their customers to withdraw cash from ATM centers of the bank or its associates. But the bank has no control over network of its associates. Another problem, all of them are not using the same technologies and security measures.

2. Most of the times, dedicated servers are not being used by the Bank. Why?? Must be commercial constrains.

3. PINs are not always encrypted while it is transmitted from ATM center to the bank servers. It travels through many servers & networks before it reaches the Bank server and all of them are not secured enough to protect your PINs.

4. ATM’s software are remotely diagnosed and repaired over Internet, which may provide opportunities for hackers to secure access onto the bank server.

Cyber Law Update June 2008 - Issue no. 1

India

Recently, the Delhi High Court allowed proceedings against Avinash Bajaj, managing director of Baazee.com, for allowing an auction of a pornographic video clip involving two students on his website. Reported in IndiaLawNews

China's intensified cyber warfare against India is becoming a serious threat to national security. Reported in Indiapost

International Sri Lanka is working out effective ways of fighting cyber crime by strengthening awareness on Information Security. Reported in Sunday Times

A group or individual by the name "Anonymous" has hacked and taken over two of MTV music websites and defaced them with racial and offensive images. Posted on MTV website

A Missouri woman accused of taking part in a MySpace hoax that ended with a 13-year-old girl's suicide has so far avoided state charges -- but not federal ones. Reported in Mail

One in three IT professionals abuses administrative passwords to access confidential data such as colleagues' salary details, personal e-mails, or board-meeting minutes, according to a survey. Reported in Information Week

Career

The role of information security managers is rapidly changing to focus on business needs instead of technology, according to a recent survey. Reported in News Wire Today