We're too late…

A new law in Georgia on private investigators now extends to computer forensics and computer incident response, meaning that forensics experts who testify in court without a PI license may be committing a felony.

In the U.S. television show “Medium,”
Patricia Arquette's character uses her “special psychic skills” to help
solve crimes. If a new law passed by the Georgia legislature but not
yet signed by the Governor goes into effect, not only could Miss
Arquette's character face legal troubles, but thousands of computer
security consultants would face the very real threat of jail time –
simply for plying their trade.

According to the legislature, a Private Investigator
is any person who is in the business of obtaining or furnishing, or
accepting employment to obtain or to furnish, information with
reference to:

(A) Crimes or wrongs done or threatened against the United States of America or any state or territory thereof;

(B) The background, identity, habits, conduct, business, employment,
occupation, assets, honesty, integrity, credibility, knowledge,
trustworthiness, efficiency, loyalty, activity, movement, whereabouts,
affiliations, associations, transactions, acts, reputation, or
character of any person;

(C) The location, disposition, or recovery of lost or stolen property;

(D) The cause or responsibility for fires, libels, losses, accidents, damage, or injury to persons or property;

(E) The securing of evidence in the course of the private detective
business to be used before any court, board, officer, or investigating
committee; or

(F) The protection of individuals from serious bodily harm or death.

In addition to the aforementioned services, “private detective
business”” shall also mean providing, or accepting employment to
provide, protection of persons from death or serious bodily harm.”

Typical “Magnum PI” kind of stuff. The problem is that the statute is
written so broadly as to include almost all types of computer forensics
and computer incident response – at least when done by outside
consultants. After all, when do you need computer forensics, or
incident response? Typically, you call in a computer forensics expert
when you suspect something “bad” has happened. Thus, you retain the
expert to furnish information with respect to possible crimes or wrongs
(the phrase against the United States or any State or territory doesn't
mean that the State is the victim of the crime, just that it violates
the state law.)

You also retain forensic experts to collect evidence about damages and
loss to you – from computer viruses, worms, attacks, and so on. You
want to know what happened, how it happened, why it happened, and how
to prevent it from happening again. You want to know the, “cause and
responsibility for … losses and damage to … property.” Namely, this
applies to your computer network and the information contained in it.
You also want the information collected in a way so that it can be used
in court or by other investigators later on, even if you do not intend
to pursue a civil or criminal case. If information is stolen, you want
to know the “location, disposition and [ensure the] recovery of lost or
stolen property” namely the intellectual property stored on the
computer. For all of these things, you would typically hire not a
gumshoe, but a forensic expert. Unfortunately, under this new law that
forensic expert would be committing a felony.

Complete coverage on Security Focus.


Registry Key to disable USB Storage devices

Once in a while I have a friend, or customer that needs to keep people from using the USB ports to copy data off of a system.

It is easy to lock a machine down, disable the floppy, and cdrom in the bios. Many times when you try to disable USB – it disables it entirely.  This can be a real pain on newer laptops or systems that don't even have a PS2 interface for the mouse or keyboard.

There is a simple registry change that will keep the USB storage drivers from starting when the system boots. Keeps people from walking up to a PC and copying data off with a USB key, but allows you to keep your scanner, keyboard, and mouse working.

As always – back your system up before messing around in the registry.
Just open regedit and browse to this key:


Notice the value 'Start'
Switch this value to 4, and USB storage devices are disabled.
Switch this value to 3, and USB storage devices are enabled.

From IntelliAdmin, who also has a little util for those scared of regedit.  I believe this is much more effective than the Group Policy I posted about.

DOJ jails Spam King, Alan Ralsky

Local hacker “Memehacker” IMed in with a scoop on Alan Ralsky, the famed “Spam King” covered by the Observer and the Detroit News. Here's the breaking story:

Valleywag: Tell me the scoop in three sentences.
Memehacker: Alan Ralsky is currently being held by the feds and
his file is sealed for the next 72hrs by the DOJ. We are concerned that
he is going to narq out the entire network since they have enough on
him to send him to jail. This means hackers, spammers, anyone who has
worked in spam legally or illegally for the last 5 years at least.

The DOJ wants to do a dragnet, they have the top dog, but they want the whole system as well.

Get the scoop on Valleywag. (via)

Bypass the Microsft Genuine Advantage check

This copy of Microsoft Windows XP is not genuine – Want to bypass and remove this warning ?

Windows XP Pirates have again found workaround methods to bypass the new Microsoft Anti-Piracy effort Windows Genuine Advantage Notifications that notifies you through annonying pop-up messages if your copy of Windows is not genuine.

WGA Notifications patch is installed if the user has opted to
automatically update Windows via the Windows Update Website or if a XP
users manually downloads the latest Windows updates.

A workaround posted on PiratBay.org titled WGA install workaround (KB905474) suggests the following:

Get the low down on Digital Inspiration. (via)

Wireless Recycling

Wireless Recycling has a slick interface which walks users through the steps necessary to secure old cellphones before passing them off to others.

The process is as simple as selecting your phone manufacturer, make
/ model, and clicking ‘Submit’. The end result is a downloadbale PDF
file for securing your mobile handset of any personal data.

From UNEASYsilence.

Back in Business

The Los Angeles Times reports that only days after flash drives containing sensitive military data were found for sale in a Kabul street market, they're available again. It seems that after the Times
first reported the data breach, military folk went through the market
and bought all the drives they could lay their hands on. For a few
days, there were no drives available, but by last Friday, drives were
once again being smuggled off the base and into the market.

If the Times' description of “thousands” of drives for sale
is accurate, the potential parameters of the data breach are kind of
unnerving. The drives sometimes turn up wiped (though the Times
story points out that deletion isn't a permanent condition), but the
range of information turning up  is amazing — everything from maps
showing where Osama Bin Laden might be traveling to pain-compliance
technique information to names and addresses of operatives to Web pages
explaining where to buy anabolic steroids.

The Times goes a good job setting the scene: Apparently the
drives are often walking off the base with local folk working on the
base (whether as employees or messengers and the like). The shopkeepers
don't necessarily know what they're selling — one gentleman apparently
priced his wares by color — though they note that prices have
increased tenfold for American shoppers since the original story broke.
And every Afghani interviewed seems to agree: The “trade” shows no
signs of drying up.

From ComputerWorld.

Studies Say HIPAA Privacy Rule Compliance Not Improving

According to a survey from the American Health Information Management
Association (AHIMA), compliance with the Health Insurance Portability
and Accountability Act (HIPAA) patient privacy rules appears to be on
the wane. Of 1,117 hospitals and health systems responding to the
survey, 91 reported HIPAA compliance last year while 85 percent said
they were in compliance this year. The top reasons given for declining
compliance were “lack of resources and diminished management support.”
However, 75 percent of respondents said they were “fully or mostly
compliant” with HIPAA's information security rules, marking a 60
percent improvement over last year's figure. A separate study conducted
by Phoenix Health Systems and Healthcare Information and Management
Systems Society (HIMSS) found the level of compliance with patient
privacy rules among companies involved in health care is higher than 80
percent, but says that figure has not changed in the last six months.
The respondents in this study said their problems with compliance were
due to HIPAA's vaguely worded rules and the ever-changing array of
available technology.

From SANS News Bites.