Outsourcing is our information safe?

Outsourcing especially with in the call center industry continues to be a hot trend. One place in particular where most companies are going is the Philippines. The list contains some very well-known corporations, Polaroid, West Corporation, Convergys, Ford Motor, Frito Lay, amongst other. The list is part of a book written in 2004 by journalist Lou Dobbs titled “Exporting America”.

The Philippines is as well known for being a hot bed for scammers at the same level as Africa and the Ukraine. If you were to Google “Philippines and Scams” the results would make your head spin. The FBI in 2010 in one of their Reports and Publicationsit list the Philippines as one of the country of origins for an international mass marketing scheme.

On August 23 of this year there was an operation conducted in the Philippines conducted by the Criminal Investigation Detection Group and the Presidential Anti-Organized Crime Commission in the Philippines which resulted in 357 arrests. This is the largest cybercrime operation in the nation’s history. The aim of this raid was to stop a scam that was going on in China.

I can understand from the economical point of view as to why companies want to outsource, but from a security point of view I cannot. There is already an inherit risk when companies in general trust their employees with sensitive information even here in the United States. To some access to this information is call to commit a crime, but when you place the same information in countries where they are well known for international crimes the risks doubles. If companies want to outsource great, just don’t provide sensitive information.

Java Flops Agains

If you have not been keeping up with the news this past week I am referring to Oracles latest flop with Java. On August 28, Oracle released Java version 7 which shortly after the launch it was discover that it had a security flaw that could be exploited on Windows, OS X, and Linux (Horowitz). According to Cnet following the news of this exploit and the potential for it to do harm, concerns arose regarding Oracle's release schedule for Java updates which are usually released quarterly.

In this case a patch was available within days. On August 30th Horowtiz posted on his website Java tester that Oracle release a patch for Java 7. He then followed this post on September 1 stating Java 7 still is still dangerous. Issues with Java has been known for a while, some month after Oracle acquired Sun Systems in April 2012 they were being criticized for not addressing the issues that were brought to them in regards security flaws with the program (Heath, 2012).

I understand that software programs cannot be perfect, but Java has a long history of being vulnerable. I think it is irresponsible for companies to launch programs that can be open to attacks. I am not saying companies do not bother to test their programs, what I am questioning is to what extent do they check for areas of vulnerability? After some research I found the answer and that is not much, this is not a new problem. In April 2003 following the "The Slammer Worm" attack that occurred in January of the same year PBS interview Amit Yoran in regards to this same very issue. At the time he was the Vice President of Managed Security Services Operations for Symantec Corporation. PBS during his interview Yoran was asked why does vulnerabilities happen and if there's such thing as code review. Yoran responded as follows:

"The code review process and the entire software development process does not have an appropriate level of emphasis on security. The consumers and clients of most software companies are so demanding of new features and capabilities that those features take priority over better software development practices and techniques. So our demand for new features essentially fuels the fire of increased vulnerabilities in software."

Fast forward 9 years and we are still in the same boat. I guess companies that offer anti-virus programs call such errors job security, but if consumers knew that companies are placing their computer at harm’s way by what it seems by design the uproar would be such that software companies would start doing better job before launching a new product or update.

References :

Cyber War! (2003, April 24). Retrieved September 2, 2012, from PBS

Heath, D. (2012, September 2). Oracle's recent Java patch is broken . Retrieved September 2, 2012, from ITWire

Horowitz, M. (n.d.). Java Tester. Retrieved September 1, 2012, from Java Tester

Kessler, T. (2012, August 30). Oracle patches Java 7 vulnerability. Retrieved September 1, 2012, from CNet

Is your conscience bothering you?

If the answer is yes you might shelling out a lot of money. In a recent FBI article there is new virus in town and is praying in the guiltily conscience of many Americans who use the internet. According this article the virus is called Reveton. This virus is being described as a “drive-by” malware as it present itself as soon as the user visits and infected site. The virus is going to display a message that basically locks up the screen and would not let the user exit.

The malware will display a message letting the user know that their computer was identified by the FBI or the Department of Justice Computer Crime or Intellectual Property Section as having been associated with child pornography or other online illegal activities. The message goes on to say that unless they pay a fine they will be prosecuted. Many American’s have paid the so called fine as requested using MoneyPak order.

In another article found in privacy-pc the author David B speaks of an in depth analysis written by Brian Kerbs a well-known security researcher wrote. David states that Mr. Kerbs believes that the distribution of the Reveton Virus is quite likely to be associated with another infection known as the Citadel which in turn is derivative of the notorious password-stealing ZeuS Trojan.

After reading these articles two questions came to mind; first who is vulnerable? and second what site they are visiting? Sports, entertainment, adult, religious, bookstores, etc…? It did not take long to find the answer, everyone is vulnerable and it can be anywhere. One of the examples I found was in Webroot community blog where someone posted that their computer becomes infected after visiting their daughter dance studio website.

There a few guidelines issued by the IC3, the IC3was established as a partnership between the Federal Bureau of Investigation and the National White Collar Crime Center (NW3C) to serve as a means to receive Internet related criminal complaints and to further research, develop, and refer the criminal complaints to federal, state, local, or international law enforcement and/or regulatory agencies for any investigation they deem to be appropriate, according to their website The guidelines are as follow:

• Do not provide any personal information.
• Contact a computer professional to remove Reveton and Citadel from your computer. .
• Be aware that even if you are able to unfreeze your computer on your own, the malware may still operate in the background. Certain types of malware have been known to capture personal information such as user names, passwords, and credit card numbers through embedded keystroke logging programs. .
• File a complaint and look for updates about the Reveton virus on the IC3 website. .