UW Computer Security Research and Course Blog

According to MSNBC (http://www.msnbc.msn.com/id/29017452/), Monster.com along with USAJobs.com (which monster’s parent company runs) was breached, resulting in the theft of user ID’s, passwords, email addresses, names and phone numbers.  The number of records stolen was not disclosed, nor were any details concerning how the thief obtained access to their databases.

Continue reading →

BitTorrent has been popularly used for transferring files illegally because it reduces a vast amount of networking bandwidth that would have been required. The way it works is that users can connect to each other directly to send and receive files. The tracker generally does not have any information about the contents of file being transferred because the users directly connect one-to-one. There’s no one server that serve all users. Also, the uploading and downloading process happen at the same time, allowing it to use the bandwidth efficiently.

Because of the speed and no cost transfer, BitTorrent protocol has been used by people to transfer files, such as movies, music, and softwares illegally.

It is hard to prevent the development of such smart protocol. People have all sort of things in mind to develop. The creator of BitTorrent apparently has a creative mind to create such protocol that use bandwidth efficiently, and allow people to share files with one another, rather than downloading from a central server.

Illegal file sharing can negatively affect a lot of people. The entertainment industry will be at lost because people wouldn’t go out to the store to buy a CD. The consumers will download those files almost instantly and for free, without caring about the consequences of their illegal download. As a result entertainment industries are losing profits, and soon, they would collapse. In the long run, the companies will lose incentive to create/improve new products and, in the worst case, the consumers may not be able to enjoy such entertainment anymore.

To prevent the illegal file sharing issues, the government can enforce copyright laws stringently. The consequences of illegal downloads may be enforced through campaigns. A more recent technique is found, that is to sniff illegal file transfers . This tool can detect such transfers and keeps a record of the transfer as an evidence. The nice thing is that the tool works silently; it will not slow down the network traffic.

In another of a long line of high-profile security breaches both in and out of the government recently, the Federal Aviation Administration has announced that in the course of a breach of their computer system, over 45,000 employee names – and presumably, personal information – were compromised. The systems were thankfully not connected to the air traffic control system or other critical operations systems.

The FAA is said to be following up with potentially affected individuals one by one.

Similarly, healthcare giant Kaiser Permanente reported on Sunday that nearly 30,000 employee names, addresses, Social Security numbers, and dates of birth were stolen. The breach was a chance discovery – the files containing the data were found in the possession of one Mia Garza, who was arrested on unrelated counts of stolen property and fraud. It is unclear how she came to possess the data, and thus it is entirely possible that copies of it are still in the hands of malicious people. As she was arrested on December 23rd of last year, it has clearly been quite some time since the breach occurred.

According to Kaiser, existing security policy included restricted access to sensitive information by ACL and encryption of data on electronic devices, including cell phones – both measures that sound wise. It is still entirely possible that the issue was policy not in fact being followed – Kaiser does not know what caused to the loss of data.

Due to the lack of detail surrounding both of these events, they serve simply as a reminder of how broadly security breaches can affect people on a personal scale. In just a few weeks, companies and government agencies ranging from the above to RBS WorldPay – an event in which 1.5 million people’s financial information and 1.1 million Social Security numbers were stolen – Heartland Payment, which processes over four billion payments a year, and even security specialists Kaspersky have all suffered high-profile data breaches.

Hopefully all these attacks will remind other organizations to take a long, hard look at their security systems.