Yahoo Patches Messenger

Yahoo Inc. has updated its Messenger instant messaging software to flush a bug that hackers could exploit by sending video chat invitations to unwary users.

The vulnerability, which surfaced last week in a posting to a Chinese security forum, could be exploited by duping a user into accepting a malicious webcam invitation, McAfee Inc. confirmed Aug. 15.

In its advisory, Yahoo said that it had actually patched two bugs, the heap overflow disclosed last week and a previously unknown denial-of-service (DoS) issue that also involves Messenger's video chat feature. Speaking of the latter, Yahoo's alert said: "For this specific security issue, Messenger exits unexpectedly after accepting a webcam invitation from a malicious attacker."

Unlike the buffer overflow flaw, the DoS vulnerability would not give an attacker the chance to sneak his own malicious code onto the PC.

Messenger 8.1.0.416 is the summer's second patched-up IM client for Yahoo. In June, eEye Digital Security fingered Messenger for two other critical flaws in the webcam feature. Then, Yahoo patched the bugs considerably faster: It released a fix just a day after the flaws went public. According to McAfee researcher Wei Wang, August's video vulnerability wasn't connected to the older June bugs.

Messenger users can download the patched version immediately, or wait for the software's auto-update to kick in. Yahoo acknowledged that it may take weeks for the update to be fully deployed. "Over the next several weeks, users worldwide will be prompted to update to a new version of Messenger upon signing into the service," Yahoo's advisory read.

source : www.computerworld.com

The Monster.com Mess

The last thing you need when you're unemployed is a bank account that's suddenly emptied. But that's exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs.

How It Started

This still-developing story has enough nooks and crannies to confuse a gumshoe, but some facts are clear: Monster's resume database was looted, and the personal information taken was used to forge convincing messages that deposited password-stealing Trojans and ransomware on users' PCs.

Calculated and ambitious, the attack is striking for how it blended several elements--stolen credentials of legitimate users, phishing e-mails, Trojan horses, money mules and more--into a slick assault.

What We Know So Far

Was Monster.com hacked? No, as Symantec said immediately. Instead, the attackers accessed the resume database with legitimate usernames and passwords, probably stolen from professional recruiters and human resource personnel who use the "Monster for employers" section of the site to look for job candidates. But it wasn't until Thursday that Monster.com admitted as much. "By gaining unauthorized access to employer accounts, the software was obtaining job seeker contact information," a new alert said.

What was snatched from the database? Names, e-mail addresses, mailing addresses, phone numbers and resume IDs, said Symantec. Yesterday, Monster.com added that only about 5,000 of the people whose data was filched live outside the U.S. That squares with what Symantec's Amado Hidalgo said in an e-mail: The information-stealing Trojan was hard-coded to dig through only the "hiring.monster.com" and "recruiter.monster.com" domains, limiting their theft to the Monster USA site's database. "They only targeted the U.S. Monster site and not any other international Monster [Worldwide] Inc. sites, such as those in the U.K., Spain, etc.," said Hidalgo.

source : www.pcworld.com

Site Auctions Software Vulnerabilities to top Bidder

There are many ways vulnerability information can get out to the industry but a controversial new site, auctioning such information to the highest bidder, may be the wave of the future.

The auction service, called WabiSabiLabi, lets potential sellers and buyers connect e-Bay-style, with timed bidding periods and minimum starting prices. Founders of the wslabi.com site say their auction house serves the researchers who discover vulnerabilities and often don't reap monetary rewards for their time and talent.

The business model is based on a practice that e-Bay shut down 16 months ago saying it promoted illegal activity. At the recent Black Hat show, published reports stated that 88 percent of respondents to an online poll said using such sites is dangerous. While it is accepted that researchers deserve to be paid for their work, selling to the highest bidder is frowned upon.

WabiSabiLabi disagrees, saying its e-marketplace, where any qualified buyer can bid, will actually discourage those who discover vulnerabilities from selling them on black markets to criminals who try to turn them into money.

The company says it checks out buyers and sellers before they can trade. "We are very aware about the risks of selling vulnerabilities, and this is why we subject buyers to deeper scrutiny, to minimize the risk of selling the wrong information to the wrong people," WabiSabiLabi says in its ethics statement. "We require non-anonymity from buyers and sellers alike. The stakes are just too high at this point in history."

Even so, the marketplace, which started business six weeks ago, is being eyed cautiously by entities dedicated to eliminating vulnerabilities quickly to avoid criminal exploitation.

"I don't think it's necessarily good for the community," says Jason Greenwood, the general manager of VeriSign's iDefense team, which pays bounties -- sometimes tens of thousands of dollars -- to researchers who discover vulnerabilities. "It will increase the perceived value of vulnerabilities, and the good guys already have trouble competing with the money you can get on the black market."

"There's a real danger that a number of these vulnerabilities will be purchased by buyers who do not turn them over to the vendors," says Terri Forslof, manager of security response for Tipping Point. "Once a vulnerability is turned over to a vendor its value starts to depreciate immediately. If someone paid lots of money for a vulnerability -- say US$75,000 to $100,000 -- I guarantee they're not giving it to the vendor. Otherwise they've wasted their money."

VeriSign and its competitor Tipping Point, for example, both pay cash for significant vulnerability discoveries in an effort to plug software holes before they can be exploited. The companies then work with the vendors whose software is compromised to find fixes and publish the vulnerabilities.

VeriSign runs quarterly challenges paying as much as $15,000 for researchers to find particular types of vulnerabilities in particular platforms, Greenwood says. Tipping Point ranks contributing vulnerability researchers as bronze, silver, gold and platinum depending on the quantity and quality of their discoveries, according to its description of Tipping Point's Zero Day Initiative. It rewards them with cash bonuses up to $25,000 and pays their way to the Defcon and Black Hat security conferences.

Underground markets pay as much or more, experts say. Charlie Miller of Independent Security Evaluators, says he sold a Linux Daemon vulnerability for $50,000 to an organization he approached directly. But he had no idea whether somebody else would have paid much more, he says in a talk delivered at Carnegie Mellon University's Workshop on the Economics of Information Security earlier this year.

"I had no way to know the fair market value of this exploit," he says in his paper, "The Legitimate Vulnerability Market; Inside the Secretive World of 0-Day Exploit Sales," which he delivered at the conference. "I may have been off by a factor of 10 or more."

Money isn't the motivation behind most of the vulnerabilities reported to entities that will try to fix them, says Art Manion, team leader for vulnerabilities at Carnegie Mellon's Software Institute CERT program, a nonprofit that acts as a go-between for researchers and software vendors.

"They desire to get the vulnerability out in the open and get the credit for it," he says. "We don't pay for vulnerabilities," but the software vendors may.

Researchers go through CERT, he says, because dealing with the software vendors themselves can be tedious, time consuming and aggravating. "They may not want to deal with the vendors. If it's a protocol problem, they might have to tell 60 or 70 vendors. "It's lots of work, and CERT will do it," Manion says.

CERT's goal is to get the vulnerabilities published as soon as possible, he says, making the flaws next to worthless to criminals. Their goal ideally is to run exploits before vulnerabilities have been identified when they can do maximum damage, he says.

About 16 months ago, a Microsoft vulnerability was posted on e-Bay and was taken down by the site after Microsoft complained. E-Bay says the sale violated its policy against enabling criminal activity.

WabiSabiLabi this week listed four vulnerabilities for sale, two against Windows Server 2003, one against Windows XP and one against WordPress 2.2.2. None had bids, but that doesn't tell much by itself, says Greenwood.

source : NetworkWorld

Old Worm Slammer Threatens Again

An old worm known as Slammer, which originated back in January 2003, is still going strong according to Gunter Ollmann, director of security strategy at IBM's Internet Security Systems (IBM ISS).

Ollmann, the author of the white paper "Old threats never die", says that Slammer is still the threat most commonly encountered by IBM ISS.

But it isn't just high-profile vulnerabilities and malware that are a problem, Ollmann said. In effect, the security industry is now witnessing a snowball effect, where threats are accumulating at an "exponential" rate, and it isn't really possible to eradicate any of those threats.

"Organizations need to be aware that old threats never actually retire from the digital landscape," Ollmann wrote in the white paper. "Rather, they tend to become background noise on the Internet -- ready to burst into life with each new software update, host recovery, device deployment or embedded system release."

The problem is that many of the protection mechanisms companies rely on, like signature-based security software, are no longer able to keep up with the rate at which new threats are appearing.

That's worsened by the fact that whenever security firms retire older signatures, they open a hole through which old attacks can instantly reappear, Ollmann said.

"Antivirus systems can handle tens of thousands of new signatures without blinking, but after a few hundred thousand they begin to struggle a bit," he wrote in a blog post this week. "Now, with several hundred thousand new virus strains each year (and increasing faster than Moore's Law), things are getting pretty creaky."

Security vendors are at a disadvantage, because it costs nothing for attackers to append the latest exploit to their attack systems, keeping all the old attack methods in place as well, Ollmann said.

"The consequences for all of us are that old exploits (and the threats they represent) will never disappear -- and there continues to be a steady supply of hosts vulnerable to flaws for which patches have existed for half a decade," he wrote in the blog post.

IBM ISS advised companies to think twice about retiring their old, creaking protection systems, but instead to evaluate more efficient protection models such as heuristic engines.

"Instead of a one-for-one signature protection model, more advanced heuristic engines can be used to protect the entire threat class," Ollmann wrote in the white paper.

source : www.pcworld.com

Spam Fighters Hit Criminals' Weak Spot

Is the fight against spam horribly misguided?

For years, spam haters have relied on junk-mail filters and Internet blacklists, but lately, some are saying it's time for a change in tactics.

Their answer: follow the money. And that means going after the Web sites where spammers sell their pharmaceuticals and watches and male enhancement products.

Misguided or not, it's pretty easy to argue that the fight against spam has been a losing proposition of late. At the end of last year, mail administrators noticed a big spike in the amount of spam flooding their in-boxes. Between July 1 and the end of the year, spam jumped to nearly 60 percent of all e-mail traffic monitored by Symantec Corp., and many administrators say it makes up an even greater percentage of e-mail now.

Spam filtering is not the answer, said Garth Bruen, who runs a volunteer project focused on taking down the Web sites run by spammers. Bruen tracks down the ISPs and domain name registrars used by spammers and arranges to have their sites shut down.

"This problem is not going to go away if you ignore it. Blocking and filtering is just a jacked-up technological form of ignoring," he said. "What you want to do is report it and make it difficult for these people to exist on the Net and do their transactions."

Earlier this month, researchers at the University of California, San Diego, endorsed Bruen's position, saying that antispam fighters could really hurt the spammers' bottom lines by targeting their Web sites.

"If there was more diligence in taking down the Web sites, that would have an effect on overall spam," said Chris Fleizach, a research assistant at UC San Diego.

Bruen says current approaches to spam fighting evolved out of a different era -- before spam was widely used for online fraud or delivering malicious software. "When this problem started out, people were annoyed, and a lot of the junk mail at that time was urban legends and chain letters and stuff that wasn't as much of a threat as it is now," he said.

Over the past four years, Bruen has tried to move the fight to a new front with his project KnujOn (that's No Junk backwards, for those who aren't into word games), which has helped shut down more than 30,000 spammer Web sites. The project asks volunteers to send in their spam, and it uses these submissions to build a large database linking sites to known spammers. To date, it has helped take down more than 32,000 of these junk mail sites.

When the project launched, KnujOn tracked just a few thousand Web sites in its database, but that number has now grown to several hundred thousand. Interestingly, the total number of spamming groups has remained constant -- somewhere around 50. "There really aren't many people involved in this," Bruen said.

That's one reason why people like Bruen think that they can make a real difference by targeting the Web. Though critics say that KnujOn may end up fighting the same war of attrition that has already occurred with e-mail blocking, Bruen thinks he can eventually wear the spammers out. "There's a point of exhaustion where they run out of places to go," he said.

KnujOn isn't the only group targeting spammer Web sites. Earlier this month, Computer Cops LLC, the company that runs the PIRT (Phishing Incident Reporting and Termination) phishing take-down program, expanded its efforts to and began doing the same thing.

Computer Cops believes many of the spamming groups are responsible for a lot of other online crime. "We're trying to take a look at all of the Internet crime out there and do criminal profiles," said Paul Laudanski, the company's owner and the leader of the PIRT project. Crime-fighting groups that focus only on spam or phishing don't get the full picture, he added. "If one organization is only focusing on one thing, they're missing a lot of criminal activity."

Scott Conti recently signed on as one of KnujOn's 1300 registered contributors because he liked the project's Web-centric approach. "There aren't many people going back to the source," said Conti, the director of information technology at Greenfield Community College, in Greenfield, Massachusetts. "That's what I thought was interesting about it. They are actually trying to take a proactive approach by going after the sites and going after the ISPs that are hosting them."

Greenfield College is now contributing between 50 and 100 spam samples per week to KnujOn, and in return it gets back information it can use to blacklist spam sites.

The college needs all the help it can get. About 96 percent of the 90,000 e-mail messages processed each day by Greenfield's IT department are spam, Conti said.

It's one of his biggest headaches, Conti said. "We probably get more vocal complaining about spam than just about any other problem we're likely to have."

source : www.pcworld.com

Panda Worm Author's Fix Fails

The accused mastermind behind the Panda Burning Incense worm has not done a very good job of making amends, according to security vendor Symantec Corp.

Li Jun, a 25 year-old man from Wuhan, in central China, was arrested last month for allegedly selling copies of Panda. He is the first man to be arrested in China for virus-writing, according to China's Xinhua state news agency.

In an effort to make an example of Li, state police said they made Li write software that would remove the worm, but after analyzing the software, Symantec says this program fails to undo many of the file and registry changes made by Panda. Worse, it is completely ineffective against some variants of the malware.

"This removal tool is not effective against most of the samples we have tested against and isn't fully effective against any of them," wrote Symantec researcher Hon Lau, in a Wednesday blog posting. "For Li, perhaps he may have learned the hard way that... it is much easier to write a program to cause destruction than it is to repair the damage."

Panda, which is also known as Fujacks and Radoppan.T was written in October 2006 and has since spread widely within China. According to Xinhua, Li made 100,000 renminbi (US$12,876) by selling copies of the worm to criminals who then distributed it. Li was one of eight men arrested in connection with the affair.

Li's uninstaller tool comes with an apology from the worm-writer himself, claiming that the program was written for research purposes, Symantec's Hon said. "He ends with a warning to beware of future threats (from others), and to take the necessary precautions," he wrote.

source : www.pcworld.com

Virus Disguised as IE 7 Download

If you receive an e-mail offering a download of Internet Explorer 7 Beta 2, delete it. A new virus is making the rounds that comes disguised as a test version of Microsoft Corp. current Web browser.

Security experts reported no widespread damage Friday morning, but they said the virus is notable for a couple of reasons. The e-mail includes a convincing graphic that looks like it could really be from Microsoft, and the virus is delivered when recipients click on a link rather than in an attachment, which makes it harder to stop it from reaching in-boxes.

"The idea of sending a link seems to be a trend among attackers; it's still fairly new and it works much better than sending a file," said Mikko Hypponen, chief research officer at F-Secure Corp.

The e-mails carry the subject line "Internet Explorer 7 Downloads" and appear to come from admin@microsoft.com. They include a blue, Microsoft-style graphic offering a download of IE 7 beta 2. Clicking the graphic will download an executable file called IE 7.exe.

The file is actually a new virus called Virus.Win32.Grum.A, and security experts were still analyzing it Friday to see what it does. Sophos PLC said it can spread by e-mailing itself to contacts in a user's address book. The virus tampers with registry files to ensure it gets installed, and it tries to download additional files from the Internet, said Graham Cluley, a senior technology consultant for Sophos.

Other specifics were unknown yet, but such viruses often install a keystroke logger to steal personal information, and establish a network of infected computers to launch a denial of service attack, Cluley said.

"We don't know anything yet about where it is coming from," Hypponen said. "It's fairly well made and hard to analyze with normal tools."

F-Secure had received many reports of the e-mail but few submissions of the virus itself, indicating that damage so far is limited. Cluely agreed: "I wouldn't classify this as one of the biggest viruses of the year, but that doesn't mean it isn't a threat" he said.

Detection of Win32.Grum by antivirus programs was "mediocre" on Thursday evening, according to Sunbelt Software Inc., and some big vendors were still not picking it up Friday morning, Hypponen said.

F-Secure and Sophos are blocking the virus and all major vendors are likely to do so soon, he said. Some e-mail filtering systems were also not blocking the virus on Friday morning.

The virus is being hosted on several servers around the world, which will increase the time it takes to identify and clean them all. They appear to be Web servers that have been hacked, Hypponen said. The SANS Internet Storm Center asked administrators to check their logs to make sure they are not hosting the file.

The virus affects only Windows users. "Microsoft is aware of this issue and is currently investigating this matter, including customer impact," a spokeswoman said via e-mail.

The final version of IE 7 was released last October, so Microsoft is unlikely to be advertising a beta of the product. Users can download a real version of the software at Microsoft's Internet Explorer home page.

source : www.pcworld.com

Bill Clinton Backs Electronic Health Records

Former U.S. President Bill Clinton on Thursday advocated an electronic medical records (EMR) law and said blogs could aid the U.S. political process.

Clinton appeared along with former President George H.W. Bush, a frequent partner on the lecture circuit, in a joint keynote address to the CTIA Wireless trade show in Orlando. Both men praised the wireless industry for generating economic growth and bringing the world closer together. Bush, 82, described himself as a Research In Motion Ltd. BlackBerry addict.

Saying he was doomed to be the straight man for Bush, whom he unseated in the 1992 election, Clinton gave more serious commentary on information technology, which he said has the power to improve the lives of disadvantaged people around the world and in the U.S.

Electronic medical records could cut US$100 billion of administrative costs of the U.S. health-care system, on which Americans spend $800 billion per year, Clinton said, referring to a McKinsey & Co. study. An EMR bill backed in the U.S. Senate by his wife, Senator Hillary Clinton of New York, and former Republican Senate leader Bill Frist failed despite three years of bipartisan effort, Clinton said.

"That's the number-one thing that can be done right now to make the American health-care system more efficient and cut costs," Clinton said. For one thing, EMR would save the cost of patients recounting their medical history every time they change doctors, which can also introduce errors because they may misremember things, he said.

Wireless technology is aiding in efforts to raise people worldwide out of poverty, one of the causes Clinton has been supporting since leaving office in 2001, he said. For example, in a micro-loan program in Bangladesh, the fastest-growing category of loans are those to women who buy cell phones and sell minutes to people in their villages who call relatives overseas and keep in touch with local markets, Clinton said. The program has raised 58 percent of all borrowers above the international poverty line, he said.

And in Haiti, the poorest country in the Western Hemisphere, the fastest-growing job is selling calling cards on the street, making young people into entrepreneurs and part of the economy, he said.

Blogs can play an important role in the media as the traditional media tries to cover an increasingly complex world with growing competitive pressures and fewer resources, Clinton said.

"Because they don't have to put out a newspaper or even put together a whole evening news show, these blog sites typically deal with one, or at most two, subjects a day, so they can do research and get the facts," Clinton said. "Technology needs to keep pushing this process of the public debate so that there will always be alternative channels."

source : www.pcworld.com

Startup Aims to Keep Network Security Vendors Honest

With the help of one of the world's best-known hackers, a little-known Austin startup hopes to give Internet service providers and enterprises a way to tell if their networking hardware is living up to its promises.

Late next month, BreakingPoint Systems Inc. plans to launch a new network test appliance that sniffs out security holes in devices like load balancers, intrusion prevention systems and routers. Called the BPS-1000, the device also gives users a way to see how their networking equipment performs under a high volume of networking traffic, said Dennis Cox, BreakingPoint's chief technology officer.

Cox and cofounder Craig Cantrell came up with the idea for BreakingPoint two years ago while working at 3Com Corp.'s TippingPoint division, where they realized that they were spending more money on testing equipment than they were on building products. What began as a running joke "every time we had to sign a purchase order for a half-million dollars worth of test equipment," eventually became a business plan, Cox said.

That vision is to build a product that gives customers an accurate picture of how their networking gear will behave in the real world -- before the bad guys have a chance to attack.

Shortly after the company was founded in September 2005, Cox hired HD Moore, maintainer of the popular Metasploit security testing tool. "He was one of the first guys I called up," said Cox. "There is no better person in the U.S. to break things than HD."

Today BreakingPoint has over 30 employees, including three security researchers who work with Moore to help develop BreakingPoint's security testing capabilities. Their job is to "do only evil," Cox joked, a play on Google's "Don't be evil" corporate motto.

While BreakingPoint's appliance does not use any of the Metasploit code, the company is leveraging Moore's expertise as a bug finder to offer customers a service called Strike Pack, which tests to see if about 2,500 attacks -- some of which have not yet been publicly reported -- are blocked on the network.

Over the past two weeks, BreakingPoint has already begun shipping its first few systems to network equipment makers, who are using it to test their own products, but Cox says that his company is also talking to enterprise customers -- particularly in the Internet and financial services markets.

Networking administrators can use the BPS-1000 to get a fix on how well their gear is really performing, something that some networking vendors try to hide with puffed up marketing materials, he said. "We believe that the network equipment manufacturers are selling equipment that isn't meeting its specifications," he said.

Enterprises "have service level agreements with a lot of these companies and they would like to prove that their SLAs are not being met," Cox said. "That would save them money."

BreakingPoint's appliance could be used to evaluate new network applications like VOIP (Voice Over Internet Protocol) systems before they are rolled out, he said.

Pricing for the BPS-1000 has not yet been determined, but it will sell in the US$100,000 to $200,000 range. One-year subscriptions to Strike Pack will cost between $20,000 and $40,000 per year Cox said.

source : www.pcworld.com

Hackers Build Private IM

Hackers have built their own encrypted IM (instant-message) program to shield themselves from law enforcement trying to spy on their communication channels.

The application, called CarderIM, is a sophisticated tool hackers are using to sell information such as credit-card numbers or e-mail addresses, part of an underground economy dealing in financial data, said Andrew Moloney, business director for financial services for RSA, part of EMC Corp., during a presentation at the International e-crime Congress in London on Wednesday.

CarderIM exemplifies the increased effort hackers are making to obscure their activities while continuing to use the Internet as a means to communicate with other criminals. "They're even investing in their own custom tools, their own places to work," Moloney said.

CarderIM's logo is humorous: two overlapping half suns in the same red-and-yellow tones as MasterCard International Inc.'s logo. The name, CarderIM, is a reference to the practice of "carding," or converting stolen credit-card details into cash or goods.

Often, the hackers who obtain credit-card numbers aren't interested in trying to convert the data into cash. But other people are. On the Internet, the two can meet. But the data buyers and sellers are constantly on the lookout for the "rippers" -- security experts or police who are gathering data on them, Moloney said.

It's not known how widely CarderIM is being used, but its distribution appears to be limited, Moloney said. Searches through Google uncover a few passing but incomplete references to the program. It's also not easy to find a copy of it.

"To get ahold of it [CarderIM] you need to be part of one of the trusted groups, which we have agents within," Moloney said.

During his presentation, Moloney showed a screenshot of an advertisement for CarderIM, which addressed the need to "secure the scene." The application supposedly uses encrypted servers that are "offshore" and does not record IM conversations.

Hackers may have needed a more secure IM application, since most of the free ones, such as ICQ, transmit messages in clear text, which can be intercepted, Moloney said.

"They know that we watch and listen," Moloney said.

source : www.pcworld.com

Senators Question Smart Card ID Requirements

enators and privacy advocates on Monday questioned a U.S. government plan to move ahead with smart card drivers license requirements, saying the cost will run into the billions of dollars and the cards could allow the government to track residents.

The Real ID Act, tacked on to a military spending bill in 2005, would require states to save digital copies of source documents such as birth certificates for drivers licenses and it would require states to share information in their drivers license databases. The goal of the new cards, which would include digital photographs and personal information in a machine-readable chip, would be to better ensure that the people carrying the ID cards are who they say they are.

Congress passed the Real ID Act in response to the Sept. 11, 2001, terrorist attacks on the U.S. The 9/11 Commission recommended that the government take steps to better ensure the validity of U.S. IDs. The pilot of the airplane that crashed into the Pentagon held three state drivers licenses, all of them fake, said Robert Barth, assistant secretary for policy development at the U.S. Department of Homeland Security.

"Real ID is fundamental to the security of our nation," Barth told the Senate Subcommittee on Oversight of Government Management.

But Senator George Voinovich, an Ohio Republican, complained that much of the cost for implementing Real ID would be passed on to states. DHS has estimated the cost of implementing Real ID at $14.6 billion over 10 years.

Voinovich also questioned how secure the cards would be. "You're going to be able to guarantee that information is going to remain private?" he asked Barth.

No one can guarantee that any data will be 100 percent secure, Barth answered, but a federal system would be "vastly, vastly" more secure than 50 separate state drivers license systems. "Whenever you have human beings involved ... you can't say there's zero risk," he said.

Voinovich pressed the question, asking if there were technological methods of defeating the proposed ID cards.

"We're going to provide the safeguards and do everything possible to prevent that from happening," Barth said.

Privacy advocates have also questioned the Real IDs, saying the data on the cards would allow the government to track citizens. "The machine readable zone on each Real ID license will provide a digital trail everywhere it is read," said Timothy Sparapani, legislative counsel for the American Civil Liberties Union.

Members of Congress have proposed that the Real ID card be required in order to vote, get a new job, obtain government benefits and travel on airplanes and trains, Sparapani said. "Senators should expect that no person would be able to function in our society without providing a Real ID-compliance license," he said.

In addition, the advocacy group the Center for Democracy and Technology said during a press briefing last week that the legislation doesn't restrict which employees of state drivers license bureaus can access the databases of private information. The Real ID act has no requirement for the security of the shared databases, said Jim Dempsey, CDT's policy director.

"The act doesn't mention the word privacy, and it barely mentions the word security," Dempsey said.

But Senator John Warner, a Virginia Republican, defended the Real ID Act. "We've got to come to the realization that the life before us is not the life behind us," he said. "We are facing some very, very serious threats."

source : www.pcworld.com