FIRST FINN BUYS TICKETS INTO SPACE

Finland’s first space tourist has booked a flight on Virgin Galactic’s commercial spacecraft. The traveller shelled out some 140,000 euros for the ticket into space.

Virgin Galactic has already sold trips to some 300 fledgling astronauts around the world, says Area, the company’s sales agent in Finland. The tourist spaceship is scheduled to begin test flights next year.
The company's commercial spaceflights depart from New Mexico in the United States and Kiruna in Sweden.
During the two-hour flight astronauts get a glimpse of space at 115 kilometres above earth and experience weightlessness for five minutes.
Confidentiality clauses prevent Area from releasing the identity of the Finnish space tourist.

Nasa photographs 'trees' on Mars

The "trees" are really trails of debris caused by landslides as ice melts in Mars's spring Photo: NASA

The images appear to show rows of dark "conifers" sprouting from dunes and hills on the planet surface. But the scene is actually an optical illusion.
The photographs actually show sand dunes coated with a thin layer of frozen carbon dioxide, or dry ice, less than 240 miles from the planet's north pole.
The "trees" are really trails of debris caused by landslides as ice melts in Mars's spring. You can even see a cloud of dust, just to the left of centre of the picture, where an avalanche is caught happening.
The photograph was taken from orbit around Mars by HiRISE, the most powerful camera sent to another planet.
NASA's Candy Hansen told The Sun: "The streaks are sand, dislodged as ice evaporates, which slide down the dune. At this time of the Martian year the whole scene is covered by CO2 frost."
Last month Nasa announced a new telescope had detected five planets outside the solar system. The observatory, which was launched last year to find other Earths, made the discoveries in its first few weeks of science operations.
Although the new worlds, called exoplanets, are all bigger than Neptune, Nasa said their discovery showed that the planet hunting telescope was working well.

Welcome to DarkMarket – global one-stop shop for cybercrime and banking fraud • Personal data and tutorials in hacking offered online • Founder of site traced to London internet cafe

Renukanth Subramaniam, 33, is accused of being a key figure in running DarkMarket, a website where criminals exchanged information on stolen credit cards and other data. Photograph: Serious Organised Crime Agency/AP

To the casual observer, there was little to distinguish the Java Bean internet cafe in Wembley from the hundreds of others dotted around the capital. But to surveillance officers staking it out month after month, this unremarkable venue was the key to busting a remarkable and sophisticated network of cyber criminals.
From the bank of computers inside, a former pizza bar worker ran an international cyber "supermarket" selling stolen credit card and account details costing the banking industry tens of millions.
Renukanth Subramaniam, 33, was revealed today as the founder and a major "orchestrator" of the secret ­DarkMarket website, where elite fraudsters bought and sold personal data, after it was infiltrated by the FBI and the US Secret Service.
Membership was strictly by invitation. But once vetted, its 2,000 vendors and buyers traded everything from card details, obtained through hacking, phishing and ATM skimming devices, to viruses with which buyers could extort money by threatening company websites.
The top English language cybercrime site in the world, it offered online tutorials in account takeovers, credit card deception and money laundering. Equipment – including false ATM and pin machines and everything needed to set up a credit card factory – was available.
It even featured breaking-news-style updates on the latest compromised material available, while criminals could buy banner adverts to promote their wares.
So vast was its reach, with members in the UK, Canada, US, Russia, Turkey, Germany and France, the UK's Serious Organised Crime Agency (Soca), which helped bust it, said it was "impossible" to put a figure on how much it cost banks worldwide.
Subramaniam, who used the online soubriquet JiLsi, was remanded in custody at his own request at Blackfriars crown court today after pleading guilty to conspiracy to defraud and five counts of furnishing false information. Judge John Hillen warned it was "inevitable" he faced a "substantial custodial sentence".
A Sri Lankan-born British citizen, Subramaniam was a former member of ShadowCrew, DarkMarket's forerunner, which was uncovered by the US Secret Service in 2004. "JiLsi was one of the highest in cybercrime in this country with what he managed to achieve setting up a forum globally. No JiLsi, no DarkMarket," said one Soca investigator.
Its 2,000 members never met in real life. Quality, not quantity, was the key. DarkMarket was fastidious in banning "rippers" who would cheat other criminals. Honour among thieves was paramount.
It operated an "escrow" service, with payments and goods exchanged through a third party – "like a PayPal for criminals", the judge observed, and an arbitration service resolved disputes. To keep off the radar, the rules were strict: no firearms, drugs or counterfeit currency.
Built on a pyramid structure, administrators decided who joined, moderators ran specific site sections, and reviewers vetted wannabes – each demanding 5% or £250 per transaction as a fixer's fee.
To get on, criminals had to present details of 100 compromised cards free of charge - 50 to one reviewer, 50 to another. Reviewers would test the cards and write an online review of customer satisfaction – just like eBay customers. "If the cards did what they were supposed to … they would be recommended. If not they weren't allowed in," said the investigator.
Payment was via accounts on WebMoney, or E-Gold. "It was the QuickTime method of sending money anywhere."
Subramaniam was one of the top administrators. He kept his operating system on memory sticks. But when one was stolen, costing him £100,000 in losses and compromising the site's security, he was downgraded to reviewer. Surveillance officers caught him logging on to the website as JiLsi unaware the fellow criminal MasterSplyntr he was talking to was, in fact, an FBI agent called Keith Mularski.
Considerable money was exchanged, though actual transactions took place away from the site for security reasons. One buyer spent £250,000 on stolen personal information in just six weeks.
Described as "a very quiet man", Subramaniam worked at Pizza Hut and as a dispatch courier. "He owned three houses but was largely itinerant," said Sharon Lemon, Soca deputy director. "The key to investigations of this sort is finding the evidence to connect the online persona with a living, breathing person."
Harendra de Silva QC, defending Subramaniam, said the "evidence was unchallenged" but said the "question of interpretation does arise in certain areas" and there would be submissions on "nuance" of the fraud in so far as it applied to his client. He is charged alongside John McHugh, 66, known as Devilman, also a site reviewer who has pleaded guilty to conspiracy to defraud and at whose Doncaster home officers found a credit card-making factory. The two will be sentenced later.
But the battle against cybercrime continues. "This was one of the top 10 sites in the world, but there are more than 100 we know of globally, and another 100 we don't yet know of," said the investigators.

In the DarkMarket

DarkMarket price listTrusted vendors on DarkMarket offered a smorgasbord of personal data, viruses, and card-cloning kits at knockdown prices. Going rates were:
Dumps Data from magnetic stripes on batches of 10 cards. Standard cards: $50. Gold/platinum: $80. Corporate: $180.
Card verification values Information needed for online transactions. $3-$10 depending on quality.
Full information/change of billing Information needed for opening or taking over account details. $150 for account with $10,000 balance. $300 for one with $20,000 balance.
Skimmer Device to read card data. Up to $7,000.
Bank logins 2% of available balance.
Hire of botnet Software robots used in spam attacks. $50 a day.
Credit card images Both sides of card. $30 each.
Embossed card blanks $50 each.
Holograms $5 per 100.

IT UNDERWORLD

Google hack hit 33 other companies

The plot thickens. According to iDefense Labs, the recent Internet attack that has so upset Google affected 33 other US tech and defence firms and is directly related to an Adobe Reader-based attack of last July.
The US flaw-hunting specialist said that the attack was an attempt to steal source code on an industrial scale and was, in many cases, probably successful. If correct, this might explain why Google has by its own normally quite restrained standards gone ballistic to the extent of threatening to quit China.
"Two independent, anonymous iDefense sources in the defense contracting and intelligence consulting community confirmed that both the source IPs and drop server of the attack correspond to a single foreign entity consisting either of agents of the Chinese state or proxies thereof," said the iDefense press statement, confirming what the world already knows.
It now turns out that Adobe itself was targeted in the latest alleged Chinese attacks, http://blogs.adobe.com/conversations/2010/01/adobe_investigates_corporat... ">as a statement on its own website explains.
"Adobe became aware on January 2, 2010 of a computer security incident involving a sophisticated, coordinated attack against corporate network systems managed by Adobe and other companies."
The note goes on to say that in Adobe's case, the attack was not successful in stealing any data.
More embarrassingly, a flaw in Adobe software has been implicated in the new attacks. iDefense has forensically linked these to last July's attacks, which involved exploiting zero-day flaws in Adobe Reader 9.1.2 and Adobe Flash Player 9 and 10 to send specially-crafted PDFs.
As well as using the same emailed PDF technique to drop Trojans, the two attacks used the same HomeLinux DynamicDNS provider, pointed to the same virtual private server host owned by US-based Linode, and had IP addresses on the same subnet within a very similar address range.
"Considering this proximity, it is possible that the two attacks are one and the same, and that the organizations targeted in the Silicon Valley attacks have been compromised since July," says iDefense.
In fact, it is also possible that exploits go back further since the flaws used in last summer's attack pre-date the known attack by some months.
Whatever the details, that China is targeting the US technology firms, the government and military is nothing new, as a Northrop Grumman report of last October made clear. It now looks as if the latest cycle of attacks could take US firms, and perhaps even the US government itself, beyond breaking point.

Cooing

Little humor for this uncertain age…

Alleged China attacks could test U.S. cybersecurity policy…

The attacks on Google and more than 30 other Silicon Valley companies by agents allegedly working for China is focusing renewed attention on the issue of state-sponsored cyber attacks and how the U.S. government should respond to them.

The U.S. has no formal policy for dealing with foreign government-led threats against U.S. interests in cyberspace. With efforts already under way to develop such a policy, the recent attacks could do a lot shape the policy and fuel its passage through Congress.

In a revelation that was surprising for its boldness, Google on Tuesday said that agents possibly working on behalf of the Chinese government had hacked into its computers -- and those of more than 30 other multi-national companies. Also hit: Adobe .

This is not the first time Beijing has been accused of state-sponsored espionage. Over the past five years, China has been implicated in dozens of attacks involving U.S. commercial, government and military targets. The most sensational of these involved a Chinese hacking group called Titan Rain , which in the early 2000s is believed to have stolen U.S. military and nuclear information.

For the most part, the official U.S. response to the attacks amounted to little more than expressions of outrage and protest by lawmakers. On Tuesday, Secretary of State Hilary Clinton released a statement asking the Chinese government for an explanation for the attacks, which raised "very serious concerns and questions." On Wednesday, Sen. Joseph Lieberman (I-Conn.), the chairman of the Senate Homeland Security and Governmental Affairs Committee, said that attacks like the one against Google must be confronted "aggressively and with all available means."

"The official response will be, 'We are highly upset about this and we demand you stop it,'" said Ira Winkler, president of the Internet Security Advisors Group. (Winkler is also the author of Spies Among Us and a Computerworld columnist.) "The reality of the situation is we are screwed. The political reality is that China, in large part, is funding the U.S. deficit. We have no leverage.

"We just can't cut China off," he said.

Articulating a response to government-led cyber attacks isn't easy.

"We have to keep one thing in mind -- it is extremely difficult to attribute a cyber attack to a foreign government," said Greg Nojeim, senior counsel at the Center for Democracy and Technology (CDT), a Washington-based think tank. "There is often a lack of certainty in that regard that makes it really difficult to decide what kind of response to make."

And even if the evidence is there, it's futile to launch any kind of cyber-retaliation, he said. "That's something that should be off the table. You don't want to have a cyberwar where you fight fire with fire. That could burn the whole house down."

Instead, what's needed is a measured diplomatic response, where the issue is raised with China when it wants U.S. cooperation on other matters, he said. "The State Department has to make it clear that these attacks are so serious they warrant a diplomatic response. I am not sure that level of commitment has been demonstrated yet," Nojeim said.

Any victories gained from cyber-retaliation are likely to be temporary, at best, Winkler said. "If you can identify the systems that are attacking us and make sure you are attacking the right systems, theoretically, that might work" to head off another attack, he said. "But that's like throwing sand in the eyes of somebody who is beating you up." It can be effective -- but only for a while, he said.

That doesn't mean, nothing can be done. U.S. organizations that are targets of attacks from China first need to bolster their defenses, said Amit Yoran, former director of the U.S. Department of Homeland Security's National Cyber Security Division. The continuing success Chinese agents have in penetrating U.S. networks points to ineffective security -- and sophisticated attackers, Yoran said.

"Companies such as Google have very, very sharp security teams, but the technologies they rely on are inadequate," said Yoran, who is currently CEO of security vendor NetWitness Corp. "We have developed a technology base in modern computing that is indefensible against modern threats."

What's needed is a security approach that focuses on continuous monitoring of networks and data, not one based solely on prevention.

"Whining about this won't stop it," said Alan Paller director of research for the SANS Institute, a Bethesda, Md.-based security institute. "Cyber-based military espionage and economic espionage are radically effective programs for the Chinese government," and it's unlikely that policy statements are going to do any good, he said. "There are simply too many attackers with too many motives to think that a policy of deterrence would be more than minimally effective."

At the federal government level, at least, "it is [security] skills with good tools that allow organizations to defend themselves," Paller said. "Sadly, these skills are in radically short supply."

The U.S government has fewer than 1,000 people with the advanced skills needed to fight in cyber space at "world-class levels," he said. What's needed are between 20,000 and 30,000 cybersecurity warriors. "Our competitors have even more."

Companies outsourcing work to China, or doing business there or in other developing nations such as India, also need to be aware of the heightened risks to their intellectual property, Winkler said. "Companies need to look at things much more strategically," he said. While it may be cheaper to outsource manufacturing in countries such as China and India, the long term costs could be high if they're not careful.

"Many are not looking at the strategic risks of a rival stealing their technology and selling counterfeit goods," he said.

As for official government cyber policies, just because the U.S doesn't have an official policy for handling attacks doesn't mean it's sitting on its hands, said one analyst who asked not to be named. "One reason why the U.S might not have come up with any rules of the road is because the NSA and other intelligence agencies are involved in the same kind of activity," he said.