InfoGram

August 9, 2001

NOTE: This InfoGram will be distributed weekly to provide members of the emergency services sector with news and information concerning the protection of their critical information systems. For further information please contact the U.S. Fire Administration's Critical Infrastructure Protection Information Center at (301) 447-1325 or email at usfacipc@fema.gov.

Reporting Cyber Incidents

Current surveys indicate that municipalities and their emergency response sectors have not made great strides in cyber security. In the past three months, several town, police, and fire websites were disrupted or defaced. Many more cyber incidents have not been reported. Throughout the United States these events have raised municipal consciousness regarding computer and network security. Nevertheless, a spokesperson from the National Infrastructure Protection Center (NIPC) said that leaders of the emergency response sectors are hesitant to report a disruption of service or defacement because of perceived embarrassment. Unfortunately, this denies the NIPC opportunities to investigate and prosecute the cyber offenders. Fire and emergency service departments are courteously reminded to report computer intrusions to the NIPC or USFACIPC given the information provided at the bottom of this document.

Wireless Security Vulnerabilities

Security researchers published details of the weaknesses in encryption techniques applied to secure wireless networks. The root cause of the gaping security holes is from a flaw in the key-scheduling algorithm used by the Wired Equivalent Privacy (WEP) protocol, which is part of the 802.11 wireless networking standard. According to an article in The Register, wireless security vulnerabilities have been widely publicized before, but the difference with this flaw is that it might be far easier to exploit. Industry groups involved in the promotion of wireless networking said the work of the researchers shows that the security measures in 802.11 alone are not enough. The Wireless Ethernet Compatibility Alliance advocated use of additional and stronger encryption tools.

Code Red II

The NIPC continues to work in close coordination with its public and private sector partners regarding what has been named Code Red II. The NIPC considers Code Red II to be a serious threat because it spreads rapidly and installs a backdoor that can be accessed by anyone familiar with the exploit. Any intruder can use the backdoor compromise to make other system modifications at will. As a result, repair of the infected system may require reinstallation of the operating system, data files, and the Microsoft patch. As in the case of Code Red last week, the Microsoft patches can be located at the following URLs:

For Windows NT 4 machines:
www.microsoft.com/downloads/release.asp?releaseid=30833

For Windows 2000 machines:
www.microsoft.com/downloads/release.asp?releaseid=30800

Electricity Supply Shortages

The drought-stricken Columbia River Basin currently remains so short of water to run hydroelectric dams that the Northwest may have to borrow power from California to keep the lights on this winter. But there's no guarantee that energy-strapped California will have power to share when the Northwest needs it. "We're in the red zone," said Ed Mosey, a spokesman for the Bonneville Power Administration. Acquiring energy from California to heat homes and conduct business may or may not happen, Mr. Mosey speculated. Also, soaring demand and problems at power plants cut deeply into the power supply grid causing New York City (NYC) to declare an energy emergency on 7 August. Although it is not the city's first energy emergency, it is the first time the NYC power system manager activated a new emergency demand reduction program calling on businesses, building managers, and residents to voluntarily throttle back their power usage.

Personal Infrastructure Protection

Critical infrastructure protection (CIP) is a high priority issue within government and business circles. Given the frequency of identity and identifier theft, more consideration should be given to CIP on a personal level as it is equally relevant and applicable. The Federal Computer Incident Response Center in its June issue of Bits and Bytes recommended the following three basic and necessary steps to protect bank/credit card accounts and credit status:

• Cancel credit cards immediately if they are lost or stolen.
• File a police report in the jurisdiction of the loss as soon as possible.
• Request the three national credit reporting organizations and Social Security Administration quickly place your name and social security number on "fraud alert."
  1. Equifax: 1-800-525-6258
  2. Experian: 1-800-301-7195
  3. Trans Union: 1-800-680-7289
  4. Social Security Administration: 1-800-269-0271

USFACIPC Weekly Lexicon: Hoax

In virus terms, an email that warns of an invalid viral infection or risk, causing more concern then necessary to the user.