Cyber-fraudster Florin Necula, accused of electronically stealing credit and debit card numbers from ATM machines, swallowed a USB flash drive that contained evidence of his crimes.

Apparently the flash drive got stuck in his intestinal tract. Federal agents obtained a search warrant, and had a surgeon remove the device from Necula’s body. Wow. I didn’t realize you could get a search warrant to search your intestine!

The latest version of the Zeus banking trojan steals not only usernames and passwords from infected computers, but it also appears to steal digital certificates and cookies from browsers. Cookies and certificates are often used by websites to authenticate a user, in addition to username and password. By stealing these credentials from a user’s computer, criminals can potentially access a variety of online sites and accounts of the victim.

One benefit to using a hardware PKI token is that the signing keys are stored on the device, and cannot be exported or stolen. This means that stealing a certificate from a browser is not effective, as you also need the private RSA key to be able to use the client-side certificate to log into a website.

The latest version of the Zeus banking trojan steals not only usernames and passwords from infected computers, but it also appears to steal digital certificates and cookies from browsers. Cookies and certificates are often used by websites to authenticate a user, in addition to username and password. By stealing these credentials from a user’s computer, criminals can potentially access a variety of online sites and accounts of the victim.

One benefit to using a hardware PKI token is that the signing keys are stored on the device, and cannot be exported or stolen. This means that stealing a certificate from a browser is not effective, as you also need the private RSA key to be able to use the client-side certificate to log into a website.

Experi-Metal, Inc. had their online business banking account taken over by hackers who stole their password in an email phishing scam. The hackers logged into the company’s online bank account at Comerica bank, and wired almost $2 Million out of the account. Comerica bank was able to recover about $1.5M, but the company was left with over $500,000 of losses from the event.

Comerica refused to reimburse Experi-Metal. So the company sued the bank to recover their funds, alleging that the bank does not have sufficient online security and anti-fraud measures.

Comerica responded by filing a request for a summary judgement to dismiss the lawsuit. A judge has dismissed the request, and the course is now going to court.

Experi-Metal, Inc. had their online business banking account taken over by hackers who stole their password in an email phishing scam. The hackers logged into the company’s online bank account at Comerica bank, and wired almost $2 Million out of the account. Comerica bank was able to recover about $1.5M, but the company was left with over $500,000 of losses from the event.

Comerica refused to reimburse Experi-Metal. So the company sued the bank to recover their funds, alleging that the bank does not have sufficient online security and anti-fraud measures.

Comerica responded by filing a request for a summary judgement to dismiss the lawsuit. A judge has dismissed the request, and the course is now going to court.

Pharmacy chain Rite Aid has been fined $1 Million for violating privacy standards of the Health Information Portability and Accountability Act (HIPAA). It is good to see that the Office for Civil Rights (OCR) put some teeth into the HIPAA act, and actually extract a meaningful fine for violating the personal privacy rules of the act. Apparently Rite Aid did not properly dispose of identifying information on pill bottles of customers.

A forum at Dell’s website has described that replacement R410 server motherboards that are infected with malware/spyware have been shipped by the company to customers.

Apparently the systems management firmware has been compromised in the manufacturing supply chain, and has been infected with malicious software. Dell is calling customers to warn them of the malware infections, and giving them instructions on how to scan the flash memory to detect and remove the spyware.

It’s another example in the growing set of supply chain vulnerabilities that are starting to emerge in the IT industry. Vendors of IT infrastructure must realize that attackers are eager to infect their products, and are even doing so inside the supply chain itself.

I was in the United Kingdom last week. The UK government is said to be ready to sign a law that would permit police from other EU countries to demand details of UK citizens suspected of crimes in other countries. Details that could be released to foreign police include banking records, phone records, and even DNA samples.

This is happening under the auspices of the European Investigation order (EIO).

Civil liberties organizations are very concerned that UK citizen’s personal details could be shared with foreign police for such mundane offenses as not paying for a meal at a restaurant.

Anthony Scott Harrison, 21, from the Black Forest area near Adelaide, Australia, yesterday pled guilty to computer hacking. He admitted to infecting 3,000 computers with a banking trojan that allowed him to steal online bank account login details and credit card information. He also admitted to infecting a further 74,000 computers with a bot designed for DDoS.

London, UK.

Conservative Member of Parliament Rob Halfon claims that the UK government is not doing enough to investigate privacy invasions by Internet companies. He warns that if government does not take more action to investigate Internet companies that are accused of privacy violations, the UK risks having a “privatized version of Big Brother”.

His comments come in the wake of concerns about Google’s StreetMap project that “inadvertently” mapped out the wifi spots of thousands of people.

Dan Raywood of SC Magazine interviewed me about privacy issues and data protection today here in London. You can read the full article here.