Hotmail Forcing Stronger Passwords

PCMag.Com - Attention Hotmail users: if your Hotmail password is "123456," it won't be for much longer.

Microsoft said Thursday that the company has added a pair of security features designed to cut down on the number of people whose accounts have been hacked, or who could be compromised in the future. The first, known as "My friend has been hacked!", has already rolled out; the second, a feature to ban common passwords, will arrive soon.

Recognizing that a friend was hacked is something that users can somewhat easily do, but machines may have a more difficult time. Generally, when an account is hijacked, it is either used for spam or to solicit money through a social engineering scheme. A suspicious user may call the friend to double-check. If a hack is discovered, the frind must then begin a process to take back his or her account.

The new program helps prevent that malicious account from poisoning others, and can also help facilitate the takeback process.

"When you report that your friend's account has been compromised, Hotmail takes that report and combines it with the other information from the compromise detection engine to determine if the account in question has in fact been hijacked," Dick Craddock, the group program manager for Hotmail, wrote in a blog post. "It turns out that the report that comes from you can be one of the strongest 'signals' to the detection engine, since you may be the first to notice the compromise. So, when you help out this way, it makes a big difference!"    More

Critics: U.S. cybersecurity plan has holes, few new items

IDG News Service - The new Strategy for Operating in Cyberspace issued by the Department of Defense on Thursday covers a collection of topics that have been discussed for years and leaves a number of important unanswered questions, critics said.

Deputy Secretary of Defense William Lynn unveiled the new strategy during a speech on Thursday, and a transcript of the speech was made available online.

"Our strategy's overriding emphasis is on denying the benefit of an attack. Rather than rely on the threat of retaliation alone to deter attacks in cyberspace, we aim to change our adversaries' incentives in a more fundamental way. If an attack will not have its intended effect, those who wish us harm will have less reason to target us through cyberspace in the first place," Lynn said.

The plan contains a handful of initiatives, including treating cyberspace as a domain like land and sea; introducing new network defenses that include sensors, software and signatures to detect and stop malicious code; coordinating with the Department of Homeland Security and the private sector; and working with other countries.      More

Anonymous Targets Secret Meeting, London Police

PCWorld.Com - Hacktivist group Anonymous claims it has "literally explosive" information about a secretive gathering of powerful men that takes place annually in California, and the group may be on the verge of leaking material from the London Metropolitan Police and agencies affiliated with the U.K. judicial system.


Anonymous reportedly intends to occupy the entrance to Bohemian Grove in Monte Rio, Calif., today as a protest against Bohemian Grove's secrecy.

Take a look at Anonymous's YouTube call to action:

According to AlterNet, Anonymous may also be gearing up to leak information from several organizations, including the London Metropolitan Police and agencies affiliated with the U.K. judicial system.     More

DHS says foreign parties put malware in products imported into US

A top Department of Homeland Security (DHS) official told Congress that some software and hardware being imported into the US contains malware planted there by foreign parties.

 

Infosecurity.Com - Greg Schaffer, acting deputy undersecretary of DHS’s National Protection and Programs Directorate, told a House panel last week that his office is “aware” of instances where malware was loaded onto software and hardware made in other countries and sold in the US.

Schaffer made the admission in response to a question by Rep. Jason Chaffetz (R-Utah), who sits on the House Oversight and Government Reform Committee. The committee was holding a July 7 hearing on the Obama administration’s cybersecurity proposal.

“Are you aware of any component software or hardware coming to the United States of America that has security risks already imbedded into those components?” Chaffetz asked.      More