News
4/3/2008
08:16 PM
Terry Sweeney
Terry Sweeney
Commentary
50%
50%

A Federal Indictment, That's What

Stop me if you've heard this one: What do you get if you try to board a flight to China while carrying confidential documents, a thumb drive, four external hard drives, 29 recordable CDs, a videotape, and $30,000 in cash?

Stop me if you've heard this one: What do you get if you try to board a flight to China while carrying confidential documents, a thumb drive, four external hard drives, 29 recordable CDs, a videotape, and $30,000 in cash?You can read more about this audacious, if abortive, data transfer here. The trade secrets this Chinese-American was carrying had an estimated worth of $600 million.

And the FBI claims that the search that led to these discoveries and subsequent arrest was "random." But she couldn't have been more obvious if she'd written "Data Thief" across her forehead. Or smuggler, or whatever it was she was actually doing.

Now, I'm the last person to lecture anyone on discretion. But might that kind of walking data center draw attention anywhere, like an airport, much less the international terminal of the world's busiest?

This sounds like a perfect job for FedEx or DHL. No TSA muss, no FBI fuss. But I suppose there was the possibility of interception or third-party scrutiny, or invocation of some untested clause in the Patriot Act that makes it illegal to ship any data volumes larger than the Library of Congress equivalent outside our borders.

E-mailing's out, if you wanted to avoid an electronic trail or potential scrutiny; and putting it in checked luggage wasn't an option. I've collected two little notices from TSA in the last 18 months, alerting me they had searched my checked baggage. No, I wasn't carrying hard drives.

The companies whose trade secrets were involved were not named. Motorola's an obvious possibility with its nearby Schaumburg, Ill., headquarters. But companies in the vicinity of the Windy City are pretty mum about this.

Where this all goes remains to be seen, and as the FBI notes, an indictment is not evidence of guilt -- just a lack of discretion, mixed with some incredibly bad luck or judgment.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.