InfoWorld: No simple life for computer users

======================================================================== SECURITY ADVISER: BOB FRANCIS http://www.infoworld.com ======================================================================== Thursday, March 3, 2005

NO SIMPLE LIFE FOR COMPUTER USERS

By Bob Francis

Posted February 25, 2005 3:00 PM Pacific Time

It's no simple life for Paris Hilton these days. First her Sidekick address book was hacked and her celebrity friends' phone numbers were made public; then the hotel heiress' name became the bait for two different e-mail worms.

ADVERTISEMENT -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- FREE SSL Security Kit from VeriSign(R) VeriSign SSL Certificates protect e-commerce and other private information with 128-bit encryption, the strongest SSL protection available anywhere. Get a Free SSL Security Kit. http://newsletter.infoworld.com/t?ctl=BF6C5C:353CA35 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

Experts at SophosLabs, Sophos' global network of virus and spam analysis centers, are warning users about the dangers of opening e-mail containing references to Paris Hilton after they discovered two separate worms that each claims to contain hard-core footage of the privacy-challenged blond heiress.

The W32.Sober-K worm bulk-mails itself using a variety of different subject lines, including "Paris Hilton, pure!" and "Paris Hilton SexVideos." The multilingual worm can send itself in German or English, depending on whether it thinks the recipient's e-mail address is owned by a speaker of German or English.

The W32.Ahker-C worm, meanwhile, sends itself using the subject line "Paris Hilton...download it!" with an attached file called "ParisXXX.zip." The worm attempts to disable anti-virus and firewall software running on the computer and blocks access to a number of Web sites, potentially opening the PC to further attack by hackers and malware.

Sophos recommends that companies protect their e-mail gateways with a consolidated solution that defends against viruses and spam. Businesses should also secure their desktops and servers with automatically updated protection.

Although these worms are dangerous enough, it was the hacking of T-Mobile's servers and the subsequent release of information gleaned from Paris Hilton's T-Mobile Sidekick wireless device that has caused the most consternation.

The target was the servers that wireless carrier T-Mobile uses to run services for its Sidekick users. The attackers grabbed copies of Hilton's phone list, which included celebrity party pals such as rapper Eminem and Christina Aguilera. They then quickly posted the previously private digits on several Internet sites. The attackers also grabbed some embarrassing (if that is still possible for Ms. Hilton) photos taken with her cell phone.

Hilton's party buddies may be upset with her, but they should probably be more upset with T-Mobile for not paying closer attention to the possibility of an attack on these servers. Details about how the attack was carried out have not been made public. But until more is known, users might want to rethink how much personal information they carry around in such devices. Here's one useful question to ask yourself: "Would I want my mother to know this?"

Supposedly, federal prosecutors have in custody the person who carried out the attack. A 22-year-old Oregon man recently pleaded guilty to a single felony count of illegally accessing a protected computer and causing damage. Federal officials have been handling the case with an unusual degree of secrecy, probably because one of the Sidekick accounts compromised was that of a U.S. Secret Service agent who used the device for agency work.

Remember on "The X-Files" when the agents constantly talked on their cell phones? No wonder they never got proof of the existence of aliens -- they were being hacked.

Bob Francis is a senior writer at InfoWorld.

======================================================================== Ever wonder how others keep up with web services? Your peers will tell you, although your competitors probably won't. This is how more than 63,000 people keep up with the fast-moving news about web services: the Web Services Report newsletter. Scan its quick summaries of the week's biggest news in web services, then move on or click through for the full story. It may not be the only way to keep up with web services, but it's the easiest. Subscribe at http://newsletter.infoworld.com/t?ctl=BF6C58:353CA35

ADVERTISE ======================================================================== For information on advertising, contact Elisabeth_raphel@infoworld.com.

UNSUBSCRIBE/MANAGE NEWSLETTERS ======================================================================== To subscribe, unsubscribe or change your e-mail address for any of InfoWorld's e-mail newsletters, go to: http://newsletter.infoworld.com/t?ctl=BF6C59:353CA35

To subscribe to InfoWorld.com, or InfoWorld Print, or both, or to renew or correct a problem with any InfoWorld subscription, go to http://newsletter.infoworld.com/t?ctl=BF6C5B:353CA35

To view InfoWorld's privacy policy, visit: http://newsletter.infoworld.com/t?ctl=BF6C5A:353CA35

Copyright (C) 2005 InfoWorld Media Group, 501 Second St., San Francisco, CA 94107

This message was sent to: GDEWILDE@GMAIL.COM