Washingtonpost.com: Another Way to Lose Your Shirt in Vegas

Byline: Robert MacMillan

I'm not a big Internet security guy.

I still do a double-take when I hear the noun "exploit" used to describe a weakness in a computer system, and I fight an urge to chuckle like Homer Simpson when I hear the terms " buffer overflow " and " Trojan ."

You might find it unusual, then, that I direct you this morning to read the SecurityFix web log by my colleague Brian Krebs. He understands Internet security and speaks the language of hackers. What he means by " port security " usually isn't what I mean .

Krebs is in Las Vegas this week attending the BlackHat security convention as well as the 13th (ooh, scary!) DefCon gathering of hackers and crackers and the federal law enforcement officers who chase them. It's the Mos Eisley of hackers.

What I found fascinating is the advice he received from kind souls about even being in the greater Las Vegas area:

Former National Security Agency computer security chief Jack Holleran suggested avoiding using the Internet at the DefCon hotel: "Apparently, the 'bad' hackers ... who invariably show up at this conference usually manage to take complete control of the hotel's network."

Here's another comment he got from a reader: "Don't use a personal credit card at the hotel at all, and maybe even within a 100-mile radius. Have fun. ..."

Apparently what happens in Vegas does not always stay in Vegas. Has the Convention and Visitors Authority warned visitors to stick to cashola? Don't bet on it.

Another Security Fix reader, Rick H., went so far as to urge visitors bearing computers to beware of third-party cash machines and to store all their data on a USB drive that they keep on their bodies at all times.

The reason this should prove interesting to the non-geek community is that it's the latest example of your world colliding with the hackers'. By now everybody knows about online identity theft, and more people are touting stories about a victim they know personally.

A recent spate of news stories highlights this blitz into the mainstream, and it's worth quoting a few items here.

The New York Times published an article about an area south of Miami's downtown that could be called the data theft capital of the United States: "In the wireless hacker equivalent of a drive-by shooting wave, criminals obtained the cardholder information of tens of thousands of customers at four major stores there, including a DSW Shoes retail outlet that appears to have been the initial source of a chainwide data breach. Recent investigations reveal that the thieves singled out stores with strong wireless signals and weakly protected data," reporter Eric Dash wrote.

"While their exact methods are not known, they could have parked a car outside a store or set up in the local Starbucks, using a laptop computer outfitted with an off-the-shelf wireless receiver. They may have even received help from Web sites listing the geographic coordinates of easy-to-target stores. From there, it would be easy to pick up signals being broadcast around the store and use them to gain access to its computer systems. For more than a month, the hackers 'robbed' the same shops again and again of premium card account numbers stored in their databases."

The disturbing news here, according to sources in the article, is that it's not small businesses and dot-com companies that are sustaining the attacks: "'What people don't recognize is that some of those companies are DSW, BJ's Wholesale or Chipotle,' said Robert McCullen, the chief executive of AmbironTrustwave, a Chicago firm that is the payment industry's largest data security auditor. 'These are big names.'"

Actually, there is so much disturbing news in this story that you ought to read it and come on back here for the rest of the column.

Jonathan Krim at The Washington Post wrote about how hackers are spending more time targeting popular online programs such as the iTunes music service:

"Flaws in software that can be exploited by hackers are on the rise, said the report by the SANS Institute of Bethesda, a cyber-security research and education center," the article said. "[W]orms, viruses and spyware can now infect machines when users simply visit certain Web sites, rather than requiring victims to click on a malicious e-mail or file. Individual songs delivered via trusted programs such as the RealNetworks media player or iTunes can be vehicles for malicious code that can cripple machines or open them up to remote control by hackers."

This news comes on top of a recent advisory from the Federal Deposit Insurance Corp. that urges banks to increase their spyware protections. Here's the report from Reuters : "The agency said banks should also enhance internal security and Internet use policies -- by prohibiting Internet downloads and visits to inappropriate Web sites, for example -- and train employees about the risks of spyware. It also said banks should consider adopting new authentication methods to thwart hackers who might already have customer account numbers and passwords."

In other words, if you go to Vegas this weekend, carry your money -- in cash -- in your underwear.

President Clinton often kept us technology reporters busy in his second term with all sorts of dealings with the high-tech industry, but things aren't quite the same with the Bush White House.

Here's a report along these lines from Jim Puzzanghera of the San Jose Mercury News' Washington bureau: "Early in his first run for the White House, George W. Bush traveled to Palo Alto and told high-tech executives that he understood their industry and 'this incredible land called Silicon Valley.' 'It's a piece of the spirit of America,' Bush told 500 people at a $1,000-a-plate breakfast in July 1999. 'It not only talks about new technologies that shape our lives, but it speaks about daring and enterprise and the ultimate American Dream.' Now, six months into his second term, some executives in Silicon Valley question whether Bush and key members of his administration really do 'get it'' when it comes to high tech."

Puzzanghera reported that Silicon Valley executives are complaining off the record that there is a "lack of accomplishment on some major policy issues and a broader lack of focus on what they consider to be a unique sector of the U.S. economy." As a result, they're saving their lobbying time for Congress.

Democratic tech folks tend, predictably enough, to take shots: "'This is an old-economy, corporate administration, as opposed to a new-economy, entrepreneurial administration,'' said Rob Atkinson, director of the Technology & New Economy Project at the Progressive Policy Institute, a Washington, D.C., think tank affiliated with the centrist Democratic Leadership Council. 'What tech lobbyists tell me all the time is in the Clinton administration, there were a plethora of people you could go to who where fairly high up, fairly knowledgeable about tech and were committed to tech,'"

As for the Republican take, we have this: "Floyd Kvamme, a Silicon Valley venture capitalist and Bush adviser, said the president and key people in his administration do 'get it.' 'That's the frightening part of my job,' said Kvamme, co-chair of the President's Council of Advisors on Science and Technology. 'They actually are listening, so you don't want to screw up.'"

But some current and former Bush administration officials said, not to put too fine a point on it, that that was then and this is now: "The Sept. 11, 2001, terrorist attacks created a far different environment from the booming 1990s, when high tech was the darling of Wall Street and Washington before the dot-com collapse. And Bush and Vice President Dick Cheney have a different, more hands-off economic philosophy than did former President Clinton and Vice President Al Gore, who were constantly lavishing praise and attention on the tech industry."

Here's a good one that's a few weeks old but hasn't spoiled yet. AdAge reports : "Research in Motion, marketer of the popular wireless e-mail device, is linking with Papa John's in an offbeat promotion to offer 'free' BlackBerry devices to the pizza maker's customers. ... Customers who place Internet orders that include a side item and two beverages will be offered the newest version of the device lovingly dubbed Crackberry by its 3 million worldwide users."

The catch, according to AdAge: You have to sign up for a two-year contract to receive Cingular Wireless's voice and data plan at $75 per month. You also must pay $150 up-front, which you can reclaim through a mail-in rebate.