Sony Chief Blindsided by Hackers

Sony Corp. (6758), besieged by hackers since April, considered its PlayStation Network an unlikely target even after threats by the online collective Anonymous and three separate security incidents in 2008.
The hacker group declared in April that it would wage a cyber war against Sony for trying to stop people from tinkering with the PlayStation 3. Three years earlier, the company faced three breaches in Europe, including one in which Sony said some PlayStation Network user data might have been stolen.
The repeated incidents should have warned Sony its online network was vulnerable, said Eugene Spafford, a computer science professor at Purdue University in West Lafayette, Indiana. The failure to enact safeguards such as appointing a single chief of security may show Sony misunderstands the risks inherent in Chairman and Chief Executive Officer Howard Stringer’s networked strategy, he said.
“The evidence we’ve seen so far speaks to a lack of a good data management plan and a good security plan,” said Spafford, who specializes in information security, computer crime investigation and information ethics.
Japan’s Ministry of Economy, Trade and Industry said today it told Sony to carry out preventive measures against data breaches, instructed the company to ease customer concerns over misuse of credit cards and share more information among affiliates.

Spreading Attacks

Sony has struggled to keep up with the barrage that started in mid-April. The Qriocity and PlayStation Network services were knocked out for almost a month, compromising data in more than 100 million accounts.
In the past week, the Tokyo-based company has been hit with smaller intrusions -- a breach at online-service unit So-net Entertainment Corp. (3789) led to the misuse of user names and passwords of 128 customers. This week, Sony shut web pages that were targeted in Greece, Canada, Thailand and Indonesia.
The PlayStation Network will resume in Japan, Taiwan, Singapore, Malaysia, Indonesia and Thailand tomorrow, while services in South Korea and Hong Kong will remain suspended until further notice, Sony said today.

‘New Experience’

“Obviously our network security didn’t stop the attack and we’re trying to understand why, and we’ve made big strides in bolstering our security,” Stringer said in a May 17 interview, before the most recent incidents.
Sony believed it had “good, robust security.” Stringer said. He rejected suggestions that Sony is paying for a lack of vigilance and said he was unaware of the 2008 intrusion on the PlayStation Network.
Since most users of PSN don’t pay, and most threats focus on stealing credit card information, the theft of passwords and other personal data from those services appeared less likely, Stringer said.
“We have a network that gave people services free,” Stringer said. “It didn’t seem like the likeliest place for an attack.”
When the April incursion first started, he didn’t know how serious it was, Stringer said. “I really don’t think I could apologize for not knowing,” he said. “It’s a whole new experience for everybody at this scale.”

Anonymous Vow

There were warning signs. Sony was singled out for retaliation by Anonymous, the hacker group that brought down the websites of MasterCard Inc. (MA) in December, after the company sued 21-year-old George “GeoHot” Hotz for posting information on how to modify the PlayStation game console. The case was settled on March 31.
Anonymous announced its revenge campaign, “Operation Payback,” on the website anonnews.org. In an early May statement, the group denied involvement in the PlayStation and Qriocity breaches, while saying some members of the loosely organized collective may have been behind it.
Sony, Japan’s largest consumer-electronics exporter, must connect its televisions, Blu-ray players, game consoles and digital cameras via the Internet to music, movies and video games, Stringer has said. Unconnected devices rapidly become commodities as rivals compete for customers, he has said.

‘Failure of Trust’

Sony’s investigation into the cause and search for suspects in the mid-April attack is ongoing, the company said. Sony on May 23 said it may spend more than $170 million related to the hack. The company also said it discovered personal data may have been stolen from 8,500 user accounts in a music entertainment site in Greece.
The company erred in “thinking of these incidents in terms of a breach of systems” and communicating with its customers based on the severity of the failure, said Kevin Kosh, a partner at Waltham, Massachusetts-based Chen PR, which represents technology companies.
“When you’re a consumer-facing organization, that’s not the way you should think,” Kosh said. “It’s first and foremost a business failure and a failure of trust.”
In March 2008, Sony informed users in Europe that an unauthorized person may have gained access to personal data on PSN through personal computers. There is no evidence that personal information or credit-card data was taken, and the security flaw, which is unrelated to the recent attack, was fixed, the company said in response to questions for this story.

2008 Probes

London Metropolitan Police questioned a teenager about a separate, September 2008 hacking attack into Sony’s developer network, according to three people familiar with the incident.
The network has no identifying information about customers and isn’t attached to the PlayStation Network, Sony said in the statement provided by Dan Race, a spokesman.
In December 2008, a user revealed a flaw in Sony’s PlayStation Home virtual-world game for the PS3 that let him manipulate pictures and videos on his own device. That person never had access to Sony’s servers, the company said.
“The one incident that related to PlayStation Network, once we identified what it was, they went in and fixed it,” Race said. The April attacks were much more sophisticated than 2008 and appear to be unrelated, Sony said.
In the weeks leading up to the April 16 breach, Sony missed key opportunities to plug holes in its system, said Bret McDanel, a security expert who monitored publicly available server logs.

Navy Server

The company’s network security should have seen a sustained probing of its systems from a Navy medical computer in Southern California, which may have been used as a proxy server by potential attackers, McDanel said.
The company hasn’t turned up evidence of such a probe of its servers, said a person with knowledge of Sony’s efforts to trace the cause of the security break.
“The truth is that people test for vulnerabilities on network systems on a daily basis, and Sony is constantly monitoring for unauthorized activity, conducting our own vulnerability tests and making constant enhancements,” Race said.
He declined to say whether Sony found evidence of a probe from the Department of Defense server. Justin Cole, a spokesman for the U.S. Navy, didn’t return a call requesting comment.
The attack in April was launched through a server rented from Amazon.com Inc. (AMZN)’s cloud-computing service, a person with knowledge of the matter said this month. The account was shut and Amazon’s servers weren’t compromised, the person said.

Security Chief

Companies should consider carefully what data belongs on open servers, put one person in charge of administrative rights and keep track of how and when the network is accessed, said Yuichi Uzawa, a Tokyo-based senior consultant in charge of investigative response at Verizon Business. Nevertheless, determined hackers can often find ways to break in, he said.
“In the end, it’s extremely difficult to defend a network from an organized, targeted attack,” Uzawa said. “Early discovery of signs of intrusion through monitoring of key assets is the best defense.”
Sony said it takes network security and the protection of personal information seriously. There are multiple layers of protection and the company constantly monitors for unauthorized activity, including testing for vulnerabilities, it said.
Even so, Sony’s chief information officer oversaw network security as part of his duties until after the April attacks. A chief information-security officer was then appointed, reporting to the CIO, to provide an additional layer of security, the company said.
Failing to take such a step earlier was a critical shortcoming, according to Chen PR’s Kosh.
“Adding a CISO after the fact is like hiring a bodyguard after you’ve been fatally wounded,” Kosh said. “It creates an impression that there’s a lack of accountability.”
By Cliff Edwards, Michael Riley and Joseph Galante taken from http://www.bloomberg.com/news/2011-05-27/sony-s-stringer-blindsided-by-hackers-who-probed-flaws-with-vow-to-attack.html

Computer errors allow violent US prisoners to be released

Reporting from Sacramento -- Computer errors prompted California prison officials to mistakenly release an estimated 450 inmates with "a high risk for violence" as unsupervised parolees in a program meant to ease overcrowding, according to the state's inspector general.

More than 1,000 additional prisoners presenting a high risk of committing drug crimes, property crimes and other offenses were also let out, officials said.
No attempt was made to return any of the offenders to state lockups or place them on supervised parole, said inspector general spokeswoman Renee Hansen.

All of the prisoners were placed on "non-revocable parole," whose participants are not required to report to parole officers and can be sent back to prison only if caught committing a crime. The program was started in January 2010 for inmates judged to be at very low risk of reoffending, leaving parole agents free to focus on supervising higher-risk parolees.

The revelations come two days after the U.S. Supreme Court ruled that California's prisons are dangerously overcrowded and upheld an earlier order that state officials find a way to reduce the 143,335-inmate population by roughly 33,000. The state has two years to comply.

State Sen. Ted Lieu (D-Torrance), a former prosecutor who requested an investigation of the unsupervised-parole program, said the inspector general's report "confirms my worst fears" about it.

Investigators reviewed case files for 200 of the 10,134 former inmates who were on non-revocable parole in July of last year. They found that 31 were not eligible, and nine of those were determined likely to commit violent crimes. The inspector general and corrections officials refused to identify the inmates who were released erroneously. They also would not specify what their original offenses had been.

Using the 15% error rate they found in their sample, investigators estimated that more than 450 violent inmates had been released during the first seven months of the program, the time period they reviewed. Prison officials have disputed the findings, saying they had corrected some of the computer problems discovered by the inspector general. The error rate is now 8%, the inspector general report says.

Gov. Jerry Brown's plan to address overcrowding would shift tens of thousands of low-level offenders from prison to county custody. Counties would also supervise most low-risk parolees, like those in the non-revocable program.

But if the state can't properly identify which inmates qualify for an unsupervised parole program, Lieu said on Wednesday, "how can the public have confidence they can release 33,000 felons safely?"

Under the law that created non-revocable parole, inmates are excluded if they are gang members, have committed sex crimes or violent felonies or have been determined to pose a high risk to reoffend based on an assessment of their records behind bars.

That's where the problems begin, according to the inspector general. The computer program prison officials used to make that assessment does not access an inmate's disciplinary history.

The program also relies on a state Department of Justice system that records arrests but is missing conviction information for nearly half of the state's 16.4 million arrest records, according to the inspector general report.

Lee Seale, a deputy chief of staff for the California prisons, acknowledged that the corrections department's computer system can't access an inmate's disciplinary record. But that information is reviewed manually by a member of his staff before prisoners are released, said spokesman Luis Patino.

Seale agreed that the missing conviction information from the Department of Justice database is a problem. "That presents a serious issue for the entire criminal justice system, every judge, every probation officer, every cop on the street trying to decide whether to arrest someone," Seale said.

In July, a parolee named Javier Joseph Rueda, who had been classified a low-level offender and placed in the non-revocable program, opened fire on two Los Angeles police officers, hitting one in the arm. The police returned fire, killing Rueda.

Prison spokesman Oscar Hidalgo said Rueda had been properly classified. At the time, Hidalgo pointed out that the attack could have taken place even if Rueda had been checking in periodically with a parole agent.
By Jack Dolan taken from http://www.latimes.com/news/local/la-me-prisons-20110526,0,6293602.story

Protesters gather in Cairo square for rally

Thousands of people poured into downtown Cairo's Tahrir Square Friday for what they called a "second revolution," calling for Egypt's military rulers to speed up the pace of democratic reforms in a country that is still charting its political future.

Christians and Muslims took turns praying in Tahrir Square, as they did in the protests that forced the ouster of former President Hosni Mubarak in February. Sectarian clashes have turned deadly since the revolution.

The ruling military warned that "dubious" elements may try to cause chaos during Friday's protests, and said it would stay clear of the protest area to avoid any friction.

Mohamed ElBaradei, the Egyptian Nobel Peace Prize winner and a reform leader, said that he was "seriously concerned about the absence of security forces."

The military's leadership of the country's democratic transition has left many protesters dissatisfied.

"I came here because I didn't feel that Egypt changed," technician Raafat Hendi said, under huge posters calling for a new constitution.

Some critics accuse the military rulers of collaborating with the former regime and being too lenient in its prosecution of Mubarak, his family and regime members. Mubarak now faces trial on charges of conspiring to kill protesters.

The Muslim Brotherhood, Egypt's best organized political force, opposed the protest and called it an attempt to drive a wedge between the military and the people. The Brotherhood's absence will test the ability of liberal and secular groups to launch their own sustained opposition movement.

Some liberal groups are calling for planned parliamentary elections, now set for September, to be pushed back so that they will have more time to prepare. The Brotherhood, however, stands to make major gains and wants the vote to go ahead.

The protest movement wants to oust the ruling Armed Forces Council and replace it with a civilian council. Protesters accuse the army of using excessive force in cracking down on peaceful protesters since Mubarak's ouster, sending thousands to military tribunals and detaining young protesters.

A joint statement by four liberal and secular groups called for postponing the September elections, drafting basic principles that guarantee that Egypt is a civil state and ending military tribunals.

The statement reflects worries of many political groups that the Brotherhood is poised to win a big portion of parliament.

The Brotherhood, banned in 1954, became a political force after renouncing violence in the 1970s. Eventually it became the most formidable opponent to Mubarak's regime, though it was still banned as a political party.

When Mubarak fell, the Brotherhood stood ready with a huge network of social services and supporters.

BY MAGGIE MICHAEL  taken from http://hosted.ap.org/dynamic/stories/M/ML_EGYPT?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2011-05-27-07-33-50

New leak feared at stricken Japan nuclear plant

Radioactive water appears to be leaking from a waste disposal building at Japan's Fukushima nuclear complex, operator Tokyo Electric Power said on Thursday, in a new setback to the battle to contain radiation from the crippled power plant.
The disclosure by Tepco raises the stakes in a race to complete by next month a system to decontaminate a massive pool of radioactive water at the site that critics see as a growing risk to both the nearby Pacific and groundwater.
A magnitude 9.0 earthquake and the massive tsunami that followed killed about 24,000 people and knocked out the Fukushima plant on March 11, triggering the world's worst nuclear accident since Chernobyl.
The crisis, which has displaced some 80,000 residents from around the plant, prompted a review of Japan's energy policy and growing calls for efforts to step up health monitoring for a crisis now in its 11th week.
Experts from the International Atomic Energy Agency began an inspection on Thursday of equipment damaged by the tsunami at a second nuclear plant, the Tokai complex about 120 km (75 miles) north of Tokyo, as part of an investigation prompted by the Fukushima accident.
A poll by the Asahi newspaper published on Thursday showed that 42 percent of Japanese people opposed nuclear power, up from 18 percent before the disaster.
The survey underscored the public's deepening concerns about nuclear safety and criticism of the way the government and Tepco initially responded to the crisis and how they appeared to have been repeatedly slow in admitting the gravity of the situation.
Although many outside experts had concluded that uranium fuel in three Fukushima reactors had melted down within days of the crisis, Tepco only announced that conclusion this week.
"We have to take seriously the criticism that we haven't done enough to provide and circulate information," Chief Cabinet Secretary Yukio Edano said at a news conference. "But we have never covered up information that we had."
POSSIBLE LEAK
The effort to regain control of the plant relies on pumping massive quantities of water to cool the three reactors that suffered meltdowns and storing the contaminated water in an improvised storage facility. Tepco officials said, however, that the water level in the storage facility had dropped, suggesting a leak.
Environmental groups have focused on the threat to sea and ground water from the accident. Greenpeace said earlier this month it had collected samples of fish, seaweed and shellfish along the Fukushima coast that showed radiation levels above Japanese safety limits.
Residents of the town of Futaba, forced to evacuate along with others inside a 20-kilometre (12-mile) zone around the plant, were allowed to return briefly to their homes on Wednesday.
A day earlier, residents of the nearby town of Minami Soma had been allowed back to their homes for a two-hour visit wearing hooded white protective suits, masks and goggles.
Video shot by a couple returning home and broadcast on Japanese television showed a ghost town with weeds overrunning a garden and a stray dog barking in the distance.
"It didn't even feel like my own home," one woman told Nippon Television. "I thought I was prepared for that, but I wasn't."
By Kiyoshi Takenaka and Yoko Nishikawa taken from http://ca.news.yahoo.com/leak-feared-stricken-japan-nuclear-plant-071027708.html

French minister tipped as next IMF head facing prosecution over financial sleaze

The glamorous French minister hoping to succeed Dominique Strauss-Kahn as head of the International Monetary Fund was today facing prosecution for financial sleaze.
Christine Lagarde, a 55-year-old former lawyer and synchronised swimmer, is being investigated for abusing her position to help a controversial businessman.
She is said to have awarded some £270million to Bernard Tapie, a convicted football match fixer and tax dodger who supported her governing UMP party.
The allegation comes after Strauss-Kahn’s arrest for the attempted rape of a chambermaid and a range of other sex crimes in a New York hotel.

While former French presidential candidate Strauss-Kahn is on bail and facing up to 25 years in prison, Ms Lagarde has been campaigning to succeed him as IMF head.
But now it has emerged that Ms Lagarde - who was pictured today on holiday in France - could also be facing a trial of her own.
In a scandal which will pile further shame on France’s political class, Paris’s Court of Cassation started an enquiry into Ms Lagarde’s part in the Tapie case last month.

Tapie, former head of Adidas in France, claims he was cheated out of millions by Credit Lyonnais bank when the sports kit empire was sold in 1993.
In 2007, Ms Largarde - whom ITV News economics editor Daisy McAndrew has admitted to a 'crush' on - ended the epic dispute by ordering a panel of judges to arbitrate and, in turn, they awarded Tapie the £270million in damages.
Opposition MPs were furious, with former presidential candidate Francois Bayrou accusing Ms Lagarde of ‘dipping into the the taxpayers’ pocket for a private beneficiary.’

Strauss-Kahn’s Socialist Party also accused Ms Lagarde of improper conduct, pointing to the fact that Tapie was a vocal supporter President Nicolas Sarkozy’s ruling UMP.
Judges will take a decision on whether to prosecute Ms Lagarde on June 10 – at a critical moment in her campaign to succeed Strauss-Kahn at the IMF.
Ms Lagarde's bid for the IMF's top job had been endorsed by the UK's coalition government, which indicated she was preferred to former Labour prime minister Gordon Brown.
The Washington DC-based IMF - which provides loans to countries suffering financial problems - has traditionally been run by a European, while the World Bank has been run by an American.
But shortly before Ms Lagarde indicated her candidacy, major developing nations on the IMF's board issued a joint statement urging an end to that practice.
In a letter to the Financial Times today, influential business academic, Jean-Pierre Lehmann, writes:  ‘Christine Lagarde must be presumed innocent until proved otherwise.
'However, the risk that she might have to resign as head of the IMF, were she appointed, pending an official investigation seems an unnecessary one to take.
‘This would be another major blow not only to the IMF but to the whole edifice of global economic governance, which is already suffering from acute problems of legitimacy and credibility.’
Ms Lagarde, who will play a major role in the G8 summit which opens in the French seaside town of Deauville today, denies any wrong-doing.
Ms Lagarde said: ‘If it’s decided to continue with this enquiry it won’t be particularly surprising. Personally, it doesn’t worry me at all.’
She added: ‘I didn’t benefit personally’.
Admitting her 'embarrassing crush', ITV’s Daisy McAndrew wrote: 'She has charisma and leadership skills in buckets… she cuts a dashing figure – a shock of coiffed grey hair and extremely elegant.'

By Peter Allen taken from  http://www.dailymail.co.uk/news/article-1391073/Christine-Lagarde-tipped-succeed-Dominique-Strauss-Kahn-head-IMF.html#ixzz1NUa5UU4i

African swine fever may spread to Europe

African swine fever (ASF), a viral disease harmless to people but lethal to pigs, is likely to spread beyond Russia and the Caucasus region into Europe, the United Nations' food agency said on Thursday.
ASF, for which there is no vaccine, is now established in Georgia, Armenia and southern Russia, with an increasing number of long-distance jump outbreaks in northern areas this year, the Food and Agriculture Organization (FAO) said.
Long-distance jumps are food-borne, with virus surviving in pig meat products carried by travelers and setting off a new outbreak at the destination where food scraps may be fed to pigs, the FAO said.
"African swine fever is fast becoming a global issue," Juan Lubroth, FAO's Chief Veterinary Officer, said in a statement.
"It now poses an immediate threat to Europe and beyond. Countries need to be on the alert and to strengthen their preparedness and contingency plans," he said.
ASF was introduced into Georgia from southern Africa in 2006 entering through the Black Sea port of Poti, where garbage from a ship was taken to a dump where pigs came to feed, FAO said.
Currently, ASF is spreading northwards at the rate of roughly 350 km a year. Usually, ASF has distinct seasonal outbreaks in the summer and autumn. But long-distance jumps have also occurred as the ASF wave travels northwards.
The frequency of such jumps is increasing as the originally infected territory enlarges, while the ASF virus strain now spreading is a very aggressive one, the Rome-based FAO said.
BUFFER ZONE IN RUSSIA
ASF is generally prevalent and endemic in countries of sub-Saharan Africa, while in Europe the disease is endemic in the Italian island of Sardinia, according to the World Organization for Animal Health (OIE).
Organization The disease was also present in Spain and Portugal from 1960 to the mid-1990s with the last outbreak in Portugal in 1999, according to OIE and Britain's Department for Environment Food and Rural Affairs.
Europe also had outbreaks of another viral disease of pigs, classical swine fever, or hog cholera, in the past few years. In the late 1990s, the Netherlands had to cull millions of pigs hit by the virus which is not dangerous to humans.
Several outbreaks happened in other countries including Germany and Bulgaria in the 2000s.
Russia said in April it would need 10-12 billion roubles ($351.4 million-$421.6 million) and 7 years to extinguish the rapidly spreading ASF with a plan which foresees setting up a buffer zone in the south of the country.
At the start of the year 17,000 pigs had either died from ASF in Russia or had to be culled, the country's chief veterinarian said in April. Last year some 60,000 pigs had to be culled or died of ASF in Russia.
Strategies to tackle the disease include quarantine, on-farm security and other measures aimed at minimizing the risk of introduction and establishing of ASF.
Early-warning contingency plans include epidemiological information-gathering, training and awareness campaigns.
By Svetlana Kovalyova taken from http://ca.news.yahoo.com/african-swine-fever-may-spread-europe-fao-115313565.html

Campaign in support of Knox steps up

Some Italian lawmakers claim Amanda Knox was treated unfairly and are seeking a probe of the prosecutors' office in Perugia, the city where the American student was convicted of murdering her British roommate.
The request to the Italian justice minister Thursday is spearheaded by a lawmaker who has frequently visited Knox in prison and written a positive book about her. The lawmaker also sent a letter to the Italian president seeking his intervention to avert any controversies arising from the case.
Both the petition and the letter cast doubt on the prosecution's case, alleging that an appeals trial currently under way has undermined the reliability of evidence originally collected against the former exchange student from Seattle, Washington. They also maintain that Knox, who has been in jail since before her conviction, should not have been kept behind bars.
"These distortions, not without reason, are fueling accusations against the administration of justice in our country," lawmaker Rocco Girlanda said in the letter, which was given to The Associated Press.
The petition to Justice Minister Angelino Alfano was signed by 11 lawmakers, all members of Premier Silvio Berlusconi's coalition. It asks Alfano to consider sending inspectors to judicial offices in Perugia — a move that is considered very serious in Italy and is typically read as a sign of discontent from Rome.
There was no immediate response from authorities.
Girlanda is an ally of Berlusconi, who has vehemently attacked Italian magistrates and is seeking to reform the system to limit their powers. Girlanda also heads a foundation that seeks to promote ties between Italy and the United States, and has established what he says is a close friendship with the 23-year-old American.
Knox was arrested on Nov. 6, 2007, four days after the body of her roommate Meredith Kercher was found in the apartment the two shared as foreign students in Perugia. The 21-year-old Kercher was stabbed to death.
Also arrested was Raffaele Sollecito, an Italian who was Knox's boyfriend at the time of the slaying. Both were convicted of sexual assault and murder in 2009. Knox was sentenced to 26 years in prison and Sollecito to 25.
The two have always denied wrongdoing.
"Who will compensate two 20 year olds — in the hoped-for case that the appellate trial recognizes their innocence — of the four years of life and freedom that they have been unjustly deprived of?" said Girlanda. "The so-called evidence and testimonies of the prosecution have proved to be at best considered contradictory and unreliable."
In Italy, many sentences are not served until all levels of appeals are exhausted. However, it is not unusual for defendants to be kept behind bars if they are considered a flight risk, or they might tamper with evidence or repeat a crime. Legal experts say that in murder cases, defendants are often kept under custody during trial.
Knox's appeals court trial has reviewed some of the claims and witnesses of the first trial, but also admitted some new testimony sought by the defense. The appeals court has granted the defense's request for a review of forensic evidence, including DNA traces.
The lawmakers' petition claims the first trial was effectively limited only to the prosecution's "questionable case" and that the defendants were denied their right to a full defense. The prosecution has denied suggestions of an unfair trial.
The appeals trial continues next month. A verdict is expected after the summer.
By ALESSANDRA RIZZO taken from http://news.yahoo.com/s/ap/20110526/ap_on_re_eu/eu_italy_knox